00:00 Hello, I'm Seth Simmons. And welcome to season one, episode 11 of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they've found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. Wondering how global surveillance could realistically work or how VPNs can play a role in your privacy? This episode, we're sitting down with Smuggler to chat about global surveillance, a realistic look at VPNs and Tor, and his journey as a cypherpunk.

Welcome on to Opt Out, Smuggler. Thank you for having me. Yeah, I've followed your work for a good while. I have listened to a bit of the podcast that you have with Frank Braun, and I've just kind of seen both of your journeys and your insight into being a cypherpunk and cyberpunk, crypto anarchy, your dedication to privacy. And I'm just really excited to have you on to chat with me today. I think it's going to be really helpful for me and then hopefully a good listen for my listeners.

But for those listeners who aren't familiar with you, would you mind introducing yourself? Sure. My name is Smuggler, which is probably not the name that my parents gave me. I also go by the name Jonathan Logan, which is also not the name that my parents gave me. I've been active in the cypherpunk crypto anarchy scene since the 90s, late 90s to be exact. I think I joined, I don't know, somewhere between 95 and 98 I joined. That's a long time ago, so my memory is a little flaky there.

And I've worked on a number of things in that context. I've done a lot of what they call deviant IT by now. Back in the day, we called it black IT, which is all the IT projects that don't show up on any budget. I ran a distributed data haven until 9-11 happened. I've run a couple of remailers, VPN services, offshore mail services, offshore storage, several payment systems, and so on. It's a long list of medium successful projects that I accumulated over the last 25 years.

And from time to time, I also commit the mistake of writing about what I think. So I wrote a couple of small two theses in the context of privacy, crypto anarchy, post-libertarian thought, and stuff like that. And right now, I'm working at a company and being their chief security and infrastructure engineer. So that's my background. Awesome. A lot there. And I'm excited to chat about one of those papers that you've written, the one from 2011, about global spying and something we'll get into later.

But I first want to kind of dive into a bit more about your personal journey towards privacy. And I'm curious, what was it that woke you up to the need for personal privacy? Yeah, there's one of those biographical questions that I think most people answer with some well-thought-out narrative. I've thought about that. And I honestly don't have an idea. So I have a sense of where it comes from and the sense is that it had to do with my family upbringing.

So there was a... I come from a relatively conservative family. And for them, privacy in certain matters was very important. So specifically towards people that were not part of family. So family secrets and family privacy was a big thing. While internally, there was no privacy at all. So I think I wouldn't lock my door as a teenager ever. So because it didn't even have a lock. So I think it's partially from that context where I've experienced a high value of privacy in a social sense, but also this conflict of lack of privacy in a personal sense.

And I think that has contributed a lot to my thinking. Yeah, it's been interesting to hear the different answers that people have had throughout the previous 10 episodes of Opt Out. I've asked that same question for everyone. And I think everyone but one has had kind of a wake-up story of something that woke them up. You're not alone in having it where it just was kind of a part of the culture of your upbringing. And it was just native because of the things that you were exposed to, whether they were cultural or like you, familial.

I think it's interesting to think about the impact that family life can have on our view towards privacy. Oh, dramatically. Yeah. Dramatically. Yeah. I mean, it's like with many other topics. You know, in the end, we become more like our parents than we ever wanted to become. It's very true. Definitely. Definitely lean that way. And you talked a good bit already about the different privacy-focused projects you've been a part of. But what is it about privacy that makes it such an important topic for you today?

So by now, I have a slightly more reflected view on that. And it's both philosophical, spiritual, and political. So from a philosophical, spiritual standpoint, it's in a world where nearly everything can be measured and everything can be known. It's the secrets that you can control that make you distinctly an individual, that set you apart from being somebody else. You know, like, if everything about you is known, then you can be basically replaced, you know, by your digital shadow or somebody mimicking you or whatever.

but it's the things in our heads and it's the silent conversations we have with our best friends that really make us true individuals. It's the things that cannot be known. It's the things that cannot be mimicked. It's the things that cannot be falsified in a way. And in that sense, I think that privacy is a tremendously important aspect of individuation. So not individualization, but individuation. Becoming an individual, becoming a human has a lot to do with those distinct things that we know, the distinct things that we think, the motives why we act.

Those are the things that really make us unique and that also make us really valuable in the world because it's all those very private things that create color in the world. And that really makes us pretty valuable because we become unreplaceable in a sense. So that is the philosophical slash spiritual view on it. And then there's the political view and the political view is that in the modern world, knowledge and the ability to modify the perception environment of people are probably the core tools of political control.

And I consider the advances in those fields to be truly frightening and essentially uncontrollable politically. At best, we can control them with personal behavior and maybe to some degree with technology. But we're quickly moving into something that could be called the vet dreams of Barnet. So the media, government, corporations, et cetera, are able to shape our perception, but shape it in the response to what they already know about us. And hence, that perception shaping becomes almost perfect to guide us towards what they want.

And as a little anarchist at heart, I find that dramatically disgusting. Let's call it that way. Yeah. It's fucked up. You know, is it allowed to say fuck? Okay. It's fucked up. It's fucked up. And I don't want to be part of that. That's it. Yeah. Yeah. It's definitely something that I've started to feel like more and more is not something that we can change through political action. It's definitely something that I would hope that that would be possible.

But privacy seems to be an issue that is maybe even past the point of no return when it comes to political action, at least in most countries, that there may be exceptions out there. But was there a third point that made it a different topic? Well, the philosophical and spiritual points are mixed together. Okay. Wanted to make sure you covered all this. Yeah. Those are really, really interesting. And I like the philosophical and spiritual one that you brought up.

I think is a very good companion to that.

10:00 that idea that privacy is the ability to reveal yourself selectively to the world. And I think that goes really hand in hand with what you mentioned, that the things that you can choose to keep secret are the things that are, yeah, the things you choose to keep secret are the things that are unique to you and irreplaceable and, yeah, very much not necessarily give you value as a person, because I feel like we, I think we do have innate value, but they're the things that make you unique and irreplaceable.

And I think that's a fascinating angle that goes hand in hand with that idea of privacy. Yeah, I would probably make it even a stronger point. So you say that we have innate value as a person. In theory, I agree to that. In practice, it is something that needs to be expressed to be true. And if you treat the unique and secret and let's use a bad word here, sacred things about you, and you just throw them out into the world, you're kind of demonstrating that your value might just be very theoretical.

You're really showing that you don't value yourself enough to keep those things private, or at least to share those things only with people who you trust and love and are close to you. Exactly. And the other thing you do better is also you demonstrate towards other people that you value them. So if I tell you a secret, if I share with you, it's a demonstration of your elevated value to me. Yeah. If I don't share that secret with everybody else on the planet.

You know, so it's actually a way to show and to demonstrate closeness. And if you have nothing private to share anymore, then how do people actually know what they mean to you? Yeah. Yeah, it's definitely true. I mean, without privacy, there's no ability to have intimacy or close relationships because there can be nothing unique about that relationship if everything is known by everyone else. It's a fascinating angle I hadn't really thought about before.

Yeah. I don't even know how to properly segue from that onto the remaining questions. That one kind of hit hard there. You can take a break if you want to. I'm going to sit on that one for a while. We'll jump right into the next one, and maybe we'll come back to that later on as I think through it a little bit more. But what's a common myth that you've run into with personal privacy? Well, that is one of those things I've been discussing with a friend today because I really stumbled over you sending me the preparation for this call and where you asked this question or said, okay, I will ask this question.

And I was thinking like that is a question that would have been easy to answer a couple of years ago, but that has become really hard to answer for me today. I'll explain. So a common myth, there are a lot of common myths about privacy. There's this common myth. If you have nothing to fear, you have nothing to hide. Or that privacy has become valueless in a civilized society. Or that it is impossible to maintain privacy. So those are like common things that you hear.

Or things like nobody is interested in me, so I don't have to protect my privacy, which I find a dramatically sad statement. Very, very sad. So those are like standard tropes you hear. But I think that for a long time I have assumed that those standard words mean something. You know, when somebody says that to you, that they actually mean it. And by now I'm not sure about that anymore. I think that a lot of that is just repetition without content.

And more like a justification, like a social justification, not a rational justification. So I think that the common obstacle, so I will rephrase it, the common obstacle is that we live in a culture, most of us live in a culture, like for the best that is true. I really hope that there are other listeners than just Americans and Europeans. For the best, it is true that privacy has become something that is not a cultural value anymore. Yeah, absolutely.

And it is something, it has been overcome by a compulsion for sharing and transparency. And your thoughts about what to share, how to share it, what to demand from others what they share, has become an important aspect of the inner cultural status games that are going on. And I have to admit that I don't fully understand that, because I find those aspects of culture disgusting to a certain degree, or at least I don't have a real emotional access to them.

So I can't really reply to that anymore, because it's just alien. It's an alien cultural cult to me. And I think that cross-cultural communication is dramatically more difficult than within a culture. And I think that so far, we haven't really considered it to be a cross-cultural argument. So I don't have a really good answer for you. I'm sorry. No, I think that was a great answer. I mean, breaking down those common myths are not often closely held beliefs.

Like you said, they're things that have been impressed upon us, that we just repeat. It's just repetition, and not something that we... I don't think anyone who actually thought deeply about that kind of a response to the issue of privacy could honestly say that that's a personal belief that they've come to on their own. But I think you're right that culture has shifted away, especially, obviously, I'm talking about Western culture. from America.

Culture has shifted away from what was a closely held belief and right to privacy. It was very much a part of this country early on, and even until fairly recently. But I think that the narrative has been so deftly shifted by governments, and more recently, corporations, that we've given that up in exchange for other things that we've been promised. Most notably, we've been promised safety, where we've been promised freedom from fear, and the thing that we've been asked to give up is the notion that privacy is something that we have a right to, or privacy is something that is good, and that is a native good that everyone should have.

Yeah, I think it's actually worse than that. So you're talking about the promise of safety and security versus privacy, and that it's a bill of goods that has been sold to people. And I think it's worse than that. I actually think that media has far more to do with this shift than politics itself. Because there's this thing that comes up, I think, in the 80s, and there's this notion of 50 minutes of fame, this notion of being a celebrity, and sticking out from the masses.

And you suddenly get this thing, I mean, it started in the 60s, but it accelerated into the 80s. It's all about expressing yourself, expressing yourself, expressing yourself. And if you add another 20 years on that, you end up with Instagram. And no politician says you have to go on Instagram because it makes it safe or secure. You know? People go on Instagram and all those places because for them, it's a way to demonstrate that there are somebody.

I mean, of course, it is curated, so there's still something like privacy in there, in the background, because they still choose what to publish and what not to publish. But the notion that you should publish is relatively universal. And you kind of have to be places to exist. You know, if you're not on LinkedIn, Insta, TikTok, whatever, you don't exist, you know? And you see that in how people make apartments for a party or how they manage their social environment.

You know, it's all put on those systems. You know, I mean, what the fuck? People put family photos on Facebook and think that it's sharing, you know, and having a community. So, but it's really what we have done as a culture. It's a circle.

20:00 good activity for having actual relationships and the moment you're stepping out of that and you're saying okay i'm not going to participate then um your life becomes dramatically harder so for example um ask a normal high school girl these days if she would date somebody who doesn't have a social media presence the answer to that is no of course not you know he's probably a serial killer because otherwise he would share you know and there's certain truth to that you know it's you're sticking out of the masses if you're you know not there yeah um so in in a way it has become a new social mechanism that is far more than just politics it's a social mechanism that is much deeper and it's been pushed by by media and of course um it companies and all those things but it is it is always people that accept those those cultures and really implement them and they enforce this in their peer group it's not the government you know there's the government is usually not running around uh with you know guns and saying you have to join cyber um facebook you

know they they usually don't not yet at least so it is a thing that we are doing to ourselves as a um and not because of uh political promises and i think that is the real issue because the political promises you can rationally argue about um when it comes to those new cultural mechanisms arguing about them is it's like um a hindu and a christian talking about theology you know it's there's a limit to how far you can talk uh before you don't understand each other anymore yeah yeah i think yeah governments are definitely not involved in that i guess that would be more the corporations that have been the ones that have been incentivizing us to to share broadly but it has become a tenant of our culture we have accepted to publish those things oh yeah absolutely it's we have accepted it it's become core it's it's something that i've seen i mean i'm obviously relatively young and have grown up in kind of the the beginning of social media taking over and i have no social media presence outside of

my twitter which is not it's not a personal uh social media accounts not something that i'm using for like sharing family photos and things that i'm doing but it's something that i use as a as a platform but i i have seen how not being on those platforms i miss out on things not being on linkedin miss out on job opportunities because i choose not to be on there um there's a lot of things that you you almost get excommunicated from the core of culture because you choose not to be on social media or if you are on social media because you choose not to be constantly sharing and revolving your life around what you can share next on those platforms um that is a it's a very interesting thing that we have we have chosen and not even not even because of fear but we've chosen because of a desire for social acceptance because that has become a core tenant of of our culture in the west because of that desire we've just voluntarily given up our privacy and made it natural to share any anything and everything that's going on

in our lives with a a community that is likely not a close community i mean i i have cutting myself off of social media i haven't lost close relationships i've actually realized that the relationships i actually have in real life have gotten better because i'm not spending time in this place is building these kind of pseudo relationships with people that i may or may not be close to and it's been an interesting transition for me but i think that more people would realize that if they limited and limited limited and maybe cut off completely their time spent in social media and revolving their life and what they do around how they're going to share and interact on social media and focus on real world relationships and real world friendships yeah yeah and and i think there's a dangerous aspect to that and the dangerous aspect is really what what happens in the culture if you don't participate like you you know or like me i mean i have a twitter account but it's not a personal one um but what happens if if if you actually value their privacy offensively what happens is that

it causes mistrust because you're you're in a certain way you become an uncalculatable outsider of society and there's this insecurity that people have about you i mean when i say people i i mind both specific individuals but also the mass of people and we there i think politics comes into play again because you know politics is about the many right so and one of the things we we see there is this push there's this this triple push that is happening around privacy um in our culture and the one push is uh we want transparency so we want transparency about um everybody that we perceive as being um powerful or rich or uh famous or whatever we want transparency about them and we think we're entitled to know everything about them and if you don't um the next thing that happens is conspiracy theories you know why why doesn't he share that you know why isn't he open with us does he do something in the shadows you know so it's it's immediately this it's almost like an immune reaction of of society um against people that don't follow

the code and you can see that um dramatically in in stuff like the pandora papers and panama papers and stuff like that where most of the behavior in in those papers and i consider publishing those papers as a violation of personal privacy um without public interest um what you see in those papers is not a bunch of criminals but it's a bunch of people that have chosen to protect their financial privacy in one way instead of another and the fact that they have chosen to do that um creates panic and creates oh we have to know you know there must be something behind it you know whatever the the kindergarten friend of putin has so many millions so it must be connected to putin and this is where all the shadow money is and then this politician bought a house for whatever 20 million um that must be bribery you know and it's it's an obsession with transparency that you have there that's number one the number two is of course this narrative um we have to limit privacy for security sake but i actually think that that narrative

becomes less and less catchy because so far they haven't been good in showing that this link actually exists yeah and on the other hand there might be a pretty good argument for the opposite and that is you need privacy to have security especially in the digital age that might actually be truly the case because data leaks and hacked cloud accounts etc they are a security issue because you were not private in the first place so there might be a strong link actually that supports security by having privacy and then there's the third aspect and the third aspect is this that is really between the political camps you know the left and the right so whoever is in power will blame the other side for surveillance because they're like five percent of votes you can get by blaming the other side for surveillance so if the if the right is in power they will say whatever in the us you know obama you know what was it um yes we scan you know the slogan yes we scan you know um the left is bad because obama is the president and

he uses surveillance so you get a few points in the next election for that and then you turn it around and um the next dude is trump you know and then oh trump now has access to all these things that we collected this is really bad you know we have a tyranny with access to the data um you know you shut down the nsa because trump could abuse it you know and then i don't know maybe in half a year or a year you know it will be or biden is spying on all of us you know from the right again so but none of that is actually an honest argument you know because when they do it themselves it's never a problem you know it's only when the other one does it and i think you only get to the truth when you're not part of any of those two camps and you realize that they're both abusing you and that when our power is connected with surveillance and all these things you get into a really bad situation so it doesn't really matter who's spying on you um but i don't think that the nuance of that argument um is actually well received

in society anymore because of this cultural shift and this cultural shift also includes something where we more and more consider privacy as a privilege not a right so it's a it's only given to people as long as

30:00 they're behaving nicely. But we have no problem of taking that right away for somebody who doesn't fit either by his behavior or criminal acts or whatever. Then we take it all away. And because we want to be able to take it away, we can never fully grant it. You know, if all the world would support privacy, then you cannot take it away from criminals anymore. You cannot take it away from the celebrities anymore. You cannot take it away anymore to gossip about your neighbor.

You know, suddenly you have to respect it, even for people that you don't like. And I think that's an issue. Yeah, those are great points. And the last one about just blaming the other side and everyone feeling like the whatever political party or group they're not a part of, they feel like that group is always the one who's creating these surveillance tools and using them wrongly, but don't realize that, like you mentioned, both sides are just as to blame and have both either implemented or continued to use the surveillance tools that we have to fight against nowadays. And it's not something where one side is better than the other. The current people in power are the ones responsible for that. Something that I have to bring up a good bit as people just kind of get, I think, blinded by the political views that they hold, whether those views are right or not.

They get blinded by those and don't see that there's a joint effort to destroy our privacy that continues no matter the political candidate and continues no matter the political party. Exactly. And I think there's a real danger there. And that is, whenever your side is in power, you also believe that you can have legal action to protect your privacy. And then people rely on on legal codes. And I can just tell you as one thing, as somebody who's worked on DV and IT, the law only exists where it can be enforced. And if it's companies, if it's other organizations, if it's states, if it's private parties, it doesn't matter.

They only protect your privacy when they could be caught breaking the law. Otherwise, they try to get everything they can. And legal protections are really weak. So number one, you don't see where they're broken necessarily. That's number one. Number two is they can be changed all the time. And then data that has been collected under one legal regime suddenly becomes available under a different legal regime. And that really means that when we're talking about the legal aspect of privacy, the only thing that we really want there is the right to protect ourselves and to help others to protect themselves.

That's it. If you think that some nice act can prevent cloud providers from having a secret data basis about your connections and data, whatever, you're grossly mistaken. You have to protect it yourself and you have to protect it in cooperation with others. So it's not a really individual thing. It's kind of have to have a community of people that protect privacy. But the law ain't gonna save you no matter who's in power. It doesn't matter. So the law never saves you when it comes to privacy.

Hmm. Yeah. It's really just about decriminalized privacy. You know, that's the main thing. Decriminalized privacy and we're good. Yeah. I love that point of I just want the ability to reclaim privacy for myself and to help others do the same thing. Like that's really the core of it. I want to have control over what I share and what I don't share. And then I want to be able to help others to do the same thing. Hmm. And that really that that should be true regardless, but not relying on the law to enforce those things or things like GDPR to ensure privacy.

It's not gonna it's not gonna be the end all be all of of privacy. It's something that we're gonna have to take control of ourselves and take us towards ourselves. And the law is often actually negative. So the impact of privacy laws is often negative because people then turn around and say, okay, we can trust the law and then everything will be fine. Mm hmm. But as I said before, the law doesn't work, you know, it doesn't. It's it especially doesn't work when it comes to data, because data is easy to copy to hide to transmit to, you know, all those things.

Yeah, so there's no policeman that is going to be able to go after every single copy of your point collection, you know, say they won't and they can't. And because that is the case, all the laws are they work against people that actually respect the law. But the problem is that we actually write laws to catch bad people. And that simply doesn't work. So if you rely on the law here, we're basically mistaken, you know, it's the, it's always gonna fail.

Yeah, grants a false sense of security. Yeah. Yeah. And I, we went through quite a few different things that people believe and different roadblocks people run into. Um, but I wanted to kind of circle back to that idea of a, of society voluntarily giving up their privacy. And I'm curious if you have any approaches or ways that you try to help show people why that's a problem and help them to get past that roadblock and realize the need for personal privacy.

Usually I do that by insulting them. Um, um, and I'm not going to repeat that, uh, just so we can stay within the ability to publish this recording. But, um, the, I have given up on a lot of these, um, rational things because, um, people make decisions most of the time emotionally and they're not making them rationally. And even if they sometimes have a rational implementation, it usually washes away with emotion. You know, it's this, it's a typical thing. Um, I don't know, you have that with a bad behavior in general, you know, you, you're smoking too much.

And rationally, you know, that you should stop smoking. And if you stop smoking just from a rational standpoint and nothing else, you will start again. You have to have an emotional inner drive for it as well. And it's the same thing with privacy. You know, even if you convince them on an intellectual point once, um, just wait a few months and they'll be stripping on, on Twitter. So. And because of that, um, and because I've seen that too often, I kind of, I kind of, I'm going to go to the next.

Um, and, um, and, um, comparing them to, to other people that are offensively anti-privacy. And that has an interesting effect. So there, there are some people that of course completely freak out. Um, and, um, um, that is okay because then, uh, you show your true colors. Uh, and there are other people that actually, actually are stopped in their thinking because they realize that all the things they say against privacy, all the arguments that make against it are just justifications for something.

They pre-decided on a false emotional image. So is that black rhetoric? Yeah, I think it is, but come on, you know, it's closer off time. You know, it's yeah. Yeah. I mean, I, the time for niceness has kind of ended. I think. Yeah. It's a, it's a, uh, divisive approach, one that can be, can be helpful. And I think, I think that, that point you mentioned about needing an emotional reason or, uh, something more than just a logical or, um, reason based approach to privacy is very important.

I think a lot of times the people you see that have woken up to privacy was because it was very, it was something very personal that affected them, or it was something very aggressive that they faced. It's people who grew up in countries that, um, had struggles with authoritarian rulers and they had struggles with privacy affecting people's actual lives, not just theoretical, but actual lives. Yeah. Or it's people who had something that was, was very important that was revealed without their, their knowledge or revealed without their consent. And it shook them up and showed them why privacy matters. And yeah, I don't, I haven't had much success talking to people and just showing them like, these are the reasons why privacy matter. It has to be something that they realize like, oh, I actually do care about this.

I do have things that like we talked about earlier that are unique to me that are special to me that if I share those with everyone, it, it hurts the ability to have intimacy with other people or to have close relationships or to maybe in the future, if your government changes or something like that, we've talked about that a lot. It could hurt you in the future with the ability to have a livelihood, to have a job, to have potentially even your life, depending on, on how serious things get.

So it's, it's something where people need to have a visceral reaction in some way. And prompting that can be, can be as simple as just telling your story, your, your approach to privacy and why that, why that has woken you up or yeah, I haven't taken your approach yet, but we'll see. It's probably because I'm an old cynic by now. So I'm happy that you still have nicer approaches. I'm trying to, trying to stay away from cynicism, but it, it does get harder and harder.

I understand why people end up there.

40:00 and it's a constant battle to try to stay hopeful but realistic, I think is kind of the approach that I take, realizing where we are but hopeful that we can keep pulling people in and keep growing the community that does realize the need for privacy and are taking active steps. Yeah. So for me, there's actually like the approach of evangelizing privacy has kind of stopped. So for me, it's really about helping people that already know that they want it and also not just helping them technically or emotionally or rationally but also trying to create a subcultural appreciation of them, you know.

And that for me has become a much more important aspect of this whole struggle is to care about the people that have, you know, fallen down the rabbit hole. Yeah, I definitely agree. I mean, that's why I started doing this podcast is I wanted, for those people who did wake up, like I know people aren't just going to listen to opt out and suddenly decide they care about privacy or at least I would doubt that would be the norm. But I want a resource for people who do realize that need to be able to start figuring out the, I think, the philosophical reasons we talked about are very important for people to realize what the narratives are and why we're going against them and for people to realize both what the tools are available to them and how to use them.

So that's definitely, I do think that that's the most value add. It's very hard to wake people up, but if we can create the tools, create the resources, create the material that helps those who do wake up, I think that can be a much more vital approach towards that. Indeed, and I think it's really important because if you're alone with going against the grain, opting out, et cetera, that can be really tough, like emotionally tough. And just seeing that there are other people that care about the same thing, just care, you know, and talk about it.

They might not have the same opinion, but just seeing that other people care and seeing that there are other people that appreciate your choice to be more private, that is greatly empowering. Yeah, no kidding. Community is such a huge, huge part of this journey towards privacy. And I mean, to life in general, but especially, like you said, when you're choosing to become countercultural, as we talked about, it's very countercultural to care about privacy, to take active steps towards it.

So when you're choosing that, it's very important that you have people around you who realize that, who can both help you technically and just be a support system for you. Yeah. One of my favorite questions that I ask every guest, and I'm really curious to hear your responses, is what's something that you feel like almost no one agrees with you on? Since I'm probably the most disagreeable person I know, it's a million things. I'll take two things.

Number one, cryptocurrencies are the solution for financial privacy. And I disagree on that. I think that they're a bad idea. So that is number one that people disagree with. And number two is, I don't think that low latency privacy protection is really useful in most cases. And that includes holy cows like Tor, for example. And I think that a lot of privacy defenders are dramatically naive when it comes to the approaches of state corporations and organizations in between when it comes to undermining the privacy.

So I constantly get into battles with people that defend Tor and Bitcoin and stuff like that. So I'm very disagreeable there. Yeah, definitely. I would love to get into both of those more. I'm really curious, especially about the first. I don't know if we'll get to that today, but may just have to chat offline about that more. I think the second point that you mentioned ties in really well to the paper that you wrote in 2011. And that was pre-Snowden.

So very early days for talking about global surveillance. I know there have been many people who've talked about that in the past, but at least pre kind of the wake up for many people. And you wrote that on how global surveillance can realistically be accomplished. And I'm curious if you don't mind breaking down kind of the core of that, what prompted you to write it, and then how you've seen those things play out, but also just how that explains here, what you were just talking about, about how like Tor and those kinds of tools aren't kind of the holy grail of privacy.

Yeah. So the paper was originally a single email that I wrote on an email list of people that cared about privacy and freedom. And there was this constant argument that was made that it is impossible to surveil everything. And everybody just said that, but nobody really was able to show that it's true. And so when there was this day again, you know, I probably had too much coffee or something. And there was another email saying, you cannot surveil the internet.

The internet routes around surveillance. And I freaked out. So most of the things I write are from a position of anger. Sooner or later, I'm fed up and then I do research and then I write a rebuttal. So this is where the paper comes from. So it was originally just a very long email by somebody who had been in digital networking, et cetera, for a couple of years. At that point, I had like 10 years under my belt working with ISPs, running VPN providers, running hosting systems, et cetera.

So I knew a bit about how to deal with data and how to deal with networks. So I sat down and just wrote this email. And Steve was on this email list as well. And Steve said, okay, great points you make. Now, I know that it's all true, but let's add some source material to it. So that people just not have to believe you, but can actually go to the sources for that. And then all of that came this, this paper that was presented at DEF CON among other things and got exactly zero response from the privacy community and got a lot of response from the intelligence community.

So I actually had like at least a dozen reach outs from intelligence agencies, from companies that provide technology for lawful interception, data analytics people, et cetera, like not directly from the heads of those organizations, but for people working there. And the response was more or less, yeah, yeah, it's all true. Great paper, but it's even worse. So I never got around writing a follow up to this, but I had all kinds of people like Cisco, Nokia Siemens networking.

I had several NSA people contacting me, et cetera, et cetera, et cetera. And actually opening up my, my own knowledge much more in the field. So the paper itself is not complete. You know, it's a very, very shallow treatment actually of the topic. And it's frightening enough if you really understand it, because what I try to do in the paper is to show how much does it cost to surveil the whole internet? What's the money you need for that? And that has to do with, you know, what, what kind of traffic do you have?

How do you deal with traffic? How to, do you optimize your collection? And then comparing that a little bit with the perceived use of surveilling everything. And then making the game theoretic argument that the moment everybody knows how cheap it is, you have to do it because otherwise you're locked out of strategic information. So it is something that if you realize how cheap it is, you're entering an arms race. You have to do it. Yeah. And that is more or less exactly what happened at that time without me knowing, you know, from, I didn't have like insider information.

So it was just public sources and my own understanding of how things worked, but there was no, no background information I had. I didn't work for any of them. I didn't know what exactly they were doing. And the fascinating thing is that in a way, the, the strategies that we propose in the paper are very much what the NSA has done or NSA plus GHCQ and whatever else the, the parties there are with the little exception that they have optimized the, they have optimized the,

50:00 it to a point that I never thought about. And that is, they didn't view it as a purely competitive environment, but as a competitive and cooperative environment, which makes it so much worse. And I didn't think about that. So the argument why global surveillance is inevitable is much stronger if you realize that they have ways of cooperating with allies, but also with competitors. So there might be sections where their interests overlap and they can cooperate. And that makes the argument so much stronger. And a lot of the strategies, as I mentioned, are what you find later in the Snowden papers. If it's tapping into internet exchanges, if it's tapping into landing points, XQ score is something that is shallowly described in the paper as your ability to do global filtering and selection to reduce data and focus in on sources that really matter. And of course, the NSA has done it dramatically better. I thought about this thing between breakfast and lunch. And they thought about it for a couple of years with

people that were dramatically smarter than me. And they have created a pretty awesome system that is really frightening. So that is what the paper is. The paper is the argument why such a system must exist. Let's take a quick break from this episode to chat about the sponsors of OptOut, Cake Wallet, and LocalMonero. Cake Wallet is a key tool that I use daily, as it allows me to easily and quickly use Monero for private by default payments. It's available in both iOS and Android, and is a fantastic way to get started buying and using Monero, with a simple and easy to understand user experience.

I regularly onboard new users to Cake Wallet, and hope that it will help simplify and ease your journey into cryptocurrency. If you're interested in purchasing Monero for the first time, we're hoping to bring others into a parallel economy. I'd recommend you look at using LocalMonero, like I do, to buy and sell Monero while maintaining your privacy and avoiding invasive exchange surveillance. LocalMonero is entirely peer-to-peer, and is an important part of opting out of the surveillance state and into a parallel economy.

Thank you to both sponsors for their incredible support and partnership, and I hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com slash sponsors. Yeah, I unfortunately didn't get a chance to read it before jumping in, but as someone who has worked in cybersecurity and obviously studied the resources that Snowden leaked and looked through that, it's terrifying once you realize the capabilities that have been out there for quite a while.

And not to even mention that you mentioned motive a lot in the paper, and that's kind of a core focus. Once you have that motive and you have essentially unlimited resources because they don't really have budget constraints, or at least not in the normal way, you realize that that's not... They're not startups, yes. Yeah, no, they are. They're not startups. They have consistent funding and probably far more than is publicly listed on budgets. So it's not something where they don't have the means, and we know that they have the motivation, and we know that they've been doing it for quite a while and are only improving in how they do it, which should hopefully be a wake-up call and give those who have woken up a sense of urgency to take some active steps towards protecting your own personal privacy.

But you mentioned in the last question about something people don't agree with you on, that tools like Tor aren't effective. Would you mind explaining a little bit your thoughts around that? It's definitely something that's counter to a lot of what I've heard, but I'm curious to hear how that fits in. When I say that, it's a statement that is kind of designed for pissing people off. Because Tor is effective in some sense and not effective in other senses.

And let me explain that. Whenever you're talking about security, and I consider privacy as a security question, you really have to define your threat model. Like, who are you defending yourself against? And what are the capabilities of your attackers? What are the motivations of your attackers? What are the constraints of your attackers? And you have to know these things and put them into your threat model so you can measure a method of defense against the threat model.

And there's one threat model that even Tor admits that they're not protecting against. And that is the so-called global passive attacker. So what a global passive attacker can do is you can listen to all traffic on the planet. The interesting thing is we know of at least one of those groups that can do that. You know, it's called the NSA. So they can, in theory, do that. But if they do it in practice and if they target you on Tor with that, it's a different question.

But the ability is there. They can listen to it. And there's a simple reason why Tor cannot protect against them. And that is that Tor does not conceal the signaling metadata when it comes to package size, package frequency, etc. And it's even worse than that because the changing of the Tor cells, like the connections within Tor, that they change relatively frequently actually leaks information about where you're coming from. Because you have the same traffic pattern in multiple parts of the network.

And if any of those parts of the network are compromised, then you have a problem. So what does that mean in practice? It means in practice that if you're using Tor to go to something like Facebook, and you're looking at a profile that is widely looked at, let's say Biden. You know, does Biden have a Facebook profile? Probably. I would assume so. I thought that he's only on OnlyFans. Never mind. So you go to OnlyFans and look at Biden profile. You are one of many people that do that.

So your specific traffic pattern, like what images are loaded, like how big are the images, in which order do you load stuff, is not really leaked. Because a lot of other people do the same thing. They look at the same profile more or less at the same time. So you're leaking nothing. However, if you go to a website that is relatively unique, then you're leaking a traffic fingerprint that you don't share with a lot of other people. And when it comes to surveillance and de-anonymization, this single call on a website and loading the website is actually not what matters.

What matters is that surveillance is a multi-round game. So you're looking at the network. You make a hypothesis about who could be the person looking at a certain website. And then you wait a certain time. And then you test the hypothesis again. And then what you get is a subset of people. You know, those two sets, the two candidate sets intersect. And there's a new set that is much smaller. And then you do that again. And then the set becomes smaller again.

So it's a multi-round game. And while a single call to a website might be protected by something like Tor, it is not protected when you go to the website again and again and again and again. Because sooner or later, this hypothesis becomes more and more matchable. So that is the theoretical reason why something like a low latency relay network cannot protect you. And that is widely documented and known in the anonymity research community. Like in the academic community, everybody knows that.

And then there are, of course, more elaborate attacks. You know, something like network intersection. So you're looking at what potential hops could you have made through the network. And you can do that by, for example, time tagging. You can see how long does it take a certain stream of packages that have a certain characteristic to enter the Tor network on one side and then exit at the entry guards. So, and there are quite a number of those attacks that make use of the fact that Tor cannot hide certain characteristics.

And it's, I'm not blaming Tor for that. It's, it's just that there are limits to the model. And no matter how good you, you create your software, you will not overcome the limits of, of the model. And the problem is when people run around and try to sell use cases for Tor that break the limits of the model because they don't actually understand how things work. That is a problem. And so I don't understand.

1:00:00 as bashing tor and bashing people that consider tor as the best solution for all threat models because it's simply not and this even goes down to the point that uh one of the main issues of tor if you're not um a global attacker but you know you're just a company like mine um you want to analyze tor and see what people do um one of the the main issues is that you can run sibling attacks against tor which which basically means is you're introducing tor notes into the network and you can do that stupidly and you can do it smartly so if you do it stupidly the tor people will figure that out and block your your notes you can also do it smartly you know take your time have a few company front companies run a few sub-popped accounts etc etc and then sooner or later you have a few hundred or maybe a few thousand of those nodes established and what you can do then is um the more of those nodes you have this more stable they are the longer they're in the network the more likely they are selected as entry cards which is awesome because you directly see the ip address of the user

and um if you on the other hand are something like a big company or a police or whatever you can also afford running an exit node and then what you can do is you can um control how traffic between your exit node and all entry guards flows in the sense of that you can delay traffic um that you can compress traffic etc and this pattern of delay and compress you will be able to find in your entry notes again um and that is just one of many attacks you can do and for that you don't need any special uh privileges you need money for it not much so there are estimates um like academic estimates on how much tax like this and others cost and they're roughly around 20 000 per month and 20 000 per month is so small that that again game theory hits um because game theory tells you if you're able to do that and you have an advantage from doing it you should do it you know because especially because others know that as well um because it might be a strategic advantage to have control over it and that means that it is um

extremely likely that there are companies out there that have infiltrated the tor network and i'm not talking about caa or something like that because um in reality like caa and it's a blah blah blah do do not do most of their dirty work most of the dirty work especially when it comes to technology is outsourced um it is you know there's a company that comes and says okay i have a really good solution for you to de-anonymize tor and then this deal with the company gets a special compartmentalization so basically nobody who's not involved with that will know about that the company uh probably gets something like 500 000 a month for a job that only costs 20 000 everybody's happy there's a lot of cocaine and hookers and then you can basically call the company and say hey i need historic data no we had an access to this website give us potential um matching users for that and then they'll deliver you know something between one and thousands of of potential um users that could have accessed uh this resource and then um it's the

job of the police or whoever else to drill down on those ip addresses further and say okay um how good is the case that you can make especially without revealing where we have the data from and it's called parallel construction you have to come up with a story that explains why you know that some person was on uh biden's only fan profile so to summarize a bit the core of what you're saying i think is that tor is not i mean hopefully everyone agree with this tor is not the perfect solution to all privacy problems and it is not specific it's specifically not effective against targeted and motivated attackers or attacks exactly exactly but it it is a useful tool to protect against dragnet surveillance and against general surveillance but it's not it shouldn't be viewed as like if you use tor you're fine and if you don't know you're not fine no i disagree i don't i don't actually think that it's that great against dragnet it's interesting so um so from a technical point of view there's it is not um there is however um there's a standard

argument that is made all the time and that is that the tor notes are distributed around uh the planet if you really want to get into that you have to deal with a shit ton of tor notes you know like right warrants blah blah blah um in different jurisdictions so you'll never be able to do that it's too expensive to do that and that is the argument why why it doesn't work for dragnet surveillance but that is not how dragnet surveillance works dragnet surveillance doesn't work by a prosecutor sitting in in his little office and writing a million warrants it's by tasking a unit in the nsa to say how can we get this data without a warrant and then you come up with things like oh wait a second we have a public list of of tor notes um we have a very limited of a number of routes that the traffic between those tor notes can have um and we have an extremely limited number of um internet exchanges etc where we can see that traffic and you know what we actually don't have to capture that traffic ourself we can actually buy it from the internet exchange or from the data center directly because

that data is sold because it's needed for other things like anti-ddos or um for incident response in in cyber security uh cases where we basically go to certain companies and say hey i really want to know um who used what are the ip address of somebody behind an open proxy was and you can look these things up because they're recorded and the same thing with less precision is true for something like tor it's less precise i mean that is true so tor increases the ambiguity of course you know and there are a lot of cases where it will not make sense to go and try to analyze store traffic because number one you don't want to leak that you're able to do that and number two is because it's actually expensive and hard to argue in court because it's a very probabilistic argument so you might not use it in court but you're using it you know as a lead or whatever you never tell anybody that you used it and when it comes to drag net surveillance dragness surveillance technically again is this not this

individual warrants whatever it's trying to get a global view and we know that they can do it and we know that they refine it so they might not be able to make too much out of tour traffic six years ago but they're continuously improving and they're learning and they're they're creating new tools if you if you look at the tools that were used by the nsa um when snowden did his leaks those tools are were a little bit disappointing because a lot of those tools were off the shelf for open source stuff you know i mean x-key score is basically a a web front and to a mysq database you know that is basically exactly what the papers say um after a couple of years and doing that for a longer while you begin looking at more targets you know what is what is interesting what what what work can we invest the money to specialize on so there's a difference between what can we do hypothetically and and what do we actually do because you have to distribute resources so yes even the resources of the nsa are not unlimited you know they have they have a ton of people to spy

on you know they have to you know focus and um so from that from that point of view there's no technical argument why tor should be great against dragnet surveillance there might be a momentary momentarily argument um like a snapshot in time argument that says okay they're not they haven't been doing it like three years ago or they haven't been doing it two years ago um but there's no argument why it shouldn't happen in the future because the the threat model and the technology um don't match so is tor not something that you use or recommend or it's just something that you're trying to kind of tame the expectations of it's taming the expectations so i i use tor all the time so um tor is booted when i boot my computer so um there's no no question about that there's actually i'm a little bit split when it comes to to um talking about tor so because on the one hand i don't want to bash it but on the other hand it's really important to understand what it can do and cannot do and where we have to continue in developing other

1:10:00 stuff because over expectations on tour also limit the the uptake of better technologies because everybody says oh yeah tour works so i don't have to think anymore you know it's a it's an easy excuse you know it's throwing a tool that you don't understand but the the nerd down the road said oh it's a great tool you can use it and protect yourself against the nsa you know so that's not a good good way of arguing your your um digital object so yeah um what i'm saying is using there are certain things that tor is dramatically grateful and that's a another of those topics that are hard that are hard to agree on but um tor is practically the only widespread global pseudonymous addressing system that we have so that meaning hidden services it is dramatically easy to set up a hidden service it's dramatically easy to use one and even though the implementation of of hidden services in tor are technically problematic i mean they're improving recently with version 3 but uh before that it was like um a little stepchild you know that was kept

in the in the heating room um they're improving on that and i think the tor is dramatically good for that and even to the degree that you can have a little bit of privacy if you have like high uh you know that you can have a little bit of privacy and you can have a little bit of privacy so that you can have a little bit of privacy and you can have a little bit of privacy and you can have a little bit of privacy and you can have a little bit of privacy and you can have a little bit of privacy so that you can have a little bit of privacy and you can have a little bit of privacy but i wouldn't ever bet my physical freedom on tor and especially i wouldn't make anybody else do this do the same thing yeah thank you i mean thanks for going into the the nuance there i think that's such an important thing that nuance often gets kind of tossed aside in many areas but especially in the privacy community oftentimes nuance goes out the window and everyone just kind of goes black or white with like tor is perfect or tor is a failure and uh you need to use this or you shouldn't use this

and and most people don't dig into the nuance so i'm glad that you're you're willing to dig a bit more into the the details and and your thought process there i think it's really helpful and um yeah there's an argument for it and the thing is in security privacy surveillance dealing with with shady organizations it is nuanced where where they get you you know it's not the the common mistake that is the big thing it's the you know the particular slip up you know the the false sense of security the not completely thought through threat model etc where where you fail and that is why it's important to have known so you have to understand the tools that you're using versus the capabilities of your your attacker yeah yeah definitely agree there um and i'd love to kind of transition into the background that you have in vpns um both that's an easy segue because tor and vpns are often talked about hand in hand and kind of the advantages of either one um but i also just want to kind of take a more

realistic look at vpns it's another thing that's very divisive in the the privacy community and i'd i'd love to hear more about why you've worked on vpns in the past why you've run companies that provide vpn services and kind of your thoughts around vpns as a tool for privacy or security or not as a tool for privacy as a security just kind of your views around vpns and their usefulness okay so i'll make it very short um all the bad things you have heard about vpns are true for almost all of them so um vpns as a class of tools are dangerous and and there's a reason for that and the reason is what you're doing when using a vpn is moving the trust that you might have in your internet service provider towards um an organization that will be able to capture exactly the same data that your isp could capture but can capture it even if you move um because you know you're traveling you're not always using the same isp if you're using the same vpn you know you you bring all of the data home and those companies usually fall under a

different uh legal regime than your isp so the the communication security and privacy requirements that your isp has to fulfill are usually dramatically higher than that what a vpn has to do which means that you will find a real big bunch of dramatically shady providers that will promise you absolute privacy no no dogs whatever and in reality you you couldn't sue them over it there's no legal recourse you have there's no law that forces them to to protect your privacy nothing and you give them all of that and that is the argument against vpns um the argument is basically also true for tor by the way because you're doing the same thing and in in tor you don't even have the protection of having a contract um so from a from a legal standpoint nobody can force a tor exit note to not capture your traffic well it kind of depends on what jurisdiction they are in but in general if i'm running a tor exit note and i want to capture your traffic i'm going to do that and it's something that has happened in the past there there have been huge leaks that have been released by exit note providers

you know academically just to see what people are using with tor so so that is that is like the fundamental problem the second fundamental problem is that most vpn providers um only look at one single thing and that is the question of do you keep blocks or do you not keep blocks that's the only definition of privacy protection that they have and that is a definition that is far too small because even if the vpn provider doesn't keep blocks nobody prevents the data center where the vpn provider has his computers um from keeping those logs and again it's a low latency uh relay same as tor which means that it's very easy if you just look at the timing of the packages on the incoming side and outgoing side ingress and egress it's very easy to match them so it's very easy to trace through a vpn uh if you're watching it and most vpn providers don't do nothing about that you know they they just plainly copy your your traffic from a to b and that's it um it's actually pretty easy to run a vpn provider uh you install ubuntu you know a little bit of wire guard uh two well four iptables entries and

that is it then you're a vpn provider you know um but the nuance of you know how do how do i prevent timing attacks um how do i prevent um flow matching between incoming and outgoing uh traffic um how do i prevent that i myself know which who the client is uh all those things are are very hard to do and most vpn providers never do that um they they never even have a technical argument how they would be doing that but instead they just say we don't keep blocks and that's it and that is why i think that 99.9 of all vpn providers are worse than using your isp with one exception and the exception is if you're living in a country that is problematic where you don't have any protection in the first place or when you're um on a badly secured wi-fi uh in a hotel you know then using a vpn has a little bit of an upside because you at least know who's spying on you you know as a provider so um that is the the only place where it really makes sense um and the the other things are non-privacy related so there are other uses

for vpns that are not privacy related um like you know overcoming goip uh blocking etc you know you want to watch netflix or or hulu or whatever then vpns can make a lot of sense there as a tool um but when it comes to providing privacy there are very very few vpn providers out there that deserve being taken seriously and you it's relatively easy to to recognize them because um you can ask them those questions you know like how do you prevent matching of ingress and aggress um how do you prevent that um your you can tag your traffic by the user account and stuff like that and you ask those questions and you either get a reasonable answer and potentially even a way to verify that because a lot of these answers are verifiable uh or you get hand waving and if you're looking for privacy then the answer to those questions should be a really long email with a lot of answers and comment line um um

1:20:00 command lines to try out that their claims are actually true. - Do you have any specific recommendations of providers? Or is that something they're not? - No, so there's another thing that is really important. And that is, in a way you have to trust your VPN provider. There's, you cannot get around the trust in systems like that. And again, that is true for Tor as well. You know, in Tor, you have to trust the faceless number of relays. And you're just hoping that because the trust is distributed over multiple hops, the event of having a cell, a chain of relays that are all untrustworthy, doesn't happen.

That's the basis of the security model of something like Tor. It's like, there are enough people that are honest. I claim that's not true, but there are enough people that are honest, so I'll usually not find only bad apples. With VPN providers, it's the same thing. And that means that unless you're technically really good, you will not be able to verify what I'm saying. And if I recommend a VPN provider, you will not be able to verify what I'm saying.

And then you will trust that VPN provider, even if you have no argument for trust. Same as Tor. And then you will trust it too much. And then you're fucked. So I will not make a recommendation. What I'm saying is there's a process. So you have to, when you buy a VPN, there are a couple of things you should be looking for. Number one is, as I said, you know, there are certain questions to ask. And the responses to that should be reasonable, technically verifiable.

That's number one. Number two is, a VPN provider that has no face, like there's no person at all that you could talk with, or that stands with their name for the thing, is a bad idea. A VPN provider that does not do any security research, doesn't have security people on staff, is a bad idea. A VPN provider that is in a jurisdiction where they're completely free from any risk of ever being sued, are a bad idea. Because all that are signs how people are trying to escape the consequences of, how you call it, dishonest marketing.

So you want somebody who is making themselves accountable. And sadly, that means that most of the big VPN providers are completely bullshit. And I mean, just look at what has happened to ExpressVPN. It's like, it's a perfect story. You know, I mean, it's, I'm sorry. It's a company with ties to Israeli intelligence, with people that have been involved in the NSO scandal, that have been involved in this Dubai spying organization, and so on and so on.

You know, and those people run ExpressVPN now. For privacy, I wouldn't use them. You know, like privacy in the sense of, I want data not to be leaked. You know, I don't want anybody to know which website I'm going to. If I want to prevent a specific website from knowing that, yes, that still works. You know, as long as you think that they're not sending the data back to the website, which I think is doubtful. But yeah, in general, the really big flashy ones, I have issues with.

There are a few that I would look into. There is one that I find friendly, mostly because I know the people. And so, for example, Mova is a provider that you could look at, because they don't make too much of a claim. They're kind of honest in what they're doing. And then, yes, there are extreme VPN providers that actually make good, like, huge claims. But they also can explain why they can make those claims. But you don't want to pay for them, because that is, like, very much in the IT sector, and they're expensive.

Like, you have to pay for traumatic services a lot. You're not going to get away with 10 euros a month. Yeah, I was curious if Mova or IVPN would come up, since they seem to be two of the ones that are very forward about the limitations of VPN, and forward about what they are good at and what they are not good at, which is usually a sign of good actors, but obviously not necessarily a reason to blindly trust. Just usually a good sign if someone's not making grandiose claims and they're actually telling people, you probably shouldn't be using a VPN.

I think that's usually a good sign when a VPN provider does that. So they've been two that I've enjoyed and heard good things from many people about. Yeah. I mean, I would add one more thing, and that is this trend of saying, don't pay for a VPN, build your own. You know, get a VPS somewhere and run OpenVPN or Vary Guard or something like that. Don't do that. No. Please. You're not getting anything from that because the hosting provider has exactly zero legal limits on what they can do to your traffic.

And there are actually reasons why they have to release information about your traffic. So the legal scenario of running something through a hosting provider is it's not in your favor. It's a really super thing to do. There's no anonymity there. Like zero. You know, the host knows who you are and that's it. So don't do it. The other thing is you don't even have any crowding effects. You know, you don't have multiple potential clients that you could hide behind.

You know, it doesn't exist. And the thing is, if you're always using your little VPS there and I want to do something against you, I only have one single point that I have to listen to. And I know all your traffic. I know where you're coming from, where you're located, et cetera. So if your threat model includes hiding your IP address, because that is the only thing that Tor or a VPN would be able to do is hiding your IP address, like your original IP address.

If your threat model includes having to hide that, then both the VPN and Tor are better than not having that. If you're careful with who you select as a provider. And they're always better. Well, a good provider is always better than running it yourself. Yeah. I'm glad you mentioned that. It's something that I've seen people bring up. And I stand pretty strongly against because I think people think, oh, I just won't log. And then I'm good and I have as good of privacy and as good of security as a non-logging VPN provider who knows what they're doing.

And that is not the way it works in practice or in theory or in reality. And you 100% will be logging. And I think that point about it being a single point of attack, it would be a very easy thing to surveil all of your traffic there just by taking over that VPS that the hoster can do at any time. I mean, they have complete access. Yes. So they can just easily take that over and start logging all to their things. Well, they don't have to take it over because they already own it.

Yeah. They get the English and the English. They're involved. Yeah. Yes. So, exactly. So it's always better to choose a good VPN provider over running it yourself. So if you're, of course, getting a shitty VPN provider, then, yeah, bad luck. But a good VPN provider like Mova, for example, is better than running it yourself. And also keep in mind that the VPN does not protect the traffic itself. So, of course, it protects the traffic between you and the VPN provider.

But the traffic will exit at the VPN provider in whatever format you put it into the VPN. So that means that you still have to be careful with using DNS privacy, for example. It's a thing that most people never think about. But the easiest way to surveil you is by just looking what queries you do at your DNS provider. So use something like DNS script, for example. So you at least use something like one hop between you and pod nine or something like that.

So that you don't immediately leak the query and your original IP address. And I would actually suggest often to not use the DNS provider by the VPN, that the VPN provider don't use

1:30:00 the DNS provider that the VPN provider offers. Because that already tags your DNS queries. So it's very easy to poison your local DNS cache. And then if you switch off the VPN and then do something else, and your DNS cache has still the poisoned entry, you're fucked. So that is something that very careful about. So DNS is really important to control. And the other thing is always and always and always use TLS, like end-to-end encryption for your connections.

There is no argument to ever not use it. That's it. It should be a crime against humanity if you ever switch off TLS. So you have to use TLS. But even if you're using DNS security and if you're using TLS, please still know that the IP address that the service is using that you're accessing, you know, the website, whatever. This IP address might not be unique for that service, because there are a lot of shared hosting and Cloudflare and all these things.

But it's unique enough. And furthermore, your TLS usually leaks what domain you actually want to talk with. So it actually makes sense to have a very, very modern configuration on your own computer. So, for example, there is something called encrypted SNI that prevents the host name from being leaked in your TLS connection and stuff like that. So that makes a lot of sense. And also keep in mind that when you want to protect yourself against the website that you're using or the service that you're using, there's a lot of other things they can do except for logging your IP address.

So that is actually one of the things where I applaud the Tor project. Yeah, absolutely. Because they have invested a lot of effort and they really have to let the charge against browser fingerprinting. So by now it's trickling into other browsers, which is awesome. But browser fingerprinting is a real issue. And then everything around super cookies, eternal cookies, et cetera, is a real issue. So if you want to have like real privacy, it will not ever stop with a VPN.

It's not a single click solution. But it means selecting the right browser, probably actually executing your browser in a virtual machine on a very widely spread operating system using exactly the same fonts as a million other people doing. Same plugins, same whatever. And even then, if your attacker is good enough, you're still fucked. Because the web is fucked. This is becoming a holistic resource for internet privacy. We're kind of hitting on all the different sectors here.

Yeah, it's been really, really interesting to dig into the technical stuff. But I did want to jump into a little bit your kind of your background, both your name as the real smuggler, which I thought was really interesting. And just you talk a good bit about crypto anarchy and being a cyberpunk. So I'd love to just hear a little bit more about that before we finish up here, just to get to know a little bit more about your crypto anarchist and cyberpunk views.

And then kind of where your name came from, if you're willing to share that. Okay, so the name is really easy. So a couple of years ago, I had to change my main pseudonym because the other one was burned. So I had to come up with a new one. And both my family and I have a little bit of a background in smuggling. So that is one of the reasons I took smuggler. And there's another one that I just recently remembered. There was a computer game called DSX.

And there's a weapons trailer in that game by the name of smuggler. And I really like that character. So I think those two things overlapped a little bit and led to me selecting the pseudonym. The pseudonym is only smuggler and not the real smuggler. The only reason the real smuggler is used is because I had to get a fucking Twitter handle. The original smuggler and just smuggler and whatever were already taken. So that is why the real smuggler. So that's the easy explanation for the pseudonym.

Cryptoanarchism, cypherpunk and cyberpunk. Cryptoanarchism is this idea of using cryptography and specifically cryptography that protects confidentiality to implement an anarchistic society. So a society in which coercion on the body is made impossible. And there are generally two schools of anarchism. So one school is, we call it the legal school. You have a system, a society where it's simply illegal to act coercively against somebody. And that is where most libertarians come from, etc.

And then there's cryptoanarchism. And cryptoanarchism wants to make it technically impossible to attack you. So no matter what the legal environment is, you're protected by cryptography. And I have been a proponent of that idea for, I don't know, 20 years at least. Well, more or less. I've become more extreme the old I get. But that is cryptoanarchism. And I think that if you realize what is happening today with globalization, with the internet, digitalization, cyber physical systems, etc.

Then it is clear that our current structures of governance are really challenged by the new world. That they might actually not fit at all. And they might actually be counterproductive and dangerous to humanity itself. Because the wrong political system and the wrong technological environment can lead to dramatic failures. Not just totalitarianism, but also to just mistakes. You know, if you centralize your systems too much, if you couple them too closely, you can come into really bad situations.

And we're seeing one of those right now, you know, with the supply chain crisis. That is exactly that. It's an unfitting system for the environment. And we're paying the price for it right now. And the same thing is true in politics. And I think that cryptoanarchism is the right political model for the digital age. And I don't want to dive into it too deeply because that's a podcast in itself. At least one. I mean, I think we did a recording on that.

There was like three or four hours. So I'm going to spare you that. But just as a teaser, it's the right model for the digital age. And it's the opposite of the transparency and show everything and Instagram whatever model. Okay. That is cryptoanarchy. Then cypherpunk and cyberpunk. So cypherpunk refers to a mailing list that was created in the late 80s, early 90s that dealt with questions of cryptography and their political implications. And a lot of the technologies that you're using today have been more or less invented in that context.

Like the people that were on that mailing list or even on that mailing list directly. And I've been a subscriber to that list under various pseudonyms for almost 25 years, I think. And have contributed in various ways to this and that project. So that makes me a member of the cypherpunk mailing list. So hence the cypherpunk. And then there's cyberpunk. And I like that you actually put that in there. Because cyberpunk is a literary category or how do you call it?

A genre. And so, for example, you have William Gibson with his new romance trilogy, etc. And the interesting thing with cyberpunk is it is focusing on the challenges of technology, specifically computer technologies and society. And it is not very optimistic there. And it's trying to think about things like what can hackers do? Or what if you can upload our brain to the computer? Which is basically what we do with Facebook.

1:40:00 or what are the implications if only the rich and the powerful have access to technology and not the rest of the world, which in a way is true because we're underestimating the powers of technology in the hands of our enemies. And so from that standpoint, I find Cyberpunk a very interesting aesthetic thought environment, especially the statement of low-life, high-tech. Even if you're at the bottom of a society, you can repurpose technology to your own advantage.

And I always love that about the hacker culture is, you know, take the manual, burn it, and do something else with whatever you bought. So that is an important aspect. And the other aspect is that though it's science fiction, it is kind of becoming true in a lot of ways, like the feeling of Cyberpunk. Not specifically, there's a specific predictions, but it's not, you know, it's a prophecy. It's thinking about things that could happen in our context.

And in a way, we live in a Cyberpunk world or are starting to live in a Cyberpunk world where big corporations and technology and state and robotics and psychological manipulation and all these things really begin to really matter. And like in the circle of my friends, there's an almost daily post that we do on an internal channel where somebody finds something in the news or a picture of a new technology or something. And the commentary to that is CPAF.

This is Cyberpunk as fuck. And we're living in a Cyberpunk as fuck world. It definitely does seem like that. I mean, I do. I love the Cyberpunk aesthetic and that literary genre, I think is so important. Like you mentioned, it's just a way to envision what the future could be like. And like you said, not necessarily prophecy, but I think a lot of it has turned out to be almost prophetic because it has been a very good kind of thought project to think about what can happen when technology becomes central in all these different aspects of life.

So I think there's a lot of good that has come out of that and hopefully a lot of chances for people to continue that thought project. And when new technologies come out, think about the ways that they could go to make smart decisions as early as possible on how you use it or how you support it or fight against it or just lots of different aspects, but a lot of value there beyond just the enjoyment of reading good Cyberpunk literature. And there's this fascinating personal part actually, and that is one aspect of a lot of Cyberpunk literature is dancing around the concept of super empowerment.

Like an individual suddenly through technology finding an amount of power over themselves or others that breaks all categories. And that is an interesting aspect because I think it was never completely explored in literature, but I think it's the long-term most important aspect of Cyberpunk is that we are probably entering an age of super empowerment where individuals, and usually not the good ones, will have powers that can challenge nation states.

Yeah. Yeah, definitely good. A good point and one that is somewhat terrifying, but good to have in mind and think about as we're kind of walking through the world and building culture around us. It gives you something to strive for, I guess. There you go. Awesome. Well, last kind of personal thing I wanted to get to is you are part of a podcast, Cypherpunk Bitstream, and there's a lot of value there. I'd love for you to just quickly plug kind of what that is and what people can expect taking a listen to that.

Sure. Cypherpunk Bitstream is a podcast by TAZ0, which is a temporary autonomous zone in the building in Berlin, Germany, and it's hosted by Frank Brown and me. And we're talking about all things digital politics, crypto anarchy, surveillance, weapons, building stuff out of shipping containers, the future of politics, the corruption of culture, and so on and so on. So it's basically two dudes with a strange background discussing topics that might interest other people with a strange background.

There's a lot of great stuff there. I love the topics they all cover. A lot of them are very rarely covered in other areas, so I feel like there's so much value there. And I like the long format, just get to hear a lot of deep thoughts. I need to listen to more of them. Yeah. Thank you. Thank you. Yeah, for sure. Definitely wanted to make sure that was mentioned because I think there will be a lot of crossover between my listeners and at least a few of the topics that you all have covered there.

A lot of value. Yeah. A question I ask everyone who comes on is just what are some of the tools that you use regularly to opt out that you'd recommend others to take a look at and then why? I know we've covered this a good bit in our talk about Tor and VPNs and all of that, so it may just be a summary of what we talked about before, but I'd love to get your thoughts. Okay. I'll go a little bit left field here and give answers that hopefully nobody else gives except for one, and that is cash.

So I'm a lover of cash and I pay in cash whenever I can. So that's number one. Number two is I really love the pandemic for one reason, and that is it gives us a justification to wear sunglasses and face masks at the same time. So that has been a dramatically liberating moment for me because I've done that before the pandemic and I always stood out and now it's like everybody's doing it and I'm thinking, hey, you're gone. Yes, exactly. So I do like hoodies, face masks and stuff like that.

Face-to-face meetings is a really important thing. It's a tool that I use regularly. It's the walking together in the park and having a confidential conversation. And then there are a few crazy things. So for example, containers that are a Faraday cage and voice masking technology that prevents microphones from picking up what you're saying. Yeah, those are definitely unique so far. I think we've talked a little bit about cash, but it's never kind of like a core tool that people focus on.

But yeah, as long as it is an option, which hopefully it will continue to be an option for a very long time, it is one of the most powerful tools we have for financial privacy. I also love gold coins. The combination of gold coin, a shovel and GPS is dramatically awesome. Be your own bank, take it to another level. Exactly. The world is big. And last question I have for you, Smuggler, is just what advice would you give to someone who's just starting to realize the need for personal privacy?

Don't be timid about it. So really realize that it is a thing you have the inborn right to do. There's no good argument that says that you should not be able to control your privacy. And be proud of being private. Don't feel awkward about it. Know that it's a highly valuable and very enlightened thing. And prepare yourself for really learning a lot of things and surrounding yourself with people that already know a lot of these things and realize that it's a community effort, but also a fun effort.

It's very fun. It is. And test the things that people say. A lot of people run around with wrong advice. You have to be able to test advice and you have to spend time on that. Yeah. Yeah. I love that. I think that's something that doesn't get brought up enough is that the journey towards privacy is an enjoyable process. And there's so much you learn along the way. There's so many amazing people that you get to meet. I mean, if I hadn't started to care about my personal privacy, I would never have been sitting down and chatting with you for two hours about all of these topics and learning about your background and all the other guests that I've had on, not to mention the communities that I have online now and just the actual technical process of trying out new tools.

And there's a lot of fun there. There's a lot of enjoyment of learning new things, trying new things. Like you said, testing out things that people are suggesting and recommending. And it's not all kind of doom and gloom. There's a lot of enjoyment there and you find such good community as you take those steps that that can often be one of the best things that happens is, yes, you get your personal privacy, but you also have great community around you as you're doing that.

And that can be a lot broader of a pro for you than necessarily privacy is, or at least maybe that you noticed today. Yeah. And let me add something there. And that is, a lot of people today think too technically about privacy and that kind of discourages people that don't have a technical background. My experience is that the masters of privacy are not technical people. They're disciplined people. And...

1:50:00 There are people that enjoy what they're doing, that love a little bit of subterfuge. If you're a person that enjoys living in the real world and is not a computer geek, then you might actually be able to master privacy so much more than most of the geeks. Because some of the most valuable things in privacy are the ability to talk a hotel into letting you stay without identifying yourself, for example. That's not a computer thing. That's a human-to-human thing.

Or being able to have a private face-to-face meeting and setting that up without actually leaving a digital trace. So there's a lot of... One of the things I really suggest to people is to have those two aspects of privacy. And that is, there's a game part of privacy, which might not be the perfect method, but it's an enjoyable method. And it's fun to do with friends. And then there's the, if it really matters, part of privacy. And you should indulge in both.

You know, it can be a little bit of a game and fun. And you don't have to be a geek. Yeah. Yeah, I love that. Well, thank you so much for coming on Smuggler. It was a long one, but there's so much meat in here, so many good things. I'm really excited to share this and hear people's thoughts. But thank you so much for taking the time out of your day to come on and chat with me and share a little bit more about your views, your journey, and your thoughts on different tools.

It was a pleasure. Thank you. Well, is there any specific place or kind of way to keep up with you or follow on your work that you'd like to share? Easy. T-A-Z-0.org. So T-A-Z-0.org. So the podcast is opaque.link is where my personal website is, which sometimes is down. Anaplex.net is where a lot of community effort is happening. And yes, also Twitter at TheVeusWantler. Awesome. Well, I'll make sure to have those links in the show notes as well. But thanks again.

So much of a pleasure getting to sit down and chat with you. And I'm really excited to share this with more people. Thank you. Thanks for listening. And I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the links to our guest content and contact info, as well as links to all of the tools we discussed in today's episode in the show notes or at optoutpod.com.

Now get out there and opt out this week. This week's tool to help you opt out is a simple one. Google Search. Google is a privacy-preserving, JavaScript-free, self-hosted front-end for Google Search that lets you make searches, preferably over Tor, using public instances without any of the tracking or bloat present on Google itself. Search and the tracking around it by providers like Google and Bing is an important factor in the constant attack on privacy.

And opting out of that system is a key step in the journey. I run a Google instance that's available for public use at search.sethforprivacy.com and have that link and how to set it as your primary search instance in the show notes. Feel free to test it out and use it if you enjoy it. Thanks.