Snowden book

I read Edward Snowden's book, Permanent Record, over the Christmas break. It's an accessible, engaging account of how he got to where he is.

His early education was shaped by the anarchic, liberal, open, collegiate internet of the late 20th century, before it began to be reshaped by commerce and states as the mass surveillance machine it is today. His family were supportive or possibly indulgent of his obsession with the computers and networks of the 1990s.

In school, Snowden hacked the system to avoid homework. Quizzes were worth 25%, tests 35%, term papers 15%, homework 15% and class participation 10%. He figured he could skip both the homework and the term papers and still comfortably pass by acing everything else. Then one of his teachers confronted him, asking why he had not handed in any of previous six homework assignments. Innocently Snowden explained his reasoning to the laughter of his classmates. The teacher complimented the young Snowden on his cleverness and, within 24 hours, changed the system to make homework compulsory. He also took Snowden aside and encouraged him to put his fine brain to more constructive use than avoiding work and to be aware of how records follow us around and the impact on his permanent record.

Snowden's parents broke up. He learned to be independent, went to community college and got a job as tech support for a small business, working out of the business owner's home on the south west edge of Fort Meade. Yes that Fort Meade - home to the NSA. Snowden was at work when the 9/11 attacks happened and everything changed.

He bought hook, line and sinker into the Bush/Cheney 'war on terror':

"It was as if whatever individual politics I'd developed had crashed – the anti-institutional hacker ethos instilled in me online and the apolitical patriotism I'd inherited from my parents, both wiped from my system – and I'd been rebooted as a willing vehicle of vengeance. The sharpest part of the humiliation comes from acknowledging how easy this transformation was, and how readily I welcomed it."

And joined the army.

Coming from family generations of which had served in the Coast Guard, Snowden wanted to serve his country through the branch of the armed services considered by that family to be the "crazy uncles of the military". He aced the entrance exam, went into training for special forces, got injured on exercises and was eased out on administrative separation.

So back went Snowden to community college and decided he could best serve his country through his technical prowess. But to do that he'd need to join the CIA, NSA or other intelligence agency. And to do that he would need security clearance - top secret (TS) and top secret with a Sensitive Compartmented Information (SCI) qualifier. This involved filling out some forms and "sitting around with your feet up and trying not to commit too many crimes while the federal government renders its verdict." As a military veteran of sorts and the product of a multi generational service family, most of whom had the equivalent clearances, he was a good prospect and in due course succeeded. By this time Lindsay Mills had also become part of his life and so closes part 1 of the book.

Part 2 opens with 'The System.' Snowden describes a system as "a bunch of parts that function together as a whole". At the Open University we have a slightly longer definition of a system:

1. A system is an assembly of components connected together in an organised way.
2. The components are affected by being in the system and the behaviour of the system is changed if they leave it.
3. This organised assembly of components does something.
4. This assembly as a whole has been identified by someone who is interested in it.

Given the systems Snowden was thinking about - the professional civil service his family were steeped in and the computer systems he was obsessed by - his working definition satifices. When it came to computers he was most intrigued by their total functioning, not as individual components but as overarching systems. So the natural inclination was to get into systems administration or systems engineering which is what he did. Sysadmins and systems engineers naturally incline to a craft of understanding how computer systems work and fail and develop the diagnostic processes that go into keeping them running and getting them fixed and retrofitted and improved and renewed. It is not unnatural, then, when working within government (albeit for contractors) for techies to apply to same systems analyst skills to the system of government. Which is also what Snowden did.

We know about the five eyes mass surveillance systems and activities from Snowden's disclosures in 2013, from PRISM to TEMPORA, XKEYSCORE to QUANTUM, TURBULENCE and beyond. Yet, in some ways, the most chilling chapter in the book is "Homo contractus". It essentially outlines the private sector infiltration of the US intelligence services.

"I had hoped to serve my country, but instead I went to work for it. This is not a trivial distinction... government had treated a citizen's service like a compact: it would provide for you and your family, in return for your integrity and the prime years of your life.

But I came into the IC during a different age.

...the sincerity of public service had given way to the greed of the private sector, and the scared compact of the soldier, officer, and career civil servant was being replaced by the unholy bargain of Homo contractus, the primary species of US Government 2.0. This creature was not a sworn servant but a transient worker, whose patriotism was incentivized by a better paycheck and for whom the federal government was less the ultimate authority than the ultimate client.

...for third-millennium hyperpower America to rely on privatized forces for the national defense struck me as strange and vaguely sinister."

Snowden goes on to explain the use of contractors is a con to let the agencies circumvent statutory federal caps on hiring. As contractors are not included in the limits, the agencies can hire as many as they have the budget to pay for. Post 9/11 was a time when no congresscritter was going to go on the record as opposing any resources the intelligence and security agencies declared necessary for the 'war on terror'.

Huge resources got poured into the intelligence agencies for technical surveillance infrastructure and the people to create, develop, deploy and operate it. A large proportion of the people working on this mass surveillance were, like Snowden, technically employed by contractors and sub contractors but working directly for and within the agencies, the CIA and NSA in Snowden's case. Many of those nominally employed by the private sector started out as government employees, as the private companies didn't want to pay someone to wait around for a year or more for their TS/SCI security clearance to come through. Once the clearance was secured they could swap a government job for a better paid private sector job, sometimes doing the same work. Snowden's first job was with the state of Maryland partnered with the NSA opening a new institution called CASL, the Center for Advanced Study of Language.

As the building in which CASL was to be resident was still under construction, he essentially did the work of a night shift security guard. Whilst there and considering his long term career as a federal employee, he was amazed to find few opportunities to work directly for the government. Most of the sysadmin and systems engineering jobs available in government were through "working for a subcontractor for a private company that contracted with another private company that served my country for profit." Given these positions provide "almost universal access to the employer's digital existence", it's surprising to find these circumstances prevailing in the context of security and intelligence.

"In the context of the US government, however, restructuring your intelligence agencies so that your most sensitive systems were being run by somebody who didn't really work for you was what passed for innovation.

The agencies were hiring tech companies to hire kids and then giving them the keys to the kingdom."

Snowden's first contracting gig was for a company called COMSO, subcontracted to hire him by BAE Systems. He worked at CIA headquarters in McLean, Virginia. He had been earning $30k at CASL and asked COMSO for $50k. His nominal "manager" at COMSO talked him up to $62k. Middlemen contractors charged the government the employee's salary plus 3-5%. The higher the salary, the higher the cut.

The actual job at the CIA was both depressing and enlightening. Depressing on the extent of the cynical restructuring of the agency by the Bush administration and the move to a dependency, particularly in relation to modern technical information systems, on external contractors. Enlightening on the extent of the access Snowden got to highly classified material and the insight that gave him into the reach of the CIA and the importance of intelligence operations. It also gave him a hankering to really serve his country by applying for a role in a CIA field office overseas, preferably in a conflict zone. That meant swapping his contractor badge for a government employee badge, swearing an oath to defend and uphold the US Constitution and going back to school.

The techie in the CIA field office or embassy is responsible for every piece of kit in the building, from computers to heaters, encryption devices to locks. For security reasons no embassy will employ local contractors on even routine maintenance. The tech guy and there are not usually that many of them does everything. That's what the 6 months schooling before deployment was for.

Conditions at the CIA Warrenton Training Center ("the Hill") were less than ideal and whilst there, Snowden got his first taste of what reporting problems up the chain of command led to i.e. no addressing of the problem and a marking of the card of the whistleblower. Instead of getting his preferred deployment to a war zone to actively live out his heart on a sleeve patriotism, he was sent to Geneva for his first overseas tour of duty.

In Geneva, Snowden got a front seat view of the changing intelligence world and the pivot of the CIA from human intelligence (HUMINT) to cyberintelligence (SIGNINT & COMSEC), not that the former was abandoned but became proportionately less prevalent.

" In Geneva... America was busy creating a network that would eventually take on a life and mission of its own and wreak havoc on the lives of its creators – mine very much included.

The CIA station in the American embassy in Geneva was one of the prime laboratories of this decades long experiment. This city... lay at the intersection of EU and international fibre-optic networks, and happened to fall just within the shadow of key communications satellites"

Following Geneva, he moved to Tokyo to work in his "dream job" for the NSA but again, technically, as a better paid contractor in the private sector, an employee of Perot Systems which was then taken over by Dell.

In Tokyo, communications interception was the primary mission. In Toykyo, Snowden's early work was to link the NSA and CIA systems. In Tokyo, he discovered the NSA were vastly technologically superior to the CIA and vastly more laissez faire about security. In Tokyo, he created a much more effective storage system for the NSA, called EPICSHELTER. In Tokyo, his mind boggled at the scale and reach of China's mass surveillance and censorship systems. In Tokyo, he first realised "the power of being the only one in the room with a sense not just of how one system functioned internally, but of how it functioned together with multiple systems—or didn't." In Tokyo, he began to become disturbed at US mass surveillance, even as he was creating, developing and operating elements of the systems involved. In Tokyo, he initially sated his concerns by assuring himself he was working for the good guys.

In Tokyo, he became aware senior intelligence and security community insiders had serious concerns over the Bush administration's unchecked expansion of warrantless mass surveillance. In Tokyo he accidentally got access to the classified version of the Report on the President's Surveillance Program, (PSP) filed in an 'Exceptionally Controlled Information' (ECI) compartment. Full classification TOP SECRET//STLW//HCS/COMINT//ORCON/NOFORN. Through the PSP report he learned of STELLARWIND, the NSA's general and indiscriminate, bulk collection of electronic communications. In Tokyo, he began to understand the political sophistry underpinning mass surveillance, such as the now ubiquitous claim that collected communications could only be considered to be legally "obtained" or "acquired" if a member of the agencies searched for or found them. Collected communications would not be legally acquired but would, nevertheless, be available for search and retrieval, in post hoc fishing expeditions, in perpetuity. In Tokyo, it dawned on him that the Obama administration had no intention seeking reparations for systemic illegalities or undoing any of the deployment of mass surveillance infrastructure undertaken by their predecessors.

By 2011, Snowden was back in the US, still employed by Dell, building cloud systems for the CIA. He was also getting stressed and depressed at the mass surveillance of the state; and not just willing but enthusiastic compliance and buy in of friends and the general public into commercial systems of mass surveillance. The stress led to illness, including epilepsy and he eventually took sick leave to recuperate. His next move, in 2012, was to Hawaii, still with Dell, a step down in terms of responsibilities, to facilitate his ongoing recuperation but now working for the NSA again. He was now the NSA's Microsoft Sharepoint administrator in Hawaii. Lowly in the organisational food chain but, as a manager of document management and "reader in chief", this provided the access privileges to gather comprehensive evidence on his nascent concerns from Tokyo, about US mass surveillance.

Having automated much of his formal work responsibilities he set about his task of surveying the extent of the NSA's surveillance capabilities, running into the standard security services secrecy, obfuscation, compartmentalisation, misdirection, bureaucratic code and all the other institutional processes available for keeping information from the light. He decided to automate this process too, with the approval of his boss, setting up a kind of RSS reader system on steroids. This not only scanned for or linked to documents but copied them. Snowden called it Heartbeat and gave intelligence services staff access to a personalised reader that collected classified intelligence documents (from NSA, CIA, FBI and Deparment of Defense) according to each individual's security clearance.

The volume of documents Heartbeat collected was enormous and although Snowden could see it all, beyond the capacity of a single human being to review. Nevertheless, it was through Heartbeat that he learned about Upstream (direct collection of bulk data live from private sector communications infrastructure) and PRISM (bulk data handed over by private sector actors like Google, Apple, Microsoft, Facebook and Amazon etc. and overseen, theoretically, by the Foreign Intelligence Surveillance Court, FISC). He learned of TURBULENCE, a collection of black servers hard wired into telecommunications companies' infrastructure, running internet traffic through filtering tools like TURMOIL to flag suspicious communications; and TURBINE which routs communications to the NSA, where other algorithms decide which malware to deposit (via QUANTUM) on the source computer, in order that the potential threat can be monitored.

Snowden began to become indignant at the intelligence community's blatant flouting of the US Bill of Rights, particularly the fourth amendment protections against search and seizure and also the White House, the courts' and congress's complicity in this. He was particularly incensed when the US Supreme Court decided to wash their hands of the issues in February 2013, when the Court decided, 5-4, that the American Civil Liberties Union (ACLU) and their client, Amnesty International, did not have standing to challenge the constitutionality of the warrantless wiretapping program. (Substantively, the ACLU and Amnesty were challenging the Foreign Intelligence Surveillance Act Amendments Act 2008 (FISAA). FISAA is the law that makes the act of being a foreigner a sufficient reason to be a target of US law enforcement and intelligence services.)

He had, by then, decided to blow the whistle on the whole shebang. The ACLU case and embryonic mass surveillance enabling laws in the UK (the snoopers' charter which eventually got passed as the Investigatory Powers Act 2016) and Australia (multiple bills) only hardened that resolve.

Chapters 21 and 22 extol the virtues of whistleblowing and Snowden's perspective on the fourth estate but I'll leave the reader to peruse those for themselves.

Before he blew the whistle, however, he wanted one last job, not just administering or reading about mass surveillance tools but actually using them, particularly XKEYSCORE, the NSA's incredibly powerful intelligence search engine. A position opened up at the National Threat Operations Center (NTOC), one "of the few offices in Hawaii with truly unfettered access to XKEYSCORE", through Booz Allen Hamilton. Snowden secured it and so began his education in the coal face abuses of US intelligence systems. The shock was palpable.

"Seeing them made me realize how insulated my position at the systems level had been from the ground zero of immediate damage. I could only imagine the level of insulation of the agency's directorship or, for that matter, the US president."

Snowden had already smuggled the documents he intended to pass to journalists out of the NSA on SD and micro SD cards. The flight to Hong Kong and handing over of those documents to Laura Poitras, Glenn Greenwald and Ewen MacAskill, his escape, aided by Wikileaks's Sarah Harrison, to and entrapment in Russia when the US revoked his passport, has been well documented in the Guardian, the Washington Post and Poitras's documentary, CitizenFour.

The chapter on Moscow in the book is thin on detail and only outlines the discussions Snowden and Harrison had with an intelligence official on the day they arrived, noting also thereafter they spent 40 days and nights at the airport. During that time he applied, unsuccessfully, to 27 countries for political asylum. He concludes the chapter suggesting the Russians gave him asylum because they were fed up with the media scrum at the airport.

The penultimate chapter of the book details extracts from the diary of Snowden's partner, Lindsay Mills, in the aftermath of his disappearance to Hong Kong. She is a powerful presence and positive force in his life and it would have been nice to hear more from her. Mills and Snowden were married in Russia in 2017.

The final chapter is largely a whistlestop tour of the legacy of Snowden's revelations from his perspective - global awareness of mass surveillance, some positive legal developments like ACLU v Clapper in the US and the GDPR in the EU, some important developments in encryption like HTTPS, Secure Drop, Signal and generally more end to end encryption. But if we were concerned to avoid living in a surveillance society, it's too late, we're already there. State and commercial surveillance systems are more powerful and pervasive than ever and getting worse. They will require structural solutions - legal, technical, economic, environmental, individual & societal - pressures brought to bear to bring them under democratic control.

John Oliver, Privacy International & Ryan Gallagher on mass surveillance

In the light of The Intercept's latest story on the Snowden documents, could I recommend revisiting John Oliver on government surveillance plus his Snowden interview...



 ... and Privacy International's short videos on communications surveillance, big data, data protection, metadata and privacy

Ancilla Tilia dreams about talking to her granddaughter in the future

A gentle but powerful reminder from Ancilla Tilia that we don't appreciate freedom until it's gone and in the meantime refuse to notice it drip drip dripping away.


Ironically, given the subject matter, the video cuts out half way through demanding a full name and email address. Put in a dummy name and email to get it to continue.

The Clarkson crisis and mass surveillance

I will try and find some time to consider in detail and blog about the European Court of Justice decision imposing an obligation on Google to make an effort to respect what many are calling 'the right to be forgotten.'

Firstly though, on a parallel theme of our recorded digital pasts returning to haunt us, could I point you at an edited version of some thoughts I had on the recent crises Jeremy Clarkson found himself embroiled in, that the very good folks at The Conversation kindly published earlier this week. A more detailed edition of those thoughts resides below.

I see Jeremy Clarkson is in the soup again for saying the wrong thing. This time he's accused of using the reviled, offensive, racist N word, in a Top Gear out-take two years ago. The usual gang of anti-Clarksonites and more than a few others have lined up to demand the BBC fire him. Perhaps surprisingly members of the government and some in the media not otherwise known as Clarkson fans have offered him qualified support.

Elsewhere various sexists, racists, homophobes, hatemongers and other assorted flavours of humanity that dislike people not like them are attracting the attention of the news media and political opponents for being associated in some way with UKIP. The Prime Minister David Cameron has been condemned for saying recently Britain is a Christian country.

The thing is, respect for the principle of freedom of expression means letting people we disagree with speak. It means letting people who say offensive things speak. It means letting people who say nasty, unpleasant, unsavoury, distasteful, dreadful, objectionable, idiotic, mean, poisonous, hostile, malignant things speak.  It means letting people who mumble casual blokey racist comments, in ill-judged attempts at humour, speak.

Letting people speak doesn't mean we have to listen to them. It doesn't mean we have provide them with a platform to speak. It doesn't mean the media is obligated to draw attention to them. And it doesn't mean we have to laugh with them in a way that encourages casual blokey offensiveness.

I fully accept  Deborah Lipstadt's mantra that 'Reasoned dialogue has a limited ability to withstand an assault by the mythic power of falsehood' (p.25 Denying the Holocaust - a wonderful book btw). But when destructive speech does take hold we have to counteract it. We must be better at explaining, in widely accessible & persuasive ways, why hate speech is so harmful pernicious and noxious. And we must expose the falsehoods and malign intent and/or ignorance underlying it intelligently, accessibly, in a publicly appealing ways and preferably backed up with solid evidence.

The UK Human Rights Act makes the European  Convention on Human Rights part of UK law. Article 10 of the Convention says everyone has the right to freedom of expression. We have the legal right to freedom of expression in the UK. As a member of the EU, we also have the fundamental right to freedom of expression guaranteed by Article 11 of the Charter of Fundamental Rights of the EU.

To make life complicated, in the UK there are also criminal offences relating to offending or insulting someone, under a variety of statutes including s127 of the Communications Act 2003 and s4A and s5 of the Public Order Act 1986.

A number of social network users have found this out the hard way, most notably Paul Chambers of Twitter joke trial fame. Mr Chambers was convicted of sending, by a public electronic communication network, a message of a "menacing character" contrary to sections 127(1)(a) and (3) of the Communications Act 2003. He had joked on Twitter about blowing up Robin Hood airport after his flight to see his girlfriend got cancelled due to snow. He lost his job and another thereafter, subsequently found it difficult to get work and it took two and half years of legal wrangling and appeals before the High Court finally cleared his name.

The media, the public and public figures, we all love a good witch-hunt, as long as we are not the object of the hunt. Soundbite politics, the 24/7 news cycle and our world of short attention spans see words and phrases taken out of context and wielded as weapons to demonise and misrepresent opponents, shout insults past each other, blame and preferably punish someone. Public debate can't get past megaphone soundbites of the 'we're the goodies they're the baddies' variety.  This is an arena that is positively hostile to deep and informed engagement with any subject matter but a fertile place for mob rule.

Could any of us withstand the kind of scrutiny Mr Clarkson's misspoken offence, recognised at the time but resurrected two years later, or Mr Chamber's Twitter joke was subjected to? Well to be blunt we are going to have to.

Why?

Well for the best part of the past 25 years commercial entities have been recording, storing, processing and analysing everything we see and do on the world wide web, for how long, from where, with whom and with what equipment. Additionally telecommunications service providers, both fixed line and mobile, have been obliged for some time, under the 2006 EU data retention directive, to store details of and provide government access to everything everyone does on the telephone or internet; for a period of between 6 months and two years.

Invisible digital watchers follow and record everything we do on digital communications networks without our conscious knowledge or consent.

Article 5 of the 2006 directive specified the data that has been gathered by communications service providers throughout the EU. It covers names, addresses, who spoke to whom, where, when, for how long, on what device, how often, websites visited etc. etc. This all paints a very detailed picture and most people don’t know it has been going on. The who, where, why, how, what and when of individual lives is all there in this 'metadata.'

We've also discovered in the past year via the revelations of former NSA contractor, Edward Snowden, that governments, in particular the UK and US variety, have been going much further, watching and recording our networked lives in even more detail than previously realised. If we thought about it at all which most of us don't. Through clandestine programs like GCHQ's 'Tempora' and the NSA's 'PRISM' all telephone and internet traffic is being collected, processed and stored nominally for current or potential future use in the fight against terrorism or serious crime.

Anyone's complete online life history can be examined in forensic detail even though commerce and governments could not possibly examine everyone's life in detail. The UK intelligence services collect about 40 billion pieces of data per day, for example, and simply do not have the capacity to apply human intelligence to all of it.

Just one of the problems with these mass commercial and governmental silos of personal digital life histories is that small items taken out of context can constitute unexploded digital ordinance. Equivalent to the two year old misdemeanour of Jeremy Clarkson. Most of us don't have the public profile of Mr Clarkson or the interest of the public to anything like the same degree. But as Cardinal Richelieu is rumoured to have said about 500 years ago, "Give me six lines written by the most honest man and I'll show you the evidence to hang him."

Innocent ordinary people, not just celebrities of Mr Clarkson's ilk, have found themselves at the sharp end of media witch hunts.  And which of us knows what nefarious activities people connected to people connected to people connected to us via the internet might have engaged in at some time in that past or potentially in the future? I ask that particular question because the then deputy director of the NSA, Chris Inglis, testified before Congress, in July 2013, that you don't need to be a suspected bad guy to gain the attention of the intelligence services. The NSA track people "three hops" from their targets. If I had communicated with 200 people during my online lifetime I'd be three hops away from over 5 million people. Through my job at the Open University alone I've interacted directly with thousands of people over the past nineteen years. Three hops from thousands connects me to more than the entire population of the world.

I think it is fair to call this mass surreptitious collection of personal data mass surveillance.

Interestingly enough, in a historic decision, On 8 April 2014 the Grand Chamber of the Court of Justice of the European Union hinted at the same conclusion when they decided to invalidate the 2006 data retention directive discussed above. With what may be interpreted as half and eye on the Edward Snowden revelations, the Court, effectively condemned pre-emptive, suspicionless, warrantless mass surveillance and consequent "interference with the fundamental rights of practically the entire European population".

The case was the first major court decision on mass surveillance since the Snowden stories started to break in June 2013. Though high courts in Romania (2009), Germany (2010), Bulgaria (2010),  the Czech Republic (2011) and Cyprus (2011) had previously all declared the data retention directive unconstitutional and/or a disproportionate unjustified interference with the fundamental right to privacy, free speech and confidentiality of communications.

On 23 April 2014, the Slovak Constitutional Court, taking its lead from the Court of Justice, suspended of the Slovak implementation of the directive. The UK government, by contrast, has declared the UK data retention regulations remain in force despite the directive that requires them no longer being so. The Home Secretary, Theresa May, has stated elsewhere that the implications of the ECJ ruling were being assessed.  For the first time, on 9 May 2014, a UK parliamentary committee expressed concern at the oversight of the security and intelligence agencies in this context and asked for a prompt and clear resolution of the legal position on data retention.

The previous UK Labour government were one of the key driving forces behind the original implementation of the data retention directive. The current UK government is one of the biggest cheerleaders for and operators of mass surveillance standards and practices. Though the UK government was not involved directly in the case, (and are scrambling madly to find a way to circumvent the decision as, sadly, are the European Commission), both the current and the previous administrations' behaviour, in the data retention context, is considered so heinous in law that it should never have happened; and the laws facilitating that behaviour should never have existed.

Some commentators have also suggested the Court was firing a message not just to the UK but across the pond (2 min 40sec audio) to the effect that US mass surveillance standards are totally unacceptable in an EU context.

Now come full circle to the Clarkson furore. In their data retention decision, in passing (also known as 'obiter dicta'), the Court of Justice of the EU noted in paragraphs 27 and 28 of their decision the chilling effect of the knowledge that anything we say or do is being recorded and may be used against us -

"Those data, taken as a whole, may allow very precise conclusions to be drawn concerning the private lives of the persons whose data has been retained, such as the habits of everyday life, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them.

In such circumstances... it is not inconceivable that the retention of the data in question might have an effect on the use, by subscribers or registered users, of the means of communication covered by that directive and, consequently, on their exercise of the freedom of expression"

I don't find casual laddish racist remarks at all funny. I find them offensive. Just as I find casual blokey demonisation/marginalisation/ but more particularly intentional-vicious-insult-dismissal and incitement of hatred, directed at [minority group of choice], offensive. It causes division, discrimination and tension and undermines equality, human rights, decency and collective care.

But Mr Clarkson misspoke, by accident, 2 years ago, when doing a recording for a popular TV programme. The trademark of said programme is three middle aged men, acting like big kids, mucking about with cars, playing pranks and laddishly insulting each other and other people and things for laughs.

Mr Clarkson has apologised for using a word he personally loathes. The motives of those who leaked the recording are not known.

I have no idea whether Mr Clarkson is racist though I suspect not. Intended or not, ill-used words do cause damage but it is the presence or absence of hateful intent behind such remarks rather than the words used that define the mindset of the speaker.  We can't read minds so interpret that intent, by proxy, from people's words.

Nevertheless, I would ask that s/he who wish to throw metaphorical stones at Mr Clarkson, to think also of their own many stored and detailed digital dossiers and how fragments thereof might well, one day, be held against you. Especially if, like a certain Open University academic, you might have a 3 hop connection to the population of the world.

Intelligence Gathering and the Unowned Internet

The Berkman Center at Harvard has hosted a 90 minute discussion on  Intelligence Gathering and the Unowned Internet involving Yochai Benkler, Bruce Schneier and Jonathan Zittrain, Terry Fisher plus John DeLong and Anne Neuberger the latter two being from the National Security Agency.



The video is essential viewing and John Naughton's thoughts triggered by the discussion are also well worth a further 5 to 10 minutes of your time.

Cory Doctorow & Barton Gellman at SXSW

Cory Doctorow and Barton Gellman discussing Edward Snowden, secure communications, encryption tools so easy your boss can use them, privacy, the revealing nature of metadata and mass surveillance, at SXSW should be required viewing.

Snowden quizzes Putin about mass surveillance on Russian TV

Edward Snowden just got to quiz Russian president Vladimir Putin about whether Russia engages in mass surveillance...


Guess what? Major surprise. Putin said no they don't. They fight crime and terrorism not like the rich Americans by spying on everyone but by engaging in surveillance controlled by the rule of law.

Call me a skeptic but it's a little unlikely Mr Putin has not heard of SORM not to mention a variety of other unethical surveillance and intelligence practices.

It is disappointing Edward Snowden would get sucked into such a publicity stunt though I guess he would not have had a lot of choice in the matter.

Update: Edward Snowden has defended his decision to participate in the TV show with Putin. In fairness, he makes a good case.

UK media ignore Guardian's Pulitzer Prize

We learned last night that the Guardian and the Washington Post have shared the Pulitzer prize for public service for their stories, based on documents leaked by Edward Snowden, on the US and UK governments' mass surveillance practices.

The story of the award has topped the news agenda all over the world - NYT, LA Times, The Times of Israel, Le Monde. The Times of India, even Fox News offered grudging repect whilst not missing the chance to denigrate Snowden.

In the UK the accolade has been ignored by The Times, The Daily Telegraph and the Daily Mail, though it got coverage from the BBC, The Indpendent and the FT.

A reminder. perhaps, of the need, always, to be alert to the underlying agenda(/s), motives and values of the controlling mind(/s) of the organisations from which we source our news.

MP note on Don't Spy on US

My MP, Nicola Blackwood, tells me she has written to William Hague to draw his attention to the Don't Spy on Us campaign.

"Dear Mr Corrigan,

Many thanks for your email about the ‘Don’t Spy on Us’ campaign. I apologise for the delay in my response.

I certainly appreciate that is an issue you feel strongly about, and I have taken the time to read your submission to the Intelligence and Security Committee’s inquiry. I understand your position that there is no balance to be struck between the individual right to privacy and the collective right to security, as privacy and security are not opposites. As discussed in our previous correspondence, I do firmly believe that our intelligence agencies do vital work in tackling terrorism and international crime.

The various levels of checks and balances that exist to hold our security services to account cannot be overstated, and as previously discussed these include oversight mechanisms by  Secretaries of State, the Interception of Communications Commissioner and the Intelligence Services Commissioner, and through Parliament via the Intelligence and Security Committee. One further level of accountability here that I have not discussed with you previously and I feel is worth noting here, is the strict operation of GCHQ within the Regulation of Investigatory Powers Act (RIPA). The Office of Surveillance Commissioners analyse GCHQ’s activity in detail, and also some of the codes of practices that the agencies have in place to ensure their adherence to RIPA.

I know that you have previously been unsatisfied with the response you have received from the Minister on this issue, but I have written to the Secretary of State for Foreign and Commonwealth Affairs, the Rt Hon William Hague MP, to discuss this specific campaign and to ask for a response to the concerns you have raised below. I shall of course pass any response I receive on to you in the usual way.

I will certainly keep your views on this subject in mind when considering the issue again in the future, and of course I intend to follow any further developments on this carefully. I also look forward to further announcements on the progress of the Committee’s inquiry into privacy and security, I understand the next stage will be the provision of oral evidence.

Thank you again for taking the time to contact me on this.

Kind regards

Nicola"

 I've replied.

"Nicola,

Thanks for getting back to me and for taking the time to read my response to the ISC.

As before, I don’t dispute that our intelligence agencies do vital work in tackling terrorism and international crime. However, they will do that work more effectively under a targeted data preservation regime rather than a suspicionless mass surveillance regime. Rather ironically this is one area where government ministers’ mantra of getting more from less actually applies.

We do differ in our relative positions on the checks and balances on the security services. If these had been effective as you have come to believe we would not have evolved the mass surveillance measures now operated by the security and intelligence services. As for RIPA, it’s widely accepted now on all sides to be out of date. You can drive a coach and horses through the loopholes in the RIPA regulations and the intelligence services basically do.

Finally for now, thanks for taking the time to write to William Hague about the Don’t Spy on Us campaign.

Regards,

Ray

On the week of the World Wide Web's 25th anniversary, we've learned  How the NSA Plans to Infect “Millions” of Computers with Malware. A couple of weeks ago it was revealed that GCHQ have been collecting millions of Yahoo webcam images via their OpticNerve system.

The mass surveillance stories flowing from the Snowden revelations keep coming. These are fundamentally, as Cory Doctorow put it so eloquently in his Guardian article earlier this week, matters of public health and societal wellbeing because so much of what we do these days involves the internet. 

The Don't Spy on Us campaign believe -

"Our campaigning is having an impact. The main political parties are edging towards reform of surveillance laws. We can't take anything for granted though. We have to keep pressing for change."

I would add that we need to keep pressing for public understanding and engagement. Concern about mass surveillance is still very much a minority sport in the UK.

Submission to ISC Inquiry into Privacy and Security

I've sent a submission to the Intelligence and Security Committee's Inquiry into Privacy and Security. It was done in a hurry so hopefully is not too incoherent.

To the members of the Committee,

Thank you for the opportunity to make a submission to your inquiry into privacy and security.

My name is Ray Corrigan. I’m a Senior Lecturer in the Maths, Computing & Technology Faculty of The Open University though I write to you in a personal capacity.

Executive Summary

Privacy and security are not opposites but mutually dependent. It is essential the committee understand that the false privacy v security dichotomy that so often frames public debate seriously undermines policymakers’ and the public’s understanding of the issues at hand. The single most important airline security measure put in place following the terrible attacks on September 11^th 2001 was the reinforcement of cockpit doors. That had absolutely no impact on the personal privacy of travellers. The hugely expensive naked scanners installed at airports, however, take a terrible toll on personal privacy whilst being functionally worse than useless as a security measure (and the X-ray variety has been shown to pose a risk to health). A door lock or a strong high fence provides security without compromising privacy.

Massive data collection and mining compromise privacy and security. The NSA gave 850,000 people access to classified materials as a routine part of their jobs. Their systems are big and complex and require a lot of staff to operate but there can be no security when that number of people has access to secrets. 

There is no “balance” to be achieved between the “individual right to privacy and the collective right to security”. The collective right to security requires an individual and collective right to privacy. The value of protecting individual and collective privacy is that those rights make a fundamental contribution to the overall health of society. Framing privacy as the opposite of security assumes privacy is only about hiding bad things. That couldn’t be more wrong.

It is fundamentally incompatible with the rule of law to collect information about every member of the population in the hope of conducting post hoc fishing expeditions to look for evidence of misbehaviour. Could I remind the committee of the belief of Cardinal Richelieu that given 6 lines written by the most honest man he could show you the evidence to hang him. 

It is unnecessary and completely disproportionate, not to mention dangerously ineffective, “to collect innocent communications in order to find those who might threaten our security.” Finding a terrorist or serious criminal is a needle in a haystack problem – you can’t find the needle by throwing infinitely more needle-less electronic hay on the stack.  Law enforcement, intelligence and security services have to be able to move with the times. They need to use modern digital technologies intelligently in their work and through targeted data preservation regimes – not the mass surveillance regime they are currently operating – engage in technological surveillance of individuals about whom they have reasonable cause to harbour suspicion. That is not, however, the same as building an infrastructure of mass surveillance which, incidentally, in addition to being a clear and present danger to democracy, makes it mathematically impossible for dedicated intelligence services staff to do their job with any degree of effectiveness.

The committee should understand that computers are not magic. These machines do exactly what they are programmed to do not what you would like them to do.  I make this point specifically in light of the Prime Minister’s recent comments to the effect that the TV crime drama he likes so much justifies the mass data collection activities of the intelligence services. TV crime drama and Hollywood films generally are terrible guides to how computers actually work in practice.  The committee should additionally understand that there is no clear distinction to be made between communications data (or so called meta data) and communications content. If it is difficult to define the distinction from a social or legal perspective it is impossible to implement from the technical perspective.

a)      What balance should be struck between the individual right to privacy and the collective right to security?

How does this differ for internet communications when compared to other forms of

surveillance, such as closed-circuit television cameras? To what extent might it be

necessary and proportionate to monitor or collect innocent communications in order to find those which might threaten our security? How does the intrusion differ between data (the fact a call took place between two numbers) as opposed to content (what was said in the call)?

1. If the committee only takes one thing away from this submission let it be this –

       ·        Privacy and security are not opposites.

       ·        There is no balance to be struck between the individual right to privacy and the collective right to security.

2. Privacy has an image problem. It is constantly portrayed as out of date, costly, an obstacle to public safety and new and exciting forms of commerce and research. So if we pitch privacy against something as essential as national security, it is a no contest. What does it matter if we have to dispense with a little personal privacy for the guaranteed gain of being safer and more secure?

3. It matters because when you start with this fundamentally flawed premise and the committee’s flawed question, it leads you to the wrong answers.  The notion that privacy has to be sacrificed for security is wrong. More privacy does not mean less security any more than more security means less privacy. The associated (unspoken) idea that individual privacy is damaging to society is wrong. There’s no strict division between individuals and society. The welfare of both is inextricably interlinked. The fundamental right to privacy of the individual is one of the foundation stones of a healthy society. The value of protecting individual and collective privacy is incalculably important to the future of our information society.

4. The constant refrain about the need to balance privacy and security is quite simply wrong because it has a number of built in assumptions that are wrong.

5. It assumes that privacy and security are opposites which is false. A locked door and a tall strong fence provide security and facilitate privacy. A reinforced cockpit door – the most important airline security measure put in place since the atrocities of September 11^th 2001 – does nothing to compromise privacy.

6. It assumes that undermining privacy through the use of magic modern computer systems will improve security. This is false. Democracy and freedom requires privacy and security. That such mass surveillance will not work can be demonstrated mathematically.

7. The esteemed chairman of the ISC, Mr Rifkind, has stated in parliament (in the debate on oversight of intelligence & security services on 31^st October 2013) that

“Of the totality processed by computers, perhaps 0.01% will have selectors that the computer has been programmed to look for. The communications of the other 99.99%— covering virtually every citizen of this country, bar a very small number—are never even looked at by the computer, other than in relation to a selector, such as an e-mail address. Even for the tiny minority identified by the computers as potentially relevant to terrorism, if GCHQ, MI5 or MI6 want to read the content of any of the e-mails, they have to go to the Secretary of State for permission. Under the law, only if they are given permission can the content be read”

8. I'm going to do some very rough maths here in an attempt to explain the problem with Mr Rifkind’s point that only 0.01% of communications data is looked at.

9. 0.01% of 60 million people in the UK implicates 6000. Now the pattern flagging will be nowhere near as simple as that but just run with it as a crude estimate. We know from the deputy director of the NSA testifying before the House Judiciary Committee that you don't need to be a terrorist or have contact (deliberate or inadvertent) with a terrorist to be flagged as suspicious. The NSA (and presumably GCHQ?) is allowed to travel “three hops” from its targets – who could be people connected to people connected to people connected to you. 0.01% of the UK population or 6000 people are 2 degrees of separation from about 160,197,360 and 3 degrees of separation from over 26 billion others (about three and a half times the population of the world).

10. Even limiting suspicion to two hops, your 0.01% of data on UK residents, Mr Rifkind, implicates more than 2.6 times the entire UK population. So the question then becomes, given that we are all suspects, who decides which suspects the intelligence services' limited resources should be deployed to further investigate and pursue, once the computer algorithms have worked their magic? 

11. Every time the (theoretically 99.99% effective) magic terrorist catching system is asked for a suspect it implicates vastly more people than the security services could possibly investigate in any detail.

12. Mr Rifkind also rightly stated "Modern computers... are programmed to run using certain selectors". So who gets to program the computers and what are the specific 'selectors'/filters? Who decides what the selectors should be? Who decides who decides what the selectors should be? The chair of the ISC doesn't understand computers, so how can he effectively and his committee scrutinise the technical aspects of this work? How do you measure the efficacy of these filters given it is widely known in the tech community how ineffective electronic filters can be? How, when someone is tagged as suspicious via these secret algorithms, does the information on that individual then get further processed? What happens when someone is wrongly tagged and how do they retrieve their innocence and clean bill of electronic health? Are you aware of the nature of false negative results and false positive results?

13. In multiple media engagements the Prime Minister, the Home Secretary and other members of the government refer to "protecting the public" from the four horsemen of the infocalypse - terrorists, drug dealers, child abusers and organised crime - and more. The Prime Minister last week extolled the virtues of TV crime dramas as a guide to how electronic surveillance systems should be deployed in practice. TV crime drama and Hollywood films generally are terrible guides to how computers actually work in practice. 

14. Mathematically the four horsemen are not problems that lend themselves to mass data mining. Even highly accurate (to 99.99% and by the way no current system comes close to that) data mining systems will swamp investigators with false positives when dealing with a large population. Law enforcement authorities end up investigating and alienating large numbers of innocent people. That’s no good for the innocents, for the investigators or for society.

15. There is an oft repeated the myth that the 9/11 attacks would have been prevented if only the US intelligence and security services had known where Mohamed Atta was when he had made a phone call to a terrorist suspect in Syria. The assumption is the magic terrorist catching mass data collection and analysis apparatus now run by the NSA would have pinpointed his location and led to his arrest.

16. Wrong.

17. Atta was known to the intelligence and security services and considered a threat. Police, intelligence and security systems are imperfect. Even in 2001 they processed vast amounts of imperfect intelligence information. At least one FBI agent believed Atta to pose a serious and imminent threat. That belief got lost in the noise of the intelligence information processes, suspects and issues the agencies were then dealing with, to the degree that they did not detain Atta or his associates and prevent the attack.

18. There was too much data noise in the system and they lost him. You cannot cure that excess of data noise problem by treating the entire population as suspects, engaging in suspicionless, blanket collection and processing of personal data. You cannot find the real terrorist by assuming everyone is a threat.

19. Mass data collectors can dig deeply into the digital persona of anyone but don’t have the resources to do so with everyone. The resultant pursuit of false positive leads mean the real bad guys often get lost in the noise, as happened with the 9/11 attackers including Atta who were known to US authorities but not considered sufficiently important to intercept.

20. Finding the four horsemen is a needle in a haystack problem and you can’t find the needle by throwing infinitely more needle-free hay on your stack and/or creating multiple giant and exponentially growing data haystacks.

21. Operating multiple massive databases of intimate personal communications data makes the public more vulnerable to the four horsemen not less so.

22. That such mass databases are useless for finding terrorists is clear from the maths and the evidence. The NSA has admitted in spite of previous claims that their mass data collection and analysis stopped 54 major terror attacks since 9/11 it didn't really stop any, but may possibly have provided secondary supportive evidence in relation to one. The most recent argument they used to support the deployment of such systems is mass data collection might be useful as an "insurance policy". An insurance policy?! The infrastructure of mass surveillance might be useful in the future, somehow, to someone?

23. That such systems also make the public less safe is associated with the impossibility of securing mass silos of valuable personal data. Computer scientists simply do not know how to keep databases of the magnitude of those used by the NSA and GCHQ secure from external hackers or the multitude of insiders who have access to these databases as a routine part of their jobs (850,000 including Edward Snowden in the case of the NSA).  Security experts like Ross Anderson, Bruce Schneier, Edward Felten and Peter Sommer have written extensively about this.  To understand this you have to think about how such systems can fail - how they fail naturally, through technical problems and errors (a universal problem with computers), and how they can be made to fail by attackers (insiders and outsiders) with malign intentions e.g. the four horsemen. When the inevitable hacks, leaks, data contaminations happen, what then?

24. In its most insidious form the misleading privacy v security question is phrased as a statement along the lines “the innocent have nothing to hide”. This assumes two underlying falsehoods – firstly that privacy is only about hiding bad things and secondly that decimating privacy will solve the problem du jour. I hope I’ve demonstrated clearly to the committee that both these assumptions are wrong and that in answer to your questions –

      ·       There is no balance to be struck between the individual right to privacy and the collective right to security

·        It is neither necessary nor proportionate nor is it effective to engage in blanket monitoring or collection of  innocent communications in an attempt to find those who might threaten our security

25. On the question of whether the intrusion differs between data and content I would refer you to Peter Sommer’s writings and analysis e.g. analysis (sic) at

http://scramblingforsafety.org/2012/sf2012_sommer_commsdata_content.pdf

And his evidence before the select committee on the Communications Data Bill.

b) Whether the legal framework which governs the security and intelligence agencies’ access to the content of private communications is ‘fit for purpose’, given the developments in information technology since they were enacted.

26. The notion that the day to day activity of every citizen should be recorded in the expectation that those records can, in future, be mined for nefarious activity is anathema to a healthy functioning liberal democracy. Yochai Benkler in a recent Guardian article (http://www.theguardian.com/commentisfree/2013/oct/16/nsa-fbi-endrun-weak-oversight) put it more eloquently than I could:

     “Mass surveillance represents a commitment to near-universal all-seeing gaze, so as to assess and respond to threats that can arise anywhere, at any time. Privacy as a check on government power represents a constitutional judgment that a limited government must have limited power to inspect our daily lives, and that an omniscient government is too powerful for mere rules to restrain. The experience of the past decade confirms this incompatibility...

    Technology has enabled government to have investigative and situational awareness on a scale and scope that were science fiction when the Stasi shut its doors. The "state of emergency" mindset necessary to justify the program in the first place drives those charged with assuring the safety of Americans to always use this technology to its full potential; it also gives them an independent source of legitimacy for their actions – the fierce urgency of necessity.

    Their mission clashes with the fundamental premise of privacy as a civil right: that state power is best contained by making the overwhelming majority of what goes on in society invisible to the state. As Justice Alito put it in the supreme court's decision to strike down GPS tracking:

        [Historically] the greatest protections of privacy were neither constitutional nor statutory, but practical.

    Once the state knows about behaviour, it is hard to rely on rules alone to bear the full burden of preventing overreach by those who wield its awesome power...

    Rules alone cannot hold back the millions of potential abuses of an omniscient state.

    As long as government is allowed to collect all internet data, the perceived exigency will drive honest civil servants to reach more broadly and deeply into our networked lives.”

 

c) Proposals for specific changes to specific parts of legislation governing the collection, monitoring and interception of private communications.

27. As Jemina Stafford QC made clear in a formal opinion for a parliamentary committee last week, (http://www.tom-watson.co.uk/wp-content/uploads/2014/01/APPG-Final.pdf) the current mass data collection activities of sections of the UK government already undermine the right to privacy guaranteed in the Human Rights Act and article 8 of the European Convention on Human Rights. It is clear that the Regulation of Investigatory Powers Act does require an update but I don’t have any specific proposals to put before the committee at this stage.

28. However, I do have a general proposal that suspicion should be the test for surveillance.

29. The government of course has the right to intercept and record information when someone is suspected of a serious crime. But current operation [sic] appear to involve collection of data without suspicion: which is in effect mass surveillance. Due process, since the 1765 case of Entick v Carrington, requires that surveillance of a real suspected criminal be based on much more than general, loose, and vague allegations, or on suspicion, surmise, or vague guesses. To operate the mass date [sic] collection and analysis systems GCHQ has been reported as doing which give the entire population less protection than a hitherto genuine suspected criminal, based on a standard of reasonable suspicion, is indefensible. The gathering of mass data to facilitate future unspecified fishing expeditions is indefensible in law.

30. I appreciate the ISC and a multitude of highly dedicated public officials are grappling with really complex issues here. But it is critically important that you understand –

·        Privacy and security are not opposites.

·        There is no balance to be struck between the individual right to privacy and the collective right to security.

·        Computers are not magic and never will be

·        Mass data collection and analysis is mathematically provable to be unfit for the purpose of hunting the four horsemen of the infocalypse

31. It is also hugely important that you be provided with the resources and expertise required to fulfil the immensely demanding duties required of the committee.

32. I'd leave you with one final thought. Nearly 250 years ago, Lord Chief Justice Camden decided that government agents are not allowed to break your door down and ransack your house and papers in an effort to find some evidence to incriminate you (the case of Entick v Carrington (1765) 19 Howell’s State Trials 1029, 2 Wils 275, 95 ER 807, Court of Common Pleas).

33. The good judge also declared personal papers to be one’s “dearest property”. I suspect he might view personal data likewise in the internet age. I understand Lord Camden's reasoning in Entick became the inspiration behind the 4th Amendment to the US Constitution which offers protection from unreasonable searches and seizures. For a quarter of a millennium, fishing expeditions of the type that the GCHQ and NSA are engaged in have been considered to fundamentally undermine the rule of law. It's time Parliament brought these modern practices into line with that rule of law.

 Update: I neglected to number the paragraphs in my submission on Friday. Now rectified and amended above.