How ZK Identity and Account Abstraction Are the Only Firewall Against Government Surveillance of AI

Transcript

Hello and bonjour everyone. Chris Ott, I'm an attorney and litigator. I I currently help people solve problems with technology, privacy, and data security. But part of why I'm here today is cuz I spent 15 years uh with US law enforcement and the intelligence community. Uh specifically when it came to uh gathering of information. In the context of that, I want to talk with you folks a little bit about ZK identity and account abstraction. Specifically from that kind of governmental perspective.

All right. So, against that backdrop, uh part part part of my own back- background was as technology was uh uh developing to uh within the context of specific kinds of uh legal remedies gather information for so that for investigating a specific crime to get information leveraging technology to help in the context of the intelligence community, often they are working at bulk uh information, but they also have uh sometimes uh uh obligations and interests that are in tension with each other. What I mean by

that is law enforcement is often very specifically transactionally um focused. The classic idea for that would be specifically to solve a murder. Uh so for that, they're looking at uh targets or group of targets gathering information about that, and then for public resolution of of that investigation. Uh the intelligence community is not interested in the same way in that. They're interested in information often to know things for its own for its own sake. And against that backdrop, the gathering of information is not for its public revelation, but to use it to often to gather additional information. To know is its own end for the purposes of the intelligence community.

There are entities within the US government that perform both roles. Classic example of that would be the FBI. And internationally, FSB in Russia is a similar kind of entity. They have it both an intelligence and a law enforcement role. The the those different roles drive how how they gather the information. So, for whoever it is, the first step in what they're most interested in is attribution. Uh and that that that that is who are you, uh where are you, and what are you thinking?

The first two seem basic, and they are the basis of intelligence and uh law enforcement always we're dealing with those. You know, where are you, who who who are you? Knowing where you are within the classic case of the murder is the first big step of figuring out whether they could have actually performed the crime, right? Uh who who are you can inform any number of things about the why. And uh what do you think is the bleeding edge of things? Uh going back to uh the first organized mail systems, the both law enforcement and intelligence were interested in knowing what people were writing down in their private moments because looking inside what somebody's thinking about is something

that's of great interest to government for a number of nefarious and not so nefarious reasons, but is also something that uh was less available without uh the in- intersection of technology. But as technology develops, you get more and more insight into this. When the the classic snail mail context, those letters were first written, people would pour their hearts out into those letters, and it felt very uh intimate and a very intimate uh discussion that otherwise you never could have had insight into unless you're in the room, unless you're actively surveilling them.

But those letters would go through third-party hands and sometimes could be intercepted. As technology developed, there are more and more things like that. And before people internalize that those conversations are not as intimate and not as private as they were thinking before, there ends up being the possibility for loss of very significant insight into their internal thoughts and processes. Uh AI prompts are along that continuum of technology and at the bleeding edge of it. People are having very intimate conversations with with with these LLMs in a way that you would not have had with uh other people. And even more perhaps insidiously,

those conversations are fundamentally a conversation with yourself. Right? A conversation with somebody else in a cafe can reveal a lot about what you're thinking, but it's with multiple filters there about who you're presenting uh a- about yourself, your self-image, etc. And LLM conversation is an engine to get you talking with yourself in that conversation there. So, potentially can have even more uh revelation about what you're actually thinking. And for that reason, law enforcement and intelligence community is very interested in getting those conversations. And the current way that these are set up is that there is a central central kind of depository of of where they are, right? If you're using

Gemini or a particular one of these, there is all of a sudden those answers to attribution all in one place. Uh whatever your LLM is, they're confirming who you are, they're confirming where you are. Even on basic level, if you don't have an account, they've got your IP address and geolocation data there. And then it's got the conversation about what you're thinking about. Uh from that perspective, it's something that they're very that all those entities are going to be very very interested in. And for the purpose of this conversation, I'm talking more about the governmental perspective. Obviously, the companies have an interest, too.

And that that interest is, you know, probably base. It's about advertising on a fundamental level. But but governments can have a broad and shifting interest on what to use these insights into what people are thinking, where they are, and what they're doing. Uh where it's all in one place, it gets very easy to get it. From So, from the governmental perspective and not revealing anything uh secretive, from law enforcement perspective, these conversations, it's unclear what level of process in the US circumstances would be needed, but potentially just a subpoena would be needed. That's just a sheet of paper that could be issued under the auspices of a court, but

without any judge oversight. So, that means all of a sudden this conversation, intimate conversation you're having for essentially the time it takes to print out and change the names and dates can be available and served on a central repository where this LLM is where they're keeping it. All of a sudden, insight into who you are, what you're doing, what you're saying can be get get be begot for for lack of a better term. Uh and uh however much technical uh uh sophistication is involved in locking down who who you are or or even what the conversations are, if it's all in one place, then that one place, in the

Gemini context, Google or Alphabet, will be uh subject to that legal process. And they'll change where you are uh as to what specifically is happening. Like the subpoena I'm talking about will take a different uh form at least partially in a country that's operating under the Napoleonic code or where things are a little more pragmatic like like in Russia. But fundamentally, it'll be the same. The authority of government will come forward to that central space uh and say, "Hey, hand over what you've got." If it's all in one place and technically downloadable in that easy way, history's told us that's what will happen.

Now, so uh that's fundamentally where we are. I mentioned history for a moment. Uh things like um Yeah, I've heard some of the prior speakers mentioning books. Um if you're interested in this kind of historical development of privacy, there's an author by the name of Tim Wu who has a number of books, but the one I'm thinking about in particular now is called The Master Switch, which deals with kind of the historical rise of different informational uh industrial empires from the telegraph to telephone to cable TV up through the social media companies and the ISPs.

They all have a kind of repeating life cycle where they they grew up and they're semi-private, but have governmental support to them, and over time they grow closer and closer to the organs of government until there is uh often virtually or even literally uh governmental officials who are there to ease the flow of information from these information empires directly to government on proper demand. Uh when when I say virtually, uh that it's not virtually in every context. Uh I mentioned Russia a few times. So, often they for their local uh for any local uh iteration of those information empires

that are operating in Russia, there's an actual FSB officer embedded in in the company. Uh and uh it's not as not quite the same in the US context, but uh practically, there are relationships that that that make it fairly similar. So, the the way this can work country by country is in the context of saying, "Oh, what is our compliance with the governmental responses?" Um Compliance can relieve a a lot of uh uh legal or civil responsibility. But if if we're talking about actually since

we have the opportunity to maybe shield the these thoughts and ideas, then we should try to think more about what will defeat the usual process of getting this information. And so the proposal here, and I know it's ones that there's a recent paper by Vitalik that's come out in just the last month, is to kind of embed infeasibility into the structure here. So here the likely place to do that is when it comes to the actual first authentication of the use of the LLM. The LLM has to know has to confirm on a certain level who you are, whether

that's through in the context of the paper I just referenced when it comes to getting the credits over and confirming that that it's it's a proper use through through an IP or otherwise. API rather. Or just the confirmation from the standard use in the ad tech world of confirming identity and re-advertising back going back to the alphabet context. They want to know who you are either to have some permanence with the chats, which has a great deal of utility in this. Or for re-advertising.

Um at that point of interaction, there's the opportunity to bring in some of these ZK concepts that the Ethereum Foundation is uh working with now. You can confirm who you are for the purposes of that conversation. You can make a conversation with these LLMs semi-permanent, but you don't have to have all in one place the attribution information that makes it so easy for for government to come back and actually crack into your thoughts and get a get the final word on what you're what you're thinking from each moment.

Some of that I'll go through some of the technical things here. It's not my forte, but to go back to the uh the way government works is they want to know where you are, and they want to know who you are. Like I said, the attribution. And they'd like it all to be in one place. Cuz the more that that's spread out technically, the less feasible it is for them to get a clear answer on attribution on what's being said or thought at any particular moment. To go back to the classic surveillance context, you can have great recording equipment. And hear a whole conversation, but if you don't know who's saying what, if you don't have good enough attribution of who's saying what at which time, the all that's being said can can be lost. And all of a sudden

it's a lot less useful. When things are not useful in that context, they're less and less leaned upon by the government. So, All right. As I was just saying, pragmatically name, IP address, and location are the things that government, which is not ever going to be as sophisticated as the people in this room, at least in the law enforcement and counterintelligence context I'm talking about. They will have people who'll be every bit as sophisticated, obviously, when it comes cryptographically or technically. But, when it comes to the fundamental organs of state that are interested in either proving a crime or gathering intelligence information, the

sophistication will not be as great. There to this day I deal with people who have a hard time understanding the kind the nexus of name, IP address, and location as being a very firm indicator of who a person is. In court uh most judges you'd have a hard time convincing them them that all those things come together. So, once things get more fractured and more complex from technical layer that you can apply through the principles here, the less likely it is the government will use it.

Cuz they won't be able to go back to the judge and explain in plain terms that the judge will understand. Or to their counterintelligence supervisors when you get to political appointees within a particular government and say, "Ah, this is the person." At least and that's a problem and friction problems in this context end up having large effects. So, I mentioned before we talked some a little bit at least about some of the technical protocols etc.

I would at least mention briefly the ERC 4337. Uh Thank you. And we I don't need to spend a lot of time dealing with this, but going back to the principles I was just talking about in the context of this, it takes most of those indicators I was talking about off of the one-stop stop shopping for for government. Things like the IP address etc. as I understand it there end up at the paymaster or the bundler level. That means that when it comes to actual process that we're talking about here, they have to go to three different places and synthesize. Obviously, they have the technical ability to do that.

But, pragmatically ends up getting harder and less and less useful and most importantly, I think for most people in the world, harder to do at volume. And with without that stationary one-stop shopping, it's harder and harder to get done the goals of either law enforcement or the intelligence group. I put a lot of technical stuff here for the purposes of this conversation. We don't have time to go all the way through it. But, these are just some of the different layers in which we could talk about what the pros and cons are and how how we we can deal with it.

Now uh And this is just a visual representation here of the idea of when when this would work best. If we could confirm who a person is for the purpose of the conversation, which is ultimately what should be going on in this AI context about the later retargeting either by government or by the company, then you can get all the benefits of the of the LLM itself and the conversation can continue. Um And it also frustrates in a fundamental way the way these subpoenas and returns are.

Anecdotally in the context of my my own work every day, I could tell you that in the privacy retargeting context, a lot of it the more probabilistic it is instead of being one place and determine termination of identity of a person, um I have successfully told government to get lost and say, "Hey, this is not what you're looking for. All we've got is that this is likely the same person." And so, adding in that additional friction by design ends up creating the null set I'm talking about in the context of this.

And then the broader call in the context of this conversation and otherwise as as we think about this is that um we have to uh we have to think on a fundamental level what we want from this and what we're willing to live with. And it could be everybody's willing to live with these thoughts and these ideas being in one place. But, we have to be open-eyed about what that means. In the context of advertising, we've given up a lot of privacy for the purpose purpose of free services that were unimaginable to us 15, 20 years ago.

But, that doesn't mean we have to keep doing it. And it means that there is, I think, an opportunity for people who want to be more thoughtful about their privacy and their thoughts and how they're going to interact with this technology to be able to choose an option. Maybe it's not free. Maybe it's not as fast. But, maybe more in in line with your personal or community values. And the technology gives us an opportunity to do that. Now, I think we're probably down at one or two minutes left. If there is a question, we probably probably have room for it. Yes, sir.

Yeah so he's getting the microphone, but I'll I'll say I think this is all No. Yeah. So, I think this is all absolutely true, but just just checking if I have a Gmail account or if someone if I communicate via email with people that have a Gmail account, it's kind of pointless? How do you mean it's pointless? In the sense that they're going to subpoena my email Gmail account first before they go to my AI stuff. So, there there when we talk about pointless, there are multiple levels to that, right? Like some of which is almost any protocol that we think about here, if

government were to get our device, right? Then no matter what level of encryption you have or what then they would probably get the conversations or privacy. So, that's the device level. And you're talking about on the Gmail level etc. Yeah, those things probably are going to be got if if if you're if you're talking in an unguarded way and government decides to get get them, then they probably will be. That's part of the trade-off we're talking about here. That free webmail experience is something that was kind of would be kind of a crazy option 25 years ago, right? But, that loss of privacy is something we gave up. I even paid for Yeah.

Well, no, there's a sliding scale on that, right? Like which is to say some things like ProtonMail, right? Are are you can use and move through a lot of the same tunnels, but just there is a technical and feasibility level there. If If you were on a major hit front for government, there's still problems to be got at, but yes. And just even being able to have those choices is something not everybody's articulating, and that's where the opportunity is. Yeah, thanks a lot. I think the topic is quite important. So, if you want to continue the conversation, please uh do it. And thanks a lot for this very interesting talk. Thank you very