Abstract
Common concerns about the extent of government intrusion into digital communications were confirmed by the extensive revelations by Edward Snowden, a young contractor to the US National Security Agency. Snowden used the press to inform the world that a global surveillance state may be being built. This led to the beginning of a global political debate on digital communications surveillance. This article focuses on Anna, a 28 year-old typical and entirely fictional computer science Ph.D. student at a European university. It explores the development of Anna's concerns about digital surveillance through interactions with her direct circle of friends and family. The purpose is to give the reader information and ideas for an informed ethical self-analysis of the position he or she may take in this ever-intensifying debate.
Keywords
Dataveillance: an introduction
Waking up on 7 June 2013, Anna goes through her usual routine of snoozing once or twice, and–-after much complaining from her boyfriend, David–-turns off her smartphone alarm and checks her email on the same device. While she scans through the usual newsletters and gossip email from her friends, one email grabs her immediate attention.
‘U.S., British intelligence mining data from nine US Internet companies in broad secret program’ (The Washington Post 2013) and ‘NSA collecting phone records of millions of Verizon customers daily’ (The Guardian 2013a) are the headlines in the daily news alert email that Anna receives from her political party's Internet policy working group. Links in the articles lead to articles that reveal how the US and UK intelligence agencies have secretly gained access to the main network cables that carry most of the world's Internet data (The Guardian 2013b).
‘Oh no…’, Anna exclaims, turning to David. ‘I think privacy died yesterday!’ Unimpressed with Anna's usual quick conclusions from possibly sensation-seeking news sources, David reassures her by showing her a video on his phone of President Obama putting the revelations in perspective (The Wall Street Journal 2013). ‘See, they're only collecting so-called metadata about who called whom’, David says, patting his girlfriend on the shoulder. ‘Really, this has been going on for years. We even learned about it in our telecommunication law lectures’ (BBC News 1999).
Still not convinced of the mere sensationalist nature of what she has just read, Anna rushes to her department's library. Instead of continuing work on the third chapter of her thesis, as she had done for the last two weeks, she starts writing down her thoughts and questions in her leather notebook, for which she's now finally found a use.
‘I think equating the Internet with historical technologies when making policy and applying laws is not just simply wrong, it is dangerously misleading’, she starts to write (as explored in Wright 2013). She continues:
Metadata, or communications data, now reveals more than just who we're calling. What if new, sophisticated computing tools permit the analysis of large datasets to identify individuals’ embedded patterns and relationships, such as personal details, habits and behaviours? (The New York Times 2013). Data that previously carried less potential to expose private information may now, in the aggregate, reveal sensitive details about our everyday lives! (Felten 2013).
After some angry pen clicking, Anna concludes: ‘If this is really what is happening, I don't remember voting for it.’
Panopticon effect
The following weekend, Anna gets ready for a long-awaited call with her friend Sarah, who is doing humanitarian work in Darfur. After some initial connection problems with the Internet calling service, including a mysterious incorrect connection to a bitter-sounding Arabic speaker and other ongoing interferences, Anna and Sarah finally get a chance to talk.
That happens quite often’, Sarah says about the misconnection. They say people who are under surveillance sometimes get mistakenly connected to the Sudanese surveillance office, but I don't know whether to believe them.’
‘I don't think that is how digital technology works’, muses Anna. ‘Accidental mistakes in connections cannot realistically happen with digital technologies.’
‘Well, maybe Omar al-Bashir is listening in on our gossiping and exciting lives as Europe's special agents’, Sarah joked. ‘They probably brief him about what you tell me about you and David’, she continues, ‘or think I am secretly communicating with my highly influential Ph.D. student friend about how to end this regime!’
Anna wants to react in her usual way: ‘Yeah, we'll bring down his empire with my influential political writings…’ or with something equally sarcastic. She doesn't. Neither does she mention her coincidental meeting with the Danish visual artist who is famous for her work ‘Dafurnica’ and raises awareness of the situation in Sudan through her art, who would have been a great contact for Sarah's work (Plesner 2013).
Although she isn't sure who is listening in, the fear of her jokes being misinterpreted by some unknown entity, or the mention of the name of an artist critical of the ruling regime, is enough to make Anna silence herself. The effects of what she could say, for example on the security of her friend, are not predictable. So, Anna concludes, it is better to censor herself.
Angry that the conversation continues to be bland, instead of the usual fun the two friends normally have when talking to each other, Anna grabs her notebook and decides to write down the topics she shouldn't forget to talk about to Sarah when they next meet in person. However, her anger from the call leads her to write about the effects of digital surveillance on herself:
If even my conversations with friends turn bland because we can't say what we want, can we still afford sarcasm and irony in digital communications? Do the freedoms of speech and thought actually go hand in hand with privacy on the Internet?
And what is the effect of some self-censorship of people in the bigger societal picture: are we forcing ourselves to become a more introverted society in the name of the not-unimportant but very vague goal of fighting terrorism?
Would surveillance of legal activities inhibit people from engaging in them? (Solove 2007). And are really only metadata collected, or do other governments collect the content–-as apparently the Sudanese are already doing–-only to share this with the international intelligence community? (Der Spiegel 2013a; The Guardian 2013f).
All these questions remind Anna of her recent reading of Foucault's book Discipline and Punishment, in which the effect of constant surveillance on individuals (Panopticon) is described as follows: ‘He who is subjected to a field of visibility, and who knows it, assumes responsibility for the constraints of power; he makes them play spontaneously upon himself; he inscribes in himself the power relations in which he simultaneously plays both roles; he becomes the principle of his own subjection’ (Foucault 1975).
Nothing to hide?
Anna meets her parents and friends from the neighbourhood in a local restaurant for their traditional Sunday lunch. Still confused about her reactions to the possibility of digital surveillance, she discusses her thoughts with her father, a stockbroker at one of the international banks in a nearby city.
‘What really are you so worried about, Anna?’ he says after listening to the concerns of his daughter. ‘These systems are in place to catch criminals and put a stop to terrorism. You don't have anything to hide! Or do you? Is there something we should know, Anna?’ he says jokingly, while the others at the table laugh. ‘And besides, what really is this privacy thing? It seems a little vague and meaningless to me.’
Anna struggles. It's true, she's not planning to hijack a plane, and neither does she want to. She doesn't have any skeletons in the closet, so she can be pretty sure nobody really has an interest in looking at the data that are collected about her. But she remains uncomfortable at the idea that her Internet searches or the websites she visits are kept somewhere, possibly for an indefinite time.
She tries to explain to her father what privacy really is and what it means to her. Again, however, she's lost for words when she tries to get to the essence. ‘It's about being left alone (Warren and Brandeis 1890), about people not entering your home to see what you're doing, whether physically or digitally!’ David, the weekend comedian, is quick to react: ‘You're not looking for a new boyfriend on dating sites, are you?’
Frustrated at the way the conversation is going and at her inability to explain her concerns, she lets it be. The more she says, the deeper the hole she's digging for herself. Maybe she shouldn't be so worried, as indeed, she has nothing to hide, and maybe that's the way society and government should now be in a digitally connected world.
Over the next few days, Anna's frustrations about the dinner table discussion are reinforced by her second considerations when she deletes some remarks in emails to her friends. She doesn't feel it has to be known forever what her thoughts are, intimate or not.
She decides to do some research, to better articulate her concerns the next time she sees her father. After spending several days neglecting the troubled third chapter of her research and reading up on the concept of privacy and the social effects of digital technologies, she collects her thoughts and questions in her notebook, ready for the next discussion with her father:
By discussing privacy as a protection of something I would like to hide, a concealment of something I have done wrong, we are missing what privacy is really about (Schneier 2006). Privacy is not just one protection against one issue but a concept that covers many protections against an undefined range of possible harms. Blackmail, misuse of personal data, surveillance and identity theft are just a few examples where the individual needs protection from others. Privacy has a social value that protects the individual for the sake of society! (Solove 2007)
We trust many aspects of our lives to companies that provide us with the services we now cannot do without in our daily lives. In exchange for free services, these companies build detailed profiles of their customers–-us (Mai 2012). These Internet companies often know more about us than we do ourselves: sophisticated algorithms can make inferences about which way our thinking is going, using vast data on people who previously displayed a similar search pattern (Intelligent Life 2013). To illustrate, a search engine doesn't just know you're gay or pregnant (Hill 2012) before you tell your mum; it knows you're gay (Lanchester 2013) or pregnant before you do. And now intelligence agencies do too (The Verge 2013). The NSA has pressured these companies–-threatening individual criminal sanctions (Business Insider 2013; The New Yorker 2013b)–-to install backdoors into their data systems with the aim of aggregating all Internet data from a central point. Companies are legally required to store many data types for a period of several years (European Parliament and Council 2006), and may opt to never delete collected data. So, without this mass surveillance ever being discussed in any parliament anywhere prior to implementation, the worldwide intelligence community may also now know more about us than we know about ourselves. At the very least, they have access to data and computational resources (The Daily Mail 2013) which we ourselves do not possess.
The question we have to ask ourselves is: what information does a modern intelligence agency need in order to achieve its aims? And possibly more important, especially now that the Cold War is firmly ingrained in the history books, what exactly do we want the aims of an intelligence agency in the twenty-first century to be?
Wilful cyber insecurity and dodging accountability
‘Holy smokes!’ someone shouts in Anna's computer lab. Anna turns around and sees her friend Joseph, who researches cyber security and cryptology, standing on his feet with his hands in his hair, staring at his laptop. Other students lean over to see what he is reading, and gasp in shock once the message has landed.
‘Revealed: The NSA's Secret Campaign to Crack, Undermine Internet Security’ (Pro Publica 2013) the headline reads. ‘Not only do intelligence agencies record details of every communication’, Joseph says, clearly distressed, ‘but they've actively sabotaged Internet encryption standards for their own benefit!’ The day's news uncovers how, through secret agreements and the undermining of international standards bodies, the NSA has weakened the mathematics on which the encryption of sensitive online information relies (The Economist 2013).
Within minutes, Anna's phone rings. ‘I thinkyou were right’, Anna's father admits. The whole bank is in turmoil about this digital surveillance. It turns out our secure financial transactions have not been secure all these years. By sabotaging encryption standards, intelligence agencies can intercept and see everything! The scale and scope has taken all our IT experts by surprise.’ This also applies to medical records, reasons Anna, and lawyers, whistleblowers and online credit card transactions.
Suddenly, Anna's head drops in her hands. ‘If one intelligence agency can decrypt all this information, it means others most likely can too… !’ Indeed, if Edward Snowden was able to copy all this information and publish it, how many ill-meaning former contractors have sold the same information to other governments or malevolent hacker gangs? The value of information to be uncovered is unquanti-fiable. And not only is sensitive financial information at risk, but the communications of well-meaning humanitarian workers or activists in authoritarian regimes may well also be exposed. Anna is glad she kept silent when Sarah was talking with her.
The stream of news continues over the following weeks. Anna learns that her location is constantly recorded via her smartphone (TechDirt 2013), that her phone can be hacked at will (Der Spiegel 2013c), that her social relationships are accurately mapped (The New York Times 2013), that every button she presses on her computer is potentially stored (The Guardian 2013e) and, indeed, that her Skype calls can be easily monitored (The Guardian 2013d). Disappointed in technology, she switches off her laptop and smartphone and goes to visit David in the common room of the law department.
Anna explains the social implications of constant state surveillance and the potential misuse of security flaws to David, who has also followed the revelations closely. ‘Since our discussion about privacy over lunch with your family, I've read the revealed documents myself, David admits. In a serious tone, he continues:
Do you know how the intelligence community was able to set up this global surveillance state? By interpreting dated laws as such, to allow for monitoring by all-encompassing surveillance technology that was not previously foreseen (The Guardian 2013c). And when technology wasn't legal, intelligence agencies circumvented the rule of law, possibly even the US constitution, with secret laws and courts (Forbes 2013). And when agencies were not allowed to spy on their own citizens, they exchanged surveillance information with other countries’ intelligence agencies. There was no law to stop this information sharing, because legislators probably didn't think to legislate against such an obviously unethical practice (Foreign Policy 2013). This depresses me, Anna, because trust in the rule of law seems to be, unfortunately, not realistic but extremely naive in 2013 (Arnbak 2013).
That same evening, while sitting at her desk at home, Anna still has one question that she cannot seem to logically answer. ‘Why would any intelligence agency need all this capacity, all this information, when it is perfectly capable of targeting suspected criminals and terrorists using far less invasive technology?’ ( Wikipedla.org 2013). The answer she finds that evening is one she could have expected: boundless greed in a mass surveillance industrial complex.
Cyber security and surveillance tool manufacturers, and their consultants, have been able to exploit the fear of unknown threats in combination with the alarming lack of technical knowledge among policymakers, to justify the costs of surveillance. By promising lucrative jobs to high-paying suppliers and contractors of surveillance, civil servants and spies were enticed to purchase unnecessary, but sophisticated, high-capacity and hugely privacy invasive technology, rejecting the more targeted and proportionate but cheaper options (The New Yorker 2013a). Secrecy by the circumvention of democratic processes (The Guardian 2013h) and the rule of law allowed for a path dependency on ever more invasive surveillance technology, where agencies and their contractors would share the ever increasing profits, albeit indirectly. The mass surveillance industrial complex gave rise to the global surveillance state uncovered by Edward Snowden.
While Anna was contemplating whether, maybe, the extent of this surveillance could be necessary and proportional in the digital age, David sent her an email with the newest revelation: ‘NSA director admits to misleading public on terror plots’ ( Salon.com 2013). The story reveals how only 2–-instead of 54, as had been alleged–-terrorist plots were uncovered and led to people being identified using the surveillance technology (The Raw Story 2013).
Anna feels she needs to collect her thoughts:
This intelligence community is merely forcing its own relevance, to the detriment of civil liberties worldwide, putting citizens at risk, forfeiting the role of the West to act as the global leader in the twenty-first century information society and at a huge cost to public funds. The amount of misinformation and outright lies uncovered by the press make it hard to take any news on threats to national security seriously anymore ( RT.com 2013). I have now lost trust in both the technology I grew up with and the rule of law in our democratic state. Everything I say, think and do is probably recorded somewhere and can at some point be used against me, in whatever unpredictable future context. This not only concerns me, but it concerns everyone.
Due to these technological advances, the State's effectiveness in conducting surveillance is no longer limited by scale or duration (Brown 2013). Intelligence agencies have taken full advantage of this, circumventing or re-interpreting the laws that were supposed to halt a new Stasi or hinder the next dictator from gathering the information needed to separate and discriminate against minorities.
The approach taken by intelligence agencies is to collect data now and ask questions later. The question we have to ask ourselves in the upcoming debate is whether that is the right operating philosophy, even though it is technically feasible (Center for International Security and Cooperation 2013).
Urgent need for real EU leadership
During the autumn, Anna's political party hosts a conference in the national capital. Anna takes the train to directly ask politicians some pertinent questions about their position on the surveillance revelations. It is important for her that her representatives understand the gravity of the situation and take some form of leadership to address the situation.
However, when Anna was able to ask her questions in the plenary session of the party's conference, her party's leading Member of the European Parliament of merely responded along the usual lines: ‘The real debate we should be having is about what privacy in a cyber-connected world can realistically mean, given the volumes of data we hand over to the private sector in return for our everyday convenience, and the continued need for warranted access for security and law enforcement’ (The Guardian 2013g). On her way home, disappointed in the response and the obvious lack of concern, Anna decides to draft a letter to the leaders of her party, which she will ask the party's information society committee to support.
Honourable Representatives
It is no longer okay to not understand how the Internet works or what effect information technology has on our lives. The ethical dilemma the surveillance revelations has posed is multidimensional. Any policy response will have an effect on our security and our personal freedom, and will have potentially chilling effects on society, which have to be understood. However, possibly more importantly, any decisions taken now–-or nonaction on your behalf–-will have a lasting effect on the Internet, which is the backbone of the twenty-first century economy, culture and society. The trust and security of this system will be undermined if you accept the current state of affairs, and your political position will weaken in the international political sphere (Der Spiegel 2013b).
We propose some simple points to consider in the upcoming debates about digital surveillance:
Legality Are the limitations to privacy of proposed surveillance systems prescribed by law?
Necessity Surveillance law and systems must be limited to achieving a legitimate aim.
Proportionality The measures must be reasonable, giving much due regard to citizens’ privacy concerns.
Safeguards Legal and enforced safeguards to minimise data collection, prevent illegitimate access and prevent the circumvention of safeguards through international cooperation are necessary.
Judicial overview Only a competent judicial authority that is impartial and independent must be able to authorise communications surveillance.
Transparency States should be transparent about the use and scope of communications surveillance techniques and powers.
Public oversight Effective accountability and oversight mechanisms should be set up, through parliaments or otherwise.
Integrity of communications systems When designing surveillance mechanisms, the integrity of communications systems should not be compromised (Various Civil Society Organisations 2013).
On behalf of the party's information society committee, I would like to thank you for considering the issues raised in this letter.
Yours faithfully,
Anna
Conclusion
Current digital surveillance practices affect everyone, from a personal, to a professional, a political and a societal level. It must be understood that political decisions with regard to Internet technologies have social effects further than the primary, face value, problems they solve. For example, the revelations discussed in this article have significantly weakened the position of the United States to be a credible advocate for civil liberties on the Internet.
Politicians and civil servants have to make an effort to become aware of the benefits of a free and open Internet for European citizens, its modern economy, and its flourishing culture and society. We cannot afford a fragmented, socio-technically inept and therefore ignorant European Union in the already hostile international political environment with regard to the information laws and policies that are shaping the Internet for the twenty-first century. The EU now has a chance to practise what it preaches on ethics, and it should take the opportunity to become the thought leader on civil liberties and proportionate law enforcement in the global information society.
Footnotes
