The Institutional Privacy Dilemma: Why Governments Undersupply Privacy

Transcript

Introduction & main thesis

Awesome. Can everyone hear me? Okay. Is this coming through? >> Sweet. Well, um, thanks for having me. And I think this dovetales quite nicely with the last talk, which is, you know, obviously we need scalable privacy tech solutions. And I mean I think the Ethereum community has long been forward on exactly this margin in terms of understanding from a DAC perspective the importance of privacy but getting actual viable tech on chain is crucial in terms

of the adoption curve because yes I've also had the kind of many hop to get to a privacy solution and the many you know bridges and wallet hops off of that privacy solution at which point one begins to wonder you know am I getting the benefits and at what transactional cost margin but to me this talk is actually a synthesis of three different projects I'm working on one with a audience member but more on that in a moment my major takeaways for you I like to begin saying this is where we're going to end end up this is where I'm hoping for you to land after this talk namely government enforcement of privacy rights suffers from a major structural weakness my co-author and I call this

the institution utional privacy dilemma, but we view privacy tech as crucial for bridging the gap between levels of privacy that citizens demand and feel is representative and that which the government is willing to provide. Second, a government's stance towards privacy technology is especially revelatory of its own capacity as a constitutionally constrained state. And finally, what does this have to do with blockchain? Arguably, distributed network contexts make protocolized commitments credible, including those that afford privacy to users. Again, that's where I'm ending up. And so, welcome to the, you know, the tripartite privacy show, if you will. And so, this

The Institutional Privacy Dilemma explained

is joint work with Sophia Kosar, who's in the audience. And we explore what we call the institutional privacy dilemma and zero knowledge proofs in particular as a means of mitigating or taming that same privacy dilemma. But to me, this is a critical issue in the digital age, which is simply that encryption is viewed as not consent with enforcement. And we face constant legislative assaults on encryption technologies, proposals to ban encryption, demands to embed back doors. All of this emanates from a fundamental underlying belief that I think is at least partly mistaken

which is encryption and enforcement are simply incommenurate with one another. They cannot coexist. And this is what we view as grounding the institutional privacy dilemma in practice. And it's intuitively simple which is think of many hallmark rights that you consider to be you know nations that are desirable to live in governments that are halfway decent afford their citizens this set of rights. Most people include privacy on that list. It's in international human rights covenants.

Why governments see encryption as incompatible with enforcement

It's you know in our own constitutional juristprudence as protections against unreasonable searches and seizures etc. But there's a real deep problem which is most rights don't directly cut against other government enforcement objectives when the government is ensuring the provenence of those rights. But many enforcement objectives of the government are much much harder the more privacy that citizens enjoy. This is not an argument we should always and everywhere have privacy in every moment. But we are saying this is a structural defect and the last talk was great for foregrounding why should we care about privacy? Why should people care about

privacy? I think at first and foremost it is just kind of assumed, which is to say we could enforce laws so much more effectively if we embedded cameras in every home, including in your bathroom where people might want to do illegal drugs. And hopefully, it's more than a little bit shocking to even contemplate a 247 recording of your most private spaces in your home to facilitate the enforcement objectives of the government. No one would agree to that in their right mind. That itself is indicative of the core at which people believe we have private spheres of autonomy where we should be protected in our activities and it is not assumed

NAACP v. Alabama & financial privacy

that the government has an unlimited right to perceive that. But it's not just hey we have a right to privacy that's not debatable and most people the vast majority of people when pled will agree to that. It cuts so much deeper than that. This is the steps of, you know, the the ruling in NAACP versus Alabama. This is Rosa Parks. And how many of you have heard of the NAACP versus Alabama case? I know we don't have lawyers in the audience, but we have enough privacy advocates that I'm like, I suspect some of you have heard about that particular case. But the state of Alabama says, "Hey, National Association for the Advancement of

Colored People, for tax reasons, following, and this is, you know, in the period of the civil rights movement when these organizations were rightly protesting the odious treatment of by both private organizations, but southern governments alike of colored people." So, the National Association for the Advancement of Color People in Alabama is told by the Alabama government, for tax purposes, we would like to see your entire donor list, their names, their addresses, etc. How many of you think the motive of the Alabama government at this point in time was genuinely for tax enforcement? people in the Alabama

government at this time were directly linked to the KKK. And so the thinking was you probably have other motives in mind and correctly the Supreme Court said this is a violation of the rights to association. So my point is severalfold here. One, financial activity can itself be bound up in other things such as the right to protest, the right to associate, the right to organize as against oppressive government. And so, one major misconception that's out there is if it's economic and financial, well, maybe that shouldn't be protected as much.

The third-party doctrine & the Patriot Act

Maybe that the government should always see for money laundering and tax, you know, tax evasion purposes. But to me, our financial commitments, that which we choose to support, where and how we organize is fundamentally bound up in our exercise of rights to speech, rights to association. And so my argument is not only privacy is bound up in the exercise of many of our other fundamental liberties, but that includes our financial activities. I only need to point to this Hallmark case as an example of why a government actor might not for the best reasons want a list of people providing financial support to a then disfavored organization. I'm glad

that the court ruled this way. But, you know, is this just a march towards better protected privacy rights in the United States? I'm throwing up Snowden here, but to me, we can go back to things like the Bank Secrecy Act and the emergence of the Third Party doctrine, which is basically arguing, at least before our courts and their interpretation of the relevant cases brought before them, you have no right to privacy once you give your records to a third party. Meaning, the moment you're using a bank account, the moment you do not have a right to privacy, according to the US government. And gosh, has this, you know, gotten on steroids once we s saw the Patriot Act

passed in the wake of the 9/11 attacks. And for this audience, you know, tornado cash and its continued travails with the Treasury's office of for office of foreign assets control directly paint this tension. And I'm not here to say, hey, the Patriot Act is legitimate. I'm not here to say that the authority that the Treasury's Office of Foreign Access Control acts under is fully legitimate, but what is not even remotely debatable is that is currently governing law. And so the government will act in pursuit of that governing law. And I would say correctly so. I don't want a government

Tornado Cash & OFAC tensions

that acts lawlessly. I dislike both of these sets of laws I'm describing, but they are on the books and they animate the enforcement objectives of this government. Make no mistake. And to us, this clearly indicates what we call the institutional privacy dilemma. Unlike other rights, the government will never sufficiently enforce rights to privacy. There are, you know, glimmerings of hope in our jurist credential record, which is cell phone records. You need if you're arrested with your cell phone, they need a warrant in order to crack into your cell phone. Other, you know, and so this went to the Supreme Court.

Similarly, cell phone tower records also found to need some measure of warrant prior to there being able to the enforcement authorities being able to dig into them at will. But the problem with both of these cases is the government acts first. Law enforcement officers are like, "We're going to search these phones because we arrested these people. They're on their person and we can dig into them just as we can dig through their pockets." Similarly, authorities were like cell phone towers or the fabled unlabeled room in the AT&T building in San Francisco.

Parallel reconstruction & investigative workarounds

It's only after the fact that we red address depradations to privacy rights on the part of the government and I would argue only imperfectly. More on that in a moment. And so not only should we view this as a problem and that we understandably should demand better privacy protections than that which the government is willing to provide organically. But a lot of the arguments of, hey, just give us the trusted government a back door of some kind, an algorithmic crack that will, you know, work for all, you know, any type of encryption. To me, the problem is is do you trust every single organization to

which that government is authorized to hand that information off to? The Patriot Act provides an amazing example of this called parallel reconstruction. Again, the people working for the Department of Homeland Security probably enforcement motivated, probably believe in the legitimacy of the government's enforcement objectives and want to enforce on criminals. Patriot Act vacuums up all of these private citizens information. Whether or not constitutional, they're doing it. and the Department of Homeland Security gets evidence of a lot of domestic local crimes that are completely outside their jurisdictional authority.

This probably really wrankles with the people motivated to work for such an enforcement agency in the first place. They want to punish crime. They want to find more crime. They want more information that makes that easier. And they're like, "We can't enforce because this is a local law enforcement matter." Two options. Forget about it. they don't have the constitutional authority to enforce based on that information or they can share this information with local law enforcement even though they're not supposed to. This raises a deeper problem which is at the time prior to Snowden revealing this information all of this was classified.

Why backdoors inevitably expand

So the local law enforcement officers couldn't go before a judge and say this classified program I can't tell you about is actually the reason we suspect this person of a crime and we want a warrant to search their residence. Again, we have some privacy protections, but our argument is not quite enough given these counterveiling objectives. So what did the Department of Homeland Security do? They said, "Let's train local law enforcement how to construct a false investigative trail that they can then testify in open court." To put it more bluntly, how to lie to a judge about how they came to a requisite level of suspicion to authorize the judicial

issuance of a warrant. To me, the temptation to share the perfect cryptographic crack will be too strong. And at that point to me, instead of having maybe one hyper authorized government enforcement authority that has the magic key that can unlock cryp uh cryptography, it becomes a backdoor. Do you trust all of our security partners around the world with this type of tool? And so the predominant security focused arguments fall down simply because they will not be able to keep a lid on that tool. And often the organizations that that are getting hacked are government authorities.

themselves. So to me, keeping such a tool secure secure is highly improbable, let alone the fact that they're not going to limit it to just the special authorized agencies that supposedly have the power to crap cryptography. And so we view zero knowledge proof solutions as actually incredibly useful. And so we should fight legislative battles, ideally get rid of the Patriot Act, get rid of some of these oppressive, you know, it it excesses of government enforcement authority, but we can't litigate every battle at once. So it's like, we need to get crypto on a better regulatory footing and we need to repeal the Patriot Act. And I'm like, anything

Zero-knowledge proofs as regulatory middle ground

else utopian you'd like to talk about as adding to your wish list next? And so to me, setting aside whether we're on a good constitutional footing with respect to our existing juristprudence that enables the government to perceive our activities and our day-to-day affairs. Setting that aside to me what do we do in the interim and zero knowledge proofs I think present a really really just beneficial option in many many contexts which is they enable the revelation of select elements of information characteristics of that information without saying you have to divulge every last bit of that information to the enforcement authority that's interested in it and so I've got the logos of a few

cool projects and this is now 2 years dated So definitely some of these there's much more out there but privacy pools minimum anti-olusion infrastructure holy zk email suma all of these stand as examples where you can prove that an actor is solvent without revealing their balance sheets. You can prove that an email was sent without divulging the contents or the sender of the email in a necessary sense. You can prove that a vote was cast without showing how that vote went or enabling the person to even prove to a third party that they voted a certain way. Reducing incentives for bribery and corruption. The list goes

on. But our argument in this piece is these have huge regulatory benefits. Being able to show a certain thing is in compliance without actually requiring you to reveal everything about the company. That's better. That's a better middle ground to be sure. So the next piece generalizes the logic that we spell out about zero knowledge proofs as partly taming the institutional privacy dilemma. This is joint work with Federica Karugatti at King's College London. And we argue that the capacity of democratic states to actually provide privacy rights is a hugely important bellweather of whether or not they're a good state, a state that you'd want to

Privacy pools, anti-collusion infra & compliance tools

live in to begin with. And so this is speaking to a very specific literature in political science and institutional economics which is focused on state capacity. Some states are much more effective and generally nations that people want to live in are thought to have high levels of government or state capacity. But the traditional narrative that I've definitely alluded to already is the level of opacity or privacy, the inability of the government to see into every last corner of your life at every moment. That's at odds with state capacity. And there's a lot of literature out there that definitely supports a perspective which is your citizens need to be legible to the state

in order for it to enforce plan etc. There's a robust literature on information capacity in particular cadastral surveys tax receipts census hurting you name it. There's a variety of contexts where hey the less legible citizens are the less thei state can do or enforce its objectives in any sense including providing social security. So this isn't all about enforcement. We need government identification for a variety of programs that probably people in this room support. So this isn't hey we don't want any legibility. But the traditional narrative is well the more legibility the more capable the state.

the more privacy perhaps the less capable the state and that was what we were spelling out in the institutional privacy dilemma piece. So more legibility less opacity. We view this as a problem which is we have a democratic commitment to private spheres of action and association. I think until the information age, until this digital age that we are, you know, bravely slumping into, it effectively was not even really in question. A private conversation in a private home, it was of necessity private. And only now has it become possible and and very possible. Think of Ring doorbell

State capacity theory: legibility vs opacity

cameras, Google Nest. Link that to flock cameras and you have potentially real time understanding of individual location of citizens around the country. This is not hypothetical anymore. We are deploying that surveillance tech at scale. And you start linking them together and you can get an increasingly granular picture of where someone is, what they're doing at nearly every moment. Add thermal imaging and you can probably even deduce where they are in the house and what they might be doing. This was never before even thought of.

And so most people, including, you know, in our society, surveys, the appearance in international human rights covenants, the fact that it's in our constitution, you name it, most people believe we have a fundamental right to some measure of privacy in our own homes and in our own associations. Think back to the NAC NAACP versus Alabama discussion. And so states that accord privacy protections also tend to be ones that outperform. This creates a cooperative equilibrium. Those subject to a state that doesn't believe it has an unfettered right to every aspect of your life. You're more likely to comply because you believe the laws are legitimate. It's not an

oppressive regime, to put it more bluntly. And a more legitimate state is one that is more capable because it doesn't have to fight tooth and nail to enforce every last objective against an unwilling and oppressed citizenry. So providing privacy is a means by which we can assess whether a democratic state is healthy or not. And it's actually it cuts deeper because constitutionalism is not g guaranteed with every constitution.

The pacing problem: tech moves faster than law

There are many oppressive dictatorial regimes around the world that have a But it is thought the term constitutionalism indicates separation of authorities. Those authorities checking and balancing one another. Judicial review for consistency with the fundamental rights that are enshrined in that constitution. All of these are thought to be a major input to constitutionalism appropriately construed. But how does the state self-restrain?

We think that preserving spheres of opacity, spheres of privacy for individual citizens is actually crucial. And it's not only crucial, but it's revelatory of the state's capacity to hold itself accountable. This is the version of self-restraint at a state capacity level. Thus, the representative balance in any given society between opacity and legibility constitutes modern democratic orders. Goes our argument. Where do we get a particular balance of opacity in a society at a given moment in time? stylized simple model, but we think it captures the dynamic that we're most interested in describing here, which is the

government, private citizens, and technology are the triad that determines the level of opacity that citizens enjoy at any given moment in time. But I've already argued to you one element of this triad is systematically going to under supply privacy because privacy cuts against other government enforcement objectives. Therefore, if we want the right representative balance for a given society, the other two legs of that stool have to be more loadbearing in that case. And so, citizen demand for privacy as well as technological affordances that we've been discussing already today.

Surveillance tech & public-private data pipelines

This gets worse though. There's something called the pacing problem. And this is acute in constitutionally constrained governments because they're slow by design. They have veto players. They have judicial review. Meaning they can't act quickly. And therefore, how quickly they can act in the face of technological change is the general point in the literature called the pacing problem. But we're applying that to questions of opacity in particular. Technological change is accelerating. This has asymmetric effects on legibility and opacity. What do I mean by that? our authority all else equal. I want our authorities to adopt technology that makes them more effective. It's a

political question whether I want the DHS to be as empowered as it is. But assuming that we have authorities, I want them to be effective as opposed to, you know, lumbering dinosaurs still using pen and paper when we have radically more effective solutions out there. And naturally, I want people who believe in a particular agency's mission to work for that agency. So, you give the DHS a radical new surveillance tool and what are they going to do? I've already told you they're going to adopt it and use it immediately. But our checks on this are expost.

Citizen demands. We didn't even know about the surveillance emanating from the Patriot Act until Snowden revealed it. And so, it's always after the fact and often imperfect. Similarly, corporations scale increasingly enables private surveillance, public private partnerships. I probably in this audience need do no more than utter the word palunteer and you get my point already, which is this isn't just a state problem. Information technology improves and suddenly we are all more legible to the state. Think about linking flock cameras to Ring doorbells as a great example of that. But any correction to that dynamic is after the

Why privacy demand must be load-bearing

fact. They're expost and incremental, typically judicial, and they suffer from significant asymmetries of bargaining power. More on that in a moment when it comes to the private organizations like Meta, Alphabet, you name it, Amazon that are also vacuuming up our data at increasingly, you know, prodigious rates. So if the state if you buy our argument that the state is less likely to supply opacity, the other elements of this triad of necessity become more loadbearing. Citizen demands for opacity from public and private actors alike become more important. And our argument is a descriptive but also predictive

one. We think this explains the emergence of technological affordances that provide opacity, some of which we've already been talking about today. And some of these are just great and they preserve opacity strictly. Strong encryption, peer-to-peer networks, distributed governance, pseudonmous digital identities, multi-party computation are all kind of brave, cool frontiers that most of you probably know a lot more about than I do. I'm talking typically to law and policy audiences at a fundamental level. But these are all emergent ways that we can protect our our privacy that we need to be protecting if we want the right representative balance of opacity as against the allseeing eye of the state.

Is it all zero sum though and this is in part a generalization of the point I've already made about zero knowledge proofs. We should also embrace if we realize that allseeing eye is not going to go away. And yes, we should maybe be more politically active in trying to police the boundaries of that allseeing eye. But if we take it as given that we have a Patriot Act, if we take it as given that we have these enforcement authorities, these are actually middle ground solutions that I think we should also be embracing. Zero knowledge proofs, trusted execution environments, homorphic encryption, differential privacy. All of these are partial solutions. They assume that we're revealing some information to a third

Partial solutions: TEEs, homomorphic encryption

party interested in that information, but they don't throw the baby out with the bathwater and provide all of the information. Confidentiality rings of experts in court processes, independent auditors that attest to compliance while still preserving privacy and kill switch mechanisms. All of these are partial solutions in the face of this ongoing and I would say unending dilemma. So we can understand privacy tech is essential to maintaining the right opacity balance in the digital era. And crucially though a government's stance towards privacy technology is especially revelatory of their commitments to this crucial constitutional capacity. So we should be

aware of how our government perceives encryption and other privacy technology. But it's also probably a bellweather for how restrained that state is in a constitutionalist sense. Final one, this is a good segue to that. What does any of this have to do with blockchain networks? To me, we are entering a world where more and more of our lives are bound up in network intermediated contexts. that necessarily means more and more of our rights are implicated by the processes that are executing within those contexts. So why do we like democracy?

Why blockchain governance matters

It's representative, minority protecting and therefore rights protecting. It's also just the right thing to do. These are all just major arguments about why democratic systems are desirable. Some of them are utilitarian and some of them are just like setting aside the utilitarian calculus. It is just normatively preferable as in and of itself. It's closely linked to social flourishing. If you talk to a political scientist, they'll tell you it's the least bad among bad alternatives. But does just democracy get you these benefits? And I see actually a couple people here who are at Zoo Village, Georgia, of all places. This is the Georgian Electoral Commissioner.

It's thought that the recent elections were not actually that clean. This is at the event where the Georgian electoral commissioner was certifying these seemingly fraudulent elections and a protester threw ink all over him. The point being though is just democracy does not get you these heralded benefits. Instead, it's constraints on that system. A constitutional democracy, construed, limits on collective decisions, authorities that check one another, review of collective decisions and actions, and integrity of electoral processes.

Only some constitutions get you this, and not coincidentally, the list I just provided you is conssonant with Bill of Rights. Rights constrain that which the collective can provide in terms of its decisions. Put more bluntly, Congress can't just vote to kill someone. That's not within their considerable collective decision authority. Separation of powers, judicial review, secret voting, and state ballots. These are all exemplars of these general features of constitutional systems that actually get us the benefits of democratic decision-making. Are most of our digital spaces constitutional? Probably in this audience, I don't need to belabor this

Constitutionalism vs “just democracy.”

point. Are they transparent? No. Powers separated among independent authorities. How many of you think Facebook's oversight board is doing an effective job? Review of decisions expost extremely limited if present at all. FTC digs into some of these platforms and these they're tracking what we read, what websites we visit, whether we're married, our education level, our income bracket. And when the FTC said, "Tell us about the data you're collecting on whom and what it's being used for." Companies were like, "We couldn't tell you all of the data we collected, and we sure couldn't tell you all of the third parties using it." A smaller one that also fell under the FTC's enforcement

authority said, "We're collecting all this data and linking it." And that the irony being they were like, "Do you want to be ad blocked? Do you want to be protected from all the data harvesting? sign up for our service and we'll prevent all of them from harvesting your data, but we will sell it along to third parties instead. And this particular group, a hundred data points out of the millions it collected revealed health, political, tax, employment, financial aid, directions, children, dating, and sexual preferences where and a lot of these data brokers advertise how granular they they can get information about people where they can probably geollocate you. You don't need my name.

If you say finance professor who likes wine and electronic music who lives on this street in Longmont, you already know the person in a fundamental sense. Geoloccation is also taking place and the popularity of software development kits is only making this more prolific which is often the developer of the SDK gets all of the data that downstream uses of that SDK are collecting at the same time. So, this is an early publication of mine that got me interested in distributed network governance and why it can be understood to have a constitutional flavor. Why do crypto miners mine? To make money? Why do the networks pay

Auditing, protocol entrenchment & credibility

these miners? To process network transactions reliably. And you can tell this was before Ethereum was proof of stake. It's an old paper. But why don't the miners take the money and run? because the network rules and other minors prevent it. Why do politicians politic? To make money, power, fame. And some people are like, "Wait, are you claiming every politician is so motivated?" I'm like, "No, but the ones that are not altruistic are the ones that we need to design the system to be resilient to their incentives to make money and power and fame from. Why do citizens reward politicians to make political decisions representatively? But why don't the

politicians take unconstrained power? The constitution and other politicians observation of their compliance with that constitution limitedly prevented. This isn't a narrative that we've got it perfect. But the argument is a deliberate analogy that politicians and cryptocurrency network participants, validators are the constrained representative agents of a larger polity. That means entrenched protocol on cryptocurrency networks has a constitutional character by design. It is embedded. Any one participant can't change it. And their knowledge that they can't change it creates an incentive compatible equilibrium that operates to

both users and network validators um incentives alike. ZKPs are pretty cool. They enable the revolution of the truth or characteristic of an underlying piece of information without revealing it. Huge for preserving rights to encryption while facilitating compliance. So successfully running a ZK circuit results in hash proof it hash proof of successful completion. So you just verify that a company has run a ZK circuit about encrypting your information and which companies it'll be shared with and you're good to go.

Why distributed governance enables durable privacy

Except what percentage of network users know how to verify whether a ZK circuit has been successfully run? I suspect in this audience, a decent percentage. But think out to the general population of users of networks. Probably very few. What percentage of website users know how to verify with which third parties a company has shared their data? The list goes on. This isn't a new problem. Who here knows how to audit company's financial reports? Certified accountants in the audience, maybe one or two. But in general, in many, many contexts, we rely on specialized, independent, trusted auditors. We've got somebody from the Security Alliance in

the audience, and that's my description of this emergent function in crypto. Have independent experts audit things, but How can we trust what we're going to audit? When can an auditor trust in the dynamic fidelity of what they're auditing? When a network's rules are entrenched and no central controller can alter them unilaterally. This is the essence of distributed network governance. Is this always an everywhere an issue in all contexts that our data is being used? Of course not. But the real problem is is the greater the gains from defection with respect to a specific affordance associated with our privacy rights in particular, the less

actual like the less credible that that protocol choice is, including in context where an auditor comes in to a big company and they're like, "Look, we're in perfect compliance. Audit it and certify it." They walk out the door. The greater the gains from defection, the more they can just change protocol parameters to benefit and run with the money. And so our networks need constitutionalism, too. And this is an argument I've given in a variety of context when people are like, why are you still interested in blockchains?

Final synthesis: privacy as constitutional capacity

And I'm like, distributed network governance is how we get in any digital context. It creates durable deployment of smart contracts of protocols and it makes them audible and it makes them legible to those interested in their execution. And so therefore the credibility and durability of privacy technology depends on this. So in some the government is not well positioned to faithfully protect your privacy rights because it cuts directly against its enforcement objectives. This means citizen demand for privacy and technological solutions that provide it need to fill that gap and in particular

for the most critical functions. I think that those privacy affordances should be deployed in a distributed network context because it is that context which makes those commitments durable, resilient and credible. Thank you so much for your attention.