hello and welcome everybody to the next
panel thank you for your patience we're
a bit after time but I think that should
work just fine please take a seat uh
welcome to the next panel privacy is big
big business moderated by Dr s guses and
organized as well so thank you very much
for inviting that fantastic panel and I
hand it over to
you thank you and actually the panel was
organized by Ty and Donald I'll
introduce them in a moment um so please
take a seat and happy new Year everyone
we can still say that it's January right
okay
um let's let people sit
down you can hear me
well all right great um so information
privacy um has many
aspirations one is individual privacy
protection and what we mean by that is a
protection of a person's data traces so
they not they cannot be abused or used
against
them another known one is protection
from surveillance Oscar Gandhi and later
many other Scholars wrote about the
segmentation of populations to desirable
and undesirable
segments and already surveillance as a
framework leads to the promise of
privacy to protect against Power
asymmetries that arise from the massing
of data about
populations in previous times we would
mainly refer to information asymmetries
with respect to State intelligence or
state power but we increasingly also get
concerned about other kinds of Power two
of which we would like to bring into
view today market and infrastructural
power the pursuit of privacy has found
some manifestation in technical design
which I believe many of you know as
privacy Engineers or privacy Advocates
um we Champion the development and
deployment of privacy technology
or what is in the field called privacy
enhancing
Technologies in past work Carmela
troncoso Claudia Dias and later in
conversation with marpo we aim to put
towards how pets privacy enhancing
Technologies translate privacy as a
right or an aspiration into the
technical space we came up with two main
principles that pay pets aim to
operationalize these can be summarized
bluntly as data minimization ation and
purpose
limitation data minimization ensures
that as little data is collected by the
overall system if at all this data
resides on devices that are assumed to
be under the control of the users and
not third parties we like to call this
also distribution of trust or avoidance
of single point of failure and the
purpose limitation which is a second
principle ensures that the little data
that the third party does collect is cut
to purpose and cannot be easily
repurposed in other words pets introduce
mechanisms to avoid function
creep in fact if we Define it this way
pets are not only there to protect the
confidentiality of data or privacy but
deliberately block the current
extractive logic of digital systems that
live from continuous redesign and
optimization of services for the pursuit
of
revenues but we will see throughout the
panel that industry has interpreted
these principles differently if not too
liberally some of the reasons they have
been able to interpret the use of pets
as they wish and by day I referr to
Industry is because pets are new it
takes a moment to really understand what
a design is doing especially if they're
not designed or deployed
transparently but also we have not seen
much enfor enforcement into pets however
these are not the topics of this panel
rather all very exciting but not today
all right um we want to focus on a new
sort of power which we summarize as
market and infrastructural power which
sometimes requires and sometimes allows
these companies to introduce pets in a
way that may provide some individual
protections but at the same time
transforms power relationships to their
benefit an unintuitive result
we posit that this has to do with
something we call the rise of
computational infrastructures this is a
topic we study at T Del with our
research group and by computational
infrastructures we refer to Cloud
environments as well as mobile or end
devices that have practically become
their accessories so all of your mobile
devices and potentially my
desktop what we have seen over the last
decade is a bloating of this
infrastructure ructure as well as the
concentration of its control with Amazon
and Microsoft dominating the clouds and
Google and apple dominating the devices
in our project we hypothesize the
following about these computational
infrastructures one current
computational infrastructures so clouds
and end devices like mobile phones
internet of things which are
increasingly rendered as their
accessories are organized to become the
production environment for All Digital
Services so if anyone wants to develop a
service and therefore anyone wants to
use such a device they will have to
partially or wholly pass through these
computational infrastructures which
happen to be concentrated in the hands
of a few
companies
two these computational infrastructures
we have today are not the result of
tradition result of traditional market
dynamics meaning people demanding these
infrastructures and the markets deliver
ing but instead we POS posit that a
whole series of events after the 2008
financial crisis led to the
financialization of tech companies and
to the bloating of cloud-based
services and three given this financial
financialization aside from being
difficult totic um pronounce it's a
complex phenomena these companies are
under pressure to grow they need to
expand into health education logists ICS
Supply chains you name it they do so not
by collecting data or with the promise
of selling ads but by capturing Revenue
generating operations of organizations
so if there's an organization then it
has some operations and they try to
capture these operations and there with
the revenue associated with
them we observe that these companies are
increasingly leaning on privacy by
Design or pets to cement or expand that
infrastructural and Market power as they
expand into these different sectors they
do so by transformation of the
relationship they they have with end
users but also by reconfiguring the
business ecosystem that depends on their
computational infrastructures in other
words they reshape businesso business
relationships
globally we're not the first people to
raise concerns with respect to privacy
and computational
infrastructures in a volume edited by
Corin CF titled eaten by the internet
Shan K sahib raises concerns about pets
being only feasible and affordable for
companies with large infrastructures
referring to CDN he writes while privacy
preserving Protocols are important for
privacy the Reliance on expensive
infrastructure has the effect of making
them Deployable only by large tech
companies this has ramification ations
for the politics of access to privacy on
the internet and a danger that smaller
organizations again the B2B aspect
acting in the public interest will not
be able to afford to provide privacy for
their
users which is still a different
argument from what Michael ve who says
who talks who writes in the same volume
says this situation places Civil Society
organizations in a bind since Snowden
they have successfully rallied companies
and the public behind encrypting
Communications limiting some forms of
State
surveillance but encryption technologies
have moved on and they can now more
effectively encrypt analysis and
computation as well this is a much more
open design space where businesses can
design complex pets to Advantage them to
the detriment of their
competitors so what we're observing in
this panel is is that pets are being
instrumentalized sometimes times
genuinely and at other times to do
confidentiality washing while being
designed to bring business advantages or
enable infrastructural expansion for the
bigger
players the objective of today's panel
is to provide you a quick glimpse into
three empirical cases that demonstrate
the different ways in which privacy is
being instrumentalized by these
companies that have greater control over
our current computational
infrastructures so without much further
ad do I'd like to turn to my panelists
and let me quickly introduce them to my
left is Chris
shac is he's a public interest
technologist and Irish C and at the
Irish Council of civil liberties um a
senior fellow his work focuses on
privacy Tech anti-s surveillance
emerging Technologies and algorithmic
decision-making previously he was a
researcher in darad Germany where he
worked on applied crypto cryptography
pets and Internet Security today he he
will talk about Google privacy sandbox
and we'll link it to privacy in Internet
standards making thank you for coming
Chris next we'll have tyman and Donald
um tyman is a master student at T telf
in the faculty of Technology policy and
management where I'm also based he's
been working with Donald and myself for
a little under two years and it has a
strong interest in legal economic and
ethical dimensions of digital
Technologies and next to him is Donald
who is a PhD candidate in the same
faculty he's affiliated with our
research group called The programmable
infrastructures group his research
explores how agile software production
and computational infrastructures are
changing the production of economic
value
globally tyman and Donald are going to
talk about a case called Amazon sidewalk
which is an extension to AWS that the
company presents as a closed crowdsource
Network I'm not sure they use those
words but we do all right um um Carmela
is going to be our last panelist is an
associate professor at epfl in loan she
heads the Springs lab focused on
security and privacy
engineering the work at this lab and
Carmella's work focuses on understanding
and mitigating the impact of technology
on society their research focuses on the
intersection of machine learning
security and privacy development of
privacy enhancing Technologies and
privacy engineering today she'll be
talking about what happened with contact
tracing apps and what later became known
as the Google Apple exposure
notification with that Chris I'd like to
pass the word to
you thank you s
um so first is that I when I first
looked at Google's privacy sandbox first
the word privacy stands out because
you'd assume that the word privacy in
the name of a product or series of
products would emphasize uh the
inclusion of people um whose privacy you
care
about but what you eventually see is
that most of the stakeholders they care
about our
advertisers so there's been a lot of
interaction they've had with advertisers
all that and in fact um s mentioned um
the role of uh standardization bodies
for instance w3c where Google brought
about some of their proposals uh which
didn't go through by the way no one
wanted to ment them apart from Google
themselves uh was in some sense forced
uh by the UK's competition Authority who
again was not really thinking about you
mine privacy they were concerned about
the advertisers who will lose
business if Google gets rid of third
party
cookies but many of you here probably
don't use Google Chrome you probably use
maybe mozella Firefox Brave or some
other
TRS all of whom have already gotten rid
of third party cookies long long
back so why are we still talking about
that well Google's Chrome is essentially
the market dominant player there right
so the fact that Modzilla even Apple um
and uh brave for instance get rid of
third party cookies doesn't really
affect advertisers as much as if
Google's Chrome gets rid of of third
party cookies and it's not only about
advertisers right Google makes a lot of
money through these through this because
they're not only a
browser they run operating systems they
run Cloud
infrastructure they run the um auction
systems that run behind the scenes for
uh serving ads they're everywhere so
they have a strong incentive to CH to
keep the essence of how they make
money if and when they get rid of third
party cookies which they've been
promising which most likely will go this
year
but they have very different incentives
than the other players on the
market so when we think about third
party cookies and Google and all of this
comes in
but where where's privacy all of in all
of
this right it's called privacy sandbox
but where's the Privacy so the key
argument the key Essence is
that your browsers will not be sending
personal data which is being which is
currently being used in auctions to
serve you
ads but does that is that the full
picture because just because your person
data is not sent to these what are they
called dsps and ssps in the whole
auction system that does not mean that
you cannot be targeted and that's
essentially Google's claim and that's
part of the whole ecosystem they are
building to keep their surveillance
business model without having to send
personal data from your browsers to
that but to do this they need multiple
components so when someone says privacy
sandbox it's not essentially like one
one individual technology or something
there are plenty of application
interfaces that come in uh one one
example is what is known as what is now
known as topics API at one point it was
known as flock at that point it was the
season of birds so you had flock fledge
plenty of these birds
around the idea being that you're
browsing data so the websites you go
which could be various kinds of websites
could go would play a significant role
in what kind of ads you get served so
your browsing data would then be in some
sense on your browser by the way so
essentially the browser is not serving
you but serving the Google and
ads it's all happens on your browser so
what's going to be done is that topic is
going to be in some sense estimated it
depends on the kinds of websites you go
if it's in so in the top million
websites then there is a direct mapping
because this is uh you make a map of
what kind of topics these websit serves
but if these are lesser known websites
then our fantastic tool known as machine
learning comes in to estimate and
predict what kind of topics you might
like once these topics are in your
browsers your advertisers are going to
check these topics and use that to serve
you
ads all of this sounds super fun right
but what could go wrong you're not
sending personal data it's just some
topics let's take a small
example imagine you're in Saudi Arab IIA
and you're gay the websites you go
currently they so you have https and all
of that so that layer is covered but the
estimated or predicted uh topic might be
a sexual
orientation if this information gets
leaked then you're in trouble in the
country you're in
right another aspect is who decides what
topic is acceptable that are culture
elements so it's essentially one US firm
with uh certain stakeholders who get to
decide
that even Beyond this the claim that you
cannot be identified just because these
uh your personal data is not being sent
some researchers have also questioned
that particular
aspect because if you have enough amount
of this kind of data as an advertisers
you can use that with a significant
probability to even identify individuals
now that's assuming that these
advertisers don't collude that they
don't share data with each other and
also assuming that they don't have other
kinds of fingerprinting metrics and all
of that once you bring all of the other
components into
play you're not that much better than
today's Google Chrome now all of this
also is to say that you're always in all
of these uh cases worse off than when
you're using other
browsers so your Baseline is so much
more important
here so that was just one particular API
there are plenty of these other
components which play in um there are
also components that are known as
bundles that are being pushed uh the
idea being that when you visit a website
you imagine that that you're being
served only the content from that
particular website imagine you go to New
York Times you think you're only getting
information from New York
Times but what if New York Times or some
other websites could just bundle in
information from various different
websites but always serve it as if it
was New York
Times so that's one of the additional
proposals and combine that with what is
known as a manifest wherein Google
itself serves as the entity that's going
to ser Ser you these websites so you
imagine you're going to New York Times
or some other example.com websites
that's what you see on the browsers
that's the content you get but Google is
the one who's serving
you the fact that they're serving you
means they also have all this
information
right and all of this adds up so in a
small way it's like saying we have the
small p and the large P some folks have
also written about it much more where
the small P privacy is like well trust
us we Google so we'll do all everything
good and within our ecosystem you're
protected once you go outside you don't
have that
protection final aspect to add here is
some of these mechanisms put together
need vast computational
resources and also even the minimal
privacy protections that you get on top
of the current Google Chrome assumes
that you have millions of
users now both of this also kind of
means that the other vendors on the
market are not in a position to provide
you this particular
service right so I'll stop at that for
now yeah that's great thank you um
before we go on I want to just check in
with the audience we're aware that
sometimes we're going into technical
details or maybe we're going too fast
are there any questions clarifications
that we can POs to
Chris
anyone okay that was crystal clear Chris
thank you I can or no one understood
anything was the comment so we'll find
out in discussion all right time in and
Donald go
ahead maybe
under okay testing yeah that sounds good
okay so the case that I am reading here
today is something I am empirically
researching with Donald and S together
um it's called Amazon sidewalk uh it's
not affiliated with Google sidewalk
which you might know from a few years
ago but it's another thing um and I say
to summarize it it's about bringing uh
connectivity to iot devices in a
crowdsource way and I will explain it
more in a minute but the premise of our
research is that most of the literature
we've seen on this covers the
consequences for user privacy because
it's a crowdsourced thing so there are
certain concerns that arise and those
are very very valid concerns but what we
think is under researched is uh how this
affects manufacturers of iot devices so
we think that sidewalk enables Amazon to
uh reconfigure the way this value is
created by these other companies in the
iot landscape and we are looking to see
if pets are instrumentalized to in for
that purpose so to explain what sidewalk
is I have a slide uh it could be great
yeah it's up here so imagine that you
have a smart mailbox that tells you when
your mail has arrived because everybody
has this right I should clarify right at
the start that this is a us only service
right now so maybe they have it there
but the manufacturer of this mailbox
wants to give connectivity to the
mailbox because if something is dropped
in then you might need to get an alert
on your phone or something and they
choose to make the device sidewalk
compatible so to use sidewalk for this
the consequence is then that the mailbox
does not need Wi-Fi or cellular
communication or anything it can connect
to what is called a Gateway which you
see as on the second spot and the
Gateway is connected to the internet so
it can forward the alert that the
mailbox is sending to the network server
from sidewalk and that is a piece that
Amazon implemented to forward all the
traffic and make sure it's secure and
it's a functional thing and it's part of
their cloud and then the sidewalk
Network server knows which uh which
company manufactured this mailbox so to
which application server which is the
Final End uh it has to send the alert
and then the application server can
think okay I received an alert from this
mailbox I have to send a message to his
phone on an app or something but that is
outside of scope for
now
I'm okay
so
so the premise here is that you have an
endpoint that would traditionally
connect to the server from the
manufacturer through maybe your own
phone or through your own router but now
Amazon has inserted a Gateway and a
network server in
between and this is where the
crowdsource part comes in because the
network server is entirely their own uh
in their own cloud but the Gateway
that's actually gateways owned by people
like you and me or maybe not in this
privacy aware audience but people that
have bought uh an echo speaker which you
see at the bottom or a ring camera
doorbell those devices uh were
reconfigured with the software updates
back in 2021 to share part of their
bandwidth with this network right so if
the mailbox did not have connectivity
then post this 21 2021 update it could
connect to these other gateways using
the sidewalk
protocol and now you may expect this is
where the privacy concerns come in right
uh this is where we see organizations
like e and as researchers say okay if my
endpoint talks to your gateway talks to
Amazon's cloud and then it only gets to
the manufacturer server then people can
see my data Maybe or can tamper with it
and we want to prevent that so this is
where Amazon uses their pets so there
are three layers of encryption and they
use some obfuscation to hide the
identity of these devices and the
consensus is that this works more or
less so they address the privacy
concerns and yeah we can also assume
that that is the case here here but this
is where our research takes a
manufacturer Focus so it's important to
assess whether these pets work to which
extent but we are also seeing
manufacturers becoming more dependent on
Amazon's Cloud if they make their
devices side well compatible and a
second point we see uh which is more
hypothetical but I will elaborate on it
in a bit uh is that Amazon becomes kind
of a manufact network provider and they
can see how all these iot devices
interact with the cloud and because of
that they can learn how the devices work
and more effectively compete with iot
companies so I'll start with a point uh
about iot companies becoming more
dependent on Amazon if you want to make
your device sidewalk compatible uh it
uses Bluetooth or Laura which is a
long-range technology under the hood so
you need to implement certain chips and
uh you also need to secure it in a way
and for both things you need Amazon so
Amazon has partnered with some silicone
providers and you can only use te chips
in your devices then once your prototype
is done you have to get it approved by
Amazon on then once your prototype is
finally working all the data goes
through AWS and they have a very neat
surface in AWS where you can process the
data manage your sidewalk devices but if
you don't want to use that if you want
to use another Cloud then you have to
pull the data out of AWS and then ingest
it wherever you want so there's an extra
hurdle and yeah we see all these extra
barriers that Amazon is putting up uh
deliberately or not maybe for the sake
of technology or security that makes it
harder for manufacturers to develop
their products outside of Amazon's web
services so that's our first concern it
looks like it's just a pipe maybe
connecting the endpoint to the server
but they are doing much more they are
connecting the endpoint to their cloud
and meanwhile they are kind of funling
Manufacturers to also use their Cloud
for all their other
services second point I'll be more brief
on this um it's hypothetical we are
doing more research to see what data
Amazon can see but because they own this
network server in the middle that is
fully in AWS they can see how these
devices operate and the payload so the
content of what the mailbox sends that
is encrypted so you don't have to worry
about that but we've spoken to iot
manufacturers of sidewalk devices and
we've looked into their documentations
and Amazon can still see how often a
device operates with the cloud uh from
where what the brand is of each device
uh what size the payload is so they can
learn a lot about how these devices use
the cloud and then use that to improve
their own iot devices maybe and like I
said it's still hypothetical but you
might remember that Amazon also has a
Marketplace and they tend to look at
products that are in high demand and
then copy aspects of them for their own
Amazon basic brand and that's also
something we've heard manufacturers
worry
about so it's a bit sced in our opinion
there is a power asymmetry because for
Amazon it's very clearly in line with
their revenue generating activities but
for the manufacturers it's a bit more
messy so they invest all these resources
and all these efforts to actually become
more dependent with Amazon but they have
to adopt special chips and yeah I have
to get all this knowledge on board on
how you interact with
AWS and okay you may think well what's
the big deal because they get
connectivity in return right so it's a
service you have to invest something for
it but some of the manufactur
manufacturers we spoke to actually said
that the connectivity that they get is
not really the decisive factor to join
sidewalk they're more interested in uh
just doing business with Amazon because
Amazon is so big companies rely on them
also for their Cloud their Logistics
Maybe their
Marketplace one interview we said that
they were simply befriending the Giant
and for that reason working with Amazon
in the space and it's a quite novel
surface so Amazon also invited some of
these companies to be their guinea pig
and these companies apparently agreed to
it because they want to keep Amazon as
their friend and meanwhile they making
themselves more dependent on them also
so that's where we think there's a power
asymmetry and then they are both making
themselves more dependent
and putting Amazon in a powerful
competitive position because they can
potentially see all this data about how
the devices work so that's why that's
how we see pets being instrumentalized
because all of this relies on gateways
of Ordinary People gateways that were
already in people their homes being
reconfigured with a software update that
was an opt out basis of course and
because of that opt out nature or I
cannot say because but I think there's
some overlap they published the update
on an up basis and now they claim they
cover 90% of the US population with this
network so I think we can infer how many
people found that button and that's how
we think pets are being instrumentalized
by Amazon in this
case any questions clarifications
for all
clear I have one question um latest
since we know that meta data is much
more important than the pay
you take a close look at this you
mentioned already that the metata is
what manufacturers mentioned that of
course Amazon can see how often transed
something is transmitted from and so on
is there some research going on in this
how much metadata Amazon us yes exactly
that's something we are researching um
so we are working with colleagues in
Spain at the MDA Institute uh to see
what data these devices generate right
uh we also looked into the
specifications they have of the protocol
which says uh you have to format your
data in this and this way and you can
interpret this variable like this so
that's how we got the hints of what I
said that they can look at uh coverage
for example or how often it communicates
but that is ongoing research
yes any other clarification
questions all right Carmela you're
on thank you um so yeah tman and Donald
asked me to talk about my experience
with the contact tracing apps uh for
which I was a main designer for the
protocols right and all of this started
back in 2020 if you remember there was a
pandemic it was a whole HOA and early in
the beginning uh some people decided
that technology could help and it would
be a good idea to have some technology
interventions especially to help with
what is called Contact tracing to stop
chains of infection what happened is
that Co was so fast and growing so
quickly that traditional methods became
very inefficient we didn't have enough
people to actually talk with the people
that were getting infected gather the
data about who they could have infected
and actually contact those people so
technology kind of seemed like a good
solution and at that point because we
needed to deploy this technology very
fast there was no time to kind of build
something from a scratch and the idea is
okay we can use the sensor that
everybody has which is a smartphone so
with this came a lot of issues I
actually c s called s Michael V to ask
minutes she called us for 15 minutes
yeah I called her I like can I just a
small question I just needed 10 minutes
of your time and then we ended up for
almost two years working on this kind of
daily in with s remembers as the longest
call of her life um but what was
interesting about this um is
that when we were brought into this
project and I was brought there kind of
by certain deput by B my expertise on
privacy the solution that kind of was on
the table was on the Privacy side it was
already privacy preserving but what we
observed is that that privacy preserving
solution in which there was a lot of oh
there are only random identifiers moving
around and there are no identities and
all is good actually was very
reconfigurable the way in which this
private data was collected it would
allow this infrastructure to actually be
used for different things for monitoring
for Target
right and this idea of purpose
limitation that seta was in the
beginning was extremely hard to enforce
technologically we could only rely on
policy and policies to do this thing but
we all know that when policies are the
only thing within maybe law enforcement
and data doesn't always work that well
so kind of we made a big effort in
actually creating a system and you may
remember this is a very kind of privacy
oriented batttle because privacy was the
word we were using because it's the word
that kind of the public relates to but
at the core of our design it was purpose
limitation it was the idea we want to
create something that can only do one
thing and cannot be changed later on and
reused uh the success of our plan is not
only shown in the fact that well this
was deployed la la la very nice it's on
the fact that do you know where this
apps are now have you ever heard of them
anymore no they were so good at doing
only one thing that the moment that
thing was not needed anymore they
disappeared from the face of Earth very
different from any other apps that you
have that you install them on your phone
and then you know they grow and expand
and expand and just take over your
lives so that's what we did and at that
point well Google and apple actually
kind of agreed with our philosophy I was
interesting and it was nice because at
that point then that became very
powerful you had both the experts and
the tech companies saying this is the
way to go
but what was kind of a surprise to me
about that is that well they said okay
in order to really warranty privacy and
that this data cannot be reused instead
of just allowing people to implement the
protocol themselves we're going to
implement the protocol at the operative
systems level and this is very similar
to Chris who saying of uh well in
privacy some books they're going to
implement a lot of these topics and
whatever at the well in this case it's
at the browser level but the browser is
an operative system for all that we care
nowadays right it's the thing that do
everything for you or inside what we
also have this cloud and this service
that kind of implements a bunch of stuff
on the big Tech side and they did this
in the name of privacy to just make sure
that we're all protected but when you
implement something in the operative
system of course we programmers don't
have right to access that directly the
operative system is theirs that means
that they need to put a what we call an
API an interface to allow you to
interact with their functionalities and
this is where the power comes in because
now they decide how you're going to
interact with this and they decided a
set of functionalities that they decided
it was good enough based on basically
their asset on one day yeah talking
copertino with the other guys in val
like you think it's good and they were
like yes is good um
and they implemented that thing right
and then off we go because that's what
you have now and if you want to
implement you have to implement on top
of this this you have to think uh it's
very similar to in topics right they
make a decision as Chris was saying it's
not about which topics are acceptable
they will make a decision of which are
the topics what is the fine grin which
are the kind of things that they will
learn or not learn they will essentially
decide how to define us right which kind
of keywords can Define any human on
earth it's going to be purely decided on
whatever person in uh at Google decide
this is good based on probably their ass
again or they talk with somebody that is
there um and Amazon right we're going to
see the same thing in which which
services or what kind of interactions
these end points can do with the cloud
is going to be defined which whatever
Amazon decides this is a functionality
that I consider okay or not okay and
this thing the interesting part is that
suddenly make Google and apple become a
entity on the table at that point I was
kind of helping Switzerland that's the
country where I live where my university
is and we were kind of helping the Swiss
government as the tech experts to take
part in this uh in these discussions and
I ended up in a lot of discussion
especially in the European Union with
members of other countries and of these
Tech teams and Google and Apple
and they had a lot of power here on
actually talking and saying well the
moment that they decide that something
is not possible they said we're not
going to do it and good luck to you
telling them we had uh it was
interesting that we had a lot of very
cultural clashes on them making
decisions based on how the US Works
which yes there is a lot of States so
they kind of think that Europe is the
same because we have a lot of
States yeah right and we're like no like
we're not the same we don't have same
cultur we don't have loss we don't have
anything right like this is such a
different world and we had a lot of
issues on that matter but the important
thing is that they were at the table
they were at the table that we were
making decisions they decided exactly
what was the definition of privacy we
could Implement they decided when and
how was the utility that we could
Implement not only they decided that
they decided when to change it and they
would change it under your feet with no
problem right like from day to another
your app stops working and you're just
like
Aha and they are like yeah yeah we
decided this was better and this was
like to me was a surprise right I didn't
realize how much power they had when we
were operating on the operative system
uh back then we were working with app
developers that they just do a lot of
apps like that's their business and I
asked them is this normal and they were
like yeah and they like and what do you
do when they do this thing right and
they change all the time like we went
over right there one phone that's the
place um people the user is not aware
that Google is on the other side making
changes they use an app the app stops
working they write to us and they are
annoyed right and it is the business of
the app developers and the app
developers need to work with Google very
fast and do whatever Google says because
they don't have time to fight back they
don't have that power and again we see
this power they have the power they have
the power to tell developers what to do
they have the power to kind of tell
countries what to do inside the public
infrastructure right I mean they also
have the power in the case of topics to
decide what how advertising moves and
again think not only about oh like how
much private information we can have but
just has much power you can have when
you're going to decide how people are
defined and if you want to move Commerce
to one particular sector you just take
your stream of topics and just change it
right you just change the distribution
and that would actually change what is
sold what is not sold what is presented
to people and we see in this and we will
see this all the time so at the end of
the day this this kind of tools and they
use a lot this privacy and security to
decide that some part of the
functionality it is better it is better
for you guys if they put it in the
perative system because that will make
it more secure more privacy preserving
but that also means that they're gaining
power every time because when they're
going to Define this line between what
you can do with a thing in the par
theising or not they're going to make
decisions that will affect how we can
interact with each other and that is
really what um this privacy or privacy
technologies will bring and bring their
power it's not about how much
information they have about us or not
about well they can sell us better or
not is the fact that they're going to
decide how and when things can be sold
and who and when can sell these things
and that is is really one of the
problems when we just think about
information leaks and what information
can have and we sto looking at how does
that really change and where does this
put this technology this big Tech in the
world of how we interact with each
other any clarifications for
carel
questions yes
yes uh thank you for that my name is
teren Eden I worked on the UK contact
tracing app um we started without the
Google Apple system and we we built our
own um and it very quickly became
apparent that it it couldn't work as
well as an OS level one so I I suppose
my question to you is was it worth it
was it worth switching to uh you know
switching to Google and apple who aren't
necessarily as privacy protecting versus
doing it ourselves which may have been
less effective for its
purpose um I
think
I think that at that point yes I think
it was better it was kind of necessary I
think that as said it surfaced a lot of
these problems in the very visible way
which is good it didn't create further
harm they try actually to monetize or
whatever things some more stuff because
they wanted to create some more privacy
preserving statistics to sell to people
uh in Europe people immediately told
them what um in the US it worked a
little bit better but it didn't really
work right they couldn't really get to
the place that they wanted and I said
lot I think because they pissed off a
lot of people by by kind of Crossing
closing this thing and people realized
very fast that they were just losing the
power um and I think that at that point
maybe yes it was useful because indeed
we could have implemented this on our
own and probably some countries would
really have abided to this protocol and
to this kind of idea but many others
would end up kind of using that
information so we're in a kind of in a
pickle here right because now either we
trust them to close this or not in that
particular thing especially with the
speed I mean one of the main problems
here is that we had to deploy at the
speed of light right we produced we did
a whole cycle from conception to
development in a month like this is not
agile it's like speed of light that
you don't know how happened so at that
point there is not much time to reflect
there is not that much time to put
safeguards so I think in a way that kind
of didn't play badly but the fact that
the design was so restrictive yeah uh
technologically kind of also ensured to
us that even though they got to sit at
the table they was also very limited in
what they could do and and yeah I mean
in all of the bad things again probably
was the best thing imagine that we could
have gone through the other way of thing
and then they would have all of the
these identifiers on a data center where
they could have run right so I still
think that yeah in all of the evils this
was the minimal evil we could have uh
yeah it was perfect no but I at the
point where people were like we're going
to implement this on a phone
whether you like it or not I think
that's the best outcome that we could
ever have and as I said the proof to me
a lot of people ask me aren't you sad
that these things are not there it's
like no this is a perfect proof that we
did a good
job yeah
can I have so this is a moment where we
can just take questions from the
audience um great thank
you hi uh thank you that was very
insightful um how do we make our
democracies then more robust against
this kind of digital power grab for the
next
Crisis so I think I think that one of
the things that have to come here to and
I don't know if this is about the crisis
like Crisis are very different moments
and crisis are very dangerous moments
like we were saying now right the push
that happened and also how much Society
will accept stuff like at that point I
mean I'm Spanish and Spain was super
restrictive like people were at home
like locked with their kids and they
would have taken anything to go to the
street so crisis are very but but I
don't think that we can solve problems
at crisis we have to problem solve them
before I think one of the main messages
that that uh at least I hope come out
from this panel is that privacy is very
important but we need to check about
which privacy like big te has hijack the
term to mean like we don't look at your
information instead of checking that
actually privacy helps preventing harms
whether they are due to private
information leaks like the kind of
things that um Chris was describing or
they are much deeper harms to our
democracy in terms of letting them
coming in and kind of the hard thing
here is that these two problems are
solved in different ways like one of
them is more kind of in the gdpr side
the other one is more in the antitrust
and it is interesting that these two
things are to to touch with each other
even though the activists and the policy
makers that work on them they are very
different now we see more and more how
they get entangled and I think how we
protect democracy is by by maybe
shifting a little bit all of this
privacy thing that the European
bureaucrats nowadays love to have in
their mouth like this privacy preserving
is good to actually move back to does
this solve a problem does this create a
harm how does it harm our democracy
because you can have private things that
harm your democracy so changing the
discourse uh I think is very important
to actually bring back the Democracy
discussion rather than staying at this
privacy level which um hides many things
any other takers yeah also just to
always emphasize that often the privacy
and the data protection discourse goes
together uh but we need to also think
that even when your data is
protected your privacy could still be
harmed that's I think in some sense for
a lot of people a bit counterintuitive
because of the current discourse but I
think that's that's one thing we should
always keep in mind yes data is
protected fantastic we are very happy
but is a privacy also being
protected
Donald hello yeah so um uh in the case
of sidewalk um the case that we were
studying um so I'm speaking as a person
trained in economics and usually we
don't um investigate Technical Systems
and for example in our case we saw how
privacy can actually expand
infrastructural Power by um you know
like through a single uh software update
basically agile software development you
can change devices you don't need to
acquire companies anymore to get more
information right because like that's
the economic thinking you need to
acquire uh other companies in order to
um to know what they're doing or to
assimilate more information into your
operations but then um sidewalk is very
incredible cuz you don't need
Acquisitions and mergers right um and
this is you know like mergers and
Acquisitions they usually um Target this
in competition law and in antitrust but
then um what if devices can be turned
into assets by Amazon right through um
this case that we were studying so there
are a lot of U Market theories that are
not anymore holding true and you know we
don't even know whether supply and
demand is working in the digital economy
and how to study that um um so for
example what is a market um in the
Amazon sidewalk case is it market for
cloud computing is it market for more
device more services that will run um in
your devices who has power in this kind
of ecosystem that seems to be closed and
you know that incentivizes manufacturers
to expand Amazon's infrastructural
control well at the same time you know
um experimenting with new technology so
that we would pay for more and more
subscription services in the future cuz
like this is how they make money and you
know we touched on the financialization
aspect of this a while ago so a lot of
questions about um competition and
privacy and how they go together um I
think that's very interesting also
because um I think in Carmela and
Chris's case we see that um companies
are not anymore just producing stuff
they're becoming Arbiters of priv
privacy and you know they're making
decisions for us so um it's not just a
market question or like um it's a
question of who makes the market not who
plays in the market right right that's
great and I think just to conclude very
quickly digital rights frame does look
at individual protection and if they
check the Privacy functionality then
there's very little left to actually
criticize the expansion of their
infrastructure which includes taking
over our devices
right because all of the examples if
you've noticed is about expanding the
infrastructure the services they
developed onto our devices and in the
process of reconfiguring our devices and
using privacy to do so um so if we just
stick with digital rights we might not
have sufficient grounds upon which to
both um see study and critique and
change the current um way things are
going and I think that's a really big
challenge to this community that I hope
becomes clear through the panel did you
want
to um thanks so much for I think your
final comment sort of ties in a question
that I had across and I really
appreciate you mentioning the the the
book that I added in edited in your
introduction and I think one of the
things that I want to pose to everyone
is given that um the expansion of of
infrastructural control and how it's
only in the hands of a number of
companies break so many things right it
breaks our approach to privacy activism
and the chapter you mentioned in the
book by Michael ve he makes a very clear
call on on many people in the room here
who consider themselves to be privacy
activist by saying we need to reframe
what that means because it's very easy
to think that you're an activist working
on privacy but in the long run because
of this computational infrastructural
power you actually end up um cementing
the power of big Tech by doing that and
um I was wondering what each of you
could say also about the businessto
business aspect of this which is
generally something the Civil or the
digital rights uh Community is not
always as focused on because it is hard
to see so given that so many assumptions
about how we do good advocacy are broken
by the by the work that you all do do
you have some advice on like how to pick
up on these issues in a way that we can
actually make a change while also being
willing to let go of some of our no
longer functioning theories of change
around how to be good activist in this
space I'd say the first starting point
would be not to put ourselves in silos
and so if you're a digital rights
activist great but we should also be
talking to the folks who are working on
the competition side of things on the
consumer protection side of things
because all of this interacts and the
more we see and treat them as silos we
are giving more power to those who are
running these infrastructures because
they're essentially running on top of
that right they're very happy as long as
we complain only about data protection
or privacy and someone else is
complaining about consumer protection or
competition they just treat them as
separate problems and deal with them
separately and they're very happy
they're like Yay see we solved your
problem we solved your problem so so
that's the first thing uh the second
would
be to also link all of this and look at
other
stakeholders uh in the um in the market
for instance so I mentioned like the
Google sandbox case a lot of the
stakeholders who were consulted and all
of it were advertisers but there were
plenty of small businesses out there who
were complaining the was the voices
weren't really heard so they were just
drowned right so we need to think about
potential industry side uh alliances as
well uh it's not all industry bad right
there are plenty of wonderful business
out there as well so that's the other
thing um and also to see the cross
functionality I spoke primarily of
Google sandbox as a browser thing but
there's also the Privacy sandbox for
Android which is coming up and being
developed and as CA mentioned browser is
essentially like a operating system
these days and how people use it and
Google knows this right so they develop
something as a tool for first as browser
and then move it into the uh operating
system side of things because hey they
also Control operating system here right
so it's the whole stack uh and as
competition folks would think about
think both vertical stack and horizontal
right both ways if you miss one of the
axises then you're missing the bigger
picture um so first one little
parenthesis just for those that not use
Chrome and then they say they're out of
these um Chris mentioned before manifest
manifest is how Google says that
interaction should happen with the
browser and once Google does that what
happens is that most website providers
they don't have the P the capacity to do
many so they just work for the Manifest
of uh Google and apple and that means
the that gets actually trickled down
through Safari Brave Opera Firefox so if
you think that if you're in Firefox
you're out out of there no like they
still rule what you're going to do
anyway for your question what I have
found help me like this dp3t contact
tracing Adventure was really kind of a
shock in a lot of things that I was
doing including this shift at set ass
say from moving from this data
minimization to purpose limitation so I
think that's a key thing as privacy
Advocates that we have to do right to
move from this idea that if you don't
have the data or if we can um like in
very technical terms we move from
information flows
we need to move to this purpose limit to
this repurposing to the idea of what
kind of thing you can do and the other
thing I have found very helpful also
when I go and give talks in places is to
bring up the definition the this article
the right to privacy from the the human
rights declaration apparently we have
forgotten to have a look at it back and
let big Tech hijack the term privacy as
disinformation flow because if you go
and read that article the article
doesn't say you have the right to people
not knowing your information it says you
have the right for people not to
intervene in your life and when we
change that thing this intervention then
and we go back to that definition then a
lot of the problems just come right and
you have not change anything you can
even not don't need to change privacy we
just need to reclaim the term as the
thing that it always was privacy is not
an end and make allowing these people to
convert it into an end has brought the
problems privacy is a means it was
always a means to protect yourself
that's how we use privacy in the offline
world when you don't tell things like
already when you were a teenager and you
didn't tell your parents about where you
were going it was not a question of oh I
want my privacy it's a question you
don't want them to forbid you to go to
the mall to kiss your partner right it's
not it's you're kind of the consequence
is the thing that you you're protecting
with privacy and the moment that we
forgot that part that I think and I
again I think the changing a little bit
is discourse which is not very far and
it should not be that difficult but
slowly slowly moving from we need to
protect the data to we need to protect
from harms from Intervention go back to
the basics and that should actually help
a lot in in kind of changing this this
discourse and kind of removing the
meaning that they have given to it
because if you can do the harm while
still not having the data then your
privacy technology is essentially a
privacy washing yeah so uh yeah
that that would be my recommendation
yeah so to add on to you said the
Privacy is being hijacked I can relate
to that as a researcher um so I started
for at the start of the research into
sidewalk and we looked into the
documents that Amazon put out and their
announcements and the announcements
would usually go like we have sidewalk
it's crowdsourced so we have a lot of
coverage you can do this and this and
this awesome with it and you don't have
to worry about the privacy and then came
a privacy and security white paper that
I think mentioned the word privacy less
than five times I'm not sure how often
but it was only about the security and
the pets that put in place so like you
said they are marketing it as a privacy
thing while it only goes into keeping
your data
confidential then there were some they
also defended the up out mechanism by
saying we constrain how much bandwidth
is used and it's very secure but the
question of whether you want your device
to contribute to something that creates
value for Amazon that's not addressed
and uh I think like Chris said it's also
very important to see how other smaller
companies are affected so what I learned
in interviewing these sidewalk adopting
companies about the industry Dynamics
and the reasons to adopt sidewalk
because they wanted to prevent the
Giants I'm not sure you're going to find
that anything like I'm not sure you can
find that anywhere else without talking
to these other companies in the
competitive
space and if I can just quickly add um
just to respond I think what we learned
from this these examples is that we
can't just analy the design of the
technology to figure out what are the
digital rights or policy issues and when
I say design I'm in popular policy talk
I'm talking about algorithms or Ai and
they're going to do harms or apps in
some cases what we're seeing is that
it's not only the algorithm that is
doing harm to individuals directly right
it's not just about b2c but these
infrastructures are putting a new
economic and political order in place
both reshuffling business to business
ecosystems and changing the relationship
between business to governments that
what we saw in Carmela's case that means
inequalities questions of social
economic racial Justice are going to
arise not because of how the algorithm
was design designed or how AI works or
how the app is designed that will also
happen but it will especially happen
because of this New Economic and
political order so don't just focus on
the algorithm and say we made it fair or
we made it privacy preserving or what
have you look at the new political
economic order put in place who's going
to suffer from that who has more power
are we going to see more consolidation
of businesses because they can't fight
against these bigger powers are
governments going to bend because they
continue to summon these infrastructures
for public health or for education and
what have you so I think we need to keep
that bigger lens in mind and be really
careful anything that is correction of
algorithms is the metti of big business
that is what they do best so if you try
to correct design they will always come
and say we'll do it best okay so that's
kind of my last words on that okay more
questions and maybe um how much more
time do we have we we started about 10
minutes late so how much time do we have
15 okay should I take questions in twos
so that um we hear more questions
because that's we've been talking a lot
um yeah
all right yeah okay uh thanks for the
for the great panel I missed the first
part sorry for that um I I noticed that
we're talking mostly about the business
side how big Tech instrumentalizes
privacy to expand its infrastructural
power I have the feeling that we we are
sort of not looking at the governmental
side of it and specifically I'm looking
at like upcoming regulations and IDs
around electronic identity digital Euro
where basically the same kind of like
infrastructural Dimension takes place
and where government creates a
similar expands its power I feel um does
the panel have any ideas or comments on
that and also does the panel have any
ideas on and this is coming back to what
Ena was saying what what can we do how
can
we especially help these policy makers
in making better decisions in that
respect uh my question relates more to
what kind of conclusions we should draw
when um we apply um what we learn here
um so I want to give an example from
practice I helped a couple of friends of
mine who um wanted to unionize the
delivery drivers of food delivery apps
during the pandemic in my home city of
Vienna and they ran into quite a bit of
difficulties because somehow their
employers always knew where they were
and when when they met and they were
unexpectedly fired from their
positions uh just because they hung out
in their spare
time um so uh they went to switching
phones and leaving their phones at home
when they were off off the job and
meeting and
using apps like Telegram and stuff to
communicate with each
other and um
of course they shifted dependencies to
like like you describe today like they
they took conscious steps to become more
private but they shifted dependencies to
other tech companies whoever you know
like um so but when I listen to you like
the when we get when we lift it to the
policy level it becomes very
frustratingly slow right because uh uh
the landscape changes so fast and um we
still waiting for regulations so do you
have advice on like uh the like the
technical level or like practical steps
that activists can take in order to
improve their situation be because I'm
I'm all with you that uh on the on the
policy side we should take care and pay
attention into not allowing
infrastructure to monopolize in private
hands okay but uh apart from that what
else can we do thank you
if I can have an additional question on
that one yes uh because I was thinking
uh uh when you mentioned all the the
control and The Internet of Things world
that's going to be mized by the big Tech
so we have all the digital acts out
there in Europe that a lot of them try
to organize that and try to uh minimize
that that negative uh impact any ideas
on will it work or
not okay so the upang think I mean he
said 15 minutes okay so to go about how
we're going to do with the eidas and all
of this um so may whatas is uh eidas
is the the electronic digital identity
regulation so to me there is a a lot of
conflict in there because privacy in
there cannot really help with a lot of
purpose limitation and kind of
limitation of this infrastructure which
indeed doesn't matter how much privacy
we put in it still makes a shift of
power because now it will create the
need to have an ID that I can only give
to you I will only give you the
attributes I want when I want them based
on the criteria of I decide on my
government and will accentuate this
difference of power and there is no
privacy that can help I think it's a
good a good example of this so again I
think that maybe changing and and this
discourse is going to be very hard to
change because it's not something that
the main public are going to feel
affected by because the main public does
will have the attributes they want right
so how do we make that and how do we
make this difference I think I think
that one is very hard I have been
thinking now for a lot of months uh yeah
in the fight with the IAS and what we do
and where to position ourselves or
myself as I can make it more privacy we
can we have technology to make it very
good but is that a good idea because
maybe then we're just kind of
legitimizing a tool that shouldn't exist
I don't have a good answer I think that
a very important thing is to make this
more vocal these ideas again shift the
discussion from privacy is good to is
the technology good will it help our
democracy how does it help who does it
help and the what I find the very hard
part is how to get journalists to pick
on this because they want to just ask me
can you track people on the internet
with the ID I like yeah dude this not
important I mean this is important yeah
sure but there are so many things behind
and and I find I think that can be one
of the main tools um also from my
experience in the tracing apps a lot of
it came from public opinion at the end
of the day politicians need to be
reelected so kind of getting this
information back to the public so that
they feel it and they have an opinion I
think is one of the main tools we have I
don't know how to do it so if you have
ideas about that um for the other
question about how do we help activists
I think this is a very different kind of
story right with um did you get more
dependent on these Technologies well it
is true that the big Tech Giants are
going to decide whether telegram or
signal can live on their platforms but
messenger apps are actually one of the
few things where we still have quite
some autonomy to to decide how and when
things things exist now most of them are
quite commercial and they need to live
through commercial things so they're not
going to be as protective for activists
as we want maybe we should have need a
messenger for activist my group actually
started to work with some teams about
this what is different about what they
would like signal is doing pretty good
job in some of those things but yeah
that is nothing that will prevent you
from needing a second phone right um I
don't know how to solve that problem
that is the thing that you're going to
do but I think that these these two
topics kind of are are a bit unrelated
in a way of how do we help that case and
I think that the main thing again is
about information how do we help
activist how do we help people to
understand the dangers of the phone
earlier before they get fired and that's
again I'm very happy to talk offline I
don't want to take the phone more time
about how do we do that and for your
question I have no idea
what you um maybe just about the policy
question um slow policy uh um I think um
at some point like our Frameworks should
I mean we should look for other
Frameworks because right now we
introduce infrastructural power which I
think isn't in policies yet like they
usually think about Network effects
those kinds of the standard economic
understandings that are that get
inscribed in law right um but then if
for example um there's a lot of concern
about data and policing data flows but
then if you look at the sidewalk case
then you ask like should now should we
now think about purpose limitation for
devices and not only data that that
passes through them because Amazon can
actually just you know update your
devices and then make it part of a
network protocol for its you know for
you know business making and opening up
to Developers to produce more services
which we haven't it's it's hard to study
the externalities of those because like
for other people they say oh good we
have more services and therefore you
know we're more productive but then um
like what is the Assumption behind that
and how does that impact privacy or
Notions of privacy is it now just
consumer facing like you know the um
when we read the news privacy always
seems to be about consumer facing stuff
and then we in now that there is
something about B2B and privacy that we
haven't discussed yet in detail and
maybe um policy makers should focus on
that because that's kind of a blind side
uh right now um yeah so like for example
there's the assumption that if consumer
data is protected if you um uh protect
the confident confidentiality and
integrity of data then they assume that
there's no harm to Consumers which is
you know maybe there's no priv privacy
harm because your data will not be
leaked but then if this data um becomes
pulled together to make new Services
maybe there are economic harms that we
are not seeing and actually in our
research group we some of the studies
are about that right like the economic
harms and not just discrimination harms
or misinformation harms like there are
other harms that reside not only in the
social sphere but maybe political
economic like um how do we now set
prices for these uh Services who gets a
say as to you know whether or not these
the pricing of these Digital Services
are competitive or not we don't have
tools for that actually in economics so
yeah mean things to think
about I just add that uh with the
question about all these acts uh so one
of the acts I've worked on more is the
AI regulation and the key question
always comes up is the regulations is
written in a way way where the solution
is always technical right technology
will save you right like detect bias
mitigate bias if the state of the art is
not good enough you're still fulfilling
and you're fine with the
regulation right the Assumption being
that what is going on should still keep
going
on but we'll do all these checks and the
regulations just to make sure that
you're tiing the box and you're like
okay great we've done it State
of-the-art doesn't prevent bias because
well it's not only a technical problem
so it's okay you keep continuing keep
continuing using it and so that's in
some sense a place where we need to
rethink from a policy space right or get
this into the people who are writing the
policies that just because we do the
stick boxes that doesn't change
sometimes you need to really think
harder about the business models and all
of this and all the combinations of
these things not individual components
right so that's probably one place where
I'll think we should be it's doesn't
directly answer your question but that's
the way I would be thinking about
it um as you go with the microphone I'll
just quickly pick up on the activist um
one of the things we've been trying to
do is to work with activists and
communities to ask them about their
experience of infrastructural power
instead of asking about the typical you
know um fairness or privacy or whatever
the um the highlights have been in the
past also in digital right spaces and
it's really fascinating I think um in
some of our work we make this kind of
provocative thing where we say okay
these companies these competition
infrastructures are controlled
environments that are being optimized
where the laborers are actually uh
collateral damage right so they're not
necessarily in the old kind of taoris
mode of optimizing workers as much as
they're optimizing their environment and
within that labor gets squeezed so how
can we mobilize labor not to just ask
for labor to be considered better in an
environment that is continuously going
to be optimized and squeeze them anyways
to having them read the environment for
us so that we can understand
infrastructural power and where we can
push back on it and so that's a very
different question we've been doing some
of this work with the institute for
technology and the public interest and
it's really fascinating if you switch
the question like how does your exact
your uh environment how does your
institutional relationship how do your
um so to say everyday life change as a
result of this digitalization and the
infrastructure we get very different
answers than privacy and surveillance
just as a tip
okay um yeah so I also wanted to add
that I think that uh big Tech often uses
privacy and safety as a lobbying talking
point we saw it for instance during the
digital markets act that Apple was going
around basically saying that if we do
open up the app store or the mobile
operating system that basically yeah all
hell will break loose and we cannot
protect you anymore and they did
actually get that as a win there is a
softening of the um final rule because
of that um but I think that basically
where we are coming to is that we have
to address power and if we don't
actually destroy the power that these
companies have over specific markets we
will continuously be trying to catch up
and trying to protect our rights in very
limited ways and actually protect
democracy as well um so I think we've
already you've already mentioned that we
have to align the Privacy activists with
the antitrust
activists um but maybe I would like you
to comment a little bit more of what the
scope or the possibility is in the
antitrust and maybe also wanted to ask
what do you think um about also indust
industrial policy whether we don't
actually also have to build the
Alternatives and build some Public
Utilities that are actually more
democratically controlled and that could
get us off the dependency of for
instance the
cloud can we get more questions because
we have now five minutes we have one
person here
thanks thank
you thank you oh well thank you for a
great
panel um yeah sort of my question
relates to some of the questions before
and and you've elaborated a bit already
and especially corin's question of
theories of change like in the face of
this massive complicity of governments
in the issues you described there seems
to be little hope in the law at all uh
to to to really structurally change any
of this um you mentioned indeed carela
awareness raising uh I guess more work
and research on like
exposing uh these issues
properly um I was wondering what role
there is for uh for sabotage perhaps and
I was thinking also of of seda's work on
pots like is there any uh I don't know
if she's hearing me if there's any uh
follow up on the work you've been doing
Seda on on pots
uh to to challenge uh these these issues
that you're talking about and perhaps
applied in the in the specific case
studies I'm not sure is working um hi
Mark from Article 19 it's it's very
refreshing to hear economics Market
power mentioned within the confines of
these events and I actually just wanted
to give a shout out to report that SoMo
who Margarita works for she just spoke
there on Amazon on Independent Sellers
and Market power so as an introduction
to the power that Amazon has with
vertically and horizontally it's an
excellent report and and I recommend it
to everything or to everyone I should
say and that's my statement rather than
my
question
thank you SIM from Patrick uh so it
seems that many of the issues related to
pets that we have discussed uh have a
societal aspect more or equal to the
individual aspect but it seems that we
we kind of lack a legal and practical
framework for recognize these harms and
address them
um data protection and privacy have
tended to have a individual individual
individualist Focus sorry while
competition perhaps the other side is
more societally focused so do we have
any way of addressing these quote
unquote societal harms that we have been
discussing other than through antitrust
competition law and should we develop
one if at
all I think one of the
root problems here is the lack of
control over our personal devices so it
used to be called a personal computer
and I think you know need Astic
conversation anymore but it ties it
relates to multiple things so we are
speaking about uh antitrust and
competition law but I have a very basic
understanding of it I'll start with that
but uh as far as I know you have to
define a market and Define where you
want to intervene right and with the
sidewalk example I think maybe they were
inventing something new so not sure if
you could catch up with competition law
so you would have to then like Donald
said before up with new Frameworks so
how do you how do you assess that
something is wrong in your opinion and
can you maybe tie that to the lack of
personal control so sidewalk relies on
being crowdsourced which was on upt out
basis maybe there is something you can
interview there and then not saying that
upt out is harmful from a data
protection perspective but more from
having control over your device General
and I think we're limited for time so
I'll stick with that we have two minutes
um so on see thing maybe trying to
address your question I'm not very sure
that I can so the idea of do can we
build an alternative so my experience if
there are kind of two ways of bitting
like kind of the things that are common
in the contact tracing apps we did that
by actually providing an alternative
right and that was the win because we
could say okay we can get the benefits
without the harms and that worked in the
case of chat control what we actually
did was push on chat control has no
benefits so the harms overweight right
so these are the kind of two ways and
it's not because it's not always
possible to actually build the
alternative and indeed it would be very
interesting to think about how good an
alternative that is acceptable look like
in the case of chat control there is
none right and it took a while to
actually find and and there was a lot of
work with edri actually on how do we
kind of bring technical expertise which
typically what we do is solve it via
technology to actually use the technical
expertise in the other way around and
said technical expertise is this does
not work and I think this is very
important for what um this Tech
solutionism that comes in the law
nowadays and maybe also helps with the
EAS fight in a way which is how can we
show that it doesn't work and the here
there is this should to me it is very
interesting what Civil Society links
with Academia to help
Academia with which problems to solve
like with this old bias like sometimes
we don't know how to actually make the
technical argument that bias solving
does not work and then we can have this
long-termism of all of these things so
we will solve it in the future because
there will be somebody in MIT that will
come up with a great solution some
solutions do not exist Academia is very
bad at accepting this but it happens
right but a lot of it actually requires
combination and collaboration with
stakeholders that can tell you what is
the thing that you need to demonstrate
doesn't work and that right is something
that we don't have this communication
between many times Civil Society in
Academia and that doesn't help Academia
become J Li and I think that again chat
control was a very good example and some
others very good examples
of when we cannot produce an alternative
how do we show that what is existing
actually is not doing the job and
therefore should not exist I don't know
if that helps or not and yeah I don't
know anything about
antitrust um I'm just thinking that
framing
the answers are non answers in a way
that different stakeholders understand
that is probably one way we could do a
lot of things so thinking about
industrial uh policies or antitrust or
whatever often the language is quite
different from how we speak in the
digital rights environment right so uh
there are certain overlaps so for
instance we talk about choices in both
sides but what we mean is sometimes
slightly different um so that is
probably one place where you can go and
needs a lot of effort from our end but I
think that's one um the second
is with industrial policies I don't
necessarily see it completely as a
garment thing like a lot of the
industrial policies we are seeing these
days are in some sense driven by
specific industry motivations which
governments take up and So-Cal put it
into policies and then the
implementation again goes back to the
same industry stakeholders right think
about what is it called Gaia X or
whatever they were called and they were
supposed to be the alternative for the
Amazon and Microsoft and wait who's
running
it so I think it's the chain of events
whether it be within specific Industries
so thinking about browsers and different
vendors but also the different
advertisers are small players um so and
CA mentioned just because you don't use
Chrome if you don't think about it it'll
just trickle down into other browsers
the other aspect the reason primarily is
also that otherwise these browses will
become
non-existent right because if all the uh
companies on the other end are serving
their websites only for your Chrome
imagine folks who used to use the the
browsers in 1990s this websites Works
only with Internet Explorer if you use
any other websites this website will not
work right you may not get that message
explicitly but that's L will happen open
it on Brave or Firefox the website will
break so you you'll just be forced into
other options so that's that's yeah
that's that okay I'm going to use my
last words to say industrial policy is a
new low interest rate uh okay so if you
know what that means millions and
billions are going into investment and
infrastructure right now it's done under
the heading of climate change and uh and
what have you and a lot of that money is
going to be channeled to Tech right uh
and so I think there's a lot of activism
to be done on watching that money and
working against it even though it says
it's for climate it might go for Tech
thank you everyone have a great lunch
see you
[Music]
around