Thoughts on Eric King interview with Bill Binney & SIA bureaucracies

Eric King, Director of Don't Spy on Us and Deputy Director of Privacy International, recently interviewed former Technical Director at the NSA, Bill Binney, following the latter's testimony before the Joint Committee on the Draft Investigatory Powers Bill.

The interview is available in 3 parts on YouTube and embedded below.







Binney is very clear in his belief that mass surveillance costs lives. He is also clear on the need for targeted, judicially supervised, necessary and proportionate surveillance.

The thing that strikes you about Binney and other life long intelligence careerists turned whistleblowers like Thomas Drake, is the absolute commitment they had to their craft, preserving, protecting and defending the US Constitution. Binney spent over 30 years with the NSA. Drake had a long career in military intelligence, the CIA, private contractor intelligence and finally the NSA.

Now there are discussions to be had about the activities, efficacy and adherence to constitutional, ethical and/or other nominal constraints of their respective employers during their careers. Both men, however, believed themselves to be working for institutions concerned fundamentally with operating within and protecting the Constitution.

We know that large organisations are subject to regime change. Regime change can and repeatedly does put even the core structural principles and values of any institution in jeopardy. Institutional memory fades and anything can be sacrificed to the agenda of the realpolitik of the new crew at top table.

Binney and Drake will have seen many internal organisational regime changes during their lives. They absorbed the associated slings and arrows and, it seems, for most of that period maintained the capacity to do their jobs to their own satisfaction. Around the turn of the century, though and after the 9/11 attacks, that changed. Both consider the power brokers within the NSA and other agencies took advantage of the times to throw off any and all historic constitutional leashes and committed their agencies wholesale to mass surveillance.

Admiral Poindexter, as the Director of the Defense Advanced Research Projects Agency (DARPA) Information Awareness Office (IAO), brought his Total Information Awareness programme to Congress where even the congress-critters eventually rejected it. Yet the intelligence agencies went ahead and essentially built and operated the infrastructure of mass surveillance in secret anyway.

When the NSA, both considered, ditched the Constitution and engaged in waste, fraud and crime on an industrial scale, to a degree neither could stomach any longer, Binney retired in 2001 and Drake resigned in 2008. Drake went on record in 2011 to suggest the agencies' activities had outstripped the criminality of former president Richard Nixon.  Both were subsequently pursued by federal authorities with criminal investigations relating to their whistleblowing. Binney wasn't charged but Drake faced a long stretch in prison before all the serious charges against him were finally dropped in 2011.

When asked why the agencies and the UK's GCHQ insist that bulk collection of communications data is so essential to their operations, Binney has a simple answer - power, control and money. Eric King puts to him that the military industrial complex is perhaps not so well established in the UK as the US, so it seems reasonable to ask why GCHQ would be so insistent about the importance of their continuance of bulk communications data collection and retention for target development.

Without bulk collection, the argument goes, they can't find new threats. Binney insists this is "absolutely false." They never start with an empty slate. If they take a targeted approach instead, they can define rules of association round social networks and associated zones of suspicion.

General Alexander of the NSA said we want to "collect it all". So he commits the agencies to gathering more and more data every year and therefore the government to the non-audited and unlimited ongoing funding of same. It means an ever increasing budget for any agency involved in such activities, including for GCHQ. So that, asserts Binney, is their motive for mass surveillance.

It's hard to believe any ethical institution would behave in a way - e.g. using mass instead of targeted surveillance - that jeopardises its core functions - e.g. preventing terrorist attacks - and instead devote its energies to protecting and growing the institution.

Yet you don't need to be an expert in management or organisational behaviour, in the writings of Geoffrey Vickers, Russell Ackoff or other systems experts, to know that this is exactly how both public and private sector bureaucracies do behave.

The driving forces in the DNA of every bureaucracy are the twin desires for survival and growth.

When you divide complex, deeply interconnected and interdependent public service systems up into competing quasi-autonomous silos - some bigger and more glamorous than others - and then instruct the leaders of those silos they will be evaluated on the basis of single figure simplistic targets or metrics - e.g. A&E waiting times or police response times - you cannot be surprised when the silos focus on those metrics at the expense of everything else; including the effective operation of the individual silo.

Some bureaucracies are prepared to shrink temporarily if that's what it takes to survive. An IT department, under scrutiny, can cut a third of its employees, thereby cutting nominal costs. But if simultaneously cuts 90% of the services it used to provide to the institution and declines to deal with complex problems because they undermine their "success rate", then the rest of the institution suffers. The IT department might "fix" most of the 10% of simple problems they are prepared to deal with, apparently faster and cheaper than ever before, but the real costs are absorbed by everyone else.

The intelligence agencies are a special kind of bureaucracy, not subject to the same level of scrutiny as other government agencies; and sometimes with a shared interest, with political overseers, in expanding the perceived level of threat. Home Secretaries don't get headlines by claiming all is calm, all is bright. And intelligence agencies don't get money for SIGINT, HUMINT and other activities, effective or not, by reporting we live in the safest era in the history of the west.

There is a lot of political kudos and media exposure to be gained from spreading fear and declaring toughness in the face of it. There is a lot of political kudos in being seen to be "doing something" involving spending a lot of money on security services. It would be naive to think that senior career bureaucrats in the security and intelligence agencies would not be inclined to take advantage of that psychology.

Time and again in the wake of terrorist attacks since and including 9/11, Madrid, 7/7, the murder of Lee Rigby and attacks in Paris last year, we learn of intelligence failures relating to known suspects getting lost in the morass of data and limited front line resources of the agencies. Time and again the "answer" is more extensive powers and more expansive investment in more mass communications surveillance. As Binney says, the agencies have been engaged in mass surveillance since 9/11 and it doesn't work.

In the case of GCHQ, I'm not sure I entirely accept his critique of their motivation being all about power, control and money. But I can see how they would be caught in the perennial affliction of bureaucracies through the ages, relating to survival and growth.

The current Home Secretary is absolutely determined to get the Investigatory Powers Bill on the statute books, thereby codifying most of the SIAs' ongoing communications surveillance activities into law. It would, therefore, be uncharacteristically remiss of the suits in the agencies not to take advantage of the prevailing political winds, to maximise their current and future survival and growth capital. Whether the Investigatory Powers Act, as it will become, will enhance their capability to counter threats to national security is another question entirely, one Mr Binney would presumably answer in the negative.

It does beg the further question, though, what is a 20, 30 or more years career veteran of a hugely valued public service institution to do, when said institution rejects and ejects the fundamental values and principles which underpinned its operations from inception?

Binney and Drake resigned and went public, at significant personal cost. Martin Luther King Jr might have approved, as he noted -

"Our lives begin to end the day we become silent about things that matter"

So, whether you stay and fight for what's important, lay low until you can tap the next regime change for a re-establishment of the foundational values (though when bad institutional behaviour becomes normalised it is notoriously difficult to change) or accept the institution is irrevocably damaged and depart for more productive shores, don't be silent.

What were you doing when they were building the surveillance society?

At the behest of my friend and colleague at the Open University, Mike Richards, I penned a piece towards the end of last year in connection with our introduction to cyber security mooc. I realise it is now up on OpenLearn. Copy below.

In the 1600s the founders of New England meticulously laid out their towns so that the relationship of buildings to each other and the town square allowed the Puritan inhabitants to keep a close eye on each other. For practising Puritans, at that time, allowing friends, family and the rest of the community to pry into their private lives was routine. Good behaviour in private was considered to be essential for societal wellbeing. However, that good behaviour would only be forthcoming if people watched each other closely.

This practice was brought into the internet age by a company called NetAccountability in 2002. They enabled people to sign up to have a morally upstanding friend or family member monitor their web surfing habits. The monitor then received regular comprehensive reports of the websites that person visited. There are a multitude of such services today.

In 1791, English philosopher Jeremy Bentham came up with the idea of an “ideal prison” built with a central tower from which watchers could see into every cell but the cell-bound could not see into the tower. Prisoners could never know exactly when they were being watched, would have to assume they were under constant surveillance and moderate their behaviour to avoid severe punishment. Bentham called his design a panopticon.

After the Berlin wall came down, the Stasi were found to have more than 6 million files on East German citizens, more than a third of the population. The German Democratic Republic panopticon, could not, however, when it comes to surveillance, hold a candle to modern practices of the governments of the US and the UK.

The internet, lauded in the 1990s as the force that would free humanity, has been turned into the world’s panopticon, an apparatus of mass surveillance the like of which the world has never known. Thanks to NSA whistleblower, Edward Snowden, we know that the UK and US governments sweep up communications data on an unimaginable scale, not on just a third of their citizens, but their whole populations – and the rest of the connected world.

Now I don’t know about you but I find the thought of permanently being watched oppressive, intrusive and disturbing. 1600s New England, Bentham’s panopticon, the GDR or communities that require me to sign up to constant close monitoring to protect my soul are not places that appeal to me in the slightest. However, as a result of the evolution of technologies and the war on terrorism, the Internet has become a world of incomprehensible surveillance.

Snowden has disclosed that the US National Security Agency (NSA) specifically targets the communications of everyone, ingesting, collecting, filtering, measuring and storing everything by default. The NSA’s counterpart in the UK, the Government Communications Headquarters (GCHQ) has developed a programme called Tempora; a hard wired intercept of the international communications cables entering and leaving the UK. Tempora is capable of collecting all communications content and “metadata” that pass across the UK. The metadata is the details of who is in contact with whom, what devices they are using, when and from where they are communicating, for how long, what websites are visited, searched, clicked etc.

Documents leaked by Snowden indicate data that several years ago GCHQ had the capability to collect 21 petabytes of data every 24 hours. That is equivalent to about 200 times the contents of the entire British Library, every single day. The technology (better) and economics (cheaper) of digital storage mean that their capacity is undoubtedly far greater today.

Yet the thing about the internet is we don’t notice we’re being watched. Sure we know about things called “cookies” tracking us – because of those irritating EU-mandated warnings that pop up on websites – even if we don’t know exactly what cookies are; and to a degree we know our browsing habits allow advertisers to specifically identify each and every one of us for targeted advertising.

But we don’t think about it too much… and when we do we console ourselves with thoughts such as “the government are only interested in terrorists and drug dealers and child abusers and organised criminal gangs – the four horsemen of the infocalypse – not us… and they know what they are doing… and they are the good guys… and most of us most of the time are not conscious of any intrusion… and we’ve got nothing to hide anyway….”

The trouble with the seductive “the innocent have nothing to hide” meme, wielded so freely by politicians and the press so intent on stripping away our privacy, is that is dangerous and wrong.

It is underpinned by two hidden and completely false assumptions.

1.      Privacy is only about bad people hiding bad things, so only bad people want privacy.

Wrong. The need for privacy is a fundamental part of the human condition.

2.      Sacrificing privacy will solve complex problems like terrorism.  

But here’s a news flash from a former senior executive of the NSA, decorated US Air Force and Navy veteran, and whistleblower, Thomas Drake – mass surveillance doesn’t work.

We know it doesn’t work because in 13 years of mass surveillance following the 9/11 attacks neither the US nor the UK governments have been able to produce a single example of where it has worked that can withstand robust independent scrutiny. The US has claimed 54 attacks have been thwarted. All these have been rebutted by experts. The UK claims at least two major terrorist attacks every year since 9/11 have been stopped by mass surveillance. No specifics - we just have to trust them on that. Any plots that have come to light in the media have, when examined, been uncovered through conventional targeted intelligence and policing.

You see, finding the four horsemen is a needle in a haystack problem. There may (or indeed may not) be a crime-related communication in today’s 21 petabytes of data, but it is in amongst a colossal amount of completely innocent information. It doesn’t become easier to find the needle by throwing infinitely more needle-free hay on your stack and/or creating multiple giant and exponentially growing data haystacks.

Mass data collectors can dig deeply into the digital persona of anyone but don’t have the resources to do so with everyone. The resultant pursuit of false positive leads mean the real bad guys often get lost in the noise, as happened with the perpetrators of the 9/11 attacks who were known to US authorities but not considered sufficiently important to intercept. Even then, in a time of significantly more limited and targeted surveillance, the intelligence and security services were so inundated with data that the attackers evaded their grasp.

Despite of all of this the Snowden revelations have raised little more than a collective “meh”, in the parlance of my teenagers, amongst the majority of people in the UK. Even when it was revealed that GCHQ were running a system called Optic Nerve, secretly collecting private images from nearly 2 million Yahoo! webcam accounts, - including those of children - general public apathy prevailed.

Security and privacy professionals used to joke about the government wanting to put a camera in everyone’s bedroom – it couldn’t possibly happen – now they’ve done it and we apparently don’t care.

Why is that?

Well I suspect part of the answer is related to Stanley Cohen’s theory that when we as individuals, groups, communities, societies, governments, learn about monumentally appalling things, we go into a state of denial about it. It is too complex/difficult/terrible to comprehend or cope with, so we put it to one side and don’t think about it. In that state we can readily take on board assurances of the powerful to trust them and they will protect us.

And we have the additional bonus that the internet and our gadgets connecting us to it are so attractive, gratifying, responsive, entertaining, accessible, convenient, and educational even – our very own Huxleian soma, the drug that makes us feel better.

More importantly why should we care?

We should care because invasion of privacy is an ecological problem. When I give up a little bit of my privacy I’m polluting the lives of everyone I’m connected to and everyone they are connected to. The NSA deputy director testified to Congress that they look at anyone ‘3 hops’ removed from their targets.  You don’t have to have done anything wrong, just be connected to someone connected to someone connected to someone that falls under suspicion. Then, according to Snowden, the NSA or GCHQ uses their giant personal data haystacks to time travel through a comprehensive record of your digital history and scrutinize everything with a view to deriving suspicion from an innocent life.

And in a way it is not even that concerns me the most.

A lot of this mass surveillance activity is done by good people with the best of intentions but when you build the infrastructure of a surveillance state you cannot guarantee that it is – given the revelations of Edward Snowden and Thomas Drake – or will permanently remain under the control of the good guys. Nor can you guarantee it won’t be exploited by the very horsemen of the infocalypse it was nominally constructed to counteract. Mass valuable personal data databases are irresistible targets for the horsemen. Security backdoors built into standard computer architecture for intelligence purposes quickly become available to nefarious actors too.

The thing that worries me the most, though, is the legacy we are leaving for future generations and the question my kids and possibly their kids will be asking me in 20 years.

“Dad/granddad, what the hell did you think you were you doing when they were building the surveillance society?”

Mass surveillance is incredibly socially destructive and yet we don't seem to care enough to do anything about it.