welcome back
uh we're now joined by sam
to uh get us all to get radical
uh sam works at the intersection of
feminism human rights and technology
she's currently program lead for digital
rights watch and a privacy and
technology specialist with salinger
privacy
with experience across the public
private and not-for-profit sectors and a
background in both politics and data
science
sam thinks an interdisciplinary approach
to privacy is vital
as former privacy director sorry as
former program director for code like a
girl sam is dedicated to ethics of
technology in all its forms from gender
equity in the tech industry to upholding
privacy in increasingly surveillance
obsessed world
sam is also going to use all the time
because it's just so much amazing
information to cram in
so if you have any questions please make
a note of them and ask them in the
hallway track after the talk
take it away sam
awesome thanks so much
i'm just gonna take these out okay
so hi um thanks so much for having me um
and i'm so thrilled to be here so i want
to thank you to pycon and in particular
to snake oil academy for
for creating this space where we can
really nerd out about privacy and
security it's it's um it's a really
special thing to to have and to be able
to participate in so
as this slide suggests
i'm going to be talking about privacy as
a collective issue
so this is one of my favorite topics and
i'm really excited to have you here and
to bring you along on this
journey
so
as far as i see it
as governments and companies continue to
use technology to meet their thirst for
surveillance protecting privacy is one
of the key ways that we can push back
and i think that's really really cool
and i hope that by the end of this talk
you think so too
and if you already feel that way i hope
that i leave you feeling energized and
excited to embed really good privacy
practices and protections into any
projects that you might work on in the
future
as we'll get into a little bit later i
think that using privacy as a tool can
mean so much more than just meeting our
compliance requirements
it can also help shape the kind of
technology that we build and in turn
that the world that we create
so i am coming at you from the stolen
lands of the rwandari wararang people of
the eastern kulin nation
i want to acknowledge uh the sovereignty
of these lands was never seeded and pay
my respects to elders past present and
emerging and to any first nations people
who might be here today thank you so
much for being here
i also want to highlight that a lot of
what i'm going to talk about today is
about surveillance and i think it's
really important that we keep in mind
that surveillance has intrinsic
connections with colonization and
colonial policing
and this was and continues to be about
policing race and class
we need to remember
throughout this talk and whenever we
think about privacy that aboriginal and
torres strait islander peoples continue
to be
disproportionately surveillance
surveilled and
policed i'm also going to talk a bit
about this idea of extractivism this you
know obsession with collection and
evermore collecting data and personal
information
this too is a concept that is rooted in
white supremacy and capitalism and
colonization
so
we should never forget that and i think
throughout this talk it's good to keep
that context in mind
so today's talk is essentially my love
letter to privacy
privacy isn't a perfect tool it can't
solve all of the problems in fact
sometimes it can cause problems it can
be a double-edged sword but i think it's
absolutely essential if we want to build
technology that fosters the kind of
future that we want one that is free and
fair and sustainable and one that
respects people and communities rather
than exploiting and policing them
i am of course making a few assumptions
here i mean maybe you want the kind of
future
you know depicted in some dystopian
sci-fi novel where there is no privacy
um and you know everyone knows
everything about everyone at all times
um
but i you know i think that you being
here indicates that you
you know
really wants to create a better world
and believe that technology can be a
really important way to to
propel that i mean i certainly do
but
at the same time if we can agree that
the current trajectory that we're on one
which relies on
mass data collection and surveillance
that if we can agree that this causes
immense harm both when it's done by
governments as part of a broader
surveillance and policing agenda
or when it's done by companies as part
of surveillance capitalism
if we can agree that this is causing
harm then privacy is one of the key ways
that we can push back
but we can't push back in any kind of
meaningful way if we fixate on privacy
as an individual issue we need to see it
as a collective one
so my goal is to get you all thinking
about privacy maybe in a different way
than you have before or maybe not
what i ideally want is that you leave
this talk feeling emboldened about
privacy and and you know really want to
incorporate it into your work
rather than it being you know a burden
or something that's limiting or you know
the worst just a compliance tick box
exercise
so
here's what i have planned um
so let's just just dig let's just dig in
so we've reached the dreaded portion of
any talk on privacy where the speaker
tries to define it and the reason it's
dreaded is because
it's just such
a notoriously difficult concept to
define
and i think that this is one of the
problems that we face is that in any
discussion about privacy we're using one
word to try to describe all different
kinds of concepts and
theories and
essentially approaches to information
management
so when people talk about privacy it
could really be in reference to any or
even many of these words and others
and i think we can agree that this is a
massive undertaking for one word
so
looking here we've got you know pick out
a few the to be led alone that's kind of
the classic definition this idea that we
should be free from interference
control to be able to exercise control
about you know where our personal
information goes and who gets it and
what happens and this is also tied up in
ideas of consent and choice
um
self-determination dignity you know
being able to develop one's personhood
and personality
secrecy is a uh in my opinion a
problematic one
uh privacy and secrecy often get kind of
used interchangeably and i think it's
honestly in my opinion one of the least
nuanced and most problematic um ways to
think about privacy
uh
bell hooks who is a renowned social
activist and feminist once said
open honest truth-telling individuals
value privacy we all need spaces where
we can be alone with our thoughts and
feelings where we can experience healthy
psychological autonomy and choose to
share what we want to
keeping secrets is usually about power
about hiding and concealing information
and when we think about it like this i
would say that the government is way
more interested in secrecy than we are
as a collective
um intimacy is an interesting one
because it starts to like
play in the space of privacy being able
to expand and contract to be able to let
people in so it's not just an individual
thing it's something that we can welcome
others into
and of course anonymity which is not
only really hard to say but is also i
think worth paying a little bit more
attention to because
privacy and anonymity often get
conflated and in my experience working
as a privacy consultant this is often
where people fall down
so anonymity generally refers to when
information is
information or actions or whatever is
kept separate from our name or other
identifying features
but anonymity is also really fragile
it's really not that challenging to
identify someone using only a few data
points so this was shown way back in
2000 by latanya sweeney in
in the us who showed that 87 of
americans could be uniquely identified
by just their zip code gender and date
of birth
more recently i'm sure many of you are
probably aware of the work that vanessa
teague and ben rubenstein and chris
colnaine have done at the university of
melbourne where they exposed just how
simple it was to re-identify individuals
from de-identified data
and the protection offered by an
anonymity is really minimal when it
comes to something like surveillance
capitalism because frankly companies
don't really care about our identity as
much as they care about our profile
and so this is where people sort of fall
into this trap that i mentioned they you
know in the process of
designing um an initiative or a project
they'll they'll say something to me like
well
we don't actually
know who they are we don't collect their
name so it's not invading privacy
but the trouble is is that you can cause
all kinds of harm to people without ever
actually knowing who they are and this
can still be an invasion of privacy
so targeted marketing and behavioral
advertising is
is an example of this of using what is
called individuation so this means that
you know the company may not know
who i am they may not know my name is
sam but they know my social and
political and economic preferences which
is determined by the data that has been
collected about me and the inferences
that they've made based on that data
they use this to create essentially an
abstract identity which is then in turn
used to influence me to offer me highly
personalized advertising or messaging
which is really just a fancy form of
manipulation
and because all of this happens behind
the scenes generally without people ever
really knowing about it it curtails our
ability to control
the information that's out there about
us
these kinds of companies and data
brokers
you know they're not interested in who i
am as a person they're interested in me
as an entity that emits data that they
can vacuum up they're interested in me
as someone who buys things and someone
who can be influenced to buy more things
and when you start thinking about this
kind of power to influence
and how this can be used in areas other
than in in you know commercial and
retail spaces that's when it starts
getting particularly scary because
there's quite a difference between being
influenced by a pair of shoes for
example
compared with being influenced to
believe a certain political ideology or
to be influenced to be led to believe
particular kinds of health
information or misinformation
or to vote for a particular politician
but the underlying approach is the same
so anonymity
while essential in lots of respects can
create a bit of a false sense of privacy
and so one thing is clear is that
there's so much going on here this is
this is so much happening and this is
one of the troubles as i mentioned this
wobbly non-fixed social construct that
we call privacy that morphs and changes
and shifts and evolves over time is
really wobbly
and one of the questions that i think we
need to think about is you know should
we narrow this down should we try to
just focus in on one particular aspect
of it that could be more
regular regular regular
regulatorable
more easily regulated or
should we take a more expansive view and
this offers lots of different
opportunities but also makes it kind of
hard to grapple with
um i think as you'll see i i lean
towards expansive but
you know that is certainly a question to
to think about
so i think it's worth having a look at
some history to contextualize what i
mean by privacy as a collective issue
there's plenty to dig into in ancient
history of idea about ideas of privacy
and the personal and the political
but
i think that's going a little bit too
far back for our um purposes so less to
say that the concept of privacy has been
around for a really long time
but the idea of the right to privacy
started to emerge in the late 1800s
particularly when american lawyers
samuel warren and louis brandeis wrote a
famous article on the right privacy
which they described as the right to be
let alone so it was closely tied up in
this idea of private property and
ownership
and then fast forward to the 1960s and
alan weston published privacy and
freedom where he described the right to
privacy in terms of self-determination
and
personal autonomy
and obviously there are lots more things
along the way in this path but the point
that i want to get to is that
all of these ideas are really focused in
on privacy
being seen as an individual issue
and along the way
it has really formed this association
with privacy and libertarianism
of course
so libertarianism as a refresher is a
political philosophy which holds as the
name suggests
liberty as a core principle
libertarians seek to maximize autonomy
political freedom they emphasize freedom
of association freedom of choice and
individualism
and libertarians are generally really
skeptical of authority and state power
so there's lots of good things in there
and you know it's like it sounds okay
when you put it like that
but of course as with any ideology there
are many schools of thought under the
one umbrella and while libertarianism
does have a history of association with
the left
over the last you know century or so
it's really become very strongly
associated with more right-wing politics
with ideas of conservatism and free
market capitalism and an emphasis on
property rights and ownership
and in my opinion where it falls down is
that it centres the individual to a
fault overlooking our collective
interests intersectionality or the needs
and experiences of marginalized groups
so privacy for a really long time has
kind of hung out in this libertarian
club and that's not necessarily a bad
thing but it's not the only way that we
can think about privacy
and personally i think that if we want
to leverage privacy as a way to
facilitate more positive social change
we need to be thinking about it as a
collective issue
so that means instead of focusing on me
and my data and my right to be let alone
we frame privacy as a collective social
good
worthy of protection not just to protect
ourselves as individuals but to protect
and empower communities
and when you think about it
the whole argument of like well i've got
nothing to hide so i've got nothing to
fear
that is squarely caught up in
individualism
it's not always about you as an
individual because loss of privacy
impacts all of us
so thankfully we're starting to see a
shift in the way that we uh hear about
privacy being spoken about about it
being framed as a public good
so shashana zabov in the age of
capitalism said that the belief that
privacy is private is the most
treacherous hallucination of them all
and that's because
the impact of losing privacy is shared
so there's a number of ways that this
can happen um so you know perhaps the
easiest place to start is this sense
that
your privacy will be impacted by the
choices of actions
choices or actions of those around you
so for example you might decide not to
be on social media to protect your
privacy but that doesn't prevent other
people from sharing information about
you it also doesn't prevent the
platforms from
tracking you around around the internet
another example is with the increased
use of machine learning so just by
merely sharing characteristics with
people who may or may not have willingly
shared their data can result in you
being impacted by inferences or
decisions that's made on that data so
that data wasn't collected about you is
collect about other people who are
similar to you
but then this can play out in things
like
applications for home loans insurance or
even applying for work
and then of course possibly the biggest
issue of all is the invasions or loss of
privacy can have societal level impacts
so if we take cambridge analytica as an
example
this shows that when privacy is
threatened our democratic processes can
falter
and so all of this suggests that privacy
is a collective
networked good
rather than purely individualistic
okay so lots of talk of privacy often
focuses on it as a state of being as
something that we have
you know we have it i have privacy or i
don't have privacy it also gets very
caught up in um
you know theory and philosophy which you
know we've already we've done we've done
that portion of the talk
but i think that there is value in
considering considering privacy and the
act of upholding it as something more
active as a tool that we can use
so we all know that governments and
companies are busy accumulating masses
of data including our personal
information and as they do this the
existing power imbalances between them
and us grows larger
and as more and more of our lives are
online you know our personal life dating
health work
accessing essential government services
all of these aspects of our lives are
becoming integrated with digital
technology
and as this is happening the power
shifts towards those who control the
technological systems and those who
collect and hold the data
so alongside this is this sense that
digital technology is you know treated
like a force of nature it is inevitable
and unstoppable
and we as individuals and communities we
are treated as objects that technology
happens to
rather than active participants with
agency who you know have a desire to
shape the technology and the future
so i think that we can use privacy as a
tool
and as a way to examine and interrogate
information flows which is in turn a
good method for examining power
structures
so if we imagine these structures as
something that relies on like a complex
framework of information gathering and
sharing i like to imagine like a
construction of pipes pumping data
around sucking it out of individuals and
communities and pumping it towards
governments and companies
so if we look at it this way protecting
privacy can be used as a tool to to look
at these structures the pipes and to
renegotiate the bounds of where the
pipes go and what data flows through
them
and by prioritizing privacy protections
we can redistribute this power in i hope
a more distributed way
and
as such upholding privacy can be an act
of resistance
digital surveillance is highly efficient
as a way to enforce social order it
makes us conform it helps create a
culture of compliance and it generates
social consequences for any behavior
that deviates from the norm
protecting privacy is one way that we
can resist this
upholding privacy enables us to take
some power back it enables us to see how
governments and companies are using our
personal information for their own
profit or agenda
and to say no
to be able to maintain a level of
autonomy and dignity in a world where
increasingly everything is noble and
traceable
so many people
lament the end of privacy like ah
privacy is dead why bother
why resist you know
but it's not
at least i don't think it is it's not
dead in fact the ongoing moves to
undermine it by governments and
companies just goes to show how much it
isn't dead and how much it threatens
them
so this tweet from um eva galperin was
at the same time that the
pegasus project came to light which was
a coordinated surveillance effort
between international law enforcement
agencies and i think that it rings
really true
we
really cannot succumb to privacy
fatalism because that is exactly what
would benefit governments and companies
who want us to give up on it and to
allow them to continue to exploit the
information that they have
protecting your privacy is how we resist
privacy is also an essential component
to any political movement any organizing
any attempt to challenge the status quo
so in this sense protecting privacy is
both an act of resistance in and of
itself
as well as a tool to enable
organizations and communities to push
for important social progression
if you just think about any social
movement any you know any progression
that we've had over the past
you know century
would any of that have been possible if
they didn't have the ability to retain
some level of privacy
you know
we know that
governments do not appreciate people who
are trying to challenge the power
structures of the status quo it's no
coincidence it's no coincidence that
activists are some of the most heavily
surveilled among us
so protecting privacy is how we ensure
that we maintain a healthy amount of
political engagement and pressure
and not only that
but the right to privacy can enable
other rights and freedoms for example
did you know that the right to privacy
is the reason that the us supreme court
decided that prohibiting access to
abortion and contraception was
unconstitutional
a pivotal moment in history of
reproductive rights was achieved based
on the notion of privacy
and while there certainly is debate
about whether or not that was the right
you know um rationale behind the
decision it does go to show that the
right to privacy can really pave the way
for social progression
and this brings me to my next point the
privacy can be a way to facilitate into
intersectional harm reduction
it should go without saying that you
know harms caused by loss or invasion of
privacy or privacy breaches they don't
impact everyone equally
systems of oppression are increasingly
enabled by technologies using
such as things like
facial recognition technology or
automated decision making machine
learning
and all of these require immense amounts
of personal information in order to
function
and what we're seeing at the moment is
an exacerbation of inequality amplified
by technology which is fueled by
invasive and extractive data practices
so upholding privacy by limiting the
collection
use and storage and sharing of personal
information is a vital part of reducing
harm across intersections
so let's look at a couple of examples
just to sort of wrap a head around this
so
you know women have been policed and
observed for centuries until very
recently they were considered not to
have any privacy at all when it comes to
sexual
propriety
sex workers continue to be policed and
surveilled more than
most groups online and when their
privacy is invaded it's generally not
taken seriously by those in power
and privacy has played a really big role
in the history of lgbtq plus rights
you remember how i mentioned that
privacy helped uh in the the fight for
reproductive rights well that same
argument was then later used to
decriminalize homosexual homosexuality
in the us as well
but it's not all good you know privacy
invasive laws and policies have also
been used to oppress and stigmatize
people based on their sexuality and
their gender expression for decades
so as i mentioned at the very beginning
surveillance and colonization go hand in
hand pictured here is my friend kat who
highlighted in a discussion about facial
recognition technology that if we want a
future in which aboriginal and torres
strait islander peoples are not
overrepresented in prisons
then this is incompatible this reality
is incompatible with rampant
surveillance
so strong privacy protections is not
only a way to i mean it's not the only
way to stop this from happening there's
lots of factors at play here but it is a
key ingredient in reducing harm caused
by over-policing which relies on
surveillance
so when we consider privacy as a
collective issue rather than just an
individual one we can start to see how
the impacts are so much bigger than just
me and my data and it means we can start
to use it as a tool to push back to
protect communities and to look after
one another and i think in turn to
create a more equitable future
but
all of this is not without its tensions
and a little content note i'm about to
just mention um
some gendered violence just just a
little heads up if you want to if that's
not for you today you can jump out
um
so i mentioned right at the beginning
that
uh privacy can be a double-edged sword
and i think a prime example of that is
in the realm of gendered and family
violence so for a long time privacy was
weaponized against women and gender
diverse folks as a cover for widespread
widespread abuse and violence you know
keeping things behind closed doors
but now as we're seeing a shift towards
how we think about privacy and also
shift in terms of our gender politics
and our understanding
you know modern ideas of privacy are
certainly not a call to go back to be
hiding abusive
behavior from view
and so
what makes things a little bit more
complicated as well is that privacy is
absolutely vital for for many victim
survivors and their protection so
privacy like many things can be
weaponized if we let it that can be a
you know a tool for progression on the
on the flip side so we need a liberating
rather than a restrictive view of
privacy
so in net privacy sasha molotoris says
that privacy has the potential to be
both liberating and stifling and the
challenge is to conceptualize more
clearly a positive privacy that is we
want a privacy that affords liberty
instead of confinement we want a privacy
in service of equity and i really i just
think that nails that just nails it on
the head
so we're getting towards the end now so
let's just quickly reflect on some of
the kinds of uh values that are
currently embedded in privacy invasive
approaches
so currently there's this huge focus on
extractivism as i said before at the
beginning you know this need to collect
everything to mine and extract and
exploit and profit
this clearly aligns with how you know
the environment is being exploited as
well
if data is the new oil then we are
fracking people for their personal
information
it's also grounded in policing in
watching and being watched and treating
everyone as a possible suspect
incarceral and punitive approaches
and there is a complete lack of respect
for boundaries
um you know privacy invasive technology
just storms in forces consent takes your
personal information influences you and
then tells you it tells you that you
consented to it all
so there's nothing inevitable about this
we can change the way that things are
going and you guessed it i think that
upholding privacy is a collective issue
is the way to get there
so i've got some quotes here from adrian
murray brown who is a writer and
activist who i admire and she really
emphasizes this idea of
imagining and being creative about how
the how we want to build futures
so what might the world look like where
privacy was recognized and respected and
upheld as a collective good
would we be able to think more radically
about the possibilities of technology to
build things that would not be for the
purpose of selling things but to enrich
and uplift the collective well-being
would we be able to reject this idea
that we must trade our privacy for
safety convenience and connection
so to wrap up i want to leave you to
consider not just how we might use
privacy as a tool to push back against
current power imbalances
but how we might use privacy
and perceive privacy as a guiding
principle towards creating better
structures altogether based on something
that isn't centered on extractivism
policing and control
i don't want to you know just build more
walls with privacy to be a blocker to
say no to technological innovation
rather i want privacy to be seen as a
collective good to help us imagine new
ways of thinking about tech and data and
how we can shape it to build a better
future for all of us
thank you so much for listening and
paying attention
thank you so much it was so good there
are some really cool chats going on as
well so i'm trying not to be totally off
camera
it's really good if you guys have any
questions please jump into the hallway
afterwards
and we'll be back in about 15 minutes
with our next talk
you