End-to-End Encrypted Photo Sharing: How Cryptee Balances Privacy, Abuse Prevention, and Legal Risk

End-to-end encrypted file sharing may sound simple, but for Cryptee, it took five years to ship. In this interview, Henry sits down with John Ozbay, founder and CEO of Cryptee, to talk through why: preventing CSAM, why client-side scanning doesn't work, how Cryptee's solution was designed to raise the barrier to mass spread without compromising encryption, and the broader philosophical question of where developer liability ends and moral responsibility begins.

🔗 SOURCES & LINKS
• Cryptee: https://crypt.ee
• Stop Chat Control: https://stopchatcontrol.eu
• Open Web Advocacy: https://open-web-advocacy.org
• EDRI: https://edri.org

⏱️ TIMESTAMPS
🎥 VIDEO
Watch on YouTube

🧡 SUPPORT TECHLORE
Keep Techlore Talks independent & growing: ★ Support this podcast ★

Creators and Guests

Host

Henry Fisher

Runner, artist, musician and digital rights activist. Owner of Techlore

Guest

John Ozbay

Cryptee

Editor

Tori

Techlore

What is Techlore Talks?

Techlore Talks brings you in-depth conversations with the experts at the forefront of privacy, security, and digital rights. Hosted by Henry Fisher, founder of Techlore and long-time digital rights educator, each episode features meaningful discussions with the people building, researching, and advocating for digital freedom.

From cybersecurity researchers and privacy tool developers to open-source advocates and digital rights activists—if they're shaping how we protect ourselves online, they're on this show.

Topics include: privacy tools and technologies, cybersecurity threats and defenses, open-source software, surveillance and digital rights, encryption, tech policy, and digital sovereignty.

New episodes released regularly. Subscribe and join the community at techlore.tech.

Nobody wants to talk about it.

Everyone's afraid of it.

Everyone thinks that encryption is sacred and it shouldn't be compromised.

And I 100% agree.

Hello, everybody, and welcome to Techlore Talks.

Today, I am really excited to invite back on my good friend,

John Ozbay from Cryptee, to discuss a very sensitive topic.

So I ask us all to make sure that we go into this in a proper mindset.

We're going to discuss some exciting things along the way,

like Cryptee announcing end-to-end encrypted photo sharing,

which is something they've held off on shipping for a long time.

They are an open source, end-to-end encrypted photo management and document management platform,

and they have now finally shipped sharing.

You might be wondering why that took so long for them to do, and this is overall what we talk about.

We talk about their implementation, but we also talk about their hesitation,

involving things like CSAM and other concerns they have.

We're going to talk about the legal and ethical considerations while still balancing user privacy

and some innovative solutions that John has created at Cryptee to try to balance these two things.

In this interview, we're going to talk about something quite sensitive in the privacy community,

which is the relationship between end-to-end encryption, as well as CSAM, which is child sexual abuse material.

This is something that in the past has not gone too well in our communities,

and I hope that this conversation can be a good starting point for us to really begin anew

and actually have good conversations around this.

I ask us all to be sensitive in the comments, as some people may be impacted by things like CSAM,

And this is something that I wish all of us keep in mind when we think about privacy, encryption, and the other complexities in the world.

Without further ado, let's get into the interview.

All right, I am really happy to bring back on John Ozbay from Cryptee.

John's been on here before. I'll let you properly introduce yourself in a second.

But John, we had a phone call or you texted me a few weeks ago saying that you guys had a new release at Cryptee.

And you had to do a lot of explaining to talk about the nuances of end-to-end encrypted photo sharing in context of chat control, in context of CSAM.

And I think you said, oh, let me just explain this to you in a couple sentences.

And I think it was like 10 minutes later, I was still just listening to you explain this.

But it got me thinking, this is actually a really interesting topic because this was a common discussion on our forum back in the day before it was archived of people talking about how to balance CSAM, for those who don't know, child sexual abuse material, with end-to-end encryption, if that's a real concern at all.

I know there's some takes online that that's just not really the provider's responsibility.

But you actually run an end-to-end encrypted service, and you recently just released photo sharing.

And so this was something you guys had to discuss.

And I kind of just want to start by really laying out what we discussed and why we're here.

And so I really wanted to open up this conversation as hopefully something for all of you to think about.

I don't really know what to think going into this.

I haven't made any conclusions.

So I just want to hear what John did and maybe ask questions to see how things work.

Is that a good starting point?

Yeah, that's great.

That's a great starting point.

So do you want to just quickly reintroduce yourself for those of you people who might listen to you for the first time here?

Yeah.

Sounds good, of course.

Hi, everyone.

I'm John Ozbay.

I'm the founder and CEO of a small end-to-end encrypted documents and photo storage service called Cryptee.

We've been around for a very long time now, almost eight years.

And for the longest time, we did not want to ship sharing for various legal reasons.

And we decided that now might be the perfect time.

And we've been sitting on this for almost five or six years now at this point.

So it gives me great relief to say that we're finally ready to ship sharing for your photos and your videos.

And a lot has happened over the course of the last four to five years.

And we have to keep our code base up to date so that we can one day flip that switch and enable sharing.

But finally, this week felt like the right week.

And I texted Henry saying, yo, you're never going to believe what we're about to do.

And Henry was kind enough to help me on this podcast.

And so I'm very happy and grateful.

Yeah.

So do you mind expanding?

You know, you started building this for five years ago,

and you guys have been secretly, I guess, behind the scenes maintaining it.

But what were the reasons back then, and even, I guess, as of a month ago, maybe,

why were you not shipping it?

Like, do you mind expanding on some of those reasons?

Well, so we first had a long call and chat with our legal team.

And this is, we're talking five, six years ago.

And long story short, they basically said,

there are a bunch of legal edge case scenarios

that we should be extremely careful of

if we are to do any end-to-end encrypt sharing

and distribution of content in general.

It doesn't have to be photographic content.

It could also be like documents and whatnot.

Essentially, we were just told, be extremely careful.

And when we asked for details, like, okay,

Just explain to us, run me through the scenario.

One big scenario that they flagged, especially with photos and video sharing,

and this is to put some perspective around pandemic era,

2020 and politically everything was kind of difficult in the United States

and around the world for that matter.

Our team basically said, look, there is a really strange edge case scenario.

Say, for example, someone's spreading CSAM on the internet

and they have an account with Cryptee and they shared this with five other people.

And let's say a law enforcement team from the United States catches one of the recipients

and this person gives them their key and says, here it is.

Now, the law enforcement has access to the content and they can see this content.

But in the United States, by law, including the FBI,

no one is allowed to send that key to someone else.

The only party they're allowed to send this is the National Database of Missing and Exploited Children, NCMEC.

That's the only legal party that they're allowed to send this to.

So if FBI discovers one of these recipients and this key is in their hands,

FBI legally cannot send us the key to say,

hey, we've discovered CSAM on your platform, and here's the key.

You can go verify it or something.

Can you please take this content down?

They cannot send it to us because that would constitute legally as sharing CSAM for them.

So they are not allowed to do that.

So they can't share the keys with us.

And to be honest, I don't want to have to worry about employing a content management team

that has to go through with the incredibly brittle task of having to look at the CSAM material,

CSAM content in general, to be able to say, hey, this is indeed CSAM or this is not CSAM.

And we cannot decide.

We can't be the arbiters of that decision either.

And NCMEC is basically, at least in the United States and in Northern America, the correct party to do that.

So we thought this is a problem because if they cannot share this content with us and if we can't verify because everything is end-to-end encrypted,

then how do we know that what they are asking to take down is in fact CSAM?

What if it's police brutality that someone in the United States documented and the United States legal law enforcement is saying, hey, we want you to take this down?

They have access to the recipients key, but not the sharing party's key.

And if they're asking us, hey, we need you to take this down,

we would need to somehow be able to verify this.

Otherwise, we're taking their word.

And it was a lose-lose scenario, because if we take it down

and if it's police brutality, we're effectively backing down

on our promise to do our best for reporters around the world,

to do our best for war photographers around the world.

But if we don't take it down, and if it is in fact CSAM,

then we are hosting CSAM and we're all going to go to jail.

And that's not great either.

So we thought, okay, this is a bad lose-lose scenario

that we need to think very thoroughly about

and figure out how this is going to pan out.

We don't want this to become a thing

where we are doing the wrong thing

and we're acting kind of like Silicon Valley

and sort of like releasing our code fast

and breaking things and breaking the society.

We want to do the right responsible thing and take our time.

So I thought, let's just take our time.

Fuck it.

We have nothing to lose.

We just need to do the right thing here.

And I didn't want us to unleash something onto the internet that we're not comfortable with.

And over the course of the years, what happened is, I mean, fast forward now, multiple years in,

I started going to Brussels a lot more often for various reasons,

which you've mainly discussed about in the context of Apple.

But there's also other topics like browser choice and also European digital rights and digital sovereignty.

So I ended up doing a lot of trips to Brussels and ended up talking to a lot of these regulators from the European Commission, from the European Parliament, also to civil rights organizations, to human rights organizations, to women's rights organizations.

And the more I ended up making these trips and talking to these people, the more I understood and had a better picture of what everyone is actually afraid of.

And I feel like CSAM is one of those, I don't want to say difficult topics, but one of those

thorny topics, pun intended, that nobody really wants to talk about.

And especially coming from a company like Cryptee, where we're talking about end-to-end encryption

and making sure that everyone's data stays safe.

The automatic question that a lot of people ask is, how do you make sure people don't spread

bad shit on your platform?

And they're right.

That's perfectly fair to ask.

And I thought that it's very important that someone just sits down and talks to the regulators

and talks to these human rights organizations and talks to these civil rights organizations

and psychologists and sociologists.

Just chat control especially is very, very big.

Yeah, especially chat control.

Exactly.

And chat control has been sort of like this dark cloud looming all over Europe for a very

long time now.

And thankfully, last week, we finally killed it for good, it seems.

And I thought, okay, I want to just talk to everyone, understand why they're so afraid of this particular thing, and what can we as tech companies do about it?

It was very important for me to be able to say, hey, I want to do the right thing, and I'm doing the right thing, so tell me what you're worried about, and I'm going to find an engineering solution to this problem.

Because I believe that it's not the fact that it's end-to-end encryption that scares a lot of these people, it is something else.

And the more I talked, both to the regulators and to the civil rights org, one thing became

clear is that what they're afraid of is not one person sharing CSAM with another singular

person.

What they're afraid of is mass spread of CSAM.

So if you think about sharing CSAM with one person to another, one could put it on a USB

flash drive and mail it to the other person.

There is no way to detect it, stop it.

It's effectively invisible to the law enforcement, and then someone could just do peer-to-peer sharing.

That's not the scenario that they're most afraid of, because that's already been around, and that's very difficult to prevent.

What they're worried about is people just uploading CSAM to a website, and then posting a link to the dark web with thousands of people downloading it.

That's the scenario that they want to get ahead of.

And they don't know how to address this.

The one scenario that they can keep thinking of is like, well, there's all these chat apps, there's all these social media platforms like Facebook and Google and iCloud and whatnot.

And realistically, these are the most popular vectors for CSAM to spread.

People just upload bad shit on these platforms.

And it's very easy to spread it to thousands of people.

And that's how it happens.

And so they basically said, hey, if you can build this in a responsible way where it is almost more impractical for someone to try to use Cryptee than it is for them to use any other fucking means of distributing CSAM, chances are they're not going to use Cryptee.

But you need to make sure that barrier is so fucking high that no one in their same fucking mind who wants to share CSAM would use your platform.

But anyone who wants to just share their family pictures with four or five people would do so.

And that was sort of like a awakening, oh my God, I finally understand what these people are afraid of moment.

Because up until this point, there was always this rage around the topic of encryption.

Everyone's like, no, zero compromises.

It's like, yeah, we're not going to make compromises.

We just want to do this right.

Yeah, so I feel, not to cut you off,

but I just want to make sure we dive into these things

a little bit more here.

So I think in our initial very quick call

when you were explaining things to me,

you mentioned how end-to-end encrypted services

and someone having bad content on their own platform,

let's say, that's not being shared around,

is no different than mailing a flash drive to a friend.

No one's going to be opening up the envelope.

No one's going to be analyzing what's on there,

especially if it's an encrypted flash drive.

But that's not the real concern.

The concern is, in that analogy,

the equivalent would be hosting a theater event

where hundreds of people are coming to go watch a movie.

And that's what is the worst problem

and most preventable as well.

And that is what you're saying is the issue,

is just the accessibility of the content

and whether or not you're actually building a platform

rather than, obviously both are problems.

So it would be awesome to deal with both of those issues.

But it sounds like the biggest issue is that latter one, which is.

That is correct.

Widespread, mass spread.

And essentially, to go with your analogy, like if we're talking about a theater, right, you invite 100 people, then those 100 people leave their own video copies and they get to have a 100% theater event, so to speak.

And that's what they're trying to get ahead of.

Because there is an R vector to this and you want to keep that as low as possible to prevent the spread of bad stuff on the internet.

That's the ideal scenario, at least.

So what you're saying is, yes, encryption makes it harder to moderate,

which is probably not, you know, that's not a debatable thing.

It is debatable if the moderation is, and breaking end-dead encryption is worth it,

which I think we can talk about soon here.

But the main issue you're saying is the shareability of it,

which leads me to my next question for you,

which is, you mentioned the Silicon Valley companies,

you know, Apple, Google, they all have photo providers.

They all allow sharing.

In fact, Apple does have ADP, which is end-to-end encrypted, and it still enables sharing.

You can do a public shared album on Apple.

So how are regular big tech companies handling this?

Is it still an issue on their platforms because they still have the shareability concerns,

even though they don't have the encryption for most users?

To the best of my understanding, now I can't speak for the tech companies

because I don't know how their process is behind the scenes.

But to the best of my understanding, what companies like Apple can afford to do is throw lawyers at problems.

And essentially, Apple trusts on the fact that something like 0.5% of their users probably enable advanced data protection.

And of those, we can, let's say, speculate, I don't know, 10%, 5% of it maybe actually uses it to spread CSAM, whatever.

There's probably a percentage that we don't know.

I'm making this up right now.

And they probably arrived at the conclusion that this may be a tolerable number given their multi-billion user base.

But companies like Google Photos, for example, they are not encrypted to the best of my knowledge.

Therefore, they could just scan the images as they please and essentially shut down accounts beforehand.

So they can probably use things like AI-based fingerprinting and they can use solutions like photo DNA developed by Microsoft and the NSA.

And they can use a bunch of solutions to sort of fingerprint these existing images.

but this sort of wouldn't work in the context of end-to-end encrypted sharing needless to say so i

can't comment on what the big tech companies do but they have enough legal firepower to throw at

these problems that smaller providers like us cannot do so to speak and a good example is like

apple's legal budget for the dma hearings is one billion dollars so that's just for the dma alone

And they can throw an obscene amount of money at problems.

And I think that's the solution that someone else can't do.

So that's how I see it, is that if we did this, there would be no way for us to get out of this.

If Apple does it, they will probably be able to find a very expensive solution to get out of it.

Yeah.

Can you explain maybe a little bit before we get into my next questions,

why the end-to-end encryption prevents your ability to do this?

I know you guys can't.

The whole point of end-to-end encryption is that only the account or whoever they share that account with,

whoever has the deCrypteeon keys can view the data, which you guys in theory shouldn't have because you're end-to-end encrypted.

But what about, I know Apple had the whole thing about local scanning on devices.

Theoretically, could an end-to-end encrypted service still do local scanning without compromising the end-to-end encryption?

Now, they could theoretically do that, but they would be compromising the scanning algorithm.

Now, the thing that a lot of people are afraid of, and we looked into this, just to be very clear, to understand what is it that everyone's trying to market around and what's this thing that everyone's saying, hey, we have this incredible pre-encryption scanning, whatever, magic solution that, of course, doesn't work, needless to say.

What these scanning solutions do is they've scrapped together a bunch of AI algorithms.

And essentially, they've tried combining things like age detection and nudity in the same algorithm.

So they basically try to score an image saying, hey, is there an underage person?

Is there some nudity in this?

And maybe some context like, is this a photo of a kid on a beach type of thing?

And they try to eliminate some false positives in a terrible way.

And needless to say, that's not what all CSAM is about.

And every single activism and every single human rights group and every single women's rights group and children's rights group that we talked to said, that's not what all CSAM is about.

There's a lot worse stuff than that.

And so you can't just casually detect with that.

There's gore.

There's all sorts of other things.

There's, not to get into super gory and boring details here, essentially, it just doesn't work.

You can't just do that.

And the other alternative to this is to use something like PhotoDNA developed by Microsoft and NSA, which essentially fingerprints against an existing database.

The problem with that is that their hashing algorithm for these photos need to remain private.

If you ship it in your front end, then suddenly people realize, oh, if I upload like 10 photos and do this edit and do that edit, it doesn't detect.

And you can essentially brute force your way through the hashing algorithm and it loses all effectiveness.

So in order for photo DNA to be effective, it needs to remain private.

You can't just ship it with your client.

So needless to say, we're never going to be able to ship any solution like that

or any end-to-end encrypted provider who prefers to have their code open source like we do

will never be able to do that because it effectively kills the whole point of the hashing algorithm

as someone's going to reverse engineer that and defeats the whole point.

And you can maybe ship it as a compiled version with the app somehow.

And it's still not going to work because then someone's going to capture the network traffic tomorrow and figure out what it's actually uploading.

And that's game over also.

So none of these pre-encryption scanning things that they're trying to sell, it doesn't make any sense at all.

It's just really broken in general.

How do chat apps right now kind of handle this?

I mean, so here's, you know, we always dive into this in other contexts when people ask, oh, do you like Telegram?

I say, no, I don't like Telegram because Telegram by default doesn't have any end encryption in groups or channels.

you have to opt into it for even regular DMs.

And it puts them in this really interesting position

where now you actually have to trust Telegram a lot more

than you have to trust something like Signal

because now Telegram is holding your data

and you have to trust them to respond to legal requests

and you have to trust that they're sticking to their privacy policy.

Signal, you don't really have to trust them as much

because there's only so much they can do

even if they wanted to get access to your messages.

Signal's amazing.

To the best of my understanding, they don't.

First of all, but they do things that are very similar to what we've implemented in our platform.

Well, Signal handles it by means of not storing anything.

That's a solution, right?

It's ephemeral.

You send something, Signal just forwards it to the next person, and then it's gone.

It doesn't stay on Signal's servers.

So that, because your sharing is more permanent, is actually where the problem arises, I see.

Correct, because we are the storage facility.

By law, when you're transiting something,

it's kind of like you can't keep the mail service

responsible for sending the flash drive.

They didn't know what's inside.

Because you're a photo storage provider.

Exactly, then we become liable.

So WhatsApp is a bit more liable

because they actually do store encrypted content

on their servers.

But to combat some of this,

they have recently implemented solutions

like limit the number of users

who can be in a single group.

omit the number of times an image can be forwarded, etc.

And I think that is effectively the solution,

and that's what we've arrived at also.

And I suppose this is a very long way of getting to the solutions

that we come up with to address this problem.

Before we get there, one final question here.

Because Signal recently released NDEA encrypted backups,

and WhatsApp also has backups to their own servers.

Is that not storage?

Well, it's different because your backups are not meant to be shared with someone else.

Your backups are for you.

It's the sharing aspect, basically, that becomes a problem.

So you're more liable to this problem if you're a communications provider of any sort.

It could be messaging, it could be photo sharing, whatnot.

But if you're just doing personal backups, it's no different than putting your hard drive in a storage facility in the city somewhere.

I want to touch on the solutions, and then after I want to zoom out and just ask more broadly,

The philosophical angle of this, right?

Because I feel like it's a very touchy subject.

I don't like talking about it, but I feel like it's something that's not discussed.

I don't think anyone does.

And I think that's the difficult part, is that nobody wants to talk about it.

Everyone's afraid of it.

Everyone thinks that encryption's sacred and it shouldn't be compromised.

And I 100% agree.

And that's the thing where it's like we have this inherent issue around nobody wants to talk about.

So I want to get to that and the solutions.

But last question before I dive into the solutions,

and also we talk about chat control later too.

I know you probably do have discussions with other providers

that care about privacy and security out there.

How much is this considered?

I feel like when people...

Heavily.

Yeah, when people think of Signal,

when they think of Tor,

when they think of all these services,

they just think, wow, they just built a private and secure service

and they're just rolling out new features as they're ready to build them.

But how much, you know, this isn't talked about.

No one talks about this.

So is this secretly something that every team behind the scenes is taking into consideration

when they're rolling out their services that they just don't want to talk about publicly?

I would certainly hope so.

I mean, I can at least say this.

I haven't spoken to any other founders about this particular topic in depth.

But I have spoken to some founders who had companies that were dedicated,

Like one of my really good friends who used to be my neighbor, she started an OnlyFans competitor.

And we had a very extensive two and a half hour podcast session about this and how she gets ahead of all this.

And she's an incredibly brilliant person.

And I'll send you the link if you wish to share the details of that podcast.

There's a very long, extensive conversation we had about this.

And long story short is that I think for companies that matter, they do hopefully think about it.

Within the framework of chat control,

I do know that pretty much every messenger service out there

thinks about it extensively, and it's a big concern for them.

To give you one very short personal experience,

as an example, where a couple months ago I was in Amsterdam,

and as I'm walking on the street,

and this was right on the week of the chat control vote,

I think I sent you a message when it happened to you,

but this was the week of the chat control vote,

so I was on my way to Brussels, and I was in Amsterdam.

And literally on the street, outside of a cafe, I bumped into Mary Beth Withaker, president of Signal.

And I said, like, hey, how's it going?

And we very briefly for like two minutes had a conversation.

And the entirety of those two minutes were about chat control.

That says something.

And Mary Beth was like, we got to do something about this.

And I said, yeah, we got to do something about this.

And that was the week where I was flying around like headless chicken crazy, running around trying to talk to every regulator that I can talk to.

And I told Mirabeth, and I think I told you,

I've spoken to everyone in Estonia and Finland

that I can speak to to try to get the countries

to line up as much as we could.

And thankfully Meredith was talking about that too

and she was very much concerned about that too.

And yeah, everyone was thinking about that at that time

and still is thinking about that, I think, after this week.

I want to talk, let's put a pin in that.

I want to ask you more about the regulation aspect of things

because I know a lot of people are wondering why that needs to happen.

You just do your job.

Just roll out good tech,

roll out good encryption,

and bury your head in that.

So why take all that time to go to process?

But I want to talk about that

because I think it's probably going to lead

to some interesting discussions.

Now, I want to get into your solution

and how you guys approach this

because you're not compromising

on the encryption aspect of things.

So I'm just going to assume

that it's a sharing thing.

Actually, you sent me a couple of test albums

and they expired before

because I've been ignoring you on Signal.

Because I've just been so busy this week.

I'll send them to me again.

You'll send them to me again.

You have some photos from when I was there visiting you.

So you're sharing these photos with me.

What does this look like now with the way that you're implementing this in Cryptee?

We decided that there's got to be a healthy framework that we set

to figure out what it is that we want to address first.

Let's figure out what is everyone afraid of

and what can we do to actually address these things.

And the first thing that we decided is,

we don't want this to be spread en masse.

This needs to be a solution where you can easily share it with your family,

you can share it with your client.

If you're a war photographer, you can send the photos to your editors,

to your news organization.

The idea here is to just make it so that you can very easily share

with the number of people you would want to share,

but not spread it en masse to very large numbers of people.

Now, if you want to do link sharing,

that just automatically complicates things,

because how do you verify the number of people visiting that link?

So you set it just to IP addresses?

Well, then how do you deal with people using VPN services?

What if they all use the same VPN?

Well, how do you do, like if it's like a one-time visit in that browser,

what if your client couldn't open it on their desktop,

but wants to open it on their phone or their whatever other browser and whatnot?

That's a problem.

That's not going to work.

So after going through a bunch of iterations, we thought,

okay, there's got to be a better way to do this

because we also don't want people to just have to worry about

hoarding links somewhere that they received.

And there's got to be a better way to just sort of make this more permanent and easy for people to access.

So we thought, OK, why don't we just make it so that the recipients of the links have to enter their email address.

And once they verify their email address with a one-time password, then we know for sure that only that email can access that album.

And that's it. That email is added to the recipient invitees or the recipients.

And that way we know there can be maximum five email addresses that can receive an album.

So if you have a family, that's enough.

If you have an editor, that's enough.

If you shot wedding photography and you just want to send it to the bride and groom's family,

five is enough.

Like we realized that's a very sufficient number generally.

And if you went to a party with your friends, like five is probably enough.

And please contact us if you feel that five is too small and we'll make it 10.

But basically the point is that five generally felt like a very healthy number.

And we thought email verification should be fine, right?

If you're a wedding photographer and you're sharing photos that you shot at someone's wedding,

you wouldn't mind your client adding their email there.

Or if you're sharing photos as a war photographer and you send it to New York Times,

you wouldn't mind if someone put it at newyorktimes.com email.

That's not going to change anything.

And if you share it with your friends, it's totally fine.

You already have their email address.

But if you were trying to share CSAM, as a recipient, you would probably question

what the fuck if you have to enter your email address and verify and send it to the person

sharing it how do you know if someone's not trying to bait you into something and catch you something

and this is we thought this could be a good way to actually prevent a little bit of the bad stuff

because you will have no way of knowing who the person sharing this is and maybe you're being

baited you'll have no idea so it inherently raises the bar this is the type of bar raising that i was

talking about earlier, that if we make it difficult enough for people who wish to share bad stuff on

our platform, they will simply just not do so. And they will use significantly simpler alternatives

to do so. And when they do, we reach our goal. So that's how we decided, okay, five recipients,

everyone has to verify their email address. And when you do enter your email address,

we assign a token that's valid for six hours, we assign it to your IP address,

and we assign it to that email address. And all these things happen behind the scene. And we

We try to simplify it as much as we can.

And to add to that, the sharing parties, the original source of the content, has to be a paid user.

This allows us to make sure that free users cannot just sign up and create tons of accounts and try to mass spread the content that way.

But instead allows us to limit the person who would be sharing this to one.

Or let's say two, if you happen to have two cards and you created two accounts that way.

But the idea here is that we can actually use payment methods as a means of also KYC and our customers to say, hey, we cannot see your photos, but we need to know that you are a real human and not a bot creating 1000 accounts.

If you have a payment method on file, that sort of establishes that.

We don't need to see your photos to be able to prevent bad stuff from happening.

If we can just prevent bots from signing up and sending thousands, or if we can stop you from creating thousand accounts and spreading that way.

So that's sort of the solution that we arrived to.

And also, if you're trying to spread CSAM,

the last thing you would want to do

is probably actually give your payment information

and billing information to a service.

If something goes wrong,

we can then report it to the law enforcement

and that raises the bar yet again.

So that's sort of the solution that we arrived.

It's like only five people.

There needs to be emails.

The sharing party needs to have a payment method.

And to make it even more difficult

so that you can't just post a link in the dark web

and let anyone join this thing,

links need to expire,

or at least the invites to the links need to expire after 48 hours.

So if you didn't accept the invite, I can create another link and just give it to you.

That's okay.

But that link expires again in 48 hours unless you accept it.

If you do accept it, you can continue to access it forever.

So if you think about it, you just send the link to your mom.

Your mom accepts it.

She can access the photos.

Problem solved.

Forever.

She's going to have access to that.

No problem.

But if you decide to post that link in a dark web form,

It's not going to live longer than 48 hours,

and that's sort of the point that we're trying to address here.

But the link is almost like a signal username.

It's just meant to add someone, and you can change the username afterwards,

and you're already linked at that point.

Correct, that's the idea.

And you can revoke the link at any point you want.

So say, for example, you wish to share private photos with your partner.

That's totally fine by us, right?

But let's say you broke up with your partner,

and you don't want them to have those private photos anymore.

then you should be able to very easily revoke that link and get your access back.

And we thought that the most important thing for us right now,

after having spoken to both women's rights organizations and children's rights organizations,

consent is the keyword.

As long as you're sharing your photos and videos and your consent is still there, that's good.

If you wish to revoke that link, consent is the keyword.

You should be able to revoke that link and it should be gone instantly.

So that's basically how we built this.

So that if you revoke the link, it's just gone instantly

and you can share the link again if you want to,

if this makes sense.

So this isn't for quick sharing.

I feel like people think of photo sharing

and they think, oh, I met this person at a conference

and now I'm just going to get them a link

and I'm going to share with them these 10 photos I took.

Theoretically, that could still work, but I feel like...

I mean, it's just as simple as you give them a link,

they enter their email address and that's it.

They have access to those links now.

Yeah, that's true.

Everything that happens behind the scenes that I've just described is actually...

It is pretty seamless, it seems.

It's pretty seamless.

Basically, you get a link, you just type your email address, and you have access to it.

That's it.

And the process is actually simpler than the WeTransfer's process, for context.

With WeTransfer, you have to enter your email each time you send,

and the recipient has to enter their email each time they receive.

In our case, you just have to create a link to whatever album you want,

and that's it.

The recipient just enters their email and accepts it.

Let's say someone is new, they've never used Cryptee before,

I'm at a conference, I have these 10 photos,

I give it to the person, they have to put in an email.

Is that creating a free Cryptee account, or is that just to access?

But then where do the photos go?

Because the link will expire in two days.

The link is essentially the same, but the invite expires after 48 days.

At that point, it's linked to the email,

and how do they access the photos after two days?

With the email address.

Whenever they want to access, they just do the one-time password with that email.

If you did it on your browser and then you want to do it on your phone,

you just enter your email on your phone, you get a one-time password.

Are they logging into Cryptee?

No, they're just accessing the album with a one-time password using that email.

The link has the encryption key.

So they are saving a link somewhere.

There is a link to the album.

But the invite link is separate from the actual permanent link to the album.

They're the same link.

But you said the link expires.

So the invite portion of the link expires.

Essentially, if you want, I can do a simpler explanation.

But basically, when you send a link,

let's say you receive that link,

if you don't accept invite to that link within the 48 hours,

you cannot accept invite any longer.

But after 48 hours, if you've accepted it,

you can continue to access the images from that link.

There is no separate link involved, basically.

It's the same link.

And if you already have a Cryptee account and you put in your Cryptee email, does that add it to your Cryptee account?

Not yet, but coming soon.

So basically what we're working on now is the ability to be able to simply click one button and say,

hey, I'm already logged into Cryptee, just add this to my account.

And you don't have to enter your email, we already know who you are if you're logged in.

And it's going to be as simple as literally just open in my Cryptee account and it will be permanently there.

You won't need the story link.

Whose storage is that quota being used against?

The person who shared the album.

So essentially the photos are stored in, let's say,

the photos I shared with you, they're stored in my account

and I am giving you access to those files.

That's how we're designing this.

So if I revoke it or I delete those files, they're gone.

You don't get to have a copy of it because that assumes

that I am removing the content of someone else accessing it, basically.

I see, that's cool.

That's the way we designed it.

The big thing that comes up, actually,

and this is maybe a little mini rabbit hole

that we should have to go down

before we zoom out again.

A lot of the things you brought up

don't sound very privacy-respecting,

just at first glance.

You mentioned, first off, requiring an email.

It's not just an anonymous link that anyone can access.

I understand the context.

We've been talking about CSAM and everything.

I understand that.

But payment method as well, it needs a paid account.

I guess I would ask, is it a problem?

Because you mentioned a New York Times reporter needing to put in an email.

Do you see a concern with that?

And would it make it any easier for Cryptee to potentially notice that certain accounts are tied to journalists and put you guys in greater liability?

And that could also implicate any kind of journalist on your platform if there is that kind of data.

So I'm kind of curious what the privacy implications are of everything you shared there.

So good news is that we wouldn't know who the sharing person is.

So if you have a Cryptee account, and let's say you're a war photographer, right?

we still don't know who you work for we have no clue no idea and otherwise we would have your

payment method just to be able to store your photos anyway that doesn't change anything and

as for the recipients let's say the recipient is new york times that doesn't mean i the sharing

party actually work for new york times it could be that i am just sharing photos that i took during

a protest with new york times so that they can publish it on their newspaper that doesn't mean

anything like i work for the new york times it could just be that let's say you henry went to

protest somewhere in the United States, took a bunch of videos and want to share it with a bunch

of New York news organizations. And you shared it with Wall Street Journal and New York Times and

whatnot. Doesn't mean anything. So it doesn't mean you work for those organizations and we won't know

who you work for. All we know is that one person shared another, shared an album with another

person. But we just want to make sure that there's only two persons. And the only way to ensure that

that we could come up with is using email.

Because if we use IP addresses,

again, VPNs could be a problem.

If we use only email addresses

and don't bind them to IP addresses,

then what happens is that

what if you just create one email inbox

and thousands of people just use that email inbox?

That's a problem.

So from our perspective,

if we want to prevent the spread of CSAM and MAS

while still respecting your privacy and your security

and keeping your content and to end encrypted,

this seemed like a fair compromise to say hey if the people you are who you are sharing these images

with are your family that is completely fine if they if they use their email addresses so 90 of

the users who will share the photos with their families it's good if you're a war photographer

and we had calls with various different war photographers one of which is from finland and

i'm very happy to say that he's been an avid supporter of everything that we're doing he was

in South Sudan and he went to Ukraine and he was telling us like, hey, this is how we think you

should do it. He seemed to be okay with this idea. We fact-checked it with a bunch of other war

photographers with the United States just to be on the safe side that this is not just a European

concept and maybe the Americans are more sensitive. But no, it seems that they understand and they say,

hey, look, this is completely reasonable that my editor would need to put in their email address.

If they're so concerned that we would find out, then the editor could just put in a random Gmail

address and we write it in the New York Times.

It's very simple.

If they want to use a burner email,

bind by me. The whole idea here is that

it's binded to an IP address and we know

it's one person accessing it, not multiple people.

I think the

clarification here, and actually we do the same thing

in our Plexus app,

the open source app that you can get from F-Droid.

It's how you score de-Google

apps and see which ones work so you

know before you move to a custom ROM what apps work.

But we also require an email

and pretty much

we don't care what the email is.

You can use an alias email.

It literally doesn't matter.

The whole point is that there is at least

a unique identifier to mark yourself down

so that we can prevent people from spinning up

tons of bot accounts

and then just spamming ratings onto this platform.

We have to keep the ratings legit.

It's a very different implication,

but it's kind of the same problem, actually.

Exactly.

I don't love it, but we don't have a better way

of identifying people on the internet.

So for as long as email lives,

And I hope email lives forever.

I think email is amazing.

It's interoperable.

We don't have to worry about,

oh, I want to send you an email from Gmail to Hotmail,

but sorry, they don't interoperate.

I can't email you from my Gmail to your Hotmail.

There is no such thing.

It just works across providers.

So for as long as email lives,

I think this is going to be a great solution.

And if you're very concerned about your privacy,

that, hey, I cannot share my email with you

for no fucking reason, never, ever,

then get a burner email.

Geez, if that's your threat model, you should have a burner email anyway.

I was going to ask you about aliases, because I assume privacy.com would work,

like alias cards, alias emails.

The point isn't, and this is again the same thing with Plexus on our ends,

the point isn't to try to identify people, we just need some way to verify

that 10 ratings came from one person.

So that way we know if one person is spamming, we can just shut that one down.

which I don't think we've had many problems with.

I think that system has actually prevented a lot of the issues.

I mean, look, privacy.com, as great as it is,

they also have limitations.

They stop you from creating more than five accounts

on the same platform, if I remember correctly.

So they have limitations for the exact same reasons.

They don't want their platform to be abused.

So everyone's trying to do the right thing,

and everyone's trying to put some artificial limits

to prevent abuse, and there is a lot of abuse.

So this is the best solution that we could come up with.

I don't love it.

I would have rather made it so that you can just make one link

and anyone on the other end can just access it freely.

But the world is a horrible place.

And unfortunately, there's a lot of people trying to use these types of platforms for awful things.

And I don't want to take part of it.

So the way we decided to go about it is it may not be the most privacy-sensitive way,

perhaps, if you have to give a payment method in an email.

But then if you want to store your photos on Cryptee,

and if you want to store more than the free plan, which is 100 megabytes,

you're going to have to give a payment method anyway.

And if the recipients want to receive anything, be it on WeTransfer or on WhatsApp, they're

going to have to give a phone number or an email.

And I would rather that it's an email than a phone number.

So I think it's a lot nicer.

Yeah, maybe, you know, before we zoom out a little bit here, just threat modeling in

general, I feel like this, I wasn't going to name call anybody, but I think it's quite

relevant because Proton had the recent activist who they were forced to hand over.

I don't even think it was direct.

I think it was indirect.

I think the FBI tapped on the Swiss authorities.

The Swiss authorities demanded a specific user account from Proton,

and they were able to get some basic information about their payment method,

and then sent that to the Swiss authorities, sent it to the FBI.

But of course, the headline was,

Proton just gave information to the FBI, which is willy-nilly.

But I think this is the same thing.

There was a really good article put out from Freedom of the Press about this incident,

which pretty much said, Proton is not anonymous.

Here is the actual threat model that they're accounting for.

And it talks about how Proton has never jeopardized

internet encrypted emails.

That is always something that they've stuck to.

They've never handed over email content.

But they've handed over an IP address.

They've handed over recovery email in the past.

They've handed over payment information.

These aren't things that they promise to keep safe,

but it's a threat modeling question.

And so I don't know how this ties into you.

How do you view the threat model of a Crypteee user

and what realistically a user can and cannot expect?

Because I think those are healthy expectations to set for users.

We have a lot of this documented on our security page.

I highly encourage everyone to go take a look at that.

And we have a privacy policy.

I think that is so simple that we have two chapters.

There's like one for lawyers and one for humans.

So you can go very simply read what we keep.

They're not humans.

Lawyers are not humans, trust me.

So basically you can just go read our privacy policy

and hopefully get a better idea about what we keep

and what we promise to encrypt and keep safe

and what we cannot keep encrypted.

Like we can't keep your payment name encrypted

because that's not something we keep in the first place.

That's our payment processor Stripe, for example.

So there are things, and the same goes for Proton, right?

Like they use Stripe under the hood.

So at the end of the day,

their payment processor also has to have these names.

And I know from having spoken to Andy

and we do exactly the same thing.

So if you essentially work with us or with Proton

or I think most privacy respecting services,

we essentially don't give you a real email to Stripe

and we give an alias email to Stripe if we can,

where we can and where we're able to,

unless you want like a special billing address

to receive your emails.

But the whole point here is that

that's not necessarily a vector in and of itself

where you could be identified.

And no one, this includes Proton, us, Signal, anyone, right?

We are legal entities

and we operate within the framework of law.

And there is this thing called

mutual legal assistant treaties.

And we have to obey this

if we receive an international court order legally.

And it would have to go through multiple different courts.

And that's literally the reason

why I moved to Estonia to start crypto

because it's got some of the strongest

privacy protections in place.

We do not have key disclosure laws

unlike most other European countries

like Germany has got a more sensitive situation.

No one can come to Estonia,

pass a mutual legal assistance treaty paper and say,

hey, we want your courts to issue an order to Crypteed to give us access.

And essentially, Estonia can only enforce us to say,

hey, we just need you to give the most basic,

whatever unencrypted stuff that you have access to,

and that's it because we don't hold your keys.

We cannot give anything else.

So we're in the same position as Proton, right?

If someone comes to us and says, hey, you have to legally obey this.

It's a criminal court order.

There's a criminal order issued, so we have to obey it.

And to put an indifference perspective, if someone gave you three euros a month and said,

hey, I want you to break the law for me, would you do that?

You wouldn't.

So no one's going to, neither us nor Proton nor any other company is going to break the

law for you for three euros a month.

If you're Apple, you have billions at your disposal.

Maybe you can break the law and get away with it because you can afford to pay for it.

And they do.

Same with Meta.

They just get a fine, a slap in the wrist for like five million.

and they can get away with that.

But in our case, that's not the case.

So if someone comes to us and says,

hey, we need you to give access to everything you have,

that's going to be your email address.

That's going to be your account meta information,

which is like the last time you logged in, for example,

which is something we have to keep for your security

to make sure that we can keep your account safe

or things like the IP address

so that we can make sure that

while you're logged in in the United States,

someone doesn't try to suspiciously log in

to your account from Czech Republic

that's not cool either.

Someone needs to be able to take a look at it digitally

and see, hey, this doesn't look right.

Henley normally accesses from the US.

All of a sudden, he popped in Czech Republic

and something's fishy here.

Maybe your phone is stolen.

But there needs to be a system

that can safe keep your account as well.

And these are all compromises, right?

We also want the security aspect of things.

So we tried to find a middle ground

and our promise to our users

is that your data is always encrypted.

We don't hold your keys.

you hold your keys, and we're going to do everything we can to keep your account safe.

That's the best we can do, that's the best Proton can do,

and under any law framework, under any legal framework,

that's what any company can do.

Unless you live somewhere on a pirate boat

and you just land yourself completely lawless.

I don't think you should trust them to keep your data safe.

Yeah, I'd be curious how their servers work on the ocean.

Beats me, Matt.

Maybe easier to cool.

You can strap the servers on the bottom of the boat

and water-cooled servers.

I have a very tinfoil hat theory

that I haven't verified or talked to anyone about.

But I think the hype around,

let's send data centers to the satellites,

to space, and all that hype

somewhat has to do with that

because it would technically be lawless.

Okay, that's very possible.

Any company on planet Earth

would still need to operate those satellites

and they would still need to be under some legal jurisdiction.

So there's some gray area there.

Yeah, I'm sorry.

More questions keep coming up.

One thing that came up, what are your feelings?

I think I briefly mentioned this at one point.

Mega, the end-to-end encrypted cloud provider,

which also has pretty good photo support.

I use them for photos for quite a while.

They have end-to-end encrypted sharing via a public link.

So I'm curious what your thoughts are on that.

And actually, on this note, it's funny because Mega was criticized in the past.

I think it was like a semi-viral Reddit thread.

accusing Mega of not having end-to-end encryption

because they were banning accounts

that were spreading CSAM using their platform.

When really, when Mega cleared up,

they said, well, these are public URLs.

Like, if you're sharing a public URL,

even if there's an encryption,

like the encryption key is literally in the URL.

In the URL, exactly.

So it's not really end-to-end encrypted

once you have a public link.

So I don't know if you have thoughts

on kind of the way they approach that

and what that looks like.

Yeah.

There is no public sharing with us.

So I can at least say that with us, it wouldn't be the same

because the idea is that you shared the link with someone else

and only that other person can access it.

That being said, if you grab a Cryptee photo sharing link,

which has a key in the URL also,

and then you just go and post that link to your MySpace account

because that's what's fashionable,

then if we end up running into that link,

yeah, of course we can see the contents.

If we do see it within the first 48 hours,

because then after that, the invite will expire

and we wouldn't be able to access it either.

Only the person who verified their email

and added it into the system will be able to.

I guess a better question is,

why didn't you go with mega system?

What issues do you have with that system

and why doesn't it align with what you want?

Mass spread.

We just didn't want our system to be used

for potential use of mass spread of CSAM.

Because if you can spread images with a link,

it could potentially lead to unlimited number of users

being able to access those images.

Then all it would take is to share a CSAM album.

You just grab a link, post it on a form, and that's it.

Thousands of people can access it.

That sort of defeats the purpose of trying to prevent mass spread.

So our goal here is to clamp down on that

and limit it to maximum five number of users,

and that's the whole email thing.

Yeah, and I think if I was running a service,

Even if, you know, because I'm thinking,

like if I'm running Henry Photos

and an encrypted photo provider,

if I did the public sharing method,

I'm good.

That sounds like a lot of work.

And I mean, yeah, we have our PeerTube server.

We host videos, man.

But it's completely, you know, my moderation platform

or my moderation protocol for our PeerTube?

No public account.

Like it's just for our content

because I'm not going to deal with moderating that

for similar reasons as you guys.

But if I ran this service and, you know,

I started getting reports.

Let's say we had a reporting system.

We maxed it out.

So if we noticed more than 100 downloads on a file,

we can set up algorithms.

We can try to automate this.

We can do a lot to try to prevent this kind of problem.

But at the end of the day,

you're not going to get around you and your team needing.

I would need to have either myself or a team member

or a whole team dedicated to having to access those links

to see if it's actually appropriate content or not.

And so now you have to have the moderation teams,

and we've seen the mental health issues that come from these big tech companies

that outsource this to third-world countries and people there

who already aren't in a great situation,

and they're having to look at this,

and they have done studies on these people,

and it's disastrous to their mental health.

It's permanent damage.

It's just a nasty problem to deal with.

So that's why I would probably avoid that.

But I don't know how to handle that.

I'd like to ask them.

huge reason why we don't want to ever deal with that either and i don't think anyone wants to

and look we're based in northern europe we have extremely high quality of life standards i'm like

in a situation where i would not want to put any of my co-workers or any of my team members in a

situation of hey someone needs to look at c sam like that's just horrible nobody should ever have

to do this but if there ever comes a point where someone needs to it should be trained professionals

It shouldn't be us who have no training, no psychological training or support.

It should not be us.

And if there ever comes a day where we have to have a team, then I would also have to

hire a bunch of psychologists to train and support the staff.

It's not going to be just the staff who does this.

I would want for each person who does the support to be a dedicated psychologist or a

therapist to be able to assist him.

And it's not an easy situation.

And I don't think anybody should ever have to do this.

It's pretty horrible.

And I think the solution to this is to try to prevent mass spread of this.

And that's a big start.

And if we can all do our best to try to clamp down on that,

the world would be a much better place in the first place.

Yeah, so, you know, finally zooming out,

as I was promising we'd get to at some point.

I'm doing good.

What liability, and maybe this is more philosophical,

more of your personal views here,

do encrypted services have liability?

Is there anything wrong with building a tool?

I mean, I think Tornado Cash is maybe a decent example here.

So Tornado Cash was the, I might get some of the details wrong.

My understanding, it was a mixing service on the Ethereum blockchain, I believe.

And the idea is you can send funds into Tornado Cash and it spits it out and it essentially mixes those funds so you don't know where it came from.

It's a privacy service to make cryptocurrency a little bit more private.

Those guys, both of them, I believe they got thrown in jail, or at least they were tried.

But I think they were arrested, and that's still an unfolding case.

But did they have liability, right?

Like, if it was, let's say, just 1%, I don't know what the exact amount was.

They cite different numbers, but it's just for the example, right?

What liability do developers have when it comes to the software they're building?

And is that their decision?

Is that their problem?

Like, do you see a personal liability building a service?

How do you grapple with this?

How do you think other people might grapple with this?

Let me reframe the question.

Because I think liability and responsibility are two different things.

Being responsible and legally liable are two different things.

Maybe there is no law that regulates me to do certain things,

but I should still have a moral responsibility to do the right thing.

And I think this is the most important distinction here,

is that there are countries where the age of consent is so fucking low

that it almost makes you question the meaning of the word consent.

and there are countries where the age of consent is high and they respect people's consent.

And what I'm trying to get to by saying this is that I don't want to be the arbiter of what the

legal age of consent is because every country has a different number, right? But it's very important

that whatever the law says doesn't matter. I have a moral responsibility aside from the legal

liability. And it is that I want to do the morally right thing. I don't want to do just what's legally

okay and just move on and just wash my hands and think this is fine. The best way to look at this,

I think, is to perhaps use a physical analogy rather than a digital one. I think encryption

is a dual-use technology, right? You can use it to keep personal data safe, but you can also use it

in militaries to keep military communications safe, etc., in the context of war or to harm someone

with it, to distribute bad content with it. So encryption is dual-use. But guns, for example,

are not exactly dual use. It's just built to kill or to harm people. A similar analogy is knives,

right? There are kitchen knives you can buy from Ikea to cook and feed your family, and you can

exactly go to Ikea, buy a large kitchen knife, and hurt someone with it. Does this mean Ikea should

be responsible for anyone who ever attempts a knife murder? Like, I don't think so. I don't think

it's Ikea's responsibility if someone buys a kitchen knife and kills someone with it. But this doesn't

To solve this problem, we just go around banning all sales of kitchen knives.

We're also not saying, hey, we're going to ID every single person who buys kitchen knives at IKEA either.

That's not a solution either here.

Maybe if we age verified kitchen knives, it would solve the problem.

You know what I saw this morning in my RSS feed?

A company wants to age verify vapes.

And I'm like, oh my god, you know the meme where men will do X before going to therapy?

You know this meme? Men will literally, and then it's something ridiculous before going to therapy.

It's kind of the same thing. It's like, we will literally age verify

a vape before holding vape companies accountable. We will literally

age verify every platform in the world before holding big tech companies

accountable. It is so, yeah, sorry, I didn't mean to steal your thunder.

That just came to mind. Totally, man. But that's exactly what I'm getting at, is that

I don't think IKEA is responsible for selling a kitchen knife. In the same

way I don't think we're responsible for selling another dual-use technology like encryption.

So what we do is we store your photos and secure them with encryption and someone can use it for

good or bad in the same way someone can use a kitchen knife they bought from Ikea for good or

bad. So that's the distinction. If we were selling guns it would be inherently bad and I think we

should ID everyone and raise the age limit for guns and maybe actually do a mental sanity check

at least in the United States, like in Europe, we don't seem to have this problem, but just saying.

So what I'm trying to get to here is I don't think beyond that moral responsibility to do the right

thing, to make sure that we do everything within our power to make sure that our platform is not

used to spread bad content and put restrictions in place to make sure we have the reasonable

pipelines to comply with the law. If someone comes to us and says, hey, this needs to be taken down,

we can take it down but do so in a responsible manner where we tried our very fucking best to

make sure that someone can't spread bad content on our platform that is the best we can do and

unfortunately that's not even the tip of the iceberg for just how bad the situation is for

the opposite of the spectrum which is like facebook or google photos and whatnot there is

millions and billions of csm material being shared on these platforms precisely because it's open for

anyone and everyone to upload content. And they're not doing this type of due diligence. So it's all

about doing what we can, the very fucking best we can to hold that moral responsibility bar as high

as we can, even if the legal or, I don't know, lawful frameworks of Europe or Estonia doesn't

require us to. They don't tell us, hey, you need to have this, this, this, this, this, and this type

of checks in place to be able to do end-to-end encrypted photo sharing. They don't. There is no

a law that really requires us to do that. So we don't really need to do any of those things,

but we want to do this because this is the right thing to do. And to that extent, yes, we are

liable. And I think we should, and all platforms should be held to a higher standard so that they

do the right thing. And not because the law requires them to, but because it is our moral

responsibility. So if I make kitchen knives that also have fucking lasers and laser guided aiming

and whatever. And it's very clearly a murder weapon and not just for cutting cucumbers, man,

I don't know. Like that's the line where it gets really blurry. So I just want to be very

responsible with what we do. And I would like to think after having spoken to enough people that

we're trying our best and I think we're doing good, but I do think the bar should be a lot higher.

And I think platforms should be held to a greater standard where all these civil rights groups and

women's rights organizations and children's rights organizations should come to us and say,

Say, hey, we need you to add this other thing to make this a bit better.

You don't have to compromise on encryption, but we would love if you could just do this too.

And that's the kind of dialogue that we're open to and we want to have.

And we've spoken to as many as we could, and we want to speak to as many more as we can.

So that we try to cover all our bases and hope to be able to do the right thing here.

Yeah, so I don't remember exactly what the thread was called.

I just remember there being a pretty hot thread back on our forum.

before it was archived.

Someone came on our forum and pretty much asked,

hey, how do we actually talk about the CSAM problem?

How do we all feel about it?

It was kind of just a vibe check,

and someone was kind of expressing

and having some of these thoughts of like,

hey, what if these encrypted services

do have this negative side to them?

Is there something that we should be doing about this?

Is there something we can do about this?

AKA, is there some legitimacy to the whole idea

that encryption can harm children?

And it wasn't a productive thread, I think.

Like, a lot of people were very absolute in saying,

like, no, we cannot fight encryption.

This is not our fault.

This is not our problem.

Bad things will be done.

You know, I'm sure you can imagine how that went.

Yeah, and just to pause you for a second,

encryption is not what harms children.

It's the people who use encryption that harms children.

And in the same way, it's not knives that harm children.

It's people who use the knives that harm the children.

We don't put knives into jail, we put the people who use the knives into jail.

And yeah, I think it's an education problem, not exactly a technical problem.

So how can people who are listening to this, who are, maybe they've already been thinking about this,

or maybe they're listening to this and going, wow, I disagree with all of this.

But either way, how can people engage in a discussion from here on out in a way that's less awkward

and that appreciates the complexity of the situation?

How can people, because I would like to think after this is recorded, because I'm learning a lot from this as well.

I'm trying to, again, we had this 10-minute spiel and now we've been recording for over an hour now.

If our forum was still live and someone made this thread, what would you suggest that discussion looks like now?

Both for someone who's posting the thread and somebody who's responding to it to have a productive discussion about this.

Look, I think the hardest, harshest thing I've learned is after having gone to Brussels and having spoken to the regulators and having spoken to these experts and women's rights orgs and children's rights orgs, one thing became clear that wasn't clear for me in the past, which is just how bad the situation is.

it's not as light or as simple as we think it is the the severity of CSAM on the internet is a lot

worse than we realize and it's getting worse progressively these rights groups are monitoring

the situation and I'm not talking about law enforcement I'm talking about women's rights

and children's rights organizations these don't have the inherent instinct to hey we want to do

widespread surveillance their goal is not to do surveillance they're not law enforcement they're

another government. They're just people trying to help kids and women. It's bad. It's really,

really bad. And we don't wake up every day and have to deal with the reality of a horribly broken

internet where people share CSAM and mess with millions of people, but they do. Every morning,

in the same way you and I wake up and open up YouTube and maybe grab a cup of coffee and watch

a home renovation video, they have to go to work and spend eight hours having to deal with CSAM

at scale of millions and they just see how bad it is we don't so understandably so there is this gap

between people who don't see that side of the internet and people who do see that side of the

internet and it's a massive communication gap because nobody wants to talk about this topic

nobody really wants to bring this topic up it's one of those things where it's like it's dark we

know it we just hide it under the the rug and just move on and i think it's it's horrible that

the internet is this broken and we don't have this conversation especially as tech founders and

when i sat down to try to talk with the folks in the european commission when i sat down to talk

with the folks with digital rights orgs and others and especially during the heat of the chat control

debate there was an inherent eyebrow raise moment where they were like why are you asking these like

what is it that you're trying to sort of gauge here like it's bad but i was like look guys i

understand it's bad but just how bad like because that matters if it's one person in the whole world

that we're worried about like maybe in the grand scheme of things it's not that bad but if it's

millions of people it's bad and if it's billions of people it's fucking out of control right so it's

there's got to be a scale of just how bad it's severity and and i think it depends on that if

we realize, hey, there's 8 billion people on the planet and 4 billion of them are abusing children,

well, we have to do something more drastic about it. But if it's, I don't know, 100,000, a million,

whatnot, then we should think about compromises and figure out how to solve this problem in

different ways, perhaps because maybe encryption itself isn't the right way to solve this.

So once I went to talk to these people, to regulators, to digital rights organizations,

to civil rights organizations, it was then I understood just how bad. And that was sort of

the awakening moment for me because as a tech founder who's in his own tech bubble and in his

own friend group where things are jolly and we don't have to worry about these types of things

day to day i don't know just how bad it was i don't get the cds every day so i had no idea and i don't

think any one of us do hopefully none of us have to do this unless you're a content moderator then

the more power to you thank you for keeping the internet clean at the the cost of your personal

sanity. It's pretty horrible out there. And this is the type of thing that I think I didn't realize.

And to address your question, I don't know what the right set of questions to ask are or the right

kinds of conversations that we should have around this topic are. But I think it has to do with

education first. We all have to first be educated to understand just how bad it is and go from there.

In the same way we started to, thankfully, in our generation, have the conversation around

mental health issues and slowly people are becoming more and more aware of mental health

issues and perhaps our parents' generation didn't have as much in-depth of an understanding of

mental health issues and they're now becoming more aware of the situation. I think that this is the

same kind of conversation that we need to start to have to say, hey, this is an ongoing issue,

this is a widespread problem and we need to do something about this. And only then we can maybe

start to understand, okay, these are the types of conversations we should have. These are the types of

compromises that we should have. Maybe 15 years ago, 20 years ago, I don't know, ADHD wasn't as

well understood, right? We didn't know how to accommodate people with ADHD. And now we understand

it a lot better. We have a lot better dialogues around it, and we have a lot better solutions

around it as a result of those conversations. So the way I see this is the same. It's an issue that

we need to talk about, ideally at scale, and everyone needs to be better educated about it.

Everyone needs to have a better understanding about what causes this and how we can solve this and how we can address this in the interim in the meantime so that we don't have to worry about a much worse problem coming into the next 10, 20 years until we can actually find a solution to address this problem.

So, yeah, I would say that education is perhaps the first step.

In the same way we manage to educate our societies, not to go around stabbing people with kitchen knives and just use them to cook.

I mean, sure, there is a number of people who probably do that.

We need to do the same exact type of education with this.

then it's going to start somewhere, as dark as it is.

It reminds me of just privacy concerns in general.

If somebody was trying to have a discussion about privacy concerns,

but both people aren't aware of how bad it really is

and what the implications are,

then you can't really have a discussion about it.

I don't think it's any different from that.

If anyone here cares about privacy,

but you're talking to someone and they don't seem to care at all,

what's missing there is their understanding

of what's actually happening behind the scenes.

And once you can explain that, then you can have an actual discussion about how to solve the problem.

So it almost sounds like that would be a good starting point of like, well, actually citing how bad the problem is.

So everyone in the room can at least acknowledge, okay, yeah, this is a problem.

And now we can talk more about what a solution looks like.

And to add to that point, I think the difficulty here is with privacy.

It's a bit easier to actually be able to express this to people, right?

You can show people, see, this is how they take your data out of your phone.

Or they could be like, hey, see, this is exactly the kind of thing that happens where you go to that link and see this network inspector in your browser.

This is the kinds of data that they upload.

It's bad.

Like you can actually visually show some of the stuff.

But with CSAM, you kind of can't.

That's sort of what makes this very difficult is that nobody wants to see this.

It's horrible.

You can just cite numbers, I suppose.

You can cite numbers.

But when you get to the point of, hey, there is millions and billions on the internet, then that's a number so great that it's incomprehensible to our reptile brains that unfortunately we don't understand.

And I think that's where it gets really difficult.

So that's why I think it's a dialogue like mental health.

We just have to talk to everyone and understand and be able to sort of have these difficult conversations and hopefully read more news articles that are authored by these women's rights and children's rights organizations and hopefully get a better understanding of the situation.

I guess on this note, I guess the regulation side of it, chat control has been a big thing.

And you can expand on maybe what happened last week and why it's kind of died down quite a bit.

I am asking this question all the time because I've been doing coverage for chat control.

I'm doing coverage for age verification.

I'm doing coverage for all these different issues happening globally right now on the channel.

And I just am so lost on some of this regulation.

Some of it just seems stupid.

Like a lot of the stuff that comes out of these U.S. states, I'm just like, okay, this is clearly some person who's never used a computer.

And this just sounded like a good idea on paper and they signed off on it.

And they just do not understand even where.

Because even if that was their goal, if their goal was to ban VPNs, if their goal was to be repressive and do all these crazy things,

the bills themselves and how they're written aren't actually going to accomplish those things.

And anyone would be able to tell them that.

But on the other hand, I'm still conflicted.

People who are trying to pass chat control, people who are trying to break encryption, do they have ulterior motives?

Are they using this child thing to get what they want, which is something different?

Or do they just genuinely care about this topic?

They're all in the room and they agree on this child problem.

They just don't understand the implications of what it would mean to ban an encryption.

And we, everyone, just kind of disagrees on whether or not banning encryption is part of that solution.

I don't know if you can speak to a litmus test based on especially your time speaking to a lot of these people.

Okay, it's very complex.

So I'll start by saying that I think the answer is yes and no.

Because when we talk about groups like European Commission, European Parliament, they represent a very vast spectrum of political parties.

For those of you living in the United States, Europe has a multi-party system where it's not just two parties.

We have multiple parties, all forming coalitions and sort of representing everyone all at the same time.

There is no two-party battles going on, so to speak.

And I think this is very important because when we talk about the European Commission,

we sort of sum everyone up into this tiny little narrow slice of an organization thinking,

oh, that's everyone.

That's what everyone in the European Commission must be thinking, but it's not.

And European Commission consists of some incredibly talented and smart people,

at least based on my personal experience having interacted with them at the Digital Markets Act team.

And they have experts with PhDs in computer science.

They are not politicians.

They are experts in their own domain.

law, computer science, whatever have you, whatever it is that they're going to regulate,

they have experts in these topics.

So that straight off the bat is very different from a bunch of lawyers sitting around a table

trying to decide what it is.

They actually have people who understand what's going on.

And they consult others who understand what's going on.

They consult the civil society and human rights organizations and women's rights organizations.

And if they're in doubt, they talk to digital rights organizations like EDRI.

If they're in doubt, they talk to Free Software Foundation Europe,

like folks like Lucas that you interviewed.

And I don't remember if you had the chance to speak

the Yann Penfrat from EDRI.

Amazing folks that they basically bring into the room

to have these conversations.

So long story short, this is a very divisive topic.

And the way it was packaged when it was presented

was literally, if you look up the name of chat control,

which is just an alias that we've given

amongst privacy conscious folks,

but the actual name of the legislation

is to prevent the distribution of child sexual abuse or whatever.

Like, they just named it in such a way that if you say no,

it just makes you sound like you are one of the bad people.

Like, it's just the way it was packaged and wrapped already

from the name and the get-go is just a little bit hostile,

which should, rightfully so, sort of raise the sort of, like,

awareness and maybe ring the alarm bells a little bit

to wonder who it is that proposed this.

If I recall correctly, it's been such a fucking saga with roller coasters of ups and downs and who pitched it and then who shapeshifted and then who added some new segments to that thing.

It's like, it's a mess.

But if I remember correctly, the initial party from Denmark who proposed this said, hey, we should do something like this and pitch this idea.

one of their key political members of the party who pitched this actually got arrested for child

sexual abuse related issues. So that should tell you everything you really need to know about

what's going on. So someone should look this up and find the links or I can just try to send you a

link and give you a better idea of what's actually going on here. It's quite ironic. So with that in

mind, I don't know if the key goal here was to, in fact, keep kids safe. At least maybe for that

person, it wasn't. But it's very important to acknowledge that there are so many people,

as a part of the European Commission, as a part of the European Parliament,

as regulators, as civil society orgs, as women's rights orgs, whose goal 100% was to keep kids safe.

That is undeniable. That being said, when chat control took its new evolved Pikachu to whatever

crazy monster form it took, it turned into a bit of an interesting surveillance legislation that

took a really strange turn in a really strange shape where initially it was pushed out by

religious and conservative parties, coalitions in Europe, which sort of made it a bit easier to

track down who it is that actually lobbied for it. And to spare everyone the legal complications of

how lobbying actually works in Europe, there are some protections in place to make sure that there

is no corporate influence in European politics. But needless to say, it is not sufficient to the

extent that you would expect. And I can give you one personal example of this from the Digital

Markets Act, where every single Digital Markets Act hearing that I went to, to spend seven hours in

front of a camera talking and yelling at Apple lawyers. There were a bunch of rights organizations,

air quotes, who were there to essentially just repeat Apple's marketing taglines. And we realized

that those rights organizations were actually entirely funded by Apple. So sure. I remember

seeing one of these that they put out these like really formal looking PDF reports on why

European legislation was harmful to Apple users.

I think it was maybe in the context of Google search.

They were showing Google search results

and how they have to have these pop-ups in Europe

that don't exist in the US.

And we found that users were 30% more dissatisfied

and we care a lot about this topic

and we think that Europe should back off.

But when you looked at who funded it,

it was big tech companies.

Sorry, I didn't mean to cut you off.

It's good, but that's the thing.

Essentially, that's how it creeps in.

And it has the shape and the face of a right organization, XYZ, fill the blank.

But it is, in fact, behind the scenes funded by a tech company.

When we looked at, out of curiosity, who it is that is actually funding the organizations pushing for these chat control-like issues,

one of the key names that showed up was Thorn.

And it keeps coming up, this name, I'm sure you've heard of it.

It's a company that was initially funded by Ashton Kutcher, and it was a startup that specializes in utilizing AI tools to scan images in video to detect CSAM.

And they are essentially a CSAM scanning company.

And if they could theoretically lobby to make this happen in Europe, and messengers were required to scan these messages, there are no bigger service providers out there who could theoretically handle the volume.

So it would be Thorne who would be handling this and they would be making millions from this.

So needless to say, Thorne was quite often and very frequently and vocally involved in lobbying for things like this.

There are other organizations that I don't think fully understood what was going on and lobbied for it without fully actually understanding the context of what it would entail.

But I think, again, it boils down to this communication issue, right?

Like there weren't enough technical people in the room to sometimes explain, hey, in order to do that, you have to just break the whole world's encryption and just make everyone insecure.

And that's not a solution.

That's just to give you a little sample taster of how some of this came to be.

And eventually, when you talk to enough people and name the legislation in a specific way and talk about the topic with the framework of protecting kids, I think it makes it very difficult for people to have these conversations at scale.

until everyone's in the room and they can anonymously and maybe secretly push the vote no but

if you go to the corridor and the halls of european commission and want to have these conversations

with people then they're a little more hesitant or the european parliament they're a bit more

hesitant because they are like hey like i don't want to say no fuck protecting kids we shouldn't

break encryption like that's not any what anyone wants to say and that's not their view either

everybody wants to protect kids the point is not everyone wants to break encryption it's that

conversation the nuance of it was lost in a lot of these conversations and it's it's a very nuanced

and very difficult problem of how it came to be and it took a very different shape and eventually

it got to a point so serious that in some countries the parties that were secretly pushing to make

this happen and the conversations that were secretly happening behind the scenes not so secret

but secret as in the context of behind the scenes public doesn't directly engage with

it took really interesting shapes like defense ministries of certain countries got involved

they were like hey maybe this is not a good idea like months before this happened the swedish

military and the defense ministry said hey we're going to start using signal and then a few weeks

later someone else from the swedish ministry said hey we will like the support check control and

then the swedish defense was like uh what no like we just said we're gonna use it we don't want

wait hold on a second and it just really complicated situations and that should go to

how complex the issue is. So all this is to say, it took a very interesting shape. And I ended up

running around trying to talk to as many regulators as I could within my reach in the languages that I

could speak in the fluency that I could communicate with. And it's a very difficult topic that I don't

want to make mistakes and have it get lost in translation. It was very difficult. And there

aren't that many experts who can talk about these things or have the connections. Maybe there are the

experts, but they just don't know how to reach out to their regulators. So it's very difficult,

very nuanced. And it took a while, man. I mean, Meredith was in Brussels. I think she was in

Amsterdam talking to all these people as much as she could. She was going to all the seminars. Like

I was talking to as many people as I could. I'm sure folks at Proton were doing the same,

Tutai were doing the same. We were all engaged at what capacity or another trying to do the right

thing. So it took a while, but I think we managed to convince the right people to have the right

conversations to sit down and say maybe this was a bad idea in the first place and i think there are

very few people who could take more credit than people like patrick or people like marcel from the

pirate party who did their very best to try to explain the reality of what this would entail and

made magic happen so and there's tons of people who i don't even know their names of someone created

the Stop Chat Control website, I think, from Denmark. And everybody used that to send these

emails to the European Parliament and European Commission. Whoever you are, you're an amazing

anonymous person. Thank you for making that website, because that basically was the tipping

point, I think. And one person single-handedly made it possible to fight this battle. So it's

very complex. And I think it's just the fact that it's a very difficult topic to talk about

made it very difficult for everyone to engage in it also. Yeah, so last week, it was about one or

two weeks ago, Patrick kind of cited it as mostly dead. I'm still trying to wrap my head around it.

So can you explain the most recent update very briefly? So essentially this last week, what

happened is there were two votes held. And to the best of my understanding, the one on Thursday was

final and the European Commission essentially, sorry, European Parliament essentially killed it.

That's to the best of my understanding.

And yeah, that's at least the best of my understanding.

But again, this is one of those topics that it will come back.

I can tell you already, this is not a final win.

This will need to be drafted into every single independent country's laws to say you cannot compromise on people's privacy.

And it is their human right.

It is their national right to respect their privacy.

and it cannot be altered with.

It should be in law, codified in law,

for it to never be possibly brought up again.

Even then, the European Parliament might try.

Certain parties might try to push their agendas.

It could happen.

It's been, in this particular case,

the right-wing and the Christian Democrat parties,

and tomorrow it could be someone else.

But point being, for now, we're good,

to the best of my understanding.

And on the verge of learning that,

we thought maybe now is the right time

to launch our sharing features

because we've been waiting very long and thought,

okay, this is the right time.

If there's ever a better time, it's Thursday when they announced it.

They announced that it's dead, and an hour later we released sharing.

So we were literally waiting for it.

Yeah, one quick note.

I've seen, on my end, it might swing a little bit, plus or minus 5%,

but I've seen chat control, encryption bans,

all this stuff proposed from both sides.

I know that you mentioned right quite a bit in yours,

But in the U.S., I've seen left-wing politicians try to pass it.

I've also seen in Europe some people on the left also try to pass this kind of stuff.

So I just wanted to make that clear because, again, another thing, back in the forum days,

there was a lot of pointing fingers of right versus left.

And someone who was right-wing would point at the left-wing people and say,

well, actually, this other bill in the neighboring country is from the other side.

This is a pretty bipartisan thing.

The important thing, though, I think it's worth mentioning these things

because if you voted for the Christian Democrats or any one of the right-wing parties, first of all,

I have utmost respect for you. Vote for whichever party you want to. That's the beauty of the

European governing system is that we are all represented, right? But the important thing here

is you should also know if you want your privacy rights to be respected. And if it is your

representatives who tried to push this, then I think you should know, be it left or right,

who pushed for it. And there are amazing websites where you can go check out who pushed for it,

and you can log in and take a look at it

and you'll find out that this was mostly the case

in most countries, at least in the Nordics.

And it's very easy to see.

Yeah, and I liked also Patrick.

He put out his blog and then shortly after he said,

now we can actually focus on keeping children safe.

I think his overall point he was trying to make

was so much of the air in the room

was taken up by chat control.

And a lot of the technologies

that they were trying to use for chat control

weren't even evidence-based.

Like 50% of the times, or even more than 50% of the times,

they were just positive yeah i mean your client's eye scanning it just doesn't fucking work like so

yeah so it's just it's cool how now he's saying like you know now we actually have that that air

we can all kind of reflect on this problem and so maybe it's good timing as well for this podcast

for us to kind of think about this i mean i think so too if if you're a regulator if you're one of

those political parties and if you want to have this conversation please reach out to us i'd be

more than happy to sit down and talk about the reality of encryption and how that keeps you safe

and everyone's safe and your constituents safe

and how revoking encryption is not going to help you

or your constituents or kids for that matter.

People are still going to keep doing what they're doing.

They're still going to find ways to encrypt this stuff

if they want to do that.

Yeah.

Because when I first started getting to know you,

you weren't really active in the legal side of things

as far as I know back then.

So I'd say the last few years,

you've been getting a lot more active

on the political side of things.

I know we have casual conversations all the time,

but I've never had to directly ask,

did it just happen organically?

Did you start getting into this?

What's the value you see in that?

Can you shed a little bit of light of what it looks like to do that?

Yeah, absolutely.

I'm not even saying what you do,

so you should probably expand on what you've done.

I don't love it. I'll start with that.

I've never seen myself as someone who would ever wear a suit and sit in a room, and yet I found myself, caught myself doing that in a way that I'm like, fuck, what am I doing?

Why am I wearing a blazer?

Why am I wearing a suit?

And I'm just a nerd, guys.

I'm a coder, and I come from a technical background.

This was all new to me.

And I think what started all this was two years ago when the whole Digital Markets Act-related issue started to happen.

And you and I had this video, actually.

I think I can attribute the day that I got dragged into all this shit.

Pretty much that video that you and I made about Apple trying to block web apps in Europe

under some false premises.

Little backstories, Apple said, hey, we're going to kill all web apps in Europe.

Basically, Apple said, we're going to kill web apps in the EU.

And they tried to use...

They didn't even say, they just pushed out an update that killed it.

Yeah, they just said that they just killed it.

They pushed down beta and they were going to kill the companies

and they were like, hey, you know what, we're just going to do this.

And the false excuse they used for that was that they were saying, hey, in order to comply with the Digital Markets Act, we have to do this.

And I was like, what kind of a bullshit act is that?

Let me go read that shit.

They're going to kill my company, you know.

And I had to sit down and read.

And I was like, nothing in the Digital Markets Act says that they need to do that.

What the fuck is that about?

And then I started reaching out to a bunch of organizations and by some amazing miracle, I connected with two incredible dudes from Australia who started Open Web Adversions.

who were trying to advocate for the open web and for essentially to get more browsers and browser engines in iOS.

That's apparently what triggered Apple to say, hey, if you want to have other browser engines on iOS, then we're going to kill web apps.

Even though that is a complete bullshit argument and there was no security benefit, no nothing.

And open web advocacy and myself involved, we published an open letter to Tim Cook saying, don't do this.

And within 48 hours, we got 5,000 signatures from every single big tech organization you can imagine, to every single engineer from every company you can imagine, small and big.

Everyone said no.

And Apple immediately backed down and said, maybe we're not going to do that.

But only Safari should be able to install web apps and stuff like this.

Whatever.

That was my first unexpected foray into the legal side of things with Digital Markets Act.

And that sort of got me directly, that affected me directly and got me involved directly because I have a small company that was going to be very directly affected by this.

And effectively, that act would have made or break my company, so to speak, in a very specific manner.

And I reached out via the Open Web Advocacy to the European Commission to say like, hey, like, what's going on?

Can we have this conversation?

Can we talk a little bit?

And they were incredibly kind and incredibly amazing.

And they've actually invited open web advocacy in every capacity that they can to engage with us at every capacity that they can.

Almost weekly, we had calls with the European Commission trying to understand what we can do, how we can fix things, how we can remedy things.

What would be a good compromise?

What would be a good solution?

What are some things we're happy about and not happy about?

And we had years of these conversations almost every few weeks with the European Commission.

And also with the UK competition market authorities and with the Japanese ones.

And it slowly became a thing where at first I started helping out the folks at Open Web Advocacy because I was directly impacted and my livelihood was going to be directly impacted by it.

And in the process of doing so, I ended up making a lot of trips to Brussels.

And over the course of the years now, I've been there enough times that I got to meet all these incredible people from these amazing organizations like Lucas from Free Software Foundation or Jan Penfrott from EDRI or Bruce from Vivaldi.

and Kush representing Mozilla, their policy person.

There's been incredible people that we got to meet

over the course of these years

who have been working their butts off every fucking day

trying to do the right thing for our rights.

And it's just incredible.

The atmosphere is just really uplifting and energizing

because you walk into that room

and you realize you're surrounded by all these other people

who are trying to protect your rights.

And everyone's got your back.

And that sort of got me, that dragged me into this a little bit.

And I've realized over the course of the years in doing this, I don't think encryption alone is going to keep us safe.

I can say as much that it's not a magic bullet.

I mean, it's a dual use technology, but it is not.

And it's a controlled export good, but it's still not going to protect us in that you can have the best, best piece of mathematical formulas and encryption that you want.

If someone says you're not legally allowed to use it, good fucking luck.

No company is going to be able to offer it.

And maybe you can try to do it open source and GitHub will take it down or someone else will take your website down.

I mean, if someone says this is not cool legally, you're not going to be able to do this.

And I realized, OK, so encryption is a big piece of the puzzle, but not the only piece of the puzzle that we need to focus on.

And I realized, OK, like web is another big piece of this puzzle, because if we lose the web, if we lose the openness and interoperability of the web, we're also fucked.

Because if we depend only on the app stores, you've seen what happened to Ice Report apps in the United States.

You've seen what happened to, I mean, it's super weird, right?

In the United States.

VPNs in Russia, China.

VPNs in Russia and China, exactly.

And the irony of the situation is in the United States, if you ask Apple, they would say, hey, we want to protect the kids.

And if you look at their app store guidelines, they will say that they will take down anything that harms people.

Yet, they've continued hosting Rock, which literally is used for creating CSAM.

And they didn't take it down.

There is an amazing Verge article.

I know.

Oh, I thought you were going to reference what the Alt Store guys posted on Mastodon.

Exactly.

I was getting to that.

Yeah, yeah, yeah.

You can explain it.

Yeah.

Over the course of going to Brussels, I met these incredible folks, Riley and Shane, from the Alt Store.

And they've created this beautiful piece of alternative app store for iOS devices.

And they made an amazing app that only shows you a yes or no, basically.

And it says, which of the app stores have CSAM on it and allows apps that creation of CSAM.

And believe it or not, it is the Apple's app store and not the Alt Store.

Yet, those were exactly the kinds of shit that they've accused Alt Store of distributing potentially.

And that's why they wanted to have some notarization process so they can take a look at which apps are being distributed through the Alt Store, yada, yada, yada.

And the irony here is, it's so weird.

right? Apple says, hey, we want to protect minorities. We want to protect kids. That's why

we have all these policies. And they don't take down Grok, which is used for creation and distribution

of CSAM. But then they declared people who work for ICE as minorities who should be protected.

And then they took down ICE reporting apps. The irony here is these are grown up men with fucking

guns. I don't think they need your digital protection. I think they can protect themselves

versus kids who are being abused, on the other hand,

whose sexual abuse is being distributed

on your goddamn app store

cannot protect themselves with guns,

so maybe you should take down Grok, but they don't.

And I think the open web is very important for this reason

because we don't depend on these app stores

and what they decide is okay

and what they decide isn't okay.

And I don't use the word decentralization lightly here

because I think web isn't exactly decentralized either

depending on where you host your website, right?

But web is still not necessarily part of these big corporations.

Like you can choose to host your website somewhere else where that corporation cannot decide who gets to have a website.

So I think web is a big component.

That's why I think it hit the right nerve for me.

And I said I need to get involved and do something to protect the future of the web so that it's not just these fucking app stores.

I don't want Apple or Google killing the web.

encryption is a big portion of it.

I want to make sure that we protect it.

And I think in order to be able to do all those, you kind of need to have these legal conversations.

And that's sort of how I became more involved into all this legal situation.

How I got dragged into this legal situation, let's say.

And I realized I can hide behind my keyboard and just code or go there and try to do some change as much as I can by talking to people and show my face.

And I had to get a good haircut for that.

And the old one wasn't doing it.

and now I have to put blazers and suits on

and I have to sweat for seven, eight hours

but that's okay, it's worth it

I think it's a pretty frequent realization for some people

a person who just comes to mind right now

just on the fly is Louis Rossman, right?

Louis, you know Louis?

Yeah, yeah, not me neither

but he started just kind of making these tutorials

about something he knew a lot about on YouTube,

which is just repairing masks.

I watched Louis Rossman

back when he had a very early channel.

Back when he was smaller than we are right now

because we just hit 300K.

So I think I remember watching him

when he was at 200K.

Thank you, thank you.

Yeah, we were actually in person for it,

recording a project,

and then we hit 300K,

so we made a little cake.

Nice!

Did you see the photo on Mastodon by any chance?

No, I should look.

Okay, yeah, check it out.

We made a little cake.

We wrote 300K on it, and it was a great, great cake.

Well-deserved.

Amazing content.

Yes, thank you, thank you.

But back then, it was just tutorials.

I was just fascinated, because he would show how to repair this one component on a Mac.

He would explain the specific things that Apple didn't want to acknowledge as real problems.

He's like, but I've had this repair at my repair shop in New York come up on literally every single person when they hit year seven on this specific MacBook model.

And so he was kind of sharing this detail.

But he never talked about right to repair in the way that he might do now.

So, you know, he went from just making these kind of like interesting videos to then talking.

And he started doing more like talk show style videos where he started, you know, talking.

He's like, here's why you need to get active in this bill.

I'm so tired of Apple.

It was becoming a little bit more on the advocacy side of things.

But now, like, I don't know how much of air quotes right to repair was, you know, started by or even advanced by Louis Rossman single handedly.

I'd say 90%.

I'd say a huge amount of it was.

He was the person who exposed me to the concept of right to repair.

He was the one who started introducing me to these bills.

And then his audience starts following this as well.

I like to think that what we've been doing the last year at Techlore is quite similar.

We started with a lot of privacy tools.

Like, oh, this is more private than this.

But it's like, oh wait, they're actually just trying to ban encrypted tools.

So we can still have those discussions.

That's quite fascinating.

I think it's fascinating.

I think it's really fun to invite.

I mean, I've had Session on this podcast.

I've had SimpleX on this podcast.

They both think the other one sucks.

It would be really interesting to get a roundtable discussion

between all of them and see what they think.

I think it would be a well-moderated discussion.

And they're both really nice guys,

so I know that they would be very professional.

I'll just say this already.

Proton's awesome.

It would be good.

I need to get Proton on the podcast, actually.

But I'm like, this doesn't matter.

It does matter because I find it technically interesting.

And I'm sure that still deserves a place.

But I was putting so much emphasis on that

when really we were missing the whole picture of like,

well, these tools are only allowed to exist.

And people already talk about how hard it is to just move to Signal.

Signal is, feature parity-wise, quite similar to WhatsApp.

You have stories on Signal.

Yeah, I would argue better too.

And now we're talking about getting people over to Session or SimpleX,

which the usability is far worse than Signal.

I have no issue saying that.

So that's already kind of an issue.

But then, okay, let's set up a situation

where encryption is just banned.

So now you have to convince your friends and family

not just to move to Signal,

which apparently is hard enough to do for a lot of people.

And it is, I have this problem as well.

You now have to convince them to use an illegal tool

along the way.

You really think that's a healthy environment?

And maybe compile it themselves

and not get it from the app store,

load it as they call it,

and find ways to install it.

What do you mean, you idiot?

You didn't build your own signal source code for Linux Arm,

which they still haven't done, by the way.

I'm very frustrated about that.

I am extremely frustrated as well.

I don't know if you've seen, but I switched all Chromebooks with great pleasure.

With Android apps running in Linux apps on there as well?

Yeah, you can run Linux apps, you can run progressive web apps,

you can run Android apps.

It's actually, if you think about it, the most accepting platform.

Everything runs on it.

In some ways, yeah.

That's interesting, except you have to deal with Linux Arm.

So far it hasn't been that bad.

Even our development tools are all working great.

I can safely say that we shipped it with Chrome OS

and I'm really happy about it as a web app developer

who makes web apps.

And I don't have to use Apple products for stuff anymore.

It's really good.

After having shit-talked them so many times in these hearings,

I feel like it's going to be really nice to flash my Lenovo.

I saw one of the new Microsoft laptops.

I don't know their lineup confuses.

because I still associate the Surface

as the crappy little piece of crap

they released the first time.

But it's grown a lot.

It's genuinely really nice hardware.

I think it's the Surface laptop.

It is kind of like MacBook Pro build quality.

It runs an ARM chip, the Snapdragon X.

I don't think it's as good, but it's still okay.

So the hardware is getting there,

but dude, when the hardware's out,

Linux still isn't there.

This is very off topic.

So let's get back on track.

On topic in that I think all this was made possible

by incredible folks like Louis Russman,

initially taking their time to engage with the legal process

and making it so that the right to repair movement

catch the right steam and caught the right momentum

and basically said, hey, you know what,

maybe we should do something about this.

And then we started getting computer manufacturers

like Framework and System 74 or 76.

I forget their name because I'm bad with numbers.

Yeah, honestly, it's all made possible by folks like this,

pushing the limits of what's possible with regulation.

And I realize just how important that is.

I'm trying my best in the best way I can, spending our funds as much as I can.

So if you're spending money on Krypton, you have a subscription, all of it is going to this shit.

And essentially, we're trying to push the boundaries of what we can do with our legal team, our tiny, small engineering team, and me making trips to Brussels, trying to talk to the regulators to defend your rights.

And I can tell you the same about Vivaldi.

If you use a Vivaldi browser, they're trying their very fucking best to do this in the same exact way.

And this is really important, is what I'm trying to say.

And Signal's doing the same.

Meredith is flying out every now and then trying to represent Signal and encryption and our conversations, privacy as a whole.

I have immense levels of respect to these people for doing what they do,

because I know firsthand just how difficult it is to actually do and live out of luggages in hotels.

And aside from the inconveniences, if you have to keep doing it and grabbing drinks with these people, it gets really tiring.

You know, at our age, it's not that easy to keep getting tipsy and talk about privacy all day long.

So not that I don't dislike it, but it's hard to convince the right people.

Yeah. Well, that's all I have.

This is a very no-filter podcast.

Yeah, but it was a little more filtered than the last one, I think.

The last one was quite all over the place.

unhinged. That's a good way to put it.

Great. Well, I'd appreciate anybody's thoughts in the comments.

Obviously, keep in mind

the sensitive nature of what we're discussing.

Even if you firmly disagree and you're

like, I think this child stuff is nonsense

and I think encryption is

be respectful about it because

keep in mind the context of how sensitive

this conversation is. People in the comments

might have people personally affected by this.

I tried my best to treat this as sensitively

as possible. John clearly did as well.

So I just ask a little bit of compassion

and kindness as well.

To this day, our intro video on our channel

doesn't have comments anymore because it's an intro video.

I want to keep the comments open to still have people discuss this

in a productive way.

That's all I ask.

I think the most important thing we can do right now

is to engage in civil conversations about this topic

because just ignoring what all these people

trying to protect kids are trying to say is not going to work.

We can't just close our ears and say, I can't hear you.

I know you're trying to protect kids, but I can't hear you.

It's just not going to work out.

We have to have very civil conversations around this.

And we can't ignore what they're saying.

And we're not going to make compromises on encryption.

I promise you that.

No one is going to.

None of the privacy-respecting, security-respecting companies that you hold dear to your heart,

like Proton or Tuta or Signal, we're not going to make compromise.

But we also have to have this conversation.

And it's going to be a difficult conversation.

And I hope that you would be as civil and as open-hearted and open-minded about it,

because there will be people in the comments, statistically, there will be people in the

comments section who are going to be personally affected, who were going to be personally affected,

who may be actively affected.

And I sincerely hope that you will respect them.

And I sincerely hope that you will understand that it's a very nuanced topic.

It's a very difficult one for them.

And these people who have these conversations in public

and talk about their incredibly dark traumas and experiences,

they make incredibly difficult sacrifices

to have these conversations and make these possible.

So I hope you can respect that as well.

Yeah.

Well, thank you, John, for your time.

I know that I told you beforehand

this would be 80, 90% informational.

But it's good.

But congrats on the release.

I know this is something you've been cooking for a long time.

Thank you so much.

Yeah, I guess if anyone wants to check that out,

I guess you have to be a paid user.

But there is a Crypteec.

I don't know if there's cards.

I think there are cards for external links.

But we'll leave it in the show notes.

Yeah.

Yeah, there you go.

It's funny, too, because what you see here

isn't the format even that is done in post in Riverside.

Oh, shit.

It's quite funny.

God damn it.

I've scratched all sorts of body parts.

We'll find out how that looks like.

Well, thank you.

And I'm sure we'll be back on at some point.

And until then, keep up the great work.

Sounds good.

Thank you so much, Henry.

Deeply appreciate you all.

Yeah.

And there you have it, everybody.

I hope that we all learned something today.

I know I did.

This is a very new territory for me.

And I didn't really have the full terminology

nor understanding of this topic going into the interview.

And it's clear that John has done a lot of his research

and has talked to a lot of very experienced people

to be able to share what he knows with us today.

If you enjoyed this interview,

definitely leave a rating down in the description.

I'd love to hear any comments you have

as long as they please are sensitive

given the nature of what we discussed today.

Thank you all for watching this Techlore Talks

and I'll see you next time.

*music*