"Cyberfascism: what is it and how we can fight it?" by Eva Galperin // ECC#2 - Buenos Aires 2025

[applause] Oh, hi audience. I can see you now. That's pretty exciting. Hello. Uh, so uh, welcome to my talk.

Uh, cyber fascism. What is it? Uh, and how do we fight it? So, a very light, cheerful romp uh through political science. Um you you may also be wondering extremely important questions like uh who the hell I am.

Uh my name is Eva Galprin and I am the director of cyber security at the Electronic Frontier Foundation. I am also the co-founder of the Coalition Against Stalkerware. Uh, I have some nice useful contact information on there that no longer includes Twitter because Twitter is bad. You may be asking yourself, wait a minute, this is not the right slide. What is happening?

Can I get somebody? Okay, here we go. Ah, all right. So, uh, how many of you here have heard of the Electronic Frontier Foundation? Uh, fantastic.

You're going to save me a lot of time. So, as you all know, the Electronic Frontier Foundation is a t-shirt and sticker company with a law firm attached, uh, where some engineers also work. And now it is time for me to make a tearful confession. Uh, which is that I, Eva Galprin, director of cyber security at the Electronic Frontier Foundation, do not have a degree in computer science. So what did I spend my undergraduate time doing?

I went and I got a degree in political science and international relations. So, as you can imagine, the last couple of years in the United States have been, you know, real fun for me. And one of the things that we talked about a lot in uh in my uh political science classes that I think we don't talk about in computer science is the extremely important question of what is fascism. So if uh you ask most people uh what fascism is uh you will get the answer that uh fascism is a far-right authoritarian and ultraist political ideology defined by a dictatorial leader the forcible suppression of opposition and the regimentation of society and the economy. Uh here you see it in its most classic form.

uh Mussolini, Hitler, Franco, uh you know, a very particular type of outfit usually located somewhere in Europe. But fascism is not just a particular type of European cosplay. Fascism is one of those things that political scientists have been studying for a very long time. uh and those scientists have come to some conclusions about sort of like how can you tell it's a fascism beyond the outfit uh some things that you are looking for are uh centralized autocracy uh power is concentrated in the hands of a single leader who is viewed as infallible uh you're looking for ultra nationalism uh the ideology promotes an intense often exclusionary nationalism prioritizing the nation over all other things. It is also tied uh to a mythic past.

You have to return uh and the notion of a perceived decline, humiliation or victimhood of the national community. Uh you're also looking for militarism. Uh fascism glorifies violence, conquest, and war and often leads to external expansion and imperialism. So living next door to fascists is not a good idea. Uh forcible suppression of the opposition.

Uh so you're also looking for uh fascist regimes use violence to silence disscent. Uh persecute or eliminate perceived political enemies and minority groups. Uh there's also an emphasis on hierarchy. uh it promotes a belief in a natural social hierarchy with individual interests subordinated to the interests of the nation or the race. Uh for some strange reason, the people who are always telling us that there is a natural hierarchy uh always seem to belong to the group that they place at the top of the hierarchy.

It's just weird like that. Um you're also looking for populism and elite collaboration. Uh fascist movements uh use populist appeals to gain mass support often while working with traditional elites to abandon democratic liberties. Uh pay close attention. This is going to become more important later.

Uh and finally scapegoating. Uh fascism identifies specific enemies and scapegoats and creates a unifying cause to focus the anger of the populace. So there is always some sort of mythical time that was better. there's some sort of hierarchy that is right and it's always that enemy's fault over there why you are not getting the uh the wonderful things that you deserve. This is of course best exemplified in the film Barbie.

So some core beliefs and behaviors of uh of fascists. So, we've we've gone like, "So, how do you know it's a fascist? What is the fascist doing?" You're looking for violent action. Fascism sees violence as a cleansing and empowering aspect that reshaped society.

Early fascist violence was fueled by the chaos of World War I and later war making helped solidify fascist rule. Uh, the rejection of liberal democracy. Uh, fascists reject fundamental liberal democratic tenants such as individual rights, pluris, pluralism, competitive elections, and political disscent. None of that is fashionable. Um, economic regimentation.

Fascist regimes often control and regulate the economy, suppressing labor power while protecting corporate interests. Uh, propaganda and control of media. uh fascist states maintain power by controlling mass media, undermining the truth and promoting myths. This will also become important later. Uh and uh finally, they're looking for reactionary and uh revolutionary nature.

So uh they advocate for a return to this imaginary past. Uh fascism, fascism uses revolutionary tactics to overthrow existing systems. Uh and finally, opposition to other ideologies. Everything that is not fascism is bad. Uh historically, fascism has stood in direct opposition to communism, socialism, liberalism, and democracy.

Pay close attention. This is absolutely going to be on the test. And you may ask yourself, "Oh, but Eva, fascism is not the only thing that is bad. There's also communism. Uh, one of the things that I did while I was studying political science back in the early 2000s when dinosaurs were roaming the earth, uh, was I studied, uh, I studied the internet and specifically I studied internet censorship.

Um, I studied Chinese internet censorship because quaintly it was the only censorship on the internet at the time. I went through a great deal of trouble. I learned Mandarin Chinese. I did, you know, a bunch of research. I found this fascinating.

And at the time, we had this really quaint idea that Chinese internet censorship was an aberration, that the internet was going to connect people and when people could talk to one another freely, it would have a democratizing effect and democracy and liberalism would spread everywhere. I am very sorry about how extremely wrong that turned out to be. Um but the thing that makes communism different from fascism uh in this particular case is that we have understood the anti-democratic effects of uh communism on on the internet for a very long time. It was one of the very first sort of anti-democratic uh movements uh that we that we experienced. Uh for example, here we have a uh chart from uh 2021 uh showing countries with the lowest internet freedom uh index scores and you can see China right there at the top uh followed by Iran, Myanmar, Cuba, Vietnam, Saudi Arabia, Pakistan, Egypt.

you can see that like communism is actually making a pretty pretty good showing near the top of the uh like the big players in uh you know low levels of internet freedom. Uh I would go so far as to say this chart probably looks pretty different in the year 2025. Um, at the very least, I think that Russia has probably moved uh many many many many places up the chart as uh as Russian fascism has increased. Um, I I do want to take a moment to distinguish between what is happening in Russia. Uh, no chart, spend all that time talking about a chart.

This is the chart. Uh, you can see Russia right there at the bottom. It should be way up near the top. Uh, China way up near the top because they've been doing internet oppression for a very long time. What does Chinese internet oppression look like?

China's version of the war on terror uh, depends less on drones and strikes by elite military units than facial recognition software and machine learning algorithms. Its targets are not foreigners, but domestic minority populations that appear to threaten the Chinese Communist Party's authoritarian rule. And again, the thing that makes this all bad is authoritarianism. Uh, in Shinjang, the web of surveillance uh reaches from cameras on buildings to the chips inside of mobile devices uh to Weaguer's very uh physomy, their uh their facial structure. Uh face scanners and biometric checkpoints track their movements almost everywhere.

Um, other programs scan Waguer's uh digital communications looking for suspect patterns and flagging religious speech or even a lack of fervor in learning Mandarin. Um, deep learning systems search in real time through video feeds capturing millions of faces, building an archive that can supposedly help identify suspicious behavior in order to predict who will become an unsafe actor. Actions that can trigger these computer vision technologies include dressing in an Islamic fashion, failing to attend a nationalistic flag raising ceremonies. Um, all of these technological systems are brought together uh in a way that is constantly learning from the behaviors of the weaguers that it watches. So at this point uh Chinese uh kind of the the web of uh digital censorship and surveillance has gotten uh extremely advanced and it turns inward.

Uh what's particularly interesting um about the technology that runs this surveillance is that frequently it is powered by American companies. Um, Chinese repression runs on technology built in the United States. And this goes all the way back uh to uh Golden Shield uh which was the uh system that was originally sold as part of the you know Chinese uh you know the the Great Wall of China's internet um to identify uh political dissident uh specifically um Cisco came to China and offered to sell them systems specific specifically telling them, "We can help you to identify your political enemies, the fallen gong." Um, EFF uh helped to uh to work on a lawsuit uh against Cisco called Doze versus uh Cisco uh on behalf of uh Fallen Gong um over this Operation Golden Shield uh situation. So, we figured out what fascism is.

We've distinguished it uh from authoritarian communism. Um, but what makes it cyber? I have spent my entire life making fun of the kind of people who just append the word or I guess uh add the word cyber to the beginning of everything and then act like it's suddenly revolutionary. Cyber war, cyber espionage. Cyber Pearl Harbor.

Uh, I've rolled my eyes at these people all my life. Uh, and yet here I am, uh, coining the term cyber fascism with a straight face. Why am I doing this? Um the reason is that uh the difference between plain ordinary fascism which is this you know form of cosplay that happens in Europe um and what we are experiencing a sort of resurgence in worldwide right now is powered by digital information. It's powered by censorship.

It's powered by surveillance. uh and all of this uses technology. There is an everinccreasing amount of data being created about people, their movements, their preferences and their interactions. Uh we have seen these webs of tracking, surveillance and control uh as well as webs of uh uh of propaganda and uh and the spread of disinformation. And since this is all happening on digital platforms uh using uh digital technology, I I think it is worth talking about cyber fascism as a sort of as a unique thing.

And you may ask yourself now where is this all going? And the answer unfortunately is nowhere good. Uh, I am now going to engage in the extremely tacky behavior of reading a tweet thread. I promise you it's going to be worthwhile. Uh, this is the work of my colleague at the Electronic Frontier Foundation, uh, Matthew Guerrlia.

Uh, he is, uh, an activist. uh but he is also a scholar and his area of of scholarship uh the area in which he has uh written a book published by Duke University Press uh is the uh interaction between uh policing and surveillance. The history of police surveillance uh and usually the way in which uh it turns out police surveillance is unbelievably racist. So recently uh he he made the following tweet thread which I will now read to you. Please be patient.

He says, "I spent the week at a sur at a police surveillance convention and let me tell you my biggest observation. The name of the game now is consolidating as much information as humanly possible from surveillance devices, the internet, other governmental data, and literally a million other places. A lot of big companies are in are incredibly interoperable with a thousand other devices and companies and serve as major platforms to consolidate, fuse, map, and provide AI enhanced analysis of all this data. We're talking drones, automated license plate readers, surveillance cameras, gunshot detection, and more. The smaller companies make money by getting the big ones to lease their services, providing specific information to the bigger platforms.

One company has relationships with smartome appliances for data. One company only does social media scraping and analysis. One does metadata from phone companies. You name any type of device or platform that collects data. A company exists that can package it, sell it as a data stream to police to be fused with everything else.

Clear? Oh yeah. Geoloccation from advertising data brokers. Yes. The big takeaway here is a mass erosion of the barriers between governmental and corporate data collection and surveillance.

And the idea that one-off surveillance of walking past a single CCTV camera is over. The consolidation of all data means true mass surveillance from 100 redundant pieces of data. A few found cars is enough to appease folks that mass surveillance is okay for those small wins. But here are the important takeaways. One, police are so shockingly cozy with the multibillion dollar companies that sell surveillance tech that you have to ask who's actually making policy.

And two, no mention of the harms that this can cause. Like policing generally, this tech is only being deployed a fraction of the time to address serious crime. What does it do the other 22 hours of the day? And how are marginalized communities going to suffer for it? But you know, cheerful stuff.

And this is nothing new. Um, the legal framework for identifying, tracking, and controlling minority populations was in uh established by laws like lantern laws seen as a direct precursor to modern policing and surveillance technologies. Lantern laws were a colonial area uh era legal code primarily uh based in 18th century New York City that required black mixed race and indigenous enslaved people to carry candle lanterns after dark when in public and without a white person. These laws served as an early form of surveillance and control, establishing a framework for modern stop and frisk policy by deputizing any white person to stop those found uh without a required lantern. So this was a uh a method of identification and control.

Uh the primary goal was to identify and control the movements of black, mixed race, and indigenous enslaved people. Um it was also a way of suppressing resistance. The laws were aimed to discourage enslaved people from gathering uh such as attending school for slaves which was a source of of uh of resistance. Uh and so also it was a precedent for stop and frisk. By empowering any white person to stop and question individuals of color.

The law established a precedent for stop and frisk policing practices that continue to this day and of course more cheerful content. Uh I will now tell you about a time that a uh a US company uh decided that fascism was great and it was going to do absolutely everything that it could uh to help move fascism along. specifically in Germany, specifically the Holocaust. So the first thing that Hitler wanted to know uh when uh when he took over Germany was how many Jews resided in Germany. Um IBM hired thousands of people uh to execute door a door-to-door racial census.

Uh once Hitler had the names and locations of Germany's Jews, IBM created systems to tabulate that data against professional and employment databases as well as financial institutions to help Germany systematically popularize them. Location data was then used to organize the mass transfer of Jews from their homes into ghettos. Ghetto residents were then systemically forced onto trains into camps. Those trains ran on IBM punch cards and owed their punctual timets to special IBM scheduling programs. All the work and prisoner data from all the concentration camps was fed into a central nerve center in the TE building in Oriber known as section D2 and powered by customwired IBM machines.

Everything IBM did for Germany was custom specific and tailored to the Nazis specific needs. All IBM machines in Nazi Europe were leased with monthly payments. They were insured by American and German insurance companies at their Reich locations and serviced by repairmen twice monthly on site whether the noisy syncopating machines were located in downtown Berlin or at Awitz. These machines were incapable of operating without IBM's custom punch cards. And each card could be used only once.

Without a computing card supplied from IBM, the machines would have been like rifles without bullets. Oh, don't worry. I'm going to get more cheerful. So this sort of behavior continues to this day. Uh I will tell a slightly more cheerful story because this is about behavior that was uh that was outed and then stopped.

Um so Microsoft uh last month told officials that unit 8200, the uh Israeli military's elite spy agency had violated the company's terms of service by storing the vast trove of surveillance data in its Azure cloud platform. Um, the decision to cut off Unit 8200's ability to use some of its technology results directly from an investigation published by The Guardian earlier this year. It revealed how Azure was being used to store and process the troves of Palestinian communications in a mass surveillance program in a joint investigation uh with the Israeli Palestinian publication uh plus 9 uh 972 magazine uh and the Hebrew language outlet uh Local Call. The Guardian revealed how uh Microsoft equipped with Azure's near limitless storage capacity and computing power um unit 8200 built an indiscriminate new system allowing its intelligence officers to collect playback and analyze the content of cellular calls from an entire population. The project was so expansive that according to sources from unit 8200 uh a mantra emerged internally that captured its scale and ambition as a million calls an hour.

According to several sources, the enormous repository of intercepted calls uh which amounted to as much as 8,000 terabytes of data was held in a Microsoft data center in the Netherlands. within days of the Guardian publishing the article, unit 8200 appears to have swiftly moved the surveillance data out of the country. Uh it is my understanding that having uh been told to take a walk by Azure uh and Microsoft as a result of uh not just this story from the Guardian, but pressure uh from engineers inside of Microsoft who did not want to be uh engaged in this kind of mass surveillance. Um, unit 8200 simply uh went over to AWS. And this this is where you come in, every single one of you, as you can see from this slide.

[clears throat] What do we need to guard against as people who build tools? As people who think about the structure of the internet, as the people who are asked to build platforms, uh what are the kind of things that we need to guard against be against building or being asked to build? Uh one is we need to guard against powering surveillance. Uh we need to guard against the government control of media and communications platforms. Uh, we need to guard against weakening the response to disinformation and misinformation campaigns.

And we need to guard against technology that undermines our very ability to believe in the truth. As you can see here, and we're going to go through this very quickly, uh people like Larry Ellison uh very strongly believe in the notion that we are going to have omnipotent omniscient surveillance and that this is going to make people uh somehow behave better. Uh every police officer is going to be supervised at all times and if there's a problem, AI will report that problem. This is a future I would very much like to avoid. So Hannah Arent uh saw this coming.

There is a a very popular quote uh from uh Hannah Arent, philosopher and studier of totalitarianism uh going around on the internet and it goes like this. This constant lying is not aimed at making people believe a lie, but at ensuring that no one believes anything anymore. A people that can no longer distinguish between truth and lies cannot distinguish between right and wrong. And as such a people deprived of the power to think and judge is without knowing and willing it completely subjected to the rule of lies which such a people with such a people you can do what you want. So what's particularly interesting about this quote is that Hannah never said it.

This is an example of exactly the kind of misinformation and disinformation that we see online all the time. You cannot trust this stuff. Uh, and the reason why this quote is so popular is because it is an amalgamation of many things that Hannah Arent has says. It sounds Hannah Arenti. It sounds vaguely truthy and so we pass it around, but you shouldn't run around believing uh everything that you read on the internet.

I myself have a very serious problem which is uh that I am a frequent target of AI slop. Um uh over at EFF we have an exciting problem uh which is that there are now a bunch of fake news articles that quote uh or at least purport to quote people from EFF on a variety of topics. And one of the things uh that they really love to do is they love quoting me. They love making up things that I have said. It is uh their favorite.

And they don't just enjoy quoting me. Though I do get really upset that the things that they say I've said are usually kind of boring. Like these these are not impressive quotes. Uh but my personal favorite is a quote in the Arabian uh in the Arabian Post uh having to do with community cameras uh shielding uh vulnerable Los Angeles residents from ICE raids. And the interesting thing about this is uh that the uh the article quotes privacy advocate Lynn Wyn from the Electronic Frontier Foundation uh remarked that community monitoring tools are playing a civic role that she warned of the potential for misinformation.

This is particularly ironic because there is no such thing as Linwin. She doesn't work at EFF. There is no Linwin in like the entire uh like international privacy community that we are aware of. She does not work for us. She has never worked for us.

This entire thing is completely made up. And this is where you come in. What can you do as the people who build tools, as the people who build protocols, as the people who decide how the internet is going to look in the future? There's some things that you that you can do that will change the way that this plays out when fascism comes calling. Uh the most important one is that sometimes the answer is we won't build that.

Frequently when I talk to computer science uh students at universities, one of the things that they tell me is if I say I'm not going to build it, then somebody else is just going to build it. Somebody else is going to get the contract. Somebody else is going to get the money. Surely if I build it, I can build it in a better way. I can build it in a way that's less damaging.

It might as well be me. And to this I say no. If you say that you will not build it, and the next guy says that he won't build it, and then the next person says that she won't build it, then it doesn't get built. And even if it does get built 50 years from now on an internet that presumably still exists, on a Wikipedia page, presuming that Wikipedia still exists, do you want a photo of yourself next to whatever, you know, tool of mass surveillance you have just built from a fascist government? Do you want people to know that this is what you have done with your life?

Do not comply in advance. Repeat after me. When you are asked to do something that you do not absolutely have to do that is unethical. When you are asked to build mass surveillance, when you are asked to sort of correlate and and collect this data, the correct answer is is not here let me help you with that. It's [ __ ] you, make me The next thing the next thing that you need to keep in mind is that you need to futureproof your technology because even if you like the government in the place where you are living or you like the government in the place where you have chosen to uh to keep your data or to store the data for your platform or to found your company.

What is going to happen when your comfy liberal democracy backslides into fascism? they're going to have all of that data. So, you need to be thinking about that sort of thing in advance. And this is why encryption is great. Um, and also why you need to say, "Fuck you, make me."

when somebody shows up saying, "Listen, we just we just need you to build a backdoor in order for us to stop terrorists or to stop uh you know uh CESAM or to save the children or whatever the reason is uh today or tomorrow or yesterday. None of this matters. What is very important is that you need to futureroof your work." And one of the key elements of uh future proofing the work is something that everybody here already understands which is that you have to decentralize. You cannot put all of your eggs in one basket.

YOU CANNOT COUNT ON A single country. You cannot count on a single platform. Uh we need to be thinking about how to spread this work over as uh as many different geographies and jurisdictions as possible. You also need to think about practicing data minimalization. Uh it is really tempting.

I can tell you as a person who works in security to collect everything because maybe you're going to need it later. Um but when you are collecting this data, you need to think about what is going to happen when bad people get their hands on it uh further down the line. Uh and then the final and I think most important point which I think is very frequently missed uh by the sort of builders and toolmakers in this space is that you need to build with marginalized people in mind. You need to build with marginalized people at at the center of your vision of who your user is. Because if you build with marginalized people at the center of your design, you will build tools that protect people who are already powerful, who are already comfortable.

But if you build tools for the powerful and for the comfortable, you are ever going to build tools that also protect the marginalized. It simply doesn't work the other way around. And so I ask you to go forth and be radicalized. When when the fascists come, what I and they ask you to build things, what are you going to tell them? [ __ ] you.

Make me. Thank you. Thank you very much.

[applause] [groaning]