Sunday, September 6, 2015

Cyber101x Cyberwar, Surveillance and Security - Week 2 - Hacking and Leaking - Snowden

EDWARD SNOWDEN

  MELISSA DE ZWART: In June 2013, former National Security Agency contractor, Edward Snowden, released evidence to journalists that the US government through its various agencies was engaged in a massive and global scale collection of data from both its own and foreign citizens, via telephone and internet service providers. This was no random act of dissidence, but the carefully planned and executed actions of someone who had become grossly disillusioned with the system that they were a key part of. The data collection programmes were authorised pursuant to US statute, including the Foreign Intelligence Surveillance (or FISA) Act, the USA Patriot Act, and by Court Order. Neither was it particularly new news that this was occurring. Details of the mass collection of data from US citizens by the NSA had been the subject of news reporting and a book by investigative journalist James Risen published in 2005. Further, a number of NGOs, human rights, labour and media organisations had brought an unsuccessful action before the US Supreme Court in early 2013, seeking a declaration that collection of data under the FISA Act was unconstitutional. That action was unsuccessful, as the majority of the court held that claims of widespread surveillance of their communications were purely speculative. Snowden's revelations proved, in fact, that those fears were well founded. These data collection programmes gave rise to concerns in the US regarding violation of the citizens' rights under the Fourth Amendment: "the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures shall not be violated and no warrants shall issue, but upon probable cause supported by oath or affirmation, and particularly describing the place to be searched and the person or things to be seized". Snowden's revelations have had widespread impact on a global scale. In a carefully organised sequence of disclosures through journalist Glenn Greenwald and documentary maker Laura Poitras, Snowden revealed that the NSA was engaged through programmes with names like "boundless informant" in mass-scale collection of user metadata of Americans and non-Americans from telephone and internet providers. In addition, as revealed by the NSA PowerPoint slides, the major US tech companies were involved in the collection of user data. Further, the US was encouraged and assisted in this by its Five Eyes partners -- the UK, Australia, New Zealand, and Canada. The US was also actively involved in collecting data from its allies and friends, notoriously monitoring the mobile phone of German Chancellor, Angela Merkel. This was just the tip of the disclosure iceberg.

WHAT SNOWDEN REVEALED

  BRUCE SCHNEIER: What Snowden has said is he wants to start the conversation. And he certainly has. All of what we know about the NSA started from Snowden. All of the documents that the intelligence community of the United States has declassified was because of Snowden. All these discussions in Congress, in the courts, in public, are because of the Snowden documents. There was a Pew survey looking at worldwide reactions to Snowden. And running the numbers, I calculated that 700 million people on this planet have changed their behaviour because of the Snowden documents of the NSA's activities. Now, maybe they didn't really change their behaviour very much, maybe it wasn't effective, but I can't think of another issue that changed the behaviour of 700 million people on this planet. The conversation he started was extraordinary. And yes, I think it's a long and complicated conversation. I'm not convinced we're going to figure it out this year, even next year or the year after. But we're starting to have it and it's something we do have to figure out. It's impossible that the democratic experiment is over and we're now going to live in totalitarianism and mass surveillance is the norm. That's not going to be the way this comes out. But it's going to take us a while to figure it out. All of us in the security committee knew the NSA did this sort of stuff. You watch any movie with an NSA villain, this is exactly the sort of thing they're doing. What he did is confirm it in a way that brought the conversation to the mainstream. No longer do I sound like a weird paranoid when I talk about what the NSA is doing. Now I sound normal and well informed. And that turned out to be a crucial difference. It's one thing to know technically, it's another thing to see the documents, to see the code names, to see the budgets, to see what's happening. In some ways, the biggest surprise of the NSA documents is that there were no surprises in the NSA documents.

THE MEDIA RESPONSE TO SNOWDEN

 BRUCE SCHNEIER: The Snowden stories are hard. They're very technical. The documents are opaque, they're written in jargon, they're written in people who know what's going on. You have to read a hundred of them to understand one of them. They're not in code, but they're in very dense code word jargon. And that makes them hard to report. The press reports initially, and really all throughout, tended to be about the person because the human story sold better. It was hard to write the tech stories about NSA tracking of cell phones or NSA tracking Anonymity services without a human face, finding a human victim. And I think the public quickly tired of the tech. While we in the [tech] community were really interested in the details. This teaches us about security, this helps us come up with the fences. This makes us design better security systems. For the public, it ended up being all the same. And the media outlets that had access to the documents were writing to the mainstream audience and not to the tech audience. That made this hard. And it's still hard. There are stories that are not coming out because they're too techie. And for the Washington Post, for First Look Media, for The Guardian they're not worth publishing. So we're not going to see them. The difference has been Spiegel in Germany. They've written some very superficial stories but have included a lot of documents that are only marginally related to the story. And there are stories in those documents that have been ferreted out in the weeks and months after by more techie publications. So that seems to be a difference. And we're still watching it happen. The reason the Spiegel stories are so much more illuminating about NSA's activities is because the Spiegel reporters care less. They're not running what they're doing past the NSA, which the US and UK media did. And I think they are more antagonistic. 

THE FOURTH AMENDMENT

  BEN WIZNER: I think that the Fourth Amendment has not kept pace with technological realities of the modern world, although, as I will explain in a moment, we may be at the beginning of a revolution in Fourth Amendment protection in the United States. And it may be that our courts are just beginning to see the ways in which technology will reshape our needs here. The primary point I would make is that the Fourth Amendment has not always been the primary guarantor of our privacy. In some sense, the high cost of surveillance has been the primary guarantor of our privacy. Law enforcement simply didn't have the resources to follow very many of us for very much of the time. And if law enforcement wanted to track an individual, that might have required a huge investment of resources -- teams of officers to follow that person around. And of course technology has brought those costs from very high to negligible. And now it's possible for law enforcement to track all of us at almost no cost with a laptop computer, simply by contacting the technology companies that are tracking us and getting that information for them. And so now we're going to need to have Constitutional Law in places where we didn't necessarily need it before. Because of how easy it is for the government to track us and because of the ways in which that reshapes the power relationship between governments and individuals. Specifically with respect to the Fourth Amendment, since the 1960s, the tests that our courts have applied to determine whether citizens are entitled to Fourth Amendment protections is, do we have a reasonable expectation of privacy with respect to whatever is being invaded by the government? And remember, the Fourth Amendment applies only to the governments. It has nothing to say about intrusions by private corporations into our privacy. The Fourth Amendment is a limitation on government surveillance. It is not a limitation on corporate or business surveillance. Now many people have criticised that test -- the expectation of privacy test -- because it seems circular. If we're really asking what kinds of privacy expectations are reasonable, you can see how that could become a one-way ratchet. That the more surveillance we're subjected to, the less reasonable it is for us to expect more privacy. And then the protection itself under the law would go down. But that's not generally how the courts have applied the Fourth Amendment test. In general there has been a normative component where they have asked, is this something that we should be protecting? The second part of the Fourth Amendment doctrine that is in need of revitalisation is something that we call in the United States, the 'third party doctrine'. And this is a doctrine that the Supreme Court came up with in the 1970s where they said, essentially, if we voluntarily shared data or information with a third party, we'd waived constitutional protection over that data with respect to the government. And so if you give information to a bank, you can't then complain when the government goes to the bank to get those records. If you give information to a phone company, you can't complain when the government goes to the phone company to get those records. Well every time you use a phone you're giving information to a phone company because in order to use the service, you have to give them your location, you have to dial the number. And all that information has been available until recently to the government of the United States without a warrant under the Fourth Amendment. I mentioned a moment ago that we might be undergoing a positive revolution in Fourth Amendment doctrine. I'll discuss briefly two cases. In 2012, our Supreme Court held for the first time that GPS tracking of an individual's location is a search under the Fourth Amendment. And this was a big shock to the government. The government's position was, if you're driving a car out in public where it can be observed by anybody, how can you have a constitutional expectation of privacy in where you drive? And the court recognised that there's a difference between following someone around on a series of trips and tracking their location at all hours over a long period of time. You can learn everything about an individual in 20 or 30 or 40 days of tracking that person's location. So that was a very important decision and we'll see now whether that signals a broader Fourth Amendment revolution. The second case involved whether the police in the United States, when they arrest someone, can search their cell phone or smartphone without getting a warrant from a judge. Typically, the police are allowed to search your body and the objects on you when they arrest you to make sure that you don't have weapons, to see if you might be trying to get rid of contraband. And the police have been using this rule in order to do warrantless searches of people's smartphones, which have huge amounts of data on them -- medical records, other personal kinds of information. And the Supreme Court, in a unanimous decision in 2014, said to the government, in these words, "Get a warrant." That essentially, technology has changed the balance here, and where we might have sided with law enforcement in the past, now we're siding with privacy. So that was somewhat of a long answer, but I hope it will be helpful to non-American students.

THE VITAL ROLE OF JOURNALISTS

BEN WIZNER: One thing that we hear in the United States very often is, why should someone like Edward Snowden or the reporters that he chose to work with decide what is public and what is secret? Shouldn't we entrust those decisions to people who, in a democracy after all, we elected, or to people they appointed -- doesn't that provide more democratic legitimacy to have those officials, in a democracy, make those decisions? My response to them is -- let's imagine the last 10 or 15 years, if the government officials to whom we've entrusted those decisions had their way every time. In the United States we would not have known that the case for war in Iraq was trumped up based on false evidence. We would not have known that the United States tortured prisoners in Abu Ghraib, that the CIA set up secret prisons around the world and applied what they called enhanced interrogation techniques on them, that the US used drones for targeted killings far from any active battlefields. All of this information is information that our governments tried to prevent the public from ever learning. And the reason why we know about it in the detail that we do is because people within the system provided the information to aggressive and courageous journalists. And those journalists made the decision against government opposition to publish it in their newspapers. Can we legitimately say that our democracy would be stronger if those journalists had not done that? So I think the journalists play a very, very vital role. Now I think that they have played that role extremely responsibly. I haven't heard of a single case where a journalist reporting on the Snowden documents has done so without first consulting with the governments that are most relevant and would be most affected. So this is something that they take seriously and that they do carefully. But again, without a free press, then we would have presidents and their appointees deciding for themselves what information we should have on which to judge them. And that is very corrosive to a democracy. It's why the First Amendment to the US Constitution is the one that protects the free press and the freedom of speech.

No comments:

Post a Comment