On July 10, 1990, the Electronic Frontier Foundation was founded by tech pioneers John Perry Barlow, John Gilmore, and Mitch Kapor. In its founding In its founding mission statement , published exactly 25 years ago, it announced: "A new world is arising in the vast web of digital, electronic media which connect us… While well-established legal principles and cultural norms give structure and coherence to uses of conventional media like newspapers, books, and telephones, the new digital media do not so easily fit into existing frameworks. Conflicts come about as the law struggles to define its application in a context where fundamental notions of speech, property, and place take profoundly new forms." Today, the non-profit organization has thousands of members and according to its most Today, the non-profit organization has thousands of members and according to its most recent financial numbers (from 2013) it's financially healthy: it took took in over $4.4 million that year. Earlier this week, Ars sat down with Cindy Cohn, who took over the big chair at EFF in Earlier this week, Ars sat down with Cindy Cohn, who took over the big chair at EFF in November 2014 , to reflect on the last 25 years. This interview was edited for clarity and brevity. This interview was edited for clarity and brevity.

Ars: I always describe EFF as a tech legal advocacy organization. How do you describe it to friends or family members who maybe have a vague understanding of what the EFF is?

Cohn: I generally say that we make sure that when you go online, your rights go with you. And that specifically we focus in on your privacy and your free speech rights and on the right to be able to build interesting stuff that other people can use, which the Internet has really enabled.

You know, in terms of impact litigation online, there's the EFF and there’s ACLU—and then there’s the whole rest of the world doing awful things. So we could have 10 more organizations doing what we do and we still wouldn’t be able to keep up.

Now that you are the executive director, how do you see the organization today in 2015 as different from when you came aboard?

I think to a certain extent, the world has come to us rather than us changing all that much. But with the world coming to us, we have grown a lot. We just have a lot of capacity. There are cases that we can take on that we couldn’t have taken on [before]. I started full time at EFF in 2000. The first case I worked on with EFF was about 1994.

I think our basic philosophy hasn’t changed very much. We’re still generally very nimble, very small. We have to look for creative ways to bring issues to attention because we can’t engage on the litigation side—there are people that are engaged in scorched-Earth litigation; they try to take their agendas forward. We don’t have those resources and we never will.

Further Reading EFF files suit against AT&T over NSA spying

So we still have to think nimbly. We have to think, 'OK, what’s the quickest way we can bring this thing? What’s the kind of case that will get us to the issues that we think are the most important the most quickly? How do we run an activism campaign that takes advantage of us being smaller than our adversaries as opposed to one where we’re owning the space?' I don’t think those things have changed very much. But we now have an activist department. When I started at EFF, we had one activist. Now we have five or six people who keep the blog moving, who keep the Twitter feed moving, put together action campaigns and make us a much bigger force in those campaigns.

We're In the midst of arguing the cryptography wars all over again. We published a blog post yesterday [July 8] that basically summarizes the same arguments I was making in the '90s about why government regulation on crypto is a bad idea. I think we do it a little better now, we’re a little more polished, but the arguments—the government is doing the same thing—the arguments haven’t changed.

When we were talking about crypto in the '90s, we were talking about the future. We were talking about when a lot of people come online, they’re going to need privacy. We were talking about when people start to do financial transactions online, they're going to need privacy. When we live in an Internet world, we’re going to be doing things differently than when people do things that are personal and private and are just in their own house. We were trying to explain that there are servers and how mail is held on a server. That was really hard to do in the '90s—it’s really easy to do now. People have Gmail. They understand that their e-mail doesn’t sit on their computers; it sits on Google’s servers. And that the idea that just because you use Gmail doesn’t mean that you waive your 4th Amendment rights is obvious to so many people now.

I think the biggest difference now, and the consequences of what the government is trying to do, is bigger because we’re all more reliant on these technologies, but explaining why it’s a problem has actually become a little easier.

Are there cases that stick out in your mind as being the best cases? Most worthwhile?

Obviously the first one is the Bernstein case, which is the case that brought me to EFF but also where we established that computer programs are protected speech for purposes of the First Amendment and that the government’s regulation on cryptography was an improper scheme.

I think that case was seminal for me personally, but I also think it was seminal in people thinking about the Internet as a place largely of speech and the tools that people use on the Internet are themselves speech as well. And that people deserve the strongest tools that they can get in terms of their own privacy.

We took the Grokster case to the Supreme Court. That was an important moment. We were able to save the secondary liability arguments—the contributory and vicarious claims that were there. The Supreme Court created a third kind of liability called inducement liability, which wasn’t what we wanted, but I do think it’s shaken out pretty well in terms of people’s ability to use, to have access to systems where they can share information freely.

The copyright wars kind of continue, but I think that was an important battle and had we actually lost it in the way the entertainment industry wanted us to lose it, we would live in a different technological society now.

Further Reading Hollywood prevails in MGM v. Grokster

We got the National Security Letter statute declared unconstitutional a year ago [ed: it was in March 2013]; that’s up now in the Ninth Circuit and we’re waiting for a decision. That prompted Congress to basically implement some changes to that statute that don’t go all the way that we needed it to go for the First Amendment but that are far better than what the law looked like before.

I think our national security cases—the Hepting v. AT&T case that Congress passed a law to block and Jewel v. NSA that followed on—have been tremendously important. Inside the courtroom I think we’ve done a few things. The government’s foot-dragging techniques have been successful. It was that litigation campaign that I think helped spur Mr. Snowden into action to try to make sure that the world understood what was going on with regard to our global networks turning into surveillance networks. He’s been pretty clear about that. It’s been a great honor and a great responsibility now to try to take the work that he’s done and turn it into lasting change. We got a baby step with that with [the recent] USA Freedom [law], but there’s so much more to do, domestically and internationally.

These are important conversations to have. Frankly, Eric Holder just said yesterday about how these important conversations are to have. So I feel pretty happy that we saw these through. I used to call these cases my white whale: the EFF chasing the NSA and trying to get the NSA trying to stop surveilling everybody when very few people were paying attention. Now, the whole world is paying attention, but I do think that our persistence in that had a role to play.

I’ve seen you argue a few of the Jewel hearings in Oakland. That case has been dragging on for so many years. In the meantime, the surveillance continues, grows, and gets more sophisticated. Is it as frustrating for you guys as lawyers? Or do you just expect the delays?

I certainly have days where I feel like: God, just make a decision here, you know? I get frustrated with the pace of things. I get frustrated with the government arguing and re-arguing and re-arguing the same thing. We have briefed the States Secrets Privilege and whether it bars our case I think at least eight times in front of the District Court and the Court of Appeals. But they just don’t give up, and they get to play out the clock in a way that’s very frustrating. But on the other hand, have you ever tried to pass a law?

I have not.

I mean, how many years did it take to get the health care law that we got? It’s a gigantic change but not at all where we need to be, where the people on the cutting edge would want to be: a single-payer kind of idea. That took how many presidents? Clinton tried and failed. The pace of change in our country is slow. And there are good arguments to be made that our system was set up so that the pace would be slow. And in the national security context, it’s especially slow because the political branches and the judiciary are a bit nervous about telling national security professionals, "No, you can’t do this."

But then I sit down and work out on the next brief. Because real change is hard.

So we’re a couple years in, we’ve got a lot to do, but we’ve got some changes. Some of the biggest changes are the changes that people are building more security tools than people have ever before. And the EFF is a huge part of this. We’re securing the Internet.

Further Reading HTTPS Everywhere plugin from EFF protects 1,500 more sites

We have HTTPS Everywhere ; we have the SSL Observatory where we’re watching for bad certs. We’re doing gigantic technical projects, but we’re not alone.

I have tools on my phone that let me do secure communications. I’ve got secure messaging that actually works. Tor has been around for a long time. It was both distressing and heartening to see that the NSA can’t break Tor. It’s frustrating the hell out of them. I actually think that our tax dollars should not be spent attacking American technologies. That it’s a misuse of our money—that they ought to be helping us build better, secure technologies rather than attacking or undermining ours.

But it was still nice to see that the math works. As Bruce Schneier says, “Trust the math,” and the math works. People are trying to take those mathematical principles that work and make them usable for ordinary people now more than ever before. And I have been trying to get strong crypto in everyday tools that people use since 1993. There are more people engaged in that endeavor. And that’s very heartening.

With respect to surveillance, I spent a couple years living in Germany working as a journalist. It seems to me that in the US we have a very different mindset than people do in Germany and maybe other parts of Europe as well. In the US, we allow our law enforcement and government agencies to do whatever they think most effective until someone tells them to stop doing that. Whereas in some parts of Europe, it’s the opposite. A government agency says, "We need authorization to do this," or, "Is it legal for us to do that?"

Whereas here we have not just big stuff like the NSA and the stuff that came out of Snowden, but smaller stuff like license plate readers on Oakland and San Francisco police cars. And then it only comes out months or years later through advocacy from EFF and others to tell people that this sort of stuff exists.

I think the tension between law enforcement wanting to do everything that they can possibly do and law and the public having to say: “No, these are tools you can’t have because they’re too problematic” is as old as the country. There’s an argument that the Constitution and the Bill of Rights is all about saying no to law enforcement. It’s all about limits on what they can do.

But this problem of law enforcement having access to a gigantic array of tools that they just get to deploy and we find out about them later is a relatively new problem. And it comes along with the secrecy that we’ve seen since September 11. I think we do need to try to regain control of the process by which law enforcement gains access to new technology so that we have a window into it and a chance to say no earlier. We’re starting to see this, and we’re seeing local boards of supervisors raise this thing and start to talk about this.

But that strikes me as the exception rather than the rule.

One of the things that we’re going to try to do at one of our big campaigns coming up is going against overclassification, but that’s just a piece of the overall secrecy problems that we have with regard to not just national security. But this is one of the truisms: if it starts with a fancy national security program, within five years it is going to be something that the cop on the beat gets to use for all of this stuff we’re seeing. All of this telephone records stuff that we’re seeing local and state law enforcement get access to is scary and surprising. Part of what the national security people will tell you is “Trust us, we have a small cadre—we’re looking for money laundering and terrorists.” But the truth is that all this stuff has flowed down all the way.

Looking forward to the next, dare I say, 25 years, are there issues that keep you up at night? A thing that I wonder about, having written about license plate readers and stingrays, is that in three or five years, are we going to be talking about common, high quality, sophisticated facial recognition? Now we’re starting to see police officers wearing body cameras.

It seems to me that we’re not far off from when those cameras are a hell of a lot smaller and contain very good facial recognition. I wonder what does that world look like? Or what does it look like when cops pick up your hair that you drop on the street and start running your DNA through databases? I imagine a near future where everybody’s DNA is in a government database at birth.

I think it’s true that the pace of technology is to surveil us. It’s the aggregation of data that is very difficult right now for the law to grapple with. The law tends to look at: what about this technique? What about DNA matching? And not really looking at what that means when you add that to other techniques, what that could do.

Same with facial recognition. They look at facial recognition as a single thing, but when you add it to the database of all the transactions you’ve ever done and where you’ve ever been, you end up creating a persistent profile about people. So we do worry about that.

The law is going to trail technology. I’d love it if it didn’t. I’d love it if law enforcement had to get an advisory opinion from the Supreme Court every time, deciding if this new technology was appropriately deployed. There’s ways in which that would be good, and there’s ways it would be troubling, right? Because you do want space for innovation, and I want law enforcement to be able to be innovative as well. I do worry that the ability to surveil is so far ahead of us being able to build regulatory structures around it, but eventually the law does catch up.

But this is the endeavor we’re in. [EFF co-founder] John Perry Barlow told me a long time ago that rights are something that you go out and claim, they’re not something that just naturally happen. So that’s my job: to go out and help people claim their rights. The idea that you just sit back and these things are just bestowed upon you isn’t consistent with our history, and I would argue, the world.

But part of the reason I decided to do it is because not only do I think that EFF is more important than it’s ever been. Because the world cares about the issues that we care about now at a greater degree than they ever have and because the number of people who recognize that we need to step up and protect this digital world is greater than it’s ever been.

Prior to USA Freedom—prior to June of this year—the only other time that Congress has said no to the national security infrastructure of the United States was 1978, and before that, never. Twice in history have the people who run the NSA ever been told, “No, you can’t do this.” And we helped make that happen, "we" meaning the whole Internet community. As I think about where we are in time, I think we’re building a movement and we need to start thinking about how to build a movement that is strong and robust and makes it basically impossible to suggest things that might hurt the Internet.

Where do we go for the next 25 years? I think in the next 25 years, I would like EFF to be just as vibrant as it is now, but to be just as vibrant as part of a constellation of organizations and other individuals and other things that are really making sure that this new connected world that we live in protects our privacy and protects our free speech and creates space for innovation.