WBD040 Audio Transcription 

Personal Privacy and Safety in the Surveillance Age with Jameson Lopp

Interview Date: Thursday 18th October, 2018

Note: the following is a transcription of my interview with Jameson Lopp from Casa. I use Rev.com from translations and they remove ums, errs and half sentences. I have reviewed the transcription but if you find any mistakes, please feel free to email me. You can listen to the original recording here.

I welcome back Jameson Lopp to talk about his approach to privacy, and his recent Medium post on the subject: A Modest Privacy Protection Proposal - How to reclaim your privacy in the surveillance age - as well as Jameson updating me on progress at Casa.

“If you want to protect yourself from this over arching legal system then you will want to hide as much of your activity as possible.”

— Jameson Lopp

Interview Transcription

Peter McCormack: Right. Hi there, Jameson. How are you?

Jameson Lopp: Doing well, thanks.

Peter McCormack: It’s your third appearance on the podcast. Glad to have you back as always. Where’s all the beard gone?

Jameson Lopp: Well, that’s just part of operational security. one of the things that I mention in my post, is that, in- in terms of, you know, real-world, physical security, you want to try to blend into the crowd, and having any features that are particularly unique, really get other people’s attention when you’re out in public.

Peter McCormack: I thought you might’ve just gone corporate on us.

Jameson Lopp: Not at all.

Peter McCormack: And quite interesting that I contacted you wanting to talk about personal security and privacy. And did you see the news that came out today about somebody potentially killed in a Bitcoin exchange?

Jameson Lopp: Oh yeah. You know, I have various alerts set up for that because, you know, I maintain this log, basically, repository of all of the known physical attacks against crypto owners. And so, that popped up on my feed.

Peter McCormack: I know, it’s quite sad really. Before we get into that, let’s have a quick update. What’s been going on? How is everything going at Casa?

Jameson Lopp: Yeah. It’s been going well. We’ve mainly been focused lately on the node product, because we’re trying to get those starting to ship out in the next week or so. Been focusing a lot on the user experience, you know, trying to make it as plug-and-play as possible for our users. But, you know, this is definitely going to be a very experimental, like, entry into this market, and you know, I’m already seeing a number of like, future versions of it that are going to be bigger, badder, more robust, and have more features. So, this is our first foray into trying to do a plug-and-play node, and there’s definitely a lot more that you could do, especially if we were spending more money on the hardware. You know, Raspberry Pi can only do so much.

Peter McCormack: Right. I’ve ordered mine. I0 I think it comes in December, so I’m looking forward to getting that, because I did make an attempt to set up a full node here and failed epically.

Jameson Lopp: (laughs).

Peter McCormack: So, if you guys can take some of the work off of me, that would be great.

Peter McCormack: I also noticed some work done on the website. It’s some excellent design work-

Jameson Lopp: Oh, yeah.

Peter McCormack: … talking you through security, personal security. One of the things that’s coming through on Casa, is that design across the board, is important.

Jameson Lopp: Yeah. I think that, you know, I don’t want to say that nobody else has focused on design, but I think that we are making it much more in the forefront of our thinking when we’re developing these products. W were really kind of looking at it as a trifecta, right. Is that security first, usability and design second. And then, really support services third. And we think that that like, trifecta of things is, is what is going to be necessary to build products and services in the crypto ecosystem that can gain mass adoption.

Peter McCormack: And, because you’re closer to it than I am, and probably understand it better, what is the status of Lightning at the moment?

Jameson Lopp: It’s definitely better than it was a few months ago. We’re constantly keeping on our toes the new developments that are coming out. So, I know just in the past week or two, we were experimenting around with some of the automatic channel rebalancing functionality that has come out recently. You know, that’s just another thing that I think is going to be important for these nodes to figure out how to handle the complexities of this new economic system that we’re building.

Jameson Lopp: And, you know, I was in Tokyo just a week or two ago, and a number of the talks were about that. About challenges about basically managing payment channels, and rebalancing them, and opening and closing them. And, you know, I think this is what a lot of the low-level protocol, and Lightning node engineering effort is going to be focused on for the foreseeable future.

Peter McCormack: Fantastic. Well, looking forward to that. So, I asked you on to talk about privacy and security, because I ended up discovering quite an epic medium post of yours. So, let me talk you through the journey that ended up taking me to that post.

Peter McCormack: So I did my interview with Ricardo, and had a long talk about privacy, and the importance of privacy, and then there was a new release of Google Chrome, and I ended up reading a post by Matthew Green which was why he was done with Chrome. And I noticed that Chrome was logging me into the browser, this little icon for my avatar, and it was trying to get me to do the same on my phone.

Peter McCormack: So I did some research-

Jameson Lopp: Yeah.

Peter McCormack: … and I felt a little bit kind of, I felt a bit sketchy. So I made the decision to delete a lot of the Google things I used. I’m not done with everything, I’ve still got Maps, and I’ve still got Calendar, and I still got Gmail, but I’m going through the process. What I have done though, is I’ve removed all my Google data that it allows me, although it probably still exists, and I’m using a combination of the Brave browser which, ironically is a Chrome build, and Firefox Quantum.

Peter McCormack: And I’ve also been playing a little bit with Opera, with its built-in VPN-

Jameson Lopp: Mm-hmm (affirmative)-

Peter McCormack: … and actually, one of the interesting things, actually they’re all actually fantastic browsers in their own right.

Peter McCormack: So I was going through all those processes, and I started to research other things I could do, and then along came your article. Which to me was, was quite interesting. It was a really good timing. But it would be good to hear about, what took you to write that post? What happened that made you write that post?

Jameson Lopp: Well, I mean, I’ve been writing that post all year. It’s been, you know, similar to what a lot of my articles are like, where I start exploring the boundaries of some, you know, particular interesting thing that has caught my eye, simply because my research hits a wall, and it seems like nobody else is, is really gone in that area.

Jameson Lopp: And so as I’m doing my own research, I’m just writing down my experience and everything that I’m learning. And, the thing about privacy in general, especially when you’re talking about, like, real-world privacy, and operational security, is that there are a few books, and various resources out there, but by and large, I think the vast majority of people who are experts in this field, or are living an extremely private life, part of the deal is that they just don’t talk about it. So, as a result, that knowledge doesn’t get shared, and I felt like I could do a service to the community in general, privacy oriented community, to help them overcome the hurdles that cost me you know, six months, and like, tens of thousands of dollars doing all of the research to figure out how to set this stuff up.

Jameson Lopp: But even then, you know, a lot of the things that I have done, are very jurisdiction specific. So, you know, while people who are in the United States will benefit the most, I think, from what I’ve done, there is still a fair amount of, you know, online and digital privacy stuff that I also have in that post that should be applicable for pretty much everywhere.

Peter McCormack: I noted there was about 18 steps in it, and we’ll start covering that in a bit.

Jameson Lopp: (laughs).

Peter McCormack: In the article, have you done everything in there?

Jameson Lopp: Absolutely.

Peter McCormack: So, is it hard to maintain?

Jameson Lopp: You know, it’s one of those things where there’s a really steep learning curve, and then you have to adjust, you know, some of your day-to-day life experiences, and like, how you, you know, react to things. Because, a lot of people, it’s just a common convention, when you’re out and about, or engaging in business, or conversation, people ask you questions that are invasions of your privacy. And, sometimes, this is just, you know, small talk? it’s making conversation? Other times, it’s bureaucracy, where, you know, it’s companies that are just trying to collect as much information as possible.

Jameson Lopp: And so, even something as simple as like, going through a check-out line at a store. Like, they’ll ask you for your phone number, or you know, your postal code, or any number of other, like, identifying pieces of information, and they do it in such a way that it’s like, “Well, yeah. Everybody does this, and if you don’t answer the question, you get this like, awkward silence.” You know, a lot of times the person isn’t used to being told, “I’d rather not give out that information.”

Jameson Lopp: And in fact, I think just tweeted the other week, of, I went to an amusement park, and I got rejected. You know, like, I went to try to- to give them my ticket, and instead of just you know, scanning it and letting me through the gate, they called over some, you know, manager, and then they were looking through their system, and they started asking me all these questions, of like, “What’s your address and your credit card number,” and all of this stuff. Basically going along with the things I’ve outlined in my post.

Jameson Lopp: I was using a disposable debit card, disposable email address, fake mailing address, and they must have had some sort of surveillance-intelligence system on their back-end, that was trying to put all these pieces of information together, and tie them to my identity, and because that failed, their bureaucracy basically said that they had to cancel my ticket. Now, this was particularly stupid because I was standing there showing them my passport, and actually gave them my fingerprint, like, they had biometric identification for everyone entering this park. And yet, you know, their rules said they had to cancel my ticket.

Jameson Lopp: And then, it was especially stupid, because then I just, t- turned right around, took cash out of my wallet, bought a new ticket, and went on in. So (laughs), just- yeah. It- it doesn’t make any sense, but these are kind of the rules and bureaucracy that have been built up by a lot of large corporations.

Peter McCormack: And in going through this process, have you therefore, become almost more aware of how much information people are asking of you?

Jameson Lopp: Definitely. Yeah. And, you know, my other, you know, friends and family, and my close inner circle, that I then try to instil these same values upon, they start thinking the same way too. And sometimes they come to me and they’re like, “I had this experience, and they were trying to get all this information out of me, and I was pushing back against it, and it got really awkward.”

Peter McCormack: I have it every time I go into a shop. They want your email address, and I always say, “No.” I mean, I don’t want to be spammed by them. But the real kicker for me, I explained this to Ricardo, is that I sold an advert on my podcast, and it was from a company called BTC Media and I got a payment. The next time I logged into my bank account, I got a form asking me to fill in the details of my employer, and how much I earned. Which I, which wasn’t compulsory, but there was no option to cancel, I just had to find a link to get out of it. And I thought, that was kind of interesting.

Peter McCormack: I think a lot of this is relevant to you because of, obviously, the, the swatting incident. Some people won’t have heard our first interview, or maybe not be aware of it. Do you mind just explaining what happened with that, again?

Jameson Lopp: Sure. And really, this type of stuff is most relevant for any public personality. Anyone who gains a following of hundreds of thousands, or millions or tens of millions of people, because the inevitable result there, is once you have it’s kind of like the law of large numbers I guess. Where you have a huge number of people that are paying attention you, then inevitably, at least a few of them, are going to have issues, and they might do things to try to harm you. In some cases, even if it’s because they like you. So, you have to protect yourselves from those edge cases.

Jameson Lopp: But, for me in particular, you know, within the period of basically one year, I had been talking about Bitcoin and Crypto for probably four or five years on social media, but during this last bubble, my Twitter following went from, you know, 5000 or 10,000 followers, to well over 100,000 followers, and with that, just came a lot more vitriol, a lot more spam, and a lot more people trying to steal my identity and get into all of my accounts.

Jameson Lopp: And inevitably, one incident which, came more into the physical world, where someone called the police in my town, and claimed to be me, and said I had murdered a bunch of people, and was holding a bunch of people hostage, which, resulted in my entire neighbourhood getting locked down, and was not a pleasant experience.

Jameson Lopp: And, this was possible because, you know, I had been living in the same place for 10 years. My address was in a lot of public databases, and public records, and anyone who, you know, even knew how to do a halfway decent Google search could find my address, and then, you know, very easily find, you know, how to call the local police in my jurisdiction. And all it really took beyond that was someone who had the sophistication of knowing how to place an anonymous phone call, then could not be traced back to them, so they could, you know, do this with impunity, pretty much.

Peter McCormack: Did you ever get to the bottom of why it happened? Was it some form of extortion, or was it somebody just trying to scare you? Or a prank?

Jameson Lopp: I think it was mostly somebody trying to scare me. They did try to extort me a little bit but they could have tried a lot harder to extort me. And then, once it was all over, they were claiming that they were going to do even worse things, but they never did, so, you know, maybe they just lost interest at that point, or, who knows what else may have happened.

Peter McCormack: And so was that pretty much the starting point for this full privacy journey? You obviously had some interest before, but is that the time that you decided to take everything serious?

Jameson Lopp: Yeah, before that, my only real interest was in terms of, you know, financial stuff. And so, you know, using crypto assets to kind of stay outside of the traditional financial system, that would, hopefully be a little more difficult to surveil my financial activity, but, but, yeah.

Jameson Lopp: Then, after this, I started looking at absolutely every aspect of my life that I might want to guard against surveillance.

Peter McCormack: So your modern privacy protection proposal, is really a working document. In some ways, needs to be a wiki that continues to grow and develop.

Jameson Lopp: Mm-hmm (affirmative).

Peter McCormack: That’s kind of interesting. Okay, so, we’re in the age of mass surveillance, operated by the state, but also operated by Silicon Valley behemoths. We have Facebook and Google and to some extent Amazon and Twitter, in a data arms race. Whereby the more data they have, the more advertising they can sell, and the more money they can make.

Peter McCormack: We are pretty exposed to some of the nefarious things they do, the Cambridge Analytics scandal, the way Google reads our emails, yet people still aren’t reacting. So why is it you think people generally don’t care? I mean, you care, I’m starting to care, there’s a very small group of people who are, but why do you think on a larger scale people don’t care?

Jameson Lopp: It’s convenience, and, and you know, a lot of these things that we are getting, these services, they are provided to us “for free”, or at least, you know, from the general perspective of being free, because the cost that we’re paying is with our data.

Jameson Lopp: And, you know, I think it’s very tantalizing, and easy for people to give that up in return for, you know, social networking, and, and maybe discounts on various things. And even, you know, outside of like, normal consumer and marketing behaviour, it’s even a challenging for us as developers.

Jameson Lopp: So something that we’ve been dealing with at Casa, is how do we as a company act as a third party where we can facilitate helping our customers, but doing so in a way that is not actually harming their privacy.

Jameson Lopp: And what I mean behind that, is that even in, pretty much almost all modern software, especially web-based software, there’s various logging, and, and analytics, and tracking and functionality, that is not for marketing purposes, but just for debugging purposes. So that if anything goes wrong, the developers can, you know, look up the entire sequence of events of what happened, and then try to find the bug, and fix the bug, and make a better user experience.

Jameson Lopp: And, you know, these things get referred to as debugging, and, you know, crash analytics-type functionality. But what they really are, is surveillance software. Is that even the developers of various applications, are unintentionally, I guess, surveilling their users, in order to make their own jobs easier. And so, we’re having discussions of, you know, how do we, how do we prevent ourselves from collecting a lot of data on our users, while still, you know, making our jobs possible, so that we can help them if something does go wrong? It’s a, it’s a fine line to walk, for sure.

Peter McCormack: And is there, with Casa, a form of corporate privacy? Is there a corporate version of what you’ve enacted, to protect the privacy of the company, the people who work for it, the location?

Jameson Lopp: You know, I don’t think that as a company Casa has done anything particularly different. You know, unfortunately, we still use a number of various centralized systems to do things, like payroll, and tax management and all of that stuff.

Jameson Lopp: The only reason why we might be a bit safer than your average company, is because we’re so distributed, and something like 80% of the employees work from home and are spread all over the country, and now even in some other countries.

Jameson Lopp: But um, it’s only, it’s only helpful, I guess, from the standpoint that corporations, at least in America, have some additional legal protections. And, you know, from reading my guide, that’s basically what I used, is that, there are a couple of states in the United States that have even better legal protections for the privacy of corporate entities. And so, if you create entities in those states, then you can start using them to own various property, and basically create these firewalls between your own identity, and your residence and other things that you’re owning.

Peter McCormack: And I guess one of the other challenges, referring back to how you as a company extract data and use data with regards to your customers is, you are a company. You want to grow. And you do have to enact some form of marketing. And marketing, it’s I don’t see it as a bad word, it’s how you execute it. There’s good and bad marketing. But, even the security check on your website’s fantastic, and if that’s a way of bringing in new customers that’s great for Casa, right? So I guess you have that balance between not wanting to ask too much data from our customers, but at the same time, you do want to market and find new customers.

Jameson Lopp: Yeah. I mean, so far we’ve been able to do very well, just with the viral marketing I suppose? And then, we do limit, like the amount of personally identifiable data that we store in our databases, there’s a lot of things that we don’t want to know. You know, we, we don’t want to know your home address. We could rather, if we’re shipping anything to you, we would rather ship it to a private mailbox, or a UPS store or something like that, and we, you know, especially do not want to know where you’re keeping your hardware devices that are managing your private keys.

Jameson Lopp: It’s just things like that because we have to assume that even though we have some great infrastructure and security, engineers, that anything that we put in our database or our logs, or what have you, can potentially be compromised and leaked. You know, if any type of like, zero-day exploit happens, and, you just, you can’t know the future, and so you have to, to guard against it by trying not to keep any valuable data in the first place.

Peter McCormack: I guess so, because you don’t want to have any hacker types, or adversarial people thinking you have data that they can access. So, it’s almost like inception-levels of data, and privacy here. It’s kind of interesting.

Peter McCormack: Going back to your point on convenience for users, it was quite interesting in going through the process of decoupling myself from Google. A couple of things that were quite interesting. When I was using the Opera browser with the VPN, every time I tried to use Google search, I was having to do the “pick a car, pick a crossing, you know, identify photos,” so it was taking up to a minute before I could do a search, which isn’t convenient.

Peter McCormack: And also, secondly, when I noted, when I was doing location based searches, not using the location, but I come to expect a certain standard from Google that it would know my location, and the search results are very different when they don’t know your location. So for example, if you search for a doctor, and you’ve got location switched off, it goes to generic doctor-based websites or Wikipedia pages. Whereas if you’ve got location switched on, it shows your local doctor. So, you have to recondition yourself to go back to how you used search back when, do you remember AltaVista?

Jameson Lopp: Oh, yeah.

Peter McCormack: Back to the AltaVista days. And that was a real process to get used to, but I’ve kind of got used to it. I guess there’s more extreme versions on your level of privacy and security that you’ve had to get used to?

Jameson Lopp: you know, I mean, I generally use like, DuckDuckGo and StartPage for my searching, and those, even through VPN, I haven’t had those bring up any of the captcha stuff. You know, but almost every other website they’re going to present captchas, and I have actually seen some very interesting ones these days.

Jameson Lopp: You know, most people are using that Google captcha, where it’s like, identifying stuff for Google street maps or whatever, but I’ve actually seen a few now which are like puzzles, where you actually have to like move things around to drop them in the right place. So, it’s definitely interesting to see how that technology has been progressing. You know, prove that you’re a human, type of, of stuff.

Peter McCormack: But are there any experiences you’ve had offline, similar where you’ve thought, “God, this, this has become more inconvenient?”

Jameson Lopp: Yeah, it usually has to do with the financial stuff of like, I can (laughs), give you an example just from the other day, actually where, you know, I was ordering some food to pick up, and I go in there. And I made the purchase through my one of my LLCs that I set up. And so, that’s not, like a human name, right? And it’s just awkward to see, like, the person behind the counter is like, looking through the receipts, and they’re like, trying to you know, pronounce this thing, because they assume it’s a human name (laughs), and- and then they’re like yelling it out and mispronouncing it, and I’m like, “Yeah, yeah, that’s me. Close enough.”

Jameson Lopp: Stuff like that. Stuff like, um, also, going out for example, with a group of people, and splitting a tab. And you know, not wanting to use a credit card that has my real name on it, but then, if I’m using a card that is in one of my LLCs then I don’t want that potential privacy leak if like, the waiter comes back and is like, waving it around, you know. You know, “Whose is this,” type thing. So, it gets more awkward, you know, when you are having face to face human interactions.

Jameson Lopp: Another thing that I’ve implemented is, of course, that I’m using a pseudonym whenever I’m interfacing with like, service providers at my residence. There’s no reason they need to know my real name, so that- that can also get a little awkward if you haven’t fully baked in, like, this is my other, you know, name now and I need to be able to remember to respond to it, and so on and so forth.

Peter McCormack: Okay. So let’s start digging in to this. Firstly, can you outline the primary reasons why people should care about their privacy? I mean I’ve noted five, but it would be good to hear from you.

Jameson Lopp: Yeah, so I guess the most extreme, and one that I was recently trying to explain to someone, is that in the modern age, for, you know, hundreds of years, we continue to add more and more laws. So, governments very, very rarely delete laws. They just keep adding more and more and more. And we’re at the point now, where, it’s basically impossible to go about your day-to-day life and not break a law. At least in America, I think there are statistics around, you know, how many crimes per day the average person commits. Even if, you know, you believe you’re a good, honest, upstanding, law-abiding citizen, the truth is, you’re not. Nobody is. And if you want to protect yourself from this, you know, overarching legal system, then you will want to hide as much of your activity as possible from the legal system.

Jameson Lopp: There are countless cases now of people, you know, getting picked up because they were, you know, in the wrong place at the wrong time, or some piece of data put them in a suspect list, even though they had nothing to do with a crime that was being investigated. So, that’s kind of the extreme reason. You know, to basically keep yourself from being falsely imprisoned.

Jameson Lopp: And then there are plenty of other levels that are less extreme than that. Such as, I think some good examples are, we’ve seen cases where people like, young teenage girls have gotten pregnant and, you know, been searching for things online, and basically the algorithms online figured out they were pregnant, and, you know, started sending mailing stuff to their house. And like, their parents found out, and they hadn’t been able to give a chance to try to figure out how they were going to explain it to them.

Jameson Lopp: So, it can go a number of different ways, and just create very awkward and unpleasant experiences as a result of certain data being tied together and then used by companies or government agents, basically.

Peter McCormack: But there are plenty of other reasons. So I put the five down. I put “Five Primary Reasons to Care”. Unwanted attention. I saw it, within the article, about a lady who’d been tweeting before getting on a plane, and she had 170 followers, I’ll share it on the show notes, because it’s quite an incredible story, personal safety, we’ve obviously covered that, future careers-

Jameson Lopp: Yeah.

Peter McCormack: … potential for hacking, especially within crypto, and, potential for violence.

Peter McCormack: And, do you think people in crypto are even more exposed, and even more at risk? Or do you think this is just a general problem?

Jameson Lopp: So, I think that, the unique think about crypto is the potential for violence, and that we’re still in the very early days of that. You know, if you look at my like, physical Bitcoin attacks repository, I think I’ve catalogued like, somewhere between 30 and 40 known attacks. I think there are actually far more that have not been publicized. Hear about them kind of in the whispers every now and then.

Jameson Lopp: But, there’s a difference, I guess, between being crypto-wealthy and being traditionally wealthy, which is that, if most of your wealth is in stocks and bonds, or savings accounts, or, you know, physical real estate, or whatever, it’s very difficult for someone to point a weapon at you and tell you to hand those over.

Jameson Lopp: But, if you are wealthy because you have these crypto assets that are basically digital bearer bonds, then the risk/reward ratio is a lot different. And the criminals are starting to do the mental math of saying, “Well, I see that this person has been tweeting about Bitcoin since the price was only a few hundred dollars, and so, they probably have somewhere in the realm of this amount of wealth that they’re probably holding themselves, and if I can put enough physical pressure on them, they would probably hand over a significant chunk of that wealth, and it would be a lot easier than for me to go and try to rob a bank.”

Peter McCormack: So, you need Casa at that point.

Jameson Lopp: That’s one way to approach it, yeah. We are trying to create better than bank-level security for crypto assets.

Peter McCormack: And I guess one of the myths with privacy is, and I’m not sure why it’s perpetuated, but, it’s that privacy is about hiding illicit activities. And if you’re not doing anything illegal, then you don’t need to care. But that’s a myth, right?

Jameson Lopp: Yeah. As I was saying earlier, even if you’re not doing anything illegal, it’s possible that you just get caught up in the wrong thing. There are even, actually where I used to live in North Carolina, there was a case where the local police actually subpoenaed Google for all of the activity of every Google user within a several square mile area at a certain period of time, because they were trying to find someone who committed a crime.

Jameson Lopp: And so, that’s a good example of how simply being in an area, while you’re carrying your surveillance device around, by which I mean your phone, (laughs) just gets you caught up in a digital dragnet of sorts. And I think pretty much anybody would agree that they’d pretty much rather not get caught up in any dragnets, even if they are innocent.

Peter McCormack: Yeah, of course. I didn’t realize you’d moved from North Carolina. I won’t ask where you are, because obviously that would break the rules.

Jameson Lopp: I’m somewhere in the United States.

Peter McCormack: So one of the things I’ve noticed, is that it’s the ability for people to build a dot-to-dot pattern, and that’s where some of the risks are. So I noticed, for example, if you tweet that you’re on holiday, and someone can find your home address, they can burgle you. Or, you have a display of wealth, and then you check in to somewhere. Somebody knows where you are, to come and attack you. Or even old tweets can affect a future career.

Peter McCormack: I think that’s what people don’t recognize, it’s the connection of the dots, but the clever hackers, that’s what they’re doing, right?

Jameson Lopp: Yeah, just using your own data against you. This is, part of the problem with privacy, is that you don’t know what might be more important or more sensitive in the future. And this actually this goes, kind of goes back to the Justine Sacco tweet that you were talking about. She had 174 followers, and she was making crude jokes on Twitter, even though she should’ve known better, because she was like, the director of marketing for some internet advertising agency. But, you know, she had been doing it and not having any issues, and then she just made one wrong tweet that went viral. It caught the attention of the internet, and all of a sudden, she had hundreds of millions of eyes basically focused on her.

Jameson Lopp: And we once again get into that issue of large numbers, and high amount of attention, and the result was that she would then have a v- relatively small number of those people who would then take it to the next step. And like, a few of them actually showed up at the airport to basically be paparazzi and take photos of her, and, you know, make fun of her. And other people, I think, were like, calling her and her family and harassing her,

Peter McCormack: It’s almost like a Black Mirror episode.

Jameson Lopp: It is, yeah. But it’s the issue of trying to manage the attention that you’re receiving. It’s not completely manageable, but better privacy definitely helps you avoid getting more unwanted attention.

Peter McCormack: Did you ever see that video of the, I’m trying to remember what it was, it was for a fortune teller. And what they did, they were queuing up to go and see a fortune teller, and they would just fill in a form with their name and details. They would wait 10 minutes, somebody in the background was using their details to find out information about them online, they were feeding that all to the fortune teller, and the fortune teller would then tell them all this stuff about them, or the psychic, and then they would turn around and say to them, “No, I found all this information online.”

Jameson Lopp: Hmm (affirmative). Smart. No. I can definitely believe that, I haven’t seen that one though.

Peter McCormack: Yeah, it’s fantastic. I’ll dig it out and send it to you. Okay, so moving on from this, your article is fantastic, but it says in it the only way to completely disappear, is to go off grid essentially, and live in the middle of nowhere. It’s not realistic. And you also point out, rightly point out that Americans are under more attacks from frivolous lawsuits, tracked by more private investigators, so it’s kind of a lot harder for Americans.

Peter McCormack: There are different levels that people should go to in terms of protecting their privacy. You’ve obviously done the extreme version. You’ve spent a lot of money doing it. What would you consider level one? I think almost most people listening to this, either they care enough and they’ll read your article or do it, or there will be bunch of people who will say, “I need to do something.” Where do people get started? What would you say are the most important things people should be doing?

Jameson Lopp: Yeah, I mean, level one is what I was doing for many years, because actually my first job in my career was working for an online advertising company, where we were, we were sending out hundreds of millions of emails, and, every day, and my job was basically to write large back-end batch processing jobs that would perform analytics across billions and billions of various tracking points, to help marketers better target their future advertising efforts.

Jameson Lopp: So, you know, I was very deep into, like, the tracking of people, as a full time job. And so, I would say, level one is just installing various browser extensions that help protect your privacy, like Privacy Badger for example, or the “HTTPS Everywhere” extension, that kind of forces as many of your connections to be encrypted as possible. These are things where, you can spend, basically less than half an hour, and drastically increase your privacy from the sort of dragnet surveillance that online advertisers are doing.

Peter McCormack: Can you use those kind of tools on your mobile?

Jameson Lopp: Yeah. In many cases, there are additional apps. Like they have mobile versions of it that can do the same. You can install mobile browsers that are more privacy-centric. Depending on how technically sophisticated you are, you know, one thing that I like doing, is trying to figure out ways to only do this one time in your house. And, then have all of your devices benefit from it.

Jameson Lopp: And so, when we talk about the privacy and anti-tracking stuff, you can get something called a Pi-hole which, you just run a Raspberry Pi that’s running the software that is basically filtering all of your DNS queries and blocking everything from known advertisers. And if- if you put that behind your router, then all of your devices on your home network automatically get that filtering.

Jameson Lopp: And then, on a similar vein, if you go to the next level, and you start doing VPN usage to basically encrypt your entire internet connection and all of your traffic, then, you can also do that at the router level, so you don’t have to configure every single device to use a VPN.

Peter McCormack: But, outside of the home, as you say, people are carrying with them a portable surveillance device,

Jameson Lopp: Mm-hmm (affirmative).

Peter McCormack: I think it’s going to be a hard stretch to get people to, either get rid of their Android, or get rid of their Apple phone, do you have a preference of the two of those? I feel like I trust Apple more because they make less money off data than Google, so they have less reasons to track. Do you have a preference over those two?

Jameson Lopp: I mean, I’ve always been an Android fanboy, and that’s because I prefer to be able to tinker and customize things. Admittedly, Android isn’t as friendly a use experience, but I’m, I’m a geek, and I prefer to be able to turn things on and off, and what have you.

Jameson Lopp: And if you’re really nerdy, you can flash your Android phone with some privacy-enhanced kernels, like Copperhead OS, and, I think, is it Rattlesnake OS is the new one.

Jameson Lopp: But, I’m particularly interested in seeing what happens with some of the privacy-specific phones that are being developed. In particular, for the past year or so, I’ve been using a Purism laptop, which is an open-source hardware on the motherboard, and actually has like, physical hardware switches to disable all the surveillance devices such as the microphone, webcam, even the Wi-Fi and the Bluetooth, and comes at a bit of a premium, but I found that the user experience is reasonable, and this company is actually working on a phone that runs on a similar operating system, and I think will have similar hardware switches to turn things on and off.

Jameson Lopp: The next question though, even like, above the hardware, becomes, well, what about your ISP or your phone provider or whatever? And, even if you turn off your GPS and all the other tracking stuff, as long as you’re using one of these mobile phone networks, you can still get triangulated within like a hundred meters or so, just from the cell towers. So, if you do want to carry around a surveillance device like this, because they’re so convenient, then the only way to do that, that can’t be tracked, well, it’ll always be tracked, but you can, basically not tied to your identity. And that’s where like, the burner phones, and the, the SIM swapping comes in. You know, getting throw-away SIM cards that are basically purchased with cash, and are not traceable to your identity.

Peter McCormack: So, a cashless society, is going to present certain problems in certain areas here, right?

Jameson Lopp: Yeah, I mean, I had that section about all that financial stuff. And, the basic take-away is that cash is still king, but in my own experience using cash more often over the past year, it’s actually becoming trickier because fewer people are using cash. In many cases, I’ve actually not been able to complete a cash transaction because they weren’t able to give me enough change.

Peter McCormack: Right. Okay. That’s kind of strange. Wow. Will crypto solve any of that?

Jameson Lopp: Crypto of today has long way to go. I still generally say that Monero has the best like, real-world realistic privacy. But, unfortunately has pretty terrible scalability, u- which they are working on.

Jameson Lopp: The next question comes down to, like, can we build better privacy on second layer networks like Lightning? I think that that’s a tricky question. You definitely get better privacy simply by doing payments that aren’t getting broadcast to the entire world, but then the thing that I’m still trying to wrap my mind around is, “How does the privacy on the second layer networks actually relate to the privacy that you have on chain, because, you know, you’re still tying these off chain transactions to on chain transactions. So, I think it’s going to be complicated, there’s still a lot of work to be done, but hopefully that’ll get tied in to a lot of the efficiency gains that the developers are trying to make, with regard to, basically, multi-party channel opens and closes, and then, something that was very interesting that came up in Tokyo recently, was the two-party ECDSA, which basically means, figuring out ways to do multi-sig that is not, it looks like single-sigs. So, anyone who’s looking at the transactions on chain can’t even tell that they are to open and close payment channels.

Peter McCormack: Is there a form of Block Explorer for Lightning addresses?

Jameson Lopp: Yeah, kind of. I mean, there is a few different Lightning network explorers out there, but it comes down to, a, whether or not a given node is advertising its channels, the default is actually going to be changing. Far fewer nodes are going to be advertising their channels, as the Lightning network continues to mature. So, these Lightning network explorers of today, are actually going to become less and less useful, because I think the privacy on the network is going to improve.

Jameson Lopp: Other than that, the best way that you would be able to surveil the Lightning network would be to spool up a ton of Lightning nodes, and basically try to man-in-the-middle everybody. Which, you know, feasibly like, nation state actors could probably manage to do. Even then, I don’t know what the math would be off the top of my head, but you, do to like, the- the onion routing of how the messages and the payments get sent through the Lightning network, you’re only able to tell the previous hop, and the next hop on a given payment. You can’t see the entire, like, set of hops. That in and of itself, provides a much better level of privacy.

Peter McCormack: And how do you feel about privacy on Bitcoin? It’s come up in a couple of my interviews recently, but I’m totally out of my depth. But I did an interview with Saifedean Ammous and Caitlin Long, and they were talking about fractional reserve Bitcoin, and the potential for that existing on Wall Street. And one of the things that Saifedean said, is “The great thing about having an open ledger, is you can audit the wallet.” Whereas if you didn’t have an open ledger, you wouldn’t be able to do, so it would be more different to audit whether people are operating a fractional reserve Bitcoin.

Peter McCormack: And also, I interviewed Jimmy Song, and we were talking about the CVE bug. And I was asking is- if there was fully privacy base chain, if the bug had been exploited, would the inflation go undetected? I know the questions I’m asking, but I’m out of my depth whether these are real problems that would exist with a fully private base chain.

Jameson Lopp: Well, yeah, and um, really the- the closest, I think, that you’ll come to that is if you look into ZCash and there’s been a lot of discussions in ZCash around that. And, last I heard, the closest thing that was proposed to try to guard against that would be to have a like, a transparency day, every now and then, where everyone is forced to reveal the value in their UTXOs so we can then sum them all up and make sure that nobody has inflated the monetary supply.

Jameson Lopp: But, the other thing, the- the tricky thing with the like, wallet and exchange auditing, this is actually something we ran into when I was working at BitGo, is one of our first kind of extra features that we offered at BitGo, was a cryptographic attestation of funds value. I think we called it proof of reserve. But we didn’t call it proof of solvency, or proof of not-fractional reserve, because you still run into a fundamental problem of proving the value of what is in the Bitcoin or crypto wallet is only half of the problem. You have to prove what their debts are as well, which means someone has to go and audit all of their own, like, internal accounting and databases, because otherwise, you know, how do you know they haven’t promised a bunch of funds to someone else? And, you know, how do you actually know what the reserve is supposed to be in the first place? So, that product ended up not doing very well, because it just wasn’t particularly useful without being backed by an independent audit of the entire company’s finances in the first place.

Peter McCormack: So how do you personally feel about privacy with Bitcoin? Do you want it on the main chain? Do you want it on side chains? Do you have any kind of personal views?

Jameson Lopp: yeah, I mean, right now it’s the default is terrible. If you go in and look at the opening Bitcoin privacy project they outline dozens of different threats in their threat model, and there’s far more to it than just the analysis of the block chain transactions themselves. There’s also issues of like, network analysis. We know that there are like multiple companies that are surveilling the Bitcoin network, and basically running nodes all throughout the network to try to figure out, you know, who is broadcasting transactions, you know, geo-locating them, also identifying as many of the major players on the network as possible, so the kind of making the network more private is far more than just like, obscuring the values of the transactions. You know, even if we did something like confidential transactions, that would only be half the battle.

Jameson Lopp: Thankfully we are seeing, plenty of improvements, even at the base layer, such as Dandelion protocol. I don’t know, has anyone explained how that works to you?

Peter McCormack: No. I did see it the other day. I think I saw Nick Carter reference to it in an article, an interview he did, he was talking about some technologies, and I think I saw in a list alongside Mimblewimble and Grin. I think I saw a list of things.

Jameson Lopp: Yeah. So Dandelion is basically going to make the network more private for people who are broadcasting transactions, because if you broadcast a transaction, then your node essentially tells every peer node that it’s connected to, “Hey, I’ve got this transaction, do you want it?” And if they don’t have it, they’re like, “Yeah, I’ll take it.” And each of those nodes does the same thing to everyone it’s connected to. And this is called a gossip protocol. And this is a flood-fill type protocol, where it very quickly expands through the entire network.

Jameson Lopp: The downside to that, is if you have a sufficient number of nodes listening on the network and they’re all in sync with each other, like using network time protocol, then you can very easily see like, where the origination of the transaction was, just by saying, “Okay, it arrived here a few milliseconds it arrived here,” and you sort of work backwards from there and say, “Oh, it probably originated from this node.”

Jameson Lopp: And so, what Dandelion does to protect against that, is instead of just globally broadcasting immediately, instead your node only sends the transaction to one other node. And that node only sends it to one other node, that node only sends it to one other node, and then eventually, after a few hops, that node will then broadcast globally. And the reason it’s called Dandelion, is that from a network graph, it looks like you’ve got a stem and then you’ve got a big fluff ball. So basically, this is like a misdirection thing, right? And so anyone who is surveilling the network, from their perspective it looks like the transaction’s coming from over here, but in reality it started out way over here. So, interesting new developments like that that I think are very practical, and don’t require major changes to the protocol.

Peter McCormack: Very interesting. Okay. So let’s go back to your article. We can’t cover it all, and obviously I’ll share down in the show notes, but I think there are certain areas that most people should pay attention to. So we covered your phone, and we’ve covered pretty much your internet privacy.

Peter McCormack: But what we haven’t covered in there is internet behaviour. There is a whole bunch of behaviour that people aren’t thinking about. So I’m thinking about it with regards to my children. Already now starting to think, like my son’s on social media, and starting to educate him on ways he should think about behaving, because of the impact it might have in the future of his life. What are the other key things that people should be thinking about, and the stupid things people tend to do online?

Jameson Lopp: Well, one of the worst things I think, is any post that gives away your current physical location, right? And you already made a mention of that. If- if you post something that shows, you know, you’re on vacation or you’re off doing something, then obviously you’re not at home, and, you know, that gives people an incentive to go check out your house and see if they can take anything.

Jameson Lopp: For me, I purposely, I time-delay any posts that might be related to a geographic location. So, if someone is trying to go there and potentially find me, then they’re not going to do that. And interestingly enough, that is a tactic that I was already doing, and it helped with regard to my swatting incident. Because, I posted something on Twitter, it was like a Monday morning, and I- I made it, what did I say, I said something like, “Waking up seeing that we’re going to have to deal with SegWit2x for the rest of this week,” type of thing.

Jameson Lopp: And as far as I can tell, the attacker assumed then, that, you know, that I had just gotten out of bed, and was at my house, and you know, was getting ready for the day. But, in reality, I was already at the gym working out, doing my thing, 20 miles away from my house. And so, the attacker then placed that call to the police and law enforcement shut down my neighbourhood, and I wasn’t even at home when it happened. I actually drove in to the law enforcement blockade, and it was like, “Hey guys, I’m just trying to get to my house, what’s going on?” And then after a few minutes we finally figured out that they were there for me. And so, that was I think one of the reasons why law enforcement did not end up breaking down my house, was because I actually came to them first. And we figured out what was going on pretty quickly.

Peter McCormack: So what do you do about conferences? Are you telling people they can’t put you on the speaker list?

Jameson Lopp: No, you know, I am still doing conferences, and you know, this is a calculated risk basically. I think we’re not at the level where someone is going to send in a whole team of mercenaries into a conference with hundreds or thousands of witnesses, and try to like, kidnap me, you know, from in front of, of everybody else. You know, maybe that will change at some point in the future, but, I believe that we’re not quite at that level.

Jameson Lopp: And so, I’m, part of the reason I’ve done all of this operation security and privacy stuff, is because I still want to be out there interacting with the public and helping educate people, continuing to use the reputation that I’ve already built. As I said, if I wanted to do this perfectly, then I would just completely drop off the face of the internet, stop talking to anyone using my regular identity, and potentially just pop up as a new pseudonym with a, you know, fake avatar on my social media and nobody would know that it was me.

Peter McCormack: Conscious of time, and I’ve got to couple other questions I want to ask you about at the end, so just on a wrap-up, but if you were to advise people to do anything today, what are the things you would say to do straight away. Or the habits that you would ask them to change?

Jameson Lopp: Yeah, I mean, in general it’s just being more mindful about what you’re posting publicly, because you don’t know what might come back to bite you. And being mindful that the internet never forgets anything. You know, even though we have seen instances of people, like, deleting all of their accounts because they’re, you know, trying to get some sort of important job, especially in politics. You know, what happens a lot of times, is the reporters just start sifting through internet archive stuff and finding all the stuff that they thought was deleted, and it just gets more embarrassing that they tried to cover it up in the first place.

Jameson Lopp: So, you have to operate under the assumption that anything you are doing on the internet is going to become public. Even if you’re taking a lot of these privacy precautions, it’s like, I think just- just yesterday, you know, there was another announcement of some big database leak. I think it was Voter Registration or something, where anything that you’re doing that is creating records in a database somewhere, you have to assume that that data is eventually going to get leaked. Regardless of how secure, or how much you trust the organization that controlling it. Information wants to be free. It’s very hard to keep information from flowing around. And so, as a result, the only real protection you have against that, is limiting what information you put out there in the first place.

Peter McCormack: You know what’s interesting, I always feel like that step-by-step guide you’ve got on the Casa website for your crypto security, I almost feel like it would be good to have a privacy version of that, of the Jameson Lopp 18 step privacy version of that would be, pretty useful.

Jameson Lopp: Well, we could do that for digital privacy, but you know, like I said, the problem with the physical stuff is that the jurisdictions are so different, and in many cases, you actually have to talk to an attorney.

Peter McCormack: Yeah, an also, where I am, I don’t have a rack of guns as a final security of last resort device. I still haven’t actually shot a gun again since I shot one with you. I need to do that again.

Peter McCormack: Okay. So the last thing I want to ask you about, is because you were a part of it, is the B Foundation. So you’re part of it, what’s your involvement?

Jameson Lopp: So, it’s really being driven by Giacomo Zucco, and then Alena Vranova is kind of the person behind the legal entity. But Giacomo is doing the like, day-to-day driving, and operations. And the rest of us, we’re just chiming in, basically with our advice about any decisions that need to be made. So, it’s basically you know, we’re all in a, a chatroom together, and we’re discussing decisions like how to approach certain things.

Jameson Lopp: But, you know, it’s still kind of spooling up right now, you know, we haven’t really done much to speak of, other than announce our intention to create this organization. As far as I’m aware, the legal entity has not actually been formed yet, but it should be pretty shortly. And so, you know, there was a lot of backlash of course immediately, because of all of the memories of the Bitcoin Foundation, and everything they screwed up. And, it’s kind of weird how there are a number of folks that almost seem to be anti-organization in the first place? Simply because they’re afraid of what could happen if the organization basically turns malevolent, or starts, you know, having incentives to do things that are contrary to the ecosystem. So um, I guess, I would just prefer that people wait until we actually screw something up to, to, you know, get too mad at us. At this point, you know, I’m not really interested in spending more time hearing people complain about us when we haven’t even done anything yet.

Peter McCormack: Yeah, it sounded like quite a proactive thing. So I actually interviewed Giacomo earlier in the week, and it’s coming out tomorrow, and I talked to him about it. And what I thought was quite interesting about it as well, it isn’t just focused on development, you know, I understand development’s important but I’m a marketing person. I also think marketing is important and communications is important. And on of the things that other crypto currencies have maybe done better than Bitcoin is, promotion.

Jameson Lopp: Mm-hmm (affirmative).

Peter McCormack: And it feels like a lot of people in Bitcoin are scared of marketing or scared of communications, and they feel like, “If you go out and sell something, it’s bad.” But actually, Bitcoin has had a very good word of mouth strategy for the last 10 years.

Jameson Lopp: Oh yeah.

Peter McCormack: And I quite like that marketing’s part of it, and, because I think marketing has changed now, it’s not just about a poster, it’s about education, and I think with Bitcoin and a budget behind it, you can actually educate people better. This, like, bits all over the net. Most people are like, “How do you learn about Bitcoin?” It’s like, “Well, go and watch this video. Go to lopp.net and read this,” and it feels like we need a bit more of that, so I thought it was quite positive.

Jameson Lopp: Well yeah, but it’s going to be tricky, right? Is you know, even if we are positioning ourselves as like, a source of educational content, then, that has the potential to become like, politically controversial. So I’m very wary of the marketing aspect myself, I mean, I’m being, keeping a close eye on what is being proposed on the marketing side. I just feel like organizing funding for development of various applications and features to he- build out the ecosystem is probably less controversial. I- I certainly see that there is value in marketing, but I think that is uh- where most of the potential for controversy lies. Because, we do want to avoid trying to give the image of being representative of Bitcoin. It does suck that there are legal requirements to have foundation in the name itself, and you know, I will, generally be referring to it as “The B” to you know, try to p- push the branding away from the foundation perspective, because, you know, Bitcoin doesn’t need a foundation. And I’ve actually said in the past, like, if you find the foundation of Bitcoin, you should destroy it.

Peter McCormack: As ever, Jameson another great interview. My final question for you, can you just tell me what’s coming up for Casa, what’s coming up for you, and where you’re going to be at 11:30 tomorrow?

Jameson Lopp: (laughs) yeah. Well, Casa, we are, basically working on onboarding and scaling up our ability to onboard more of our premium users, it’s the $10,000 a year vault product. We’re also just trying to ship these nodes, get them out the door, you know, experimenting with various replication technologies so we can clone everything that we need, and- and get them shipped out.

Jameson Lopp: And I don’t know, for myself, I’m, I’ve just been doing a lot of traveling, going to be going to a number of different conferences. You know, I was already in Japan just a couple weeks ago, and I’m going to be going back to Asia, and then over to Europe, and back and forth and back and forth, you know, trying to to continue to educate people as much as possible.

Peter McCormack: Had you been to Japan before?

Jameson Lopp: I was in Japan for 24 hours in 2017. I was actually in the air longer than I was on the ground. I just spoke at a Tokyo University for a few hours.

Peter McCormack: For this trip? Or, or a previous one.

Jameson Lopp: No, that was a previous one.

Peter McCormack: So you had a proper trip this time.

Jameson Lopp: Yeah, I was in Tokyo for three or four days this time around. Got to do a little more sight-seeing.

Peter McCormack: What did you make of it?

Jameson Lopp: It’s um, it’s very clean. Everybody’s very polite. It’s definitely a nice place, though, though, I wouldn’t want to live there. Not quite the same level of freedoms as we enjoy in the United States.

Peter McCormack: Did you meet up with Roger?

Jameson Lopp: You know, it was kind of weird, we were in Roger’s home town, but he never showed up at the Scaling Bitcoin Conference. (laughs) You know, I think that the last one he went to was several years ago, and he actually, yeah, it was actually Scaling Bitcoin in Milan, and he forked off the opening party. He basically forked it off to create a big Blocker opening party, it did not, I guess, ingratiate himself to the rest of the folks who were at Scaling Bitcoin

Peter McCormack: And we now have Satoshi’s Vision. Is it today, happening?

Jameson Lopp: I think that’s actually been happening earlier in the week, because I’ve seen some videos get posted.

Peter McCormack: Well, we’ll see. Well anyway, just a big thank you and also, a lot of people won’t know of the amount of work you do in the background, helping me, keep my podcast going, and- and getting it where it has been. So, thank you so much for everything you’ve done for me. Always a pleasure. I’m not sure when I’ll see you next. Hopefully at a conference some time, but take care Jameson, and thank you.

Jameson Lopp: Thank you.