0:02Thank you all for being here. My name is Wesley Evans. I'm one of our product leaders here at Cloudflare. And thank you so much for coming to our panel on data sovereignty in the global internet. I am so honored today to be joined by two of our panelists, Emily Hancock, who's Cloudflare's Chief Privacy Officer, and Alyssa Starczak, who is Cloudflare's Chief Legal

0:26So there's been an amazing time. conversation so far this week about sovereignty here at Cloudflare. Thomas Seifert today talked about it with Minstral on the main stage. Earlier yesterday, we talked about encrypted data as noise and the data residency architecture, which is Cloudflare's next generation system for meeting data residency requirements across the globe. I'm really excited to talk with our panelists here today about the global internet and the tensions we have. If you remember yesterday in our talk, there were some key guiding questions around trust and transparency. How can we help build systems that are localizable, but resilient and also performant? Then also helping the internet move beyond the idea that to trust something, you have to control its physical boundaries. These ideas and these questions have been circulating inside Cloudflare for a long time, and I'm really excited to talk with our panelists today here about how we're thinking about residency and sovereignty and the global internet.

1:18So Emily, I'll start with you. Obviously, as Cloudflare's Chief Privacy Officer, you spend a lot of time thinking about data privacy. regulations, how we've met those in the European Union, other locations. Can you tell us a little bit about how data residency and data sovereignty have emerged out of the data privacy realm? Yeah, sure. So a lot of the concepts around what we see is...

1:41Let me try that again. There we go. Now you can hear me. A lot of the concepts that we've seen out that are at play right now in the sovereignty conversation... from data privacy, as Wesley was saying. So the idea of data privacy kind of has started, I mean, years and years ago, there's been concepts of privacy floating around. What does privacy mean to everybody? And it only kind of when the EU started saying, actually, we want to make sure that privacy is regulated and legislated. And by the way, in order for those rights to be protected for Europeans, the privacy... to follow Europeans' data when it leaves, because Europe was very aware that the hyperscalers that were dealing with most people's data, the social media, Google, Facebook, those kinds of companies, they were all based here.

2:31And so Europeans were saying, well, we don't want the privacy of Europeans to end at the We want it to follow them wherever the data goes. So Europe did a really good job of exporting this idea of privacy. And one of the things they said is, data is going to leave Europe, you have to do a bunch of things. And that list of things led to things like a safe harbor framework between the United States and the EU, where the two governments sort of agreed that, okay, if companies do things in the United States, it's going to meet the EU level. So Europe really exported this idea. And the company said, okay, We're going to meet the idea.

3:18And then, because of politics, which we can talk about in a minute when we want to get really spicy, some of these frameworks fell apart. But the idea is really that there's this concept that if the legislation could follow the data, then the data will stay private. And that kind of turned into this idea, well, then if the legislation can't follow the data, like, you know. States isn't going to enforce European laws, or if the United States is going to do surveillance and violate people's rights that way, then it's not going to be as private as it would be if it stayed in Europe. So Europe kind of gave this idea of like, well, the data really is going to be most private states in Europe. And so GDPR came to the General Data Protection Regulation of the EU, sort of came to this idea of privacy is local.

4:12And if we localize data, it will be more private because we aren't going to have this idea of whether the legislation that we think is protecting the data is going to follow that data outside. And I think a number of countries around the world started thinking, well, yeah, we can localize privacy that way, too. If it's a data that's local, we'll be able to protect it. So location started to be this proxy for privacy. And that, I think, is one of the things that we're going to talk about is not really what we think. privacy should be because just because data is in a certain place doesn't mean that it's going to be protected in a certain way. And, you know, laws can only go so far. The technology is something that we think is really going to protect it. But we've seen this not just in Europe. This now, this idea of general data protection regulation has been really adopted by countries all over the world.

5:03India's got a data protection law that is very much modeled on um the Europe. So same with Brazil. And so a lot of these countries are starting to kind of come up with this idea that if we regulate it this way, it'll, and, and keep it here, it'll be safe and private. And that's what we can do with the data. Um, and so now we're in a place where that's, it's kind of evolved out of privacy and, and, you know, we're now talking a lot, a lot more things because it's not just privacy anymore that they're trying to about with data there it's not just the idea that's going to be keeping the data private it's now we're talking about things like kill switches and so if data is in certain places we're going to have the ability to just you know turn off access to data and so it's not really not primacy anymore once of that evolution of the regulatory piece you know from data protection into arguably technology as politics and regulatory frameworks i mean alissa we've seen a tremendous amount of this recently in the european you can tell us a little bit more about what we're seeing with things like CADA and other.

6:08So, you know, the reality is, Emily talked about the origins of some of this, but what you're seeing right now is something completely different because of geopolitics, right? So people are really nervous around the world that they are going to lose access to technology that they are dependent on. And there are some amazing stories about what that could look like, right? We have, we actually had an issue in the EU that got a lot of play if you're in the EU about... somebody getting, an ICC judge, an international criminal court judge, losing access to systems, how hard it was for them to actually do anything, and something that felt very geopolitical. And so a lot of those conversations have driven the idea of we must control our own destiny. We have to make sure that none of these can be leverage points against us in various ways.

6:56And so the concepts that started as locality have moved into need control over the entire stack. And that has become not just data, to Emily's point, but thinking about everything down to the chips, right? So the application, all of the equipment, the chips, every component part of it is then getting put into this framework. And so one of the things I think we're struggling with right now, just from a, that's actually not a system that makes any sense from a technical standpoint. So one of the things I think we've been talking Cloudflare is what do you actually want to do? What's driving that set of concerns and how do we potentially address them in other ways? I didn't talk about KEDA. KEDA is a European EU regulation that has not a regulation yet.

7:46Proposed regulation. Actually, I think it's a directive. But anyway, I think it's a proposed law in the EU that would include sovereignty requirements for public procurement. So the concept would be that you can't be a non -European company in some cases, where you have to store all your metadata in the EU. You have all sorts of requirements that are tied to this idea of resilience and control. Well, I think what's really interesting about this is I started working on localization pretty substantially in 2023. At the time, Cloudflare's data localization, so we really met the needs of the European market in a very particular way. We said that we could. manage how your data was processed. So where we did L7 processing, like running workers or doing a WAF rule, we could do things like make sure that your metadata and your logs stayed within the boundary of Europe inside of our data centers that we have in Amsterdam.

8:34And we can be very specific about how we are handling your key material. I think the thing that we've seen that's been a pretty substantial change, at least on the technical side, is the evolution towards what we talked about yesterday, that it's no longer good enough just to talk about how data is being processed or your analytics are being stored. to you that we're now thinking about the control plane and that regulators have got very interested into how your controls and your API and your dashboards operate. And then who can also control the logging systems and who can see and access those as well with sovereign personnel operating requirements. From y 'all's perspective, what do you think is the most interesting challenge? Is the kill switches? Is it processing? Is it sovereign operating personnel? Where is that Well, I mean, one of the things- that has been a challenge for a while, and we saw this when, if anybody knows what the SHRMS2 decision was that ended the privacy framework that we had, now we have the data privacy shield before that.

9:31After the SHRMS2 decision, one of the things that data regulators started to get really interested in was this idea of IP addresses. Everybody knows what an IP address is. It's the thing that routes traffic around the internet, right? You have to have it. out in the open so that traffic gets from point A to point B. And I think one of the big things that we saw with regulators is they were starting to say, well, that's personal data. And we can't have the IP address leave Europe. It's like, well, then how is the bit going to get from point A to point B? So I think one of the challenges that we're seeing is that there's a disconnect between the desire to localize and desire to have...

10:17have data where it can stay protected in the minds of regulators. They think it's more protected if it stays in a certain place. And then the reality of what the internet is and the reality of how traffic flows around the internet. And that's, so from my perspective, getting regulators to understand how the technology works and how, I mean, it seems pretty simple probably to everybody in this room, but, and then the, the, not just how the technology. works, but then the downstream impacts of if you said something like, oh, no, IP addresses can't leave Europe, well, what does that mean? We've talked a lot about how that means maybe you just have siloed internets in each country or region, and that's not going to work. I'm assuming both of you think that having siloed and balkanized internets is a bad idea. Not a good idea. Not a good idea. No. No, but I don't know. The kill switch.

11:03Actually, you know, one of the things, we're at this interesting point, just that we're in a transition point, right? So we have have AI coming up and you, okay, you have all these geopolitics around AI. We, from a company standpoint, have to think about how do you actually solve these problems without creating things like a balkanized internet or without creating things that are fragile? Because what happens is that you can say, I want something sovereign, but if you only have one company that does it because there's only one company in your particular country, you're kind of screwed if something happens with that company, right? Or if you only have one data center. going to come if you're if you only have one data center in a company or if you are if you sort of you lose all the benefits of the resilience that you could have if you had a dynamic market so we we look at that problem and what we try to do is think about okay how do you create something that gives people the control that they want because that's clearly what they want um with the resilience that they that we know they need and actually how do you how do you start to that and actually explain that that is actually something that is possible to do technologically, even if sometimes from the lawyer's perspective, it doesn't feel as easy to do.

12:20Well, it may not also be, as we were talking about earlier, potentially just technical solutions to these problems. There could be legal and there could be political solutions to these systems as well. So we were talking about the kill switch concept, right? So in Europe, the same idea from the International Criminal Court raised questions about again, resilience, and the idea that you could just get turned off. Well, what is the answer to that? You know, I think lots of people in the tech space have sat across from regulators, and if they're a U.S. tech company, have been asked that question. And there is actually potentially a legal answer, which is, hey, it's kind of like privacy. We'll write provisions into our contract that says we'll challenge these laws. We'll think about what those structures are that could potentially enable it. And so it's the...

13:06combination of how do you create a resilient system using technology using legal mechanisms using uh and then and then come to some agreement on it that that really is is what we're looking for we can spend all day talking about resiliency and we'll probably pivot back toward that but it wouldn't be a panel at this conference if we didn't talk about the agentic internet and i'm interested a little bit in when the conversations we've been having about sovereign ai i know this morning thomas was on stage of mistral talking about the great work that they've been doing inside of europe obviously the Cloud for Policy Team published during birthday week on some of the amazing models that we brought on board as well. What are your thoughts around, there's been this idea of cultural preservation, potentially, even with sovereign AI. What are the tensions that we're seeing there beyond just where data is processed? So I mean, I think there are a lot, right?

13:51So on the cultural preservation, one of the concerns that people have with AI is that it's gonna hoover up all the data and then it's just gonna spit back out the most generic thing is right so imagine you have something that feels super culturally relevant to you all of a sudden you're not getting that anymore you're just getting the the sort of sanitized version that is um whatever the ai company gave you back right so imagine you're a canadian um and you want something that feels like canadian content how do you actually make sure that happens what does that look like um and i think if you one of the concerns that we on the ai side is that the more you have consolidation with ai the more likely you are going to get that sanitized version. So how do you create something where you can actually train on localized content?

14:37How can you think about local models? How can you give people choices in what they pick? And we've done, actually, a lot of work on the Cloudflare side to think about making sure you have access to lots of different models. So that was our birthday week post. We talked about onboarding a few different sovereign, what are called sovereign AI models, models that were trained in a particular country. languages, with the idea that you can decide actually what you want in your own system. Well, it's also because countries are thinking that their data has national security assets, right? It's a national asset. Whatever data is being generated in that country feels that way. And so they want it. There's another reason. I mean, the cultural plus also it's just sort of the security, national security issue. Well, Emily, I know you spend a lot of time thinking about user privacy and the way that workers AI and other parts of our products. Can you tell us a little bit about Cloudflare's stance on how we interact with our models?

15:26data? With our models data? Sorry, not our models data, but the models that we're running on workers AI and the information that people put into our systems. Because we don't train on users information. No, no. I wasn't sure where you were going with that. But yeah, no, the content that our customers that's going across our network, we do not train on the content. That is not a thing that we're interested in. And so we have a lot of controls in place to protect that. Which I think is amazing, particularly for a lot of our European countries. who are interested in this, and even just inside the United States. I think it's been interesting as someone who, besides working on the sovereignty space, I was running our U.S. FedRAMP Hypergram over the last couple of years, which people don't often think of FedRAMP as a sovereignty standard, but in many ways it is, the idea that you have to have your control plane, your data plane, and your logging infrastructure inside the U.S., and then to see that modeled in other parts of the world.

16:17Tom Leanza, Jake, and some other people who are here today spoke earlier about our FedRAMP. program and the way that we thought about doing FedRAMP high in the United States over the last two years, which really was a bifurcation of the control plane inside our U .S. data centers while still using the same software, obviously contained to the United States. We've been thinking a lot about how do we build the resiliency and the performance that you're going to want to need to do this in many places around the world where you can't just replicate infrastructure. And so the way we've been thinking about that is cryptography and utilizing the idea that encrypted information. is not accessible or not useful to anyone until you can possibly decrypt it. And so for both of you, you spent a lot of time talking with me about cryptography, thinking about how the encrypted internet's going to work. Where do we as Cloudflare think about the idea of cryptography being this standard?

17:07How do we come to this idea? And how do we think we might evangelize it going forward? So I kind of look at the problem set, right? We're talking about resilience and you're talking about what you want and control, right? So one of the... things is how do you actually make sure that the only people who are actually accessing your content or your infrastructure are the people you want to that you can you can actually identify them you can log them you can audit those logs you can do all of the things that you want to make sure that you're you are actually in control of the underlying content that you have and that's where cryptography comes into play and because you can actually look at that as the mechanism to make sure all of those things are secure and you can validate with them. And that's from a technical standpoint, that's where the policy and the technical pieces overlap, because it starts to make sense if you can say, hey, this is how we give you control. This is how you can actually validate it and verify it.

17:55And it doesn't have to be localization. Back to Emily's point, we can really think about controls as a mechanism of looking at how we protect access. Yeah. I mean, that's one of the things that data regulators actually have recognized is that to the extent that you're encrypting data that that will allow for the private you know to maintain the privacy and it will allow for the export of the data so being able to show that encryption to show that control is important and that's one of the things about when we have been talking to regulators about our data localization suite and the fact that your the content only gets decrypted in certain regions that you've chosen so you can have the content only be decrypted in europe for example and the regulators really like, okay, yeah, that makes sense. I like that idea. I like that idea.

18:42So I think there's appetite for that. I think there is some space to encourage other people to think about the fact that if the data is encrypted, wherever it goes in the world, it doesn't really matter as long as the decryption happens in the region that whoever it is, the customer or the government, where they care about. Yeah, I think from my perspective too, it's been really interesting to see the shift in the marketplace. as we've had this conversation over the last nine months, particularly with the various geopolitical crises going on and the loss of access to certain sovereign clouds, the idea around resiliency has only become much more important. How do we bridge this gap, which I don't have an answer to this question yet, of making sure you have the right level of control, the right level of specificity, while at the same time maintaining global resiliency and the ability to have a network that operates correctly?

19:35IP addresses, I think, were the first instantiation of this problem. going to see this repeated out in many many other areas of the world over the next couple years where we've really seen the pace of change just affect so many systems i mean who here today heard about the php thing okay if everyone's hands aren't up you should really go read the cloud for a blog about the php vulnerability but it was interesting i was having meetings with customers and partners over the last couple days talking about how we're going to build sovereignty together and build highly residential systems and the idea of well how fast can we patch if that's the case right if it's a fully owned separate system how do you make sure you can deploy updates and patches and vulnerability mitigations as quickly as possible i think that's one of the things that we as an industry are going to have to figure out over the next couple years because i certainly won't speak for both of you but i am assuming that you're seeing the pace of change increasing as quickly as i am yeah and it's only going to get faster right i mean that's the reality of what we're seeing right now um and i guess that goes back to the resilience conversation for me you know the reality is that we have to figure out how we build systems that are resilient in that way too and in scale actually helps right if you if you figure out how to patch at scale if you can figure out actually some of some of the things that we did you can actually help everybody it's not a country by country saying anymore and so you have to think about that's part of resilience in the big picture and you actually have to think about again what does somebody want they want control how do you build that control with the resilience that actually enables that kind of patching and that kind of behavior.

21:07Well, to state the obvious, I mean, the threats don't respect borders, right? The threats that we're seeing, the DDoS attacks, I mean, the malware, all of these things are global problems. And so the idea that you have a local solution to a global problem is kind of a challenge because you need to be able to take in that global data and think about the global data to be able to fight those challenges. And how do you do that if the only data that you're training on or observing is just India or just Australia or just Europe? Right. Threats are, to your point, constrained just to specific polities. And I think we see that all the time where Cloudflare is a massive customer base between free users who use us just for their smallest website projects all the way to some of the largest Fortune 10 customers.

21:55And we often see attacks developed on our smallest customers. and then rolled out against customers in other parts of the world or against different customer segments. If you only saw one part of that visibility curve, you can't protect everybody on the internet. And I think part of our mission is to help build a better internet and building a better internet for everybody, I think, means having global scale. The reduction just to localized systems seems like it would be antithetical to having that global internet. Yeah, although part of it to a better internet maybe also for our customers give them choice and control. What Alyssa was saying at the beginning is that if customers are able to figure out what the configuration is for them that works, that helps them meet their clients' or end users' needs, that helps them meet their compliance needs or whatever government they're in.

22:42I mean, so some balance of that global scale, but then also figuring out how to comply with your local regulations, trying to give our customers choice and come up with product suites that do that I think is really important. Well, I think you said something really critical that I've heard a lot, which is, or at least I've interpreted, many times I think these conversations on X or in other forums can be very black and white. It's sovereign or not sovereign. I mean, Alyssa, have you seen a black and white version of this problem, or is that really a menu of options? People don't even agree what sovereign means. So no, just literally not black and white. I mean, those questions of sovereignty and what are you trying to do with it? Again, it depends on who you talk to. It depends on what they're actually what their goals are, and you will find that it's slippery. So, you know, I think what you want to do is actually build enough controls that sort of answer the questions along the way, and then to Emily's point, pick the solutions that fit that set.

23:34And again, give people options is the key. Yeah, I think that optionality, I mean, even if you look at the way that we built the data localization suite today, you don't have to make sure that your regional services region for processing utilizes customer metadata bound. in the EU. You don't have to store your keys in the US if you want to operate a global company or you want to use Keyless. And I think being able to pick and choose how you approach sovereignty and residency from a controls framework of how do I protect data or how do I govern access is much more interesting than just saying there's a switch that you throw that suddenly everything here is one sovereign operates. I think it's also different customers have different needs and different concerns, right? If you are a Ministry of Defense somewhere, and you were very concerned about people seeing your data, maybe you want something on-prem and you want to think about what that looks like and how you protect it there, right?

24:28So it's not, I don't think there's one answer, I guess, on the sovereignty piece. I think you actually, you have to think about what you're trying to do and then how you best protect it. Sure. We've talked a little bit about emerging threats with AI in terms of speed of attack and how that can affect sovereignty in the future. I would be. remiss as the post-quantum guy on stage not to bring up the threat of quantum computers. You know, if encryption is going to be the sort of baseline standard, you know, what has Cloudflare been thinking about in terms of rolling out quantum secure software to protect our cryptographic systems? It's been a big deal for us. You know what you've been saying. I can't tee up my own question. We should be asking the technical question. We care about it a lot. Wesley, how do we care about it? It's actually something we spent a ton of time on on the policy side too, because what you've seen actually most recently is an acceleration in the date to which we'll have potentially capable quantum computers.

25:22And so in some ways, I think the reality of that date coming sooner potentially means that you have to think about what your systems look like now. And we are doing lots of interesting work, not only in the traffic space where we've actually applied quantum secure cryptography, but also potentially on the certificate side. which people can talk to. Well, and the certificate piece I think is going to be quite critical. I mean, obviously there was a tremendous cert issue this week. I hope everyone here has gone out and checked your certificate transparency logs to ensure that you aren't having intermediate certificates with the number four in them. But CloudFour is committed to Merkle Tree certificates. I think I saw Sharon Goldberg and some other people here in the room who can talk at much greater depth about how Merkle Trees are going to really change the world around quantum secure authentication.

26:11But that's part of the question. question, right, is if encryption is going to be the baseline standard by which we say that we're going to protect data and we're going to cover an access to it, we need to make sure that we have the strongest possible systems in place that can ensure that regulators have the highest degree of trust, that our systems are secure against even nation state level adversaries. Well, and we've been talking about sovereignty, right? That's the sort of basis of our conversation. Now put that in the post -quantum world where you actually want systems to talk to each other. It's really You don't want independent, you know, in every country to have their own cryptographic. Yes, please do tell your friends we don't want there to be nationalized cryptography. That's not going to be a good idea.

26:56But that is that is the world. And again, this is the broader point of sovereignty. How do you think about sovereignty, but also think about resilience? Sometimes resilience is actually things that work together because. or sovereignty has to be built on things that work together because otherwise it doesn't work very well. When I said this in the keynote yesterday, it's about trust, right? How do we build verifiable trust? And I think that's really the bedrock idea that I'm hoping that we get across over the next couple of years is that we want to be able to build systems together with the ITF, other standards, bodies, governments and regulators around the world so that we don't have to just trust us on blind faith, that there are ways that you can verify and check and prove. What's happening? Well, that's, yeah, I mean, that's one of the things. So at CloudSmart, we really think about, okay, we don't want to just talk about privacy.

27:45We want to show it, which is why we've done a number of certifications, like the global cross -border privacy rules and Europe, Cloud Code of Conduct. Don't we also have a pretty aggressive Warrant Canary program as well? What's a Warrant Canary? is a commitment to something that we have never done. And so there we have a variety of things that we have never done. We've never given law enforcement access to our system or governments access to our system, as an example. We've never weakened or broken cryptography for a third party. Those kinds of things that are essentially commitments and sort of an understanding that we would legally challenge if somebody ever asked us to do that. Well, so just, you know, when we think about these things, and we want to try to prove these things, the auditability of the controls and being able to demonstrate the controls that you have in place are really important.

28:40And then when you're thinking about cryptography too, I mean, I guess I also think of the human side of that, which is at some point the data gets unencrypted, right? At some point you're processing the data because you have a customer support person who has to open up a record and look at it. And, you know, so thinking about controls and auditability on those. kinds of controls when the people have to look at the unencrypted data and figuring out how that can happen because we're all familiar with the idea of a support person helping us because the support person is in a different country most likely um you know there's call centers all around the world and so they're accessing systems that probably aren't in that country so that's i mean this global nature of having to deal with sensitive information and being able to look at that information and deal with it and then having controls in place around the access and here's who's getting access and when to that, I think is going to be really important too.

29:32And I mean, that's a very simple human kind of level thing on top of the quantum cryptography, which I won't pretend to be able to understand ultimately, other than that is cryptography, but. It's very fancy multiplication.

29:47I want to make sure that we leave time for questions for our audience. And before I do that though, final major question to both of you. Let's pretend it's three years down the road. We're back here in San Francisco. Francisco again for Connect 2029. What do you hoped we brought to the world and the way that sovereignty has changed in the conversation? So I hope that we have built systems that can be resilient, where people have confidence that they have control. And I think there are ways we're doing it. And so my hope is that we actually have a very comprehensive story about what it looks like and how many options you might have as a customer. Well, that was what I was going to say. That's why I went first. I mean, I guess, you know, but more so more broadly, I think what I hope is that we do have kind of starting or going back to where I started is I really hope that we do have a better dialogue with regulators and a better understanding with regulators about why the cybersecurity needs of, you know, keeping data safe.

30:47Maybe I don't want to say are more important than privacy because they're not at all. But the. Privacy regulations are kind of this one small thing. And you aren't going to have privacy without security. You're not going to be able to protect the data without these secure measures. And so if you can't have regulators who can hold those two ideas together in their heads, I think that's going to be a real challenge. And in some jurisdictions, that's what's happening, is privacy regulators only have to care about privacy. And then everybody else cares about everything else. And I think we need... I would hope that we are able to move past that sort of division and there's a more holistic conversation about security in order to protect data. And Wesley, what do you want?

31:33I mean, I want many things. But specifically around sovereignty, I think one of the major challenges Cloud4's own internal teams face is how do we do this? I think that's true for all of you as well. You look at your systems. You look at how you're... running Kubernetes or Postgres or where you're storing logs, and it feels daunting to try to figure out how do I change the fundamental nature of my technical systems to make them work in a very different way. And it feels like the tail's wagging the dog. And I hope to build for my internal customers, but as well as for everybody in this room, is a world where you can go to sleep at night and know that if something changes geopolitically, you have a platform and a software system that's easy to upgrade and change, whether that's on Cloudflare or on a different provider because we've gotten people. to understand that controls and the way those controls are built are much more important than the idea that the data lives on a particular server running in a particular country.

32:26We're not going to be able to move hard drives nearly as quickly as we are able to flip switches and change things on a globally distributed network. So whether that's on Cloudflare or someone else, I really hope that the idea around these controls has evolved into a world of verifiable trust that we have commonly understood mechanisms for processing and understanding. actions on the network and actions inside of computers and we've made that more transparent with that i think about 10 minutes off for questions who wants to uh ask something of our panel oh there's a mic coming right to you given uh the discussion in cryptology being you know a focal point of what you're saying identity becomes even more important could you comment about regarding that and You have several on the floor like Octa and others, but how you integrate with them and provide that end -to -end security where identity is the critical issue.

33:24I think the idea around identity is going to really expand. So I'll take this from a very practical approach first, then I'll go super theoretical. In a very practical sense, being able to integrate multiple identity providers into a solution is going to be important. Having the ability to show off and prove that you are. the correct identity profile with two -factor in various ways, whether that's physical things like YubiKeys or PassKeys, et cetera, I think is really important. If you haven't gone down to Cloud4Expo, you'll notice there's an amazing company down there called World, which is doing proof of humanity verification with biometrics and then putting those on-chain. As the former Web3PM, I'm also very engaged with the idea that having distributed ledgers and verifiable points of trust that can prove humanity and prove... possession of ownership of certain types of biometric profiles and others could be valuable in this world.

34:13Now, obviously, we need to secure various blockchains against threats of quantum computers. But I do think this idea of verifiable humanity is going to be really critical going forward. And not just in terms of biometrics, but also as we look at device identity itself and how people operate the network. I think the thing I would add, going back to the sovereignty piece, I think one of the decision points that we're going to have. sometime in the next few years is how important is something like nationality to a whole set of questions. So do you want your identity tied to your nationality as an example, right? Do you want to be able to tell people what your nationality is, even if you don't tell them what your identity is? All of those questions of how you actually arrange a system depend a lot on what we care about, you know, just from a practical standpoint of who gets in, right?

35:01So if we care about, if we care about your nationality, should we? looking at systems that actually will tell me your nationality even if they don't tell me anything else about you. Sort of like an age verification problem, right? Should we have systems that tell whether you're over 18 or not even if they don't tell who you are? And there's some really interesting things I think that come from that. I don't think we have an answer though to that the underlying question of whether that's something people want yet and I think that I think those are things we're gonna have to figure out.

35:34It sounds like what you're describing is commonly known in the Web3 space as zero -knowledge proofs, right? Zero-knowledge proofs, there's two sides of that from the policy and regulatory perspective, right? The regulators that want to make sure that your data is secure but that the data is somewhere so they can access the data if they ever need to, right? Whereas the other side of the coin is, you know, we may not want to disclose your age, your name. All you want to, you know, disclose is that you're an American citizen. that you're over the age of 18, right? I'm curious where Cloudflare, where you all land on that debate, right? Because, you know, you do sacrifice some of the law enforcement protections that come with having the data somewhere securely stored, right? So I actually, I mean, maybe we should ask our chief privacy officer that, but, you know, I think, I personally think that those are things that are really important systems to be able to build because sometimes it's...

36:29really important. You really don't want to share extra information, right? I have kids. Okay, we may have child -sensitive things, but do I want them having to give their identity in all cases to figure out if they can get onto something? No, no, I'm not really super comfortable with that. So how do we sort of look at systems where you can actually have, again, lots of different options of how you share information, use things like zero-knowledge proofs to actually only share information that you want, verify. that it is something, but not tell you any more about it. I think those are the ways of building privacy-oriented systems that actually get you what you need. But you may have bigger... Yeah, I'm not really comfortable that my kid gets facial recognition. We've gone from software to...

37:16Sorry about that. No, but it's true. I mean, I think one of the things that we've always felt strongly about is we don't really want to know what a person is doing on the Internet. We don't really want to know what you're doing. We're trying to find the bad actors. We're trying to see where threats are. We're trying to get aggregated data out of that. So I don't, you know, when it comes to an individual level, I don't, I think we want to try and stay away from that. I mean, that's what, you know, we've got the 1.1 resolver, like the whole idea there is you can be on the internet without the end website knowing, you know, who you are, breaking that connection. I think those are the kinds of technologies. we want to continue to invest in but then at the same time there are really hard questions about preventing fraud preventing bad bots all of those kinds of things and figuring out how we break that connection between a real person and then a bad action or a good action on the internet is I think it's just it's a really hard question I mean and we're we talk a lot about it um but ultimately fundamentally I don't think it matters we don't generally haven't cared what an individual person is doing, and we're trying to stay away from any of that.

38:28I will say from an R&D perspective, Cloudflare has been invested in ZKP for a long time. I see members of our research team sitting here who have done a lot of work in the ZKSP space. Marwa Veyad, who's in the back, will kill me if I don't mention the idea of trusted execution environments, which is an idea that we have for our own processing and storage of things where we could operate processes inside of TEs that are fully encrypted. into Cloudflare so we can't see what's going on inside of them. We think about these a lot in the research and development space, particularly the Cloudflare Research Group, as we start trying to conceptualize what the next three to five years are going to bring. Next question. I guess I'll have the mic right there.

39:07How do I phrase this? So I guess this concept of cryptography instead of localization, right? Obviously, the fun thing about interacting with regulations is that there's no clear black or white yes or no.

39:26So Cloudflare is investing a lot of political capital, let's say, in this concept that cryptography will fulfill these sovereignty requirements, right? We as users are probably mostly believing in the reality of that. Right. In in the reality of that, instead of the perception of whether or not that's true, that being said, we are taking on a lot of risk by buying into this, by answering audit questionnaires, et cetera. Right. And obviously, we all understand that it's it's still our responsibility and we have to make the decisions that are best for us. But that being said, what have you all seen that makes you confident that this.

40:14will be accepted um across you know most regulatory regimes that we see um what are you what are you all actively doing maybe to help codify that maybe in seeking codified opinions um etc and then um you know this is this is touchy but um understanding that there are those canaries that you talked about um obviously you would you would pursue legal action of certain um uh bridges were crossed but um let's say that happens to a cloudflare customer whose whose defense is merited on this concept that that post -quantum cryptography does fulfill you know sovereignty requirements sorry that was really dense there's there's a lot of threads in there um i don't do it or i can start like where do we start i mean the um Well, so, I mean, Alyssa's still a global public policy in addition to her chief legal officer hat.

41:17So I don't want to speak for what the policy team is doing, but the policy team is doing a lot of things to, you know, comment on and make arguments about this in, you know. And before Alyssa gets to the policy arguments, too, I'll just be super specific. These ideas are grounded in real customer conversations we've been having across Europe and across the Middle East and Asia over the last few years. last couple of months. I think that there was a really big turning point with some major recent geopolitical crises that really painted a very clear spotlight on the fact that physical resiliency is a key part of a sovereignty story. And I think the policy team can obviously comment on the actions that we're going to take in the public policy space or might be about to take in the public policy space to help evolve these conversations. But certainly from an architectural and R&D perspective, I think we believe this is the right direction to go. And it's going to be a options, right?

42:06You know, Cloudflare obviously operates physical locations in many parts of the world. There are ways that we can use multiple bits of architecture to do different things to solve that for different customers. Right. I would just add on that piece, you know, the reality is the conversations that you're having across the board with a regulator are all about that evaluation of risk, right? So if you have to go report to a regulator because your system went down because the one sovereign player just went down. you're still going to have to talk to the regulator about why you took that risk and why you didn't actually think about it. So, you know, there's a reality of having to have a conversation with a regulator across the board. I think one of the things that we think we can do in this space on the point of sort of how do you talk about this is we should be having those conversations with regulators. We should be explaining how does this work?

42:54How do you actually generate the controls? How would a customer employ this? So that if we have a customer that then goes to that same regulator, to understand what we're saying or what you're saying and so the concept is then we should be talking about this together right there is there's a world where we can talk about how this actually satisfies this this requirements and actually reduces the overall risk um and and and actually satisfies the needs for it i think the challenge is the one that emily flagged which is that sometimes regulators are kind of narrow and they and they may not be looking at all your risk they may be looking at just the one and they may have views on it and that's that's something that's hard to manage, but I also think that, again, the more conversations we all have, the better. I think this will be our last question.

43:43Thank you. Good day.

43:46It's a bit multilayered, maybe, question.

43:51What I'm thinking, the data sovereignty is, and physical, geographical borders they're sort of washed away by two factors encryption and access meaning I may have data basically globally anywhere if it's encrypted well it doesn't matter if it's a physical location in Europe or the States doesn't matter if you cannot get access to data then who cares where it's stored on the countryside at the opposite side I may have data, let's say somewhere in Europe, but if somebody can access data globally, then it doesn't matter if it's physically residing in Europe or somewhere else.

44:37And U .S. Cloud Act basically allows one country to access data if they want to. And it's basically unilateral access. I think on that bit, that becomes the set of warrant canaries and legal controls that we're talking about. So, you know. There are all sorts of different questions about access on data. The reality of something like a legal mechanism that enables you to access data, the answer to a legal mechanism is probably another legal mechanism, right? So what we do in our world is for things that look like the Cloud Act, if you're a European customer and you're concerned about those issues, as an example, we actually have a commitment that will legally challenge it. We want to give you the right to say, hey, my data shouldn't get produced, right? And the idea is to basically...

45:23that you have that option, that should be something that is in your control to potentially do. And so we actually, that's one of the commitments that we've made on the legal side. I think when we look at those issues, though, this is my point about the broader set of things, you have to tie together the legal package of things that you can do with the technical pieces that you can do. So if you can't access the data at all because you're not in a place,

45:51It's hard to say that you can produce it because you can't access it. So your answer back to Accord in that context is, I don't even have access to it.

46:03Thanks, everybody. We really appreciate you being here today. I think this is one of the last panels in this room. So we'll be here for a couple minutes to answer questions. And then we'll see you, hopefully, at the Function Party this evening. Yeah, thank you.