NSEC2021 - Cory Doctorow - Privacy Without Monopoly: Beyond Feudal Security

### Overview Based on the paper "Privacy Without Monopoly" co-written with Bennett Cyphers at the Electronic Frontier Foundation (EFF), this talk examines the intersection of corporate monopoly, user privacy, and digital interoperability. The speaker critiques the prevailing paradigm of "feudal security"—wherein users rely on walled-garden tech monopolies (such as Google, Apple, and Facebook) for data defense—and argues that interoperability, robust privacy regulation, and competitive compatibility are essential to breaking vendor lock-in and restoring user self-determination.

### Key Topics - **Monopoly Beyond Tech Exceptionalism:** Monopolies exist across numerous industries (ranging from pharmaceuticals and rail logistics to professional wrestling and consumer goods). Rather than arising solely from unique digital characteristics like algorithmic persuasion or genius executives, market concentration stems from 40 years of weakened competition policy. Beginning with Robert Bork and the Chicago School's reinterpretation of antitrust around a narrow "consumer welfare" standard, mergers, acquisitions of nascent competitors, and vertical market integration were widely permitted. - **Feudal Security and Diverging Interests:** Digital platforms act like warlords in fortified castles: while they employ vast resources to protect users from outside "bandits," users' security breaks down whenever corporate interests diverge from user interests. Examples include Apple removing working VPNs in China to retain manufacturing access, Facebook shutting down APIs and threatening legal action against NYU's ad observer research tool, and Google fulfilling reverse-location warrants following protests. - **Interoperability and Switching Costs:** Digital technology is uniquely universal and Turing complete, enabling translation layers between disparate systems. Interoperability neutralizes network effects by slashing switching costs, empowering users to leave abusive platforms without losing communication with their networks.

### Technical Details - **Mandated Interoperability Types:** 1. *Data Portability:* Enabling users to extract personal data to competing services, despite platforms claiming collective data (such as address books) cannot be moved. 2. *Back-End APIs:* Compelling platforms to open internal APIs developed during mergers (e.g., connecting WhatsApp, Instagram, and Facebook) to third parties and middleware. 3. *Delegatability:* Allowing automated or authorized third-party access to interact with services on a user's behalf (such as headless browser automation or right-to-repair access like CAN bus vehicle diagnostics). - **Adversarial Interoperability (Competitive Compatibility):** Regulatory mandates can be brittle and prone to evasion (e.g., carmakers shifting diagnostics from CAN bus to unregulated wireless systems). Adversarial interoperability relies on reverse engineering and unauthorized compatibility tools—tactics once used by Facebook against MySpace, and Apple against Microsoft Office formats via iWork. Today, platforms restrict these tactics using laws like the DMCA, Canada's Copyright Modernization Act, the Computer Fraud and Abuse Act (CFAA), and terms of service.

### Takeaways - Monopolies drive mass surveillance because dominant firms possess vast reach, lobby against regulation, and compel third parties into surveillance-based ad ecosystems. - True privacy cannot rely on unilateral corporate choices or intellectual property litigation. - Restoring competitive compatibility alongside strong, democratically enacted federal privacy legislation with private rights of action eliminates feudal lock-in, reduces the attractiveness of centralized data targets, and enforces data minimization and consent.