Project Galileo Spotlight: Derechos Digitales

Hello, good morning, good afternoon, and good evening everyone everywhere. My name is Francisco. I am based in London and I work at the Customer Success team of Cloudflare. As part of our celebrations for Cinco de Mayo, or Cinco de Mayo in my accent, or 5th of May, which is tomorrow, our employee resource group, or ERG, called Latinflare, has been doing multiple events. Cinco de Mayo celebrations stand for multiple things, and in recent times they are more oriented to embracing the Latin culture from a broader perspective in the U.S., given that it was a famous battle that the Mexican army fought with France a while back. However, it took a different direction in the most recent years. This interview is one of our highlights, and this is why we have invited a very special guest, Juan Carlos Lara, Research and Public Policy Director of Derechos Digitales, joining us from Chile. So thank you for being here with us today. Can you please introduce yourself to our audience? Hello Francisco, it's my pleasure to be here with you. Good morning, good evening, good afternoon everyone. My name is Juan Carlos Lara. I am a lawyer by training. I have studied here in Chile and also in the U.S. in California. I have devoted most of my professional life to the work that is behind the intersection between the law and technology, and most of that has also happened in a career in the organization that Francisco just mentioned, which is Derechos Digitales. That's my current employer, that's where most of my work is done, and that's who I'm proud to represent today. Thank you so much for that introduction. To give some context, I want to share that I met Juan Carlos because Derechos Digitales is part of Cloudflare's Project Galileo. Cloudflare has the mission to help build a better Internet, and that includes protecting free expression online for vulnerable groups. Therefore, in 2014, we launched this service, free of cost, to protect important and vulnerable targets like artistic groups, humanitarian organizations, among others. So we will cover this a bit more shortly as it's actually quite related to what Derechos Digitales do. Speaking of which, that's a good segue for my question. Can you tell us a bit more about what do you do exactly? Yeah, it's a difficult question to answer, like what do I do specifically, and certainly it's not something that any person in my family could answer. But the work that my organization does is a complex set of things. But our main goal is to provide the conditions for a better enjoyment of human rights in the relation with technologies by all people in Latin America. We're an NGO, we're a nonprofit. All of our work is devoted to public policy advocacy and also public campaigning, trying to address some of the problems that we see with current technologies, with digital technologies, which is to say that they are very much very good for the exercise of human rights, but at the same time that they can be subject to certain actions by the powers that be, be it corporations or be it the governments that may want to use those same technologies that serve to empower human rights in order to diminish the enjoyment of those rights. And Derechos Digitales then, what it does is provide actions of public campaigning, of doing advocacy work with policymakers and decision makers, and also with providing evidence, with conducting or directing research, trying to deal with all the different aspects in which human rights are impacted by technology or technologies, and therefore human rights are impacted by regulation or impacted by the practices of abuse by certain governments or certain actors. So that's what we do. We try to advocate for human rights in the use of technology and in the regulation of technology, for policymakers, but also for regular people. That's really impressive. Thank you so much for sharing those ambitious goals, which sound quite challenging. So I'm curious to know, how many regions are positively impacted by all the work that you do? And how do you measure this? Because you're currently based in Chile, but I understand that you also work with other regions as well. So how would that look like? Yes. So when Derechos Digitales began like 15 years ago or so, then founders were all based in Santiago de Chile. So it was all a bunch of lawyers working in technology law in Santiago. But our mission expanded throughout time, mostly because of the positive impact that the organization was having here in Chile, which is where I'm based as well. This kind of work brought us together with many other organizations throughout the globe. It was a very positive experience to have that kind of interaction with other organizations, also some of which had inspired the foundation of Derechos Digitales. So while at the beginning, our work was all about this one country, almost a decade ago, probably like seven years ago, there was a strong shift, there was a decision to try and have the same kind of impact throughout the Latin American region. And ever since then, and ever since our first hire abroad in 2015, we have also had staff in other countries in the region, we are currently based in Santiago de Chile in our main office. But we have also staff in Brazil, Uruguay, in Colombia, in El Salvador, we've had it in the past also in Venezuela and Mexico. And we are very much keen to have more people connect with us from different parts of the Latin American region. As for our impact there, it's a tricky region. It's many different countries with very different situations, in which a few countries represented on this call do have like more favorable conditions than many others that are not or even though most of them are currently under very heavy situations of social unrest. But we want to think that our impact is not only in the region as a whole and in individual countries. We also want to think that or we aspire to also have a positive impact in the world, which is what you have when you have the connections with larger networks, with networks that involve other peers in civil society, or in academia, also in other parts of the world, but also when you connect on or when you advocate with global corporations. So as much as we want our work to be most fundamentally about Latin America, we also think that that work itself and those ambitious goals are also something that we are actively pursuing in our work at the global level too. That sounds really good. Indeed, if you can replicate that first from being in Chile and then to Latin America and then the whole world, that sounds like a very noble goal as well. That way, hopefully, we'll make things better in the world or you will have that impact there. So thank you for sharing that. Speaking of, for instance, Latin America as well, and maybe eventually this will roll out to a wider geography, I noticed that you're working on an artificial intelligence and inclusion project. Can you tell us a bit more about that? Yes, sure. And I think that project too also shows our aspirations for impact and how we will try to measure that impact. Currently, we are conducting research. We have just finished some research on projects that involve artificial intelligence or automated decision-making systems in the public sphere in four Latin American countries, Uruguay, Chile, Brazil, Colombia, with very specific applications of technologies that at one point would be sold or would be presented as artificial intelligence, regardless of whether they are actually artificial intelligence or not. So we have conducted that research, but our purpose is not just the research for the sake of research, which of course is a completely laudable, completely positive goal in and of itself. However, we are an advocacy organization. Our purpose is to take that evidence and try to create change. So therefore, we have measured things. We have conducted some research and some analysis on some internal and external characteristics of the implementation of these systems in these four countries, and our goal is to gather these lessons, probably conduct a few more case studies, but to gather these lessons and bring them to those that make those decisions on the implementation of artificial technology or in digital technology in general. This is to say not just about those public entities or those public officials that are currently in charge of implementing or deploying technologies, but hopefully those from other countries as well, and hopefully in a way that we can bring those lessons in an understandable manner in a way that they can implement them in future implementations of technology. And that is not to say also that this is only about whether we program the algorithm in this or that way. This is a broader issue about public policymaking, about participation, about an equal seat at the table, about monitoring, about evaluating whether the technologies that are implemented are fit for purpose and whether they are respectful of human rights. So that's what we are trying to do. If you want an easier plug to follow, we have ia .derechosdigitales.org. We can link them afterwards if necessary, and there you can find our reports, our executive summaries also in English, and also some of the charts that we have drafted with the information that we have gathered at the moment. But as I said, this is just beginning and we really want to bring this to further action with policymakers, with decision makers themselves. Cool, thank you. It does sound complex indeed, but I'm curious to know in which kind of instances or which kind of decisions, for instance, will you be using this AI system? For what kind of decisions this will help? Well, try to understand whether people are being included or not. Yes, and that's one of the goals of the project, trying to find those instances where technologies sold as artificial intelligence or algorithmic decision making are being deployed. And we have found several cases throughout time in the Latin American region. Some of them have been more famous than others, and we selected a few of those cases. One of them has to do with the administration of justice in Colombia. Another has to do with a government-sponsored system to allocate jobs in Brazil, which is a very impacted economy after all this pandemic too. Another one is about the use of technologies integrated into the COVID following systems in Uruguay. And a separate one is about the allocation of state services to minors in Chile. All of those have different degrees of automation or algorithmic systems behind them. But in all of those cases, you see that these are technologies that are impacting people directly in what are fundamental human rights, like the right to work, the right to health, the right to have an adequate standard of living and receiving government assistance, or the right to have access to justice. So because we see those rights possibly being affected by how these systems are implemented, aside from larger concerns about the right to privacy and the right to self -determination and information, or the right to non-discrimination, we see those as the deployments that can impact in those rights. Thank you for sharing that. Yeah, that gives me a better understanding as well of how would those be implemented. Because yeah, when we talk about rights, there are so many different things there that it could be a bit hard to imagine how it would look like with AI, especially if this is something rather new overall. So yeah, getting the flavor of that is really useful to understand the context further. I'm curious to know, you mentioned the pandemic, which every country has suffered in the past year and a few months. So I'm curious to know, how did COVID impact your day to day? Being like sort of an online human rights organization, if you will, do you see anything different from a perspective, like people coming more online or less, or how did that change your day to day, yours or your colleagues? Yeah, so of course we are a digital rights organization, so of course many of the things that the pandemic brought to all the people that are now working from home or studying from home or searching for work from home, those are things that are much of our concern day to day. However, in our daily work, like how do we work as an office, that completely changed. And I would argue that that happened at least for some of us a bit earlier than the beginning of the COVID-19 crisis, mostly because we have a few situations that came before that. One is that we have staff abroad, like just as many tech companies do or many, now many regular offices do, we do have staff that live abroad or that do live away from our main offices. So as time has passed, our office received fewer and fewer people in person. However, that and because our staff abroad has grown, that also means that a large part of our staff is away from us and they are working remotely already. However, that changed a bit before the pandemic because we had a social unrest, a social uprising here in Chile, and therefore we spent a few months away from the office too. So that kind of brought us all away from the office. And now with the COVID pandemic, something that was initially a part of the work of our staff abroad became the situation for all of us. Now we're all away from each other. Now we are all relying on the information that we have online to try and do any kind of advocacy. This is no longer about having people meet with us in person or having people meet with us and present us with documentation or having people meet with us and advocate for something in their own offices. This has brought everyone away from each other and therefore it has created new challenges. It has created, of course, a lot of opportunities, like for instance, to have this meeting with Cloudflare in different parts of the world. But at the same time, it has also brought us to the point where most of our advocacy work needs to be done online. Most of our advocacy and research work needs to be done online as well. So those challenges are something that make us rely more than ever on the Internet that we are trying to protect. Yeah, thank you for sharing your experience. And given the fact then that online presence has become even more important with COVID and before COVID because of the civil unrest situation and also having the staff abroad, I'm curious to know and ask you as well, as Digital Digitality is a partner that Cloudflare has for Project Galileo, what does that mean to you and the other organizations? What is the outcome of this partnership? Yeah, so it's important for us to stay online. It's important for us to have a visibility. It's all of our materials that count in the dozens at the moment to be available as much as possible. If we have a new website with our research or public campaigning, those need to be accessible. That is information that we want to be out there for their use by other people, by other activists, by policymakers. So having the Cloudflare services is an important part of that because what we knew from the beginning of this organization when I was not part of that, but what the organization knew from the beginning is that some of the work might be targeted by bad actors, that there would be likelihood of hacking, that other organizations would also come to us with their own concerns about hacking and about defacing or about surveillance or about any kind of actions against their own websites. So maintaining our visibility required some technical measures. And at the same time, the Cloudflare products and specifically being part of Project Galileo has been a positive experience because it has meant that we can say that this is the kind of services that you need and you can also apply for them online for free. I cannot be sure about how that can be measured throughout time because of course in many cases we have urged people that have not necessarily come to the project to request the products. However, we still try to at the very least be an example of the kind of work that we do and the kind of things we support are also held by having this kind of protection because you need that kind of protection to remain online, to remain visible and to continue doing your job, to continue doing the work that you consider important. So for us it is both the possibility to have an example but also to show the way for others to try and get the same kind of protections. Yeah, definitely. And you mentioned that there are these organizations who reach out to you. Are they organizations like mostly from Chile, Latin America, other countries as well? Where do you get them from? What are their usual challenges from this perspective because of having bad actors on the Internet? Do they have outages in their websites, loss of information or anything like that? Or what other kind of challenges that may be different from security in terms of online security that they go to you? Yeah, I think that their own concerns have to do mostly with security. But interestingly enough, most of the concerns about security that come to us are from people that have already had security concerns in the past. It is very interesting for us that security concerns come only when you are aware that you become conscious of your security gaps. And that usually happens when people have already been hacked or have already been impersonated online, when they have already been subject to any kind of visible surveillance, some kind of surveillance that they have detected. So both from the hacking and the surveillance perspective, that kind of concerns have come to us. We have now also, aside from what services we can recommend, we have also now a technical staff that can provide with some recommendations on that front. But I would say that the most important thing in all of that is to understand from our own experience that even though hacking may still happen for other organizations, that you can still conduct or you can still adopt many very effective measures to reduce that to almost zero, hopefully. But that you can actually make advances towards your own security and therefore you can continue doing your job regularly and without disruptions. Yeah, so that being the case, which is quite true, usually some companies, what happens is once they have a breach or they have a security challenge, it's like, oh yeah, I actually need this. And at the personal level, if you never had a virus on your computer, maybe you would never consider getting an antivirus until you actually suffer from it, similar to an insurance when you're driving a car. But yeah, if there's anybody in the audience that has any ties to any not-for-profit organizations or NGOs, yeah, Portugal Helio is something that you could consider to have extra protection and you could reach out to the team at Klauffler or maybe Derecho Digitales as well, depending on what exactly you're looking for. But here it's about giving an extra voice to the Internet and making sure that those voices are still there. I'm curious to know what companies will do to get involved at a personal level about Derecho Digitales. From an organizational level, it seems a bit more obvious, or maybe not, but at least we talked about it a bit. But from a personal level, is there anything that people could do? Yes, so this is one of the points where I think it's very important to have your own site and to have your own information available out there. One of the things that we have also seen in the last several years is that because of the dangers that are involved in having your own website or posting your own service, is that you might be subject to attacks in a way that you cannot prevent and therefore they sometimes move to other kinds of services like, for instance, social media instead of having their own dedicated websites. It's important for us to have our own dedicated websites to also not be subject to the social media imperatives behind their business model. So it's a political statement for us as well. But if you want to reach out to us, our information, you can either get that from social media. Of course, we have a social media presence. But in our own website, when you search for contact information and for our teams, you will have not only the possibility of writing us an email, but you have also our information to write to us encrypted messages if you wish to, which we find very important. Also, if you want to reach out to us with important things that you do not want to be subject to any kinds of surveillance, hopefully, but that you find sensible enough also to share with us. So if you want to reach out to us, you can either like write generically to info at derechosdigitales.org or you can search for our contact information in our website at derechosdigitales.org. Or you can contact us more lightly in our usual social media website, social media presence accounts, such as at derechosdigital on Twitter, at ONT, derechosdigitales on Facebook, and probably search us also on Tumblr and Instagram and a few others. Thank you for sharing that. There's a lot of resources. So hopefully somebody will reach out. I have one more question, as I know we're close to our end of the session. I'm curious to know, what is one of your favorite success stories of all the positive impact that you have generated? Yeah, I think that on that front, we have had many success stories in the past, as we have had so many things that we have learned from not being successes. But those are also important, I would say. But I think that the most important success story, or one of my favorite success stories has to do with the passing of a small regulation here in Chile years ago, that wanted to replace the law by essentially mandating data retention on telecommunication companies for an extension of two years with very detailed information. And they wanted to pass this simply as an executive decree. And we went against that. And we litigated that in an instance where it was not exactly litigation, but rather it was a form of administrative examination of that request. So therefore, we moved forward our own knowledge of the situation. We've moved forward our own legal understanding of it, our own legal research. At the same time, we conducted what amounts to strategic litigation at the same time. We also went public with it. We gave it a specific name to this whole challenge. We gave a specific name to this whole risk and to this whole threat. And we converted that into a multi-pronged action against this regulation. And we won. This was overruled by the administrative, by the general controller here in Chile. And in the end, that did not come back until it was just a legal initiative with probably a much lower chance of success because we have also inserted not just the action about the topic or the subject of that action, but also what that means. We think that we have changed the conversation too. So any kind of attempt to conduct that kind of mass collection of metadata will now hopefully face a much larger resistance movement from the population in general, and also from politicians and decision makers that we want also to see replicated in other countries as well. That sounds very impressive to get to such level of scrutiny. Now we are saying being able to have that kind of impact. So yeah, well done there. Indeed. Thank you. It looks like we are coming to the end of the session. So I wanted to thank you again, Juan Carlos, for your presence here and for sharing a bit more of what you do, what Direcho Digitales do. And with that in mind, I would like to continue inviting the audience to visit the Direcho Digitales website to see all the cool stuff that you're working on and achieving. And again, if there's any other not-for-profit organization or NGO that may need some kind of support, yeah, you can definitely do that as well, either through Direcho Digitales or Cloudflare, depending on what you're looking after, of course. So with that said, and no further ado, thank you again, Juan Carlos. Muchas gracias. Thank you, Francisco. Thank you, Cloudflare. Have a good day. Take care. Have a great rest of the week. Bye-bye. Bye -bye. Bye-bye.