Talking Tech with Chinmayi Sharma and Nick Doty on The Role of Public Interest Technologists
In this episode, we explore the vital role public interest technologists play in shaping policy. How do technical experts influence legislation around the internet, cybersecurity, AI, and more? What challenges do they face, and how can we encourage more technologists to engage in public policy?<br>Joining the conversation are Chinmayi Sharma, Associate Professor at Fordham Law School and CDT Non-Resident Fellow, and Nick Doty, CDT’s Senior Technologist.<br>Tune in as we unpack the intersection of technology and policymaking—and why it matters now more than ever.
Top Keywords
- public interest 0.012
- technologists 0.012
- interest 0.009
- policy 0.009
- public 0.008
- open source 0.007
- source 0.006
- technologist 0.006
- privacy 0.006
- interest technologist 0.006
- open 0.006
- nick 0.005
Transcript
Welcome to CDT's Tech Talks, where we dish on tech and Internet policy while also explaining what these policies mean to our daily lives. I'm Jamal Magby, and it's time to talk tech.
Welcome to Tech Talk by
CT.
Team. Today, we're diving into a critical and evolving field, the role of public interest technologist in policymaking. How do technologists influence laws and regulations that affect the Internet, cybersecurity, AI, and beyond? What barriers do they face? And how can more technical experts step into this important work? Joining us today are two amazing guests, Chinmaya Sharma, associate professor at Fordham Law School and CDT nonresident fellow, and Nick Doty, senior technologist for CDT.
Chinmaya, Nick, it's so great to have you here today. It's a pleasure to be here. Thanks for inviting me. Yeah. I'm excited to have the conversation.
Good to be here. Of course. So we're just gonna jump right into it. How would you each define the role of a public interest technologist,
especially within the policy making process? I think the policy interest technologist framing is really interesting. Of course, it's it's one of those interesting terms that doesn't have necessarily clear definition, and that's great. Sometimes we need contested definitions in order to make progress on things. I think of a policy interest technologist as someone who uses their technical expertise to improve some public interest value. And so that that is a pretty wide range. That includes, like, the civic tech people who are working to improve the government services through technology, and it includes people inside of tech firms that are just trying to build their products in a way that is well aligned with public interest. And I think it is like a and also an interesting subset of tech advocacy, of tech policy work, of using that technical expertise to influence either policy making or technical design to to support the public interest. So on the policy making side, in particular, I think it's explaining things to policy makers of all types and also sort of communicating that back to the technical community so that they can understand what the actual policy goals are and and how to get to them through some combination of technology and law and norms.
Yeah. I I love that you went first, Nick, so I can just say, like, subscribe. I agree with everything that you just said. Don't have to do a lot of the smart labor myself. It's funny that you said, like, it's a term without meaning. I am a law professor, and I'm teaching first year torts. And I, like, I think that in law, especially, it is really useful to have terms that have kind of vague, malleable, capacious meanings. But then it's also really frustrating because it's super contextually dependent how you're interpreting this term. It can also be co opted. And so kind of, like, what I'm getting at there is, like, what does public interest mean? It could mean just the idea of we have technologists that are thinking about what's best for society, but, like, what does society mean? Is it, you know, your specific jurisdiction, like, Western democracies? That's really vague. And then what's in the public interest? Like, we had Anthropic do the study recently of, like, you know, what kind of values do you want AI to exhibit? And they did kind of a democratic majoritarian type poll, and it's not clear what we think is in, like, the best interest of the public. I used aggressive air quotes there. And then there's also just, like, the alternative definition of public interest, which is you would think of, like, the government. You know, when you're a public interest lawyer, you are working for the government. The reason that matters is because I I completely agree with Nick that these can be technologists that are working in civic society. They can be technologists working in government, like the through the awesome tech congress program or one of the many technologists that have worked at the FTC. And hopefully, you know, we will have technologists working at the FTC in the future too. But you can also be in industry, like Nick said, building things that we think are either in the best interest of the public or building things for the government to help the government serve the public interest. But then there's also the fact that, like, right now, some of the biggest voices in tech policy are individuals who, talk about the public interest a lot and are technologists, but also have loyalties to not just loyalties to employers, but, like, obligations through contracts to their employers. And then employers have obligations to investors, whether they're private companies and these are private investors or fiduciary duties to shareholders. And so all of a sudden, like, what public interest means gets really distorted. But then, like, in terms of the role they play, it's all really important. It's just as diverse as I think the, like, million iterations of what public interest acknowledges can mean that I just went through it. It. It is, I think, kind of translating the world of technology engineering, product management, and that entire ecosystem to individuals making policies about it. And I imagine there's also kind of, like, the public interest technologist of taking policies and figuring out how do you shape development processes or internal governance or the actual technology itself to, like, best reflect policies.
Yeah. Maybe too often, like, we're assuming that, oh, it it goes from technology to policy because we just assume that there's some hierarchy and that the government is is making all the fundamental decisions. I think increasingly, we we don't have that assumption. I either because we've lost faith in certain governance processes or just because, like, we we recognize that there are other ways to do governance that aren't that aren't, like, laws and rules that a lot of the technical design decisions that are getting made in standard setting or something, like, have that same flavor of, like, trying to set up good incentives for all the different players in an ecosystem. So I I also think it is useful even in the sort of policy making concept to not think of it as just a one way conversation towards lawmakers.
I totally agree. I love that you brought up standard setting organizations. I feel like as a lawyer that, like, thinks about policy, there are a lot of people in my field that don't know that things like the IETF or the w three c exist and the massive influence they've had over tech governance. I mean, there's, like, for some people, this is gonna be I really that I bring it up into other people. If you haven't heard of it, you should read it. But, like, the Lawrence Lessig book code two point o that talks about how law can be something that governs, but so can architecture. So, like, the way you actually build something can govern. And so the way that we built, like, the foundation of the Internet to be open protocols was a governance decision that wasn't driven by regulation. It was technologists made this decision because they thought it was the best policy for public interest. You have, like, the IETF that, like, has expressed as a body through rough consensus what their positions are on privacy. And then you even have, like, private sector companies. I think Microsoft has been a big player in encrypted DNS, which is a privacy position. It's coming from the industry side. It's not something that actually it's something that there's a lot of parts of the government that they're opposed to it. And so, yeah, I think the back and forth, like, remembering that it's a back and forth is really important. Kind of peeked in a little bit, and I wanna go a little further and and get some insights from you both on why you think it's important that technologists
be directly involved in shaping technology policy rather than leaving it solely to lawmakers and the traditional advocates. Chinmay, I'll pose it to you first.
I mean, I think it is and I think Nick and my comments preview this a lot. And I think it's really important to have technologists, whether independent technologists or researchers, people within the government, or people in industry weigh in on policy decisions because, like anything in life, I think a lot of our positions on things are really, like, normative intuitions we have or, like, end state dream world magic wand scenarios of this is what we want things to look like. And I think that from, like, for example, from the legal side, like, when we start thinking about our end goal and we start getting fed ideas of how to achieve that end goal, we start to conflate the means to the end with the end itself. And that can be a mistake because it artificially cabins the scope of possible solutions we have. So, for example, you know, this is like a personal pet peeve of mine, but, like, when we think about building trustworthy and safe and secure and fair AI, we just hear people bring up red teaming all the time. And now I think I hear people advocate for something like red teaming as if it's the goal in and of itself. But, like, what the goal is is we wanna build systems that best support the public interest, whatever we define that to be. Red teaming is a method that has shown promise in the security space. And so, like, taking that analogy and applying it to the way systems are built and function and how users interact with them is useful, but that when we, like, when policy makers grab onto that too hard and kind of stop involving technologists and the academic community and the research community in conversations, I think we've, like, artificially altered progress on how we can achieve an end goal to something like that. And so, like, red teaming is not the end all be all for building safe and trustworthy AI. And so if you continue to engage and continue to have technologists in these conversations, then, like, you know, policymakers can do what policymakers do best, which is, like, this is what we want to accomplish. Like, this is what we want our this is what our ideal world state is, and can have technologists inform them on, like, well, this is what's possible in the technological world. This is what's newly possible. This is, like, how tested it is, how untested it is, the risks that it has. But when that interaction doesn't happen, and not just, like, when policy is being passed, but continuously as, like, a feedback loop, then you have things, like, stuck in time as overly relying on a conversation or a series of conversations that happened several years ago as, like, the way you're trying to accomplish a massive goal that's gonna be a moving target. That's really useful. I I have often thought about it as, like, a educational role that technologists need to explain what is
what are the likely implications of a particular change. But I think you're getting at, like, a more productive collaborative approach, which is that oh, also, if you talk to the actual experts in a particular field, you can, like, find a new additional novel ways that might help you get to that goal. So it's it's not just the job of the technologist to say, this is a bad idea. This is going to have all these unintended consequences. Although that is an important role, We play that role on proposals to backdoor end to end encryption on a on a regular recurring basis. But I think there's a larger opportunity, which is, oh, we can also potentially find novel solutions. And and I assume this is not new to technology. That that happens to be an area I work in more, but I think it would be similarly strange to not involve medical experts in health care policy or environmental experts and environmental policy. Both because you would get things wrong and because you would not be involving the community itself that is finding new approaches.
I totally agree. Like, there's a article that came out that I won't I won't go into too much. I actually can't even remember the exact title of it, but it's by a scholar named Ari Waldman. And he's writing about kind of the perils of over reliance on technology expertise. And there's a lot in the article that I don't agree with, but there is a lot in the article that I do agree with. And it kinda goes back to, like, what is a public interest technologist? I think the issue with kind of, like like you said, having it be like a one directional conversations that happens at one point in time of, we wanna do this technologist, like, is that possible? Okay. Conversation over. Is you are given you're privileging a lot the people who got to be at the table at that one point in time, at the exclusion of other entities. Like, I work in, a lot of my research within the cyber security space. And after Log four j, I just saw policy makers talk about open source in the dumbest way, in, like, a way that massively, misunderstands the open source community, the open source open source projects as a resource, what it means to build them, maintain them, why people share them, why people use them. And it was because in a lot of security conversations, you have private entities that comprise pub critical infrastructure at the table. It's not even always, but they're the ones that are invited to the table or encouraged to be, engaging with government, talking to government, but not, you know, for example, maintainers of Apache or a Linux distro. And the issue there is that what you need to do to improve open source security is not the same thing as what needs to be done to improve, like, proprietary code bases that are kept by commercially driven or motivated companies. Well, like health is, like, a great example. So you have doctors and they're obviously a a medical research, they're an important part of the conversation. But if you don't bring in, like, public health researchers, not just, like, practicing physicians, you, like, lose creativity in your solution finding. Like, you know, on one hand, you can fix respiratory issues or heart conditions after the fact, but there's this been this versioning field of kind of prophylactic or preventative medicine that isn't just something that happens in the doctor's office. And I'm gonna asterisk this study because I feel like I haven't reread it in a while, so it's possible that maybe it's been debunked or there are updates to it. But at one point in time, there was big news that I think it was maybe the city of Seattle. I'm also gonna asterisk that because I'm only, like, 75 to 80% confident. But a municipality that got a large that took a large amount of funding for a pilot program where what they did was they invested in air conditioning systems to just put in a bunch of people's homes. And that alone improved substantially health outcomes for respiratory and, cardiac issues because a large number of people were struggling because of poor air circulation or too much heat in the summer. And so things like that are like, if you take that into the technology space, like, it doesn't always have to be, can the code actually do this today? A little bit forward. Chinmay, you've worked at the intersection of cybersecurity and law. Can you share an example where technologist expertise
meaningfully change the direction of a policy debate or regulation?
I mentioned this a little earlier, but the log four shell incident started off with, I think, people being a little bit misinformed in the policy space about what open source was. But over time, I was so far from the only person that was that felt that way. A lot of people wrote a lot of things. A lot of people advocated. There's a lot of more conversation happening. And it got to the point where there was enough advocacy either by the open source community and on behalf of the open source community that one, there was a new organization called OpenSSF that was built by and funded by, like, Google, Microsoft, like, several massive private sector open source users. And they funded this organization to kind of there's a big collective action problem in open source. And so they kind of brought open source people together and said, you know, what are our issues today? How can we address them? And over time, a massive issue are a lack of resources and which ties to the second problem, which is, like, understaffed critical projects that don't have enough maintainer support to make sure the project is up to date and security free moving forward when it starts being relied on by either more users or extremely important users. And no matter how much, like, liability you wanna impose on a bad actor that created an insecure open source project, that's not gonna address this resource problem that is, like, prevalent in the open source community. So I think that once that sort of open source project came to the table, like, this is what we're struggling with. Like, the massive log four shell issue, like, there were about, I think, four full time maintainers on that particular Apache project that did fix it within, I think, days of the vulnerability being detected. But that's a very small number of maintainers for a massively important project that is used worldwide. It took down systems worldwide. So that's an example of when technologists came to the table. And now well, the Biden executive order, had included provisions, incorporating, something called, like, a software bill of materials that included open source projects that said, when you are going to sell when the government procures technology, we are now going to require vendors to provide basically an ingredient list of the various software components, whether private or proprietary or open source that they use so that the government has transparency into these projects. Because, yes, the ultimate issue is like a big resource problem and that's why there might be some security issues, but we don't even know where the resource problems are because, again, if the collective action action issue, there's a lack of information. Like, we don't know what projects are sitting where on our federal, state, local systems or in critical infrastructure. So having the software bill of materials is it's gonna take years and years, but it's gonna begin to get at filling that information. I wanna ask you a similar question, but slightly reversed. And, you know, based on your experience working with Internet standards and privacy,
what are some challenges technologists face when trying to translate complex technical issues into actionable policy?
Well, I think there I think there are multiple. A a big one that I see a lot is, like, communicating about uncertainty that, a a lot of the technical approaches, especially, like, the more mature ones in in the area of privacy, are are grappling with and recognizing that there isn't some, like, absolute guarantee that that we that we can't just say, oh, if if x is done, then no user's information will ever be, exposed or shared or no no one will ever face any consequences. And like famously or stereotypically engineers are the ones that like can't handle the concept of messy, fuzzy concepts. But but I think in many ways, it's been the opposite that, like, an engineers are facing the uncertainty or or, like, very aware of it and are trying to manage it in, in sustainable ways. But then when they wanna communicate with a policymaker, when there's a law that says you shall not do this or you you will face a fine if this happens, It it it it just becomes confusing or or just there's this mismatch about well, if if you wanna make sure it never happens, then we need to not do this altogether as as opposed to implementing an actual safe system where there are understandable bounds about about what's gonna happen in in privacy. So so that's one. I actually think the other challenge is in communicating the ethical norms of the technical community itself that again again, I think there's this, like, traditional perspective of just, oh, the the policymakers or the lawyers or someone say what what is good in the world, and then the engineers are just supposed to go do it. And and sometimes they do a bad job or something, and they need to be corrected. When in fact, I my experience with engineers is they often have, like, very strong ethical commitments. They they want the technology to work in a certain way. They want the bits to flow. They want people's privacy to be protected. That actually means a lot to them about the design of technical system, and they have pretty nuanced views about it. But they don't necessarily have the expertise to communicate those nuanced ethical positions, to policymakers or the or they don't necessarily feel comfortable doing that. So there have been some cases where ATF or or even w three c have published some more policy focused documents and some principles. So. But that's kind of a new experience, I think, for the technical community and still needs a lot of practice.
I love that you brought that up because I think that I this is true in all sectors. Mhmm. When patients interact with doctors, they forget that there's, you know, behind the doctor, the hospital administrators, and then maybe the private corporation that's, like, managing, like, network of hospitals and the insurance companies and the law firms that are driving liability in a particular like, there's a whole ecosystem behind it, but that's true with tech too. And I feel like, one thing that frustrates me is, like, the conflation of private companies with employees. When I've done my research, whether it's open source or my most recent paper was calling for, the licensing of AI engineers. And I'm not gonna discuss, like, the merits of that here, but one of the reasons or one of the things that I thought is an advantage of that is, that it would empower employees against their employers to say, actually, as a discipline, this is what we think the norm or ethics should be, and we as a discipline are gonna determine that to not do that is malpractice. And therefore, you, company, cannot require us to do something that would be malpractice in our field. And there's, like, an information sharing side of this too of, like, when you are an employee of a major company, like, a lot of AI safety today is not, like, hard science. It's a lot of heuristics. Like, it's not like this is super crude, but it's like you're, like, trying out a bunch of different things. You're like, oh, that one seemed to work, and you're not entirely sure why. But, you know, know, there is some science that informs it. There's some experience that you have on the ground that informs it, but then you can't take that and share that with the research community. Like, a lot of the papers that come out of even the most, like, researchy sites or private corporations do have to go through approval processes. Like, is this something that we're comfortable sharing with the world? And there's a lot of, you know, capitalism driven interest why you might not be comfortable sharing, like, how to make your system safer. Or conversely, how unsafe is the system? How many user incidents were reported? Like, do we have data that we should be concerned about? Like so, anyway, I think that employees like, I think, like, line technologists care a lot, and that's why they turn to bodies, like, standard setting organizations to, express those views. But I think that even their participation in that, like, whether it's they're explicitly told not to go or they said, like, no. We will not fund you to go to this IETF conference. Like, that plays a big role in the degree to which they can express, I think, the very important ethics that are developed in I think the professionalization
is is just like an important concept, and I think that's been part of the success of, the design of the Internet or or some other parts of technical field is that individuals inside of companies often have a lot of autonomy or they, like, you know, they have a strong reputation in the community of practice that is all the other engineers working on the Internet. They move between companies but still have that same respect, and that that makes it easier for individuals to take those ethical stances or or for individuals to actually take a view that's perhaps seen as contrary to what their employer might have preferred when they were in that particular environment and that does rely on like you know labor markets and and like the the capability of engineers to take strong stances like that but I think historically that has been like part of the success of the internet and and so I think that that sharing of norms and that like individual ethos makes it makes it possible to hear from the the people who are most immediately involved, like, what the actual implications are.
I love that. I completely agree. And, you know, as an academic, my field is talking about, freedom of expression quite a bit because academic institutions are under attack for expressing what should be protected normative views. And sometimes not normative views, just facts. And then there's, like, law firms that are being attacked for their decisions of who to represent and how to represent them. And so this is these this is, like, what's happening in my world. But, like, from the technology side, there are pressures that prevent line engineers from communicating things and techno there there are pressures that might not be as obvious as on academia or law firms today at this particular moment, but they definitely exist. There's definitely, like, kind of a chilled speech speech or information sharing limitation in that world. And and I'm even more concerned about it than ever because, like, every few months, a report comes out of how many people graduating PhD programs are choosing to go into the private sector as opposed to academia or the public sector. Mhmm. And even the ones who are in the public sector are regularly getting funded by the private sector because that's where the money's coming from. And now when you have more research money being dried up, like, that's even more concerning. So I think now more than I mean, this is gonna sound extremely cheesy given the topic of our conversation, but, like, public interest technologist has to mean more than people working in the public sector or civic society. Like, we have to start thinking of line engineers as public interest technologists or they have to start thinking of themselves as that because, like, that's where all of like, that's where our hope our best hope is. That's where they're all going. That's where the expertise lies. So building on that and looking ahead,
what emerging issue what emerging technology issues like AI governance, encryption policy, or content moderation most urgently need public interest technologists at the table?
I I feel I feel like encryption, is is not necessarily like an emerging topic because, like, we've we've been having these crypto wars conversations since, since before I was old enough to participate in them, and and they're not going away even as we expand the important use of encryption through, more of our technical systems. But it absolutely needs public interest technologists and and again like both in the private sector and in and in government and civil society to like strongly advocate for and communicate about the implications and importance of of encryption for our own safety and security and privacy. So that that one is, like, not newly emerging, but is recurring and and needs needs people to keep working on it. I agree. I think that there's a huge,
it is a a concerning bias towards right now focusing on, like, recency of, generative AI is where all of the policy conversations should be. And, yes, there's a lot that's terrifying about that. A lot that's great. A lot that's terrifying. But there's issues that have been around for ages, like security of software is the since the day software was first built. Encryption is a quintessential issue where it really isn't, like, technologists versus policymakers. It's, like, one strand of rhetoric against another strand of rhetoric, and and we haven't yet resolved it. Like, it's not security versus, like, you know, like, law enforcement and safety or privacy versus liberty. What it's it it's these are just the wrong framings. But to add on to that, I think that privacy is is an issue that we've also talked about for ages and ages, but it is like, I feel like the more time that passes, the more we have become acculturated nearly, like, brainwashed into thinking or accepting the status quo of, reduced privacy interests. The amount of information that is out there and the kinds of technologies that exist and the very limited restrictions on how that information can be collected, harvested, curated, insights drawn from it, and then sold. It's not privacy just for privacy's sake, though I I do think as a normative value, privacy is good for everybody whether you have something to hide or not. But I just wrote a paper with a couple colleagues and to shout out, Thomas Kadri and Sam Adler, who I wrote the paper with. This builds on my colleague Thomas Kadri's work of, you know, if you are a victim of abuse, your abuser can purchase information about the new home, the new phone number, even the new name that you took on to escape that abuse for, like, $17 online, and there's no restriction on that. If you are, you know, in an authoritarian regime, in a regime that's slowly devolving into an authoritarian regime, That information, you don't need, coercive law enforcement tactics to get it. Law enforcement can purchase it from brokers, and in fact, they already are. Like, this is this is not a hypothetical or speculative harms. These are very real, but they happen slowly, perniciously in the background. And, like, in a way that as an individual, my the convenience I get from giving up privacy and I will say this openly. It is so convenient for me to have these platforms. Like, I do use Amazon. I do have CLEAR. That and they're bad for privacy. They're horrible for privacy. But as an individual, that trade off for me, given my other life pressures felt valid. But as an aggregate, it is, like, deleterious to things that we hold really important. And so I would I mean, this is, like, me wanting to put the responsibility on somebody else. But, like, I would like somebody else to say, like, no. We can't do that as opposed to me having to make the very brave decision to, wait in long security lines at airports.
Last question is is for the both of you really quickly. For listeners who are technologists and who want to get more involved in public interest work, what advice would you give them about entering the policy space and making an impact? I think Nick's gonna have way better thoughts on this than I am, but I think get involved in your standard setting organizations,
talk to researchers that are outside of your discipline. That is, you know, a plug for myself, but more importantly, a plug for other people that have been doing this for a lot longer and in different areas like sociology, you know, business governance, psychology. And I I think that right. I know that I my engineering friends, would complain about writing papers that were, like, 17 pages long and mostly had charts and graphs in them. Mhmm. But I think that writing is the way to get issues or opinions in front of people that can do something with that information.
Yeah. I think there's a, like, a really important lesson there about community. I feel like we are coming back to a lot that, rather than hoping that any, like, particular technologist who's listening to this will, you know, go off and write, like, the key position paper that will change something. I actually think the most important thing is to, like, join communities of other people working in your field or or across fields. Standard setting bodies are certainly one place of that that happens, but it doesn't need to be the only place. Like, open source communities are doing that. Interest groups of all types are doing that. But having those communities talking about what they want and what they expect and what they need from from their government or from their technical systems, rather than just being involved in in one company or one software project, I think could make a much bigger difference if we're just communicating about about ethical norms, like, across the community. So so those things don't get forgotten or lost in any, single file. And you mentioned this earlier, Nick, but also I think labor organization
will play a big role. Like, there's no reason technologists can't unionize or use collective action to, have strength in numbers or leverage strength in numbers.
Absolutely. We should not, on May Day, not,
avoid talking about that. Well, to my Nick, it it's been a pleasure having you both. Thank you so so much for joining us here today. It's been such a pleasure. Thanks for having me, and it was great chatting, Nick. Yeah. Let's talk again soon. I would love that. For all our listeners to keep up with the work that CDT is doing, please visit us at cdt.org and follow us on Facebook, Mastodon, LinkedIn, and the social media platform formerly known as Twitter at SendDemTech. I'm Jamal Magby, and thank you so much for talking tech.
