Privacy in Action: Thomas Lohninger, Managing Director of epicenter.works

Interview with Thomas Lohninger, managing director of epicenter.works

For our latest Privacy in Action, we talked to one of the leaders in digital rights: Thomas Lohninger.

Thomas Lohninger is the managing director of the network political civil rights organization epicenter.works in Vienna. He was a Senior Fellow der Mozilla Foundation on Net Neutrality in Europe and is a non-residential Fellow of the Center for Internet and Society at Stanford Law School. Thomas has worked for European Digital Rights (EDRi) as Policy Advisor on the EU law on net neutrality and has been on the board of EDRi since 2019 and its vice-president since 2020. His background can be found in IT and cultural and social anthropology and occasionally he podcasts at Logbuch Netzpolitik.

Interview with Thomas Lohninger

Startpage: One of our favorite questions we privacy experts ask is: What does privacy mean to you?

Thomas Lohninger: For me, privacy is part of human dignity. It is as essential as the right to wear clothes or to be able to decide for yourself who to tell what about myself and when. Privacy also has a lot to do with democratic freedoms. It’s the reason we go into a voting booth. Or why a person’s political attitudes or their trade union membership are particularly sensitive information. For me, privacy does not mean puristic concealment or not wanting to share anything about myself, it simply means having a say in what others are allowed to learn about me in a structured manner. Privacy gives people agency.

Startpage: Why is the protection of personal data important to you? Professionally and in private life?

Thomas Lohninger: Digitization makes it easier and cheaper to collect information about third parties. The price of collecting and storing data has never been less. At the same time, the computing power to generate information from this data and the ability to network in order to relate this information is growing, also in monetary terms. In other words, if we are not careful, we will panic very quickly and third parties can inspect all possible areas of life. It is important to note that we usually know very little about the organizations that know a lot about us. Secret services often evade democratic control. There is the dictatorship of Mark Zuckerberg at Facebook, the person who bought the land around his house because he doesn’t want anyone to look into his garden. We live in an information society, but with an information asymmetry that is in no way inferior to the injustice of our distribution of wealth.

Startpage: You are the managing director of epicenter.works, a network political civil rights organization in Vienna. What are the core topics that you are working on and what are the greatest successes that you have achieved since your founding?

Thomas Lohninger: As a former AKVorrat, our first great success was the abolition of data retention in the EU and Austria in 2014. We have been concerned with securing net neutrality at EU level from 2013 until today, but reached its peak when we won the European Parliament in 2014 and will become ours in the future. Hopefully we will have another success next year in abolishing zero rating. About half of our energy goes to the international level, we also have a lot to do in Austria. Austria is one of the very few countries in the world where there is no legal basis for state hacking (state trojans). We have already been able to prevent such legal advances three times, namely in 2016, 2017 and 2019, most recently before the Constitutional Court.

Startpage: Why do you think a civil rights organization is particularly important in order to promote issues relating to privacy and data protection also politically?

Thomas Lohninger: We do not need new fundamental rights for the information age. We just have to consistently implement the existing ones, online and offline. In this respect, it is just contemporary work for us, but of course our work is shaped by the hacker ethic and belonging to organizations such as the Chaos Computer Club or the Metalab.

Startpage: It is said that there is greater awareness of data protection in Germany than in many other countries. Is that correct? And how is the public perception in Austria in comparison? Where are the differences and overlaps?

Thomas Lohninger: Historically, Germany has certainly played a pioneering role in terms of data protection and, thanks to the proliferation of data protection officers for many years, it has also had the greatest awareness of this topic. But that doesn’t mean that Germany would be better today on this issue across the board. Especially when it comes to state surveillance, Germany is not a role model for us – keyword: radio cell evaluations and state Trojans. Austria has had firewalls between the ministries since 2004, the area-specific personal identification numbers that were last discussed in Germany, but now they stick to uniform personal identification numbers, which can be used to easily link all data about a person from all ministers. The debates between Germany and Austria are certainly similar, but what bothers me the most is that there is no claim in either country to be a pioneer in how data protection and a transparent state can be brought together.

Startpage: The subject of data protection is often misunderstood. What’s a common assumption about privacy that you would like to get rid of once and for all?

Thomas Lohninger: It’s not about having something to hide. Fundamental rights don’t need to be justified or in the right situation, they apply to everyone, always. What is also annoying is the wrong analogy that state surveillance is not a bad thing, because some people are on Facebook. First, the people on Facebook have more of the character of hostages than users – who uses Facebook nowadays then voluntarily – and on the other hand, it is one thing to decide for a company as a user and a completely different one from the state through laws on data processing to be forced.

Startpage: With “Control is good” you have written an interactive play in order to deal with what is happening on the Internet in a playful way. What is the piece about and where did the impetus for this creative examination of the subject of data protection come from?

Thomas Lohninger: Haha, yes that was such a pandemic project. One of my neighbors is Tina Leisch, who already brought Elfride Jelinek’s “wards” onto the stage with amateur actors who had fled their homes. Everything Tina does has a hand and foot. When she asked me to take part in the project for the Viennese cultural summer, she really wanted to have a piece of network policy in the program. I just said yes. I didn’t know what I was getting into, but it was an enormously enriching experience. Art can convey topics in a completely different way than we usually do in activist work. Although I’ve been with almost every step of the way in creating the piece, the whole thing is somehow much more than the individual pieces. I am happy about this experience and plan to work even more in this direction in the future.

Startpage: Do you think it takes more such projects in art and culture to make people aware of why protecting their own data is so important?

Thomas Lohninger: Clearly. I refer to brilliant projects like “The Cleaners” and “Made to Measure”. Art and culture are always the ways in which things become mainstream and the net-political movement must by no means remain at its cerebral, technical, legal level. If our goal is to empower people to use technology in a self-determined manner, we have to become mainstream.

Startpage: Data leaks, biometric face recognition, digital vaccination certificates – data protection has recently been a part of the public discourse again and again. Which current risks for privacy do you see as particularly critical?

Thomas Lohninger: Biometric mass surveillance is certainly one of the most dangerous developments that has been gaining ground in almost all EU countries for several years and can now perhaps be stopped one last time. We urgently need a ban on facial recognition technologies and strict rules for the use of generally dangerous algorithms, this is where I put my hopes in the EU’s AI Act.

Startpage: What exactly do you do to protect your personal data online and offline? What tools do you use every day?

I use Tor as a browser, various encrypted messengers and most of our infrastructure is self-hosted. Which specific tools and identities are then actually used depends on the respective context and its threat analysis – keyword: compartmentalization.

Startpage: A look into the future: what political changes do we need to protect our privacy?

Thomas Lohninger: What worries me most is that, despite constantly changing technical frameworks, we are still having the same debates as we were a few decades ago. The ECJ General Advocate only ruled again in November 2021 that data retention is not compatible with the EU Charter of Fundamental Rights. The EU Commission has apparently serious plans to repeat the crypto wars of the 90s and to regulate encrypted messenger services. The challenges have really not diminished in the last few decades. If we want to move forward, the debate must not go around in circles.