“The Internet Was Never Private”, - Liz Steininger, CEO Least Authority | Privacy Academy Interviews

[Music] So yeah, hi I'm Liz from Least Authority. We perform security audits and we also build privacy enhancing technology. Um I started about nine years ago now. Uh in 2016 I started as the CEO of Least Authority. Uh, Least Authority was originally founded in 2011 by Zuko and in 2015, uh, Zcash spun out to be its own project and like I said, that's when I took over in 2016.

Um, we've been doing security audits since about 2013. Um, and especially when uh, blockchain and the cryptocurrency space and web 3 got bigger, then we started doing more of those. And then on the privacy enhancing technology side of stuff, uh, we work with uh, secure file transfer and secure file storage. um helping to enable users to have full control over their data and make sure that they have um basically very private options for managing their data. Yeah, when looking at the space right now um we see that we kind of have two adjacent communities that are working on similar goals.

uh we've got the web 3 space which uh came from the originations of like bitcoin and blockchain which has you know come into web 3 and on the other hand we have uh the um the internet freedom space uh as we refer to it now at least the this term we've been using since about like 2010 and the internet freedom space is where we there's a lot of focus on secure communications and circumvention technologies anti-censorship you know censorship resistant type technologies and really both of these spaces are all fo all about um empowering the end user, making sure that users have um you know complete control of their privacy and their data. Um so to enable them to have privacy and this idea of distributing things to endpoints is part of um you know empowering users. So decentralization, but when we look back at the history, you know, often in the cryptocurrency space, we talk about and web 3 space, we talk about um how, you know, Bitcoin came from the cipher punks and this group of people, the cipher punks, you know, had been around really focusing on how cryptography can empower users to have privacy. Um, and so this whole movement, you know, of course it wasn't the first movement for user priv privacy in technology. um you know prior to that there were you know these people who were who were building things to be more private um but yet the cipher punks come along and you know they're working on different projects and such and on one hand you have um some of the the cipher punks and some of that group that want to focus on you know private transactions and looking at like you know user empowered transactions and like that's where you really see the origination of Bitcoin um although we know now that Bitcoin is a pseudony anonymous and not anonymous.

The original intention was for it to be anonymous. Um and so really focusing on how do you help financial transactions and then on the other side you had a group of people that were working on um how do we enable data management and data privacy um you know to how to put the users back in control of their data, you know, their files and other types of data that they have. And so then you had projects like Bit Torrent and uh Tahoe LAFS kind of come out of that that side. And you know these you know fast forward uh to another 10 20 years in the case of Bitcoin maybe you know you know fast forward from you know 2008 to now we're seeing you know from Bitcoin you've spurred this whole blockchain movement and the blockchain movement um you know still focusing on decentralization and empowering users but kind of lost a little bit of sight around the privacy aspect of it and you know security is still relatively important um But it just kind of took its own path. And in parallel, you know, the internet freedom community continued to build things that were really focused on like high-risk users, you know, human rights activists, um, journalists, um, uh, digital rights defenders, etc.

And, you know, trying to make sure that they had really secure communication tools and these circumvention technologies. And yeah, it's been really interesting to see that these two groups work in parallel with very similar value systems because they have similar roots and yet still work quite separately. Ideally, because you have these two groups that have been working in parallel with similar values and you know this kind of shared past, it would be really great to see these two groups unite and really leverage each other's work more. Um I think that like the the internet freedom community has learned so much from its users and how to make security be more usable. I mean we've got things like signal um that have come out of it which you know it's really seen mass adoption because it's so userfriendly and uh you know tools like tour which have become like you know very mature and well supported and also user friendly and then you know we've got this struggle on the web 3 side where you know we're looking for mass adoption and stuff and you know how can these how can these two communities um really benefit each other and leverage each other's learnings over these past you know 10 years or so Um but also how can they like yeah unite for a future.

I think I mean this this like how to how to unite um is a really great question and I mean I would even say do we need to fully unite? Maybe they can stay as parallel communities but um how can we share knowledge across and tools across them? Um I think that this sharing can come from uh different individuals from each community or different groups working together. um you know identifying things like particular use cases that overlap from the web 3 space into the internet freedom space and vice versa and how can these projects like band together and maybe um you know work together to create things. Um also we can look at like funding mechanisms.

Um right now there's quite separate funding opportunities in either space. You have like the crypto funders and you have the internet freedom funders. And you know again the the value the missions of both of those sound so similar that they should be funding each other's projects and so how can we support them funding each other's projects. Um I I think talking to those funders about all these other opportunities out there and these use cases overlapping and yeah um you know just really educational about the technology too. So I think web 3 projects can leverage the existing uh code bases and code repos that exist um from the internet freedom space to help make their tools more uh more private and internet freedom tools can probably learn something from looking at the web 3 space and how vibrant and active it has become and um you know looking more at the different use cases to normalize privacy in that way too.

Yeah. for users to be able to know if something is actually as private as it claims to be is a really difficult thing to do right now. Um, but the information is often out there. Um, but you have to do a little bit of digging. I think what we've seen in the internet freedom space that was really valuable was we saw this concept of you know things like the electronic frontier foundation EFF creating um secure messaging uh dashboard is one example where you see them they talked about the different attributes of these secure messaging tools and they talked about the different tools and then they gave you you know red check red crosses and green check marks to show you which tool actually had those different attributes.

So we could have um you know third parties that come in uh to that could be you know established and become trusted to help uh users know more about which tools actually you know uphold the claims of privacy that they've got. And then of course we can do things like um yeah privacy reviews where we can have thirdparty uh independent verification the same way that we do with security audits have those come in uh have those parties come in and do an independent review um and say yeah they they actually have privacy by design or privacy by default as opposed to privacy by policy or you know at least educate users where the privacy is coming from if it is privacy by policy although that's not ideal and so um yeah communicating that to users users through a privacy review is one way and then how could we take those privacy reviews and you know again give it give give users a dashboard and give them easy to read um and react to information so um at least authority we created the moon math manual it's a guide to the basics about zk snarks which is a type of zero knowledge proof and it was written to help um developers or any other person who really wanted to understand better about how zk works so um It's got multiple chapters and exercises at the end of each chapter. Uh we've seen study groups uh form around the moon math manual to help groups of people kind of uh you know individuals get together to learn together um and do the exercises and uh yeah go step by step through this uh moon math manual. If we really want to see web 3 become mass adop. If we really want mass adoption in web 3, then we really need to have all users represented when we do any kind of you know user testing.

We need to have development um activities be also represented by a diverse set of people too because developers will think like the um developers come within in with a mindset of themselves also being a user sometimes too. So if your development team is not diverse, then the the users that you are aiming towards is not diverse. Um and so at every single level of the technology that we build, we need to have diversity if we actually want mass adoption. So I think anybody who thinks that they can have um you know, one type of person that can design something for everyone is just being shortsighted and that we need to have all kinds of different people designing things for everyone. Privacy is such an interesting topic.

Yeah. I mean, I think what I've seen over the years with people who are interested in the topic of privacy and want to dive deeper is one place to start is with yourself um and your internal value system and how it relates to privacy. Um, I've had all kinds of conversations with many different types of people about privacy and even similar people will come up with completely different answers about how privacy ties into their value system. But I think everybody has some personal experience that is deep uh deeply related to privacy and why it matters to them. even if they say on the surface that privacy doesn't matter or privacy is dead that you like you can dig into a conversation with them and find how privacy matters to them because there is something it's so human is what I've learned over the years that it's so fundamentally human this idea that we control ourselves we have you know this autonomy over our lives over our choices um this extends to like every aspect of our identity and so you know we walk into rooms one you know we try to present ourselves in different ways.

We say different things because we want to have a different outcome because of this like idea of control and autonomy. And so privacy is is that it's this idea that um I can go into a space and I can control what I share with that space in order to have a particular outcome that I want. And so there's so something so fundamentally human about that aspect of privacy. I think that people should start there as an individual and then from there you can also then relate to this kind of anthropological view of privacy throughout time throughout history. You can look back through the history books and see how privacy was being shaped.

It might not have been called privacy at the time, but this idea of people controlling their their their outcomes, their future. Um, and how shifts in technology throughout history have changed people's relationship with how they control themselves in space is so fascinating. So you know you can look back to like Roman times and you know then you can go even to like the like you know the current times and see um like the advent of like you know for even the existence of a camera like when cameras came about it caused people um to have this like huge societal reflection about like what does privacy mean anymore? If all of the sudden what you're doing at a particular time and place can be captured for everybody to see. you no longer have this kind of ephemeral anonymity that you get from like just people's memories.

Um, you know, now you have it captured. And so that that changed the concept of privacy for those people at that time. Like I said, it's not always referred to that way, but again, it's this idea of how we can choose to prevent ourselves into spaces and groups. And um, yeah, I think that that when you start to think in that framework about privacy, then a lot of stuff makes more sense. And you also start to see how the debates around technology and its position in society and how it impacts privacy becomes a lot easier to navigate.

[Music]