A more accurate title for this post might be Caspar Bowden's evidence to the European Parliament LIBE hearing on mass surveillance Pt2, since that's the focus. (
Pt1 is here) The 63 minute video of Caspar's statement and subsequent Q&A is now
available in full on YouTube courtesy of
Henrik Alexandersson.
Moving to section 2.2.5 of his report on
The
US National Security Agency (NSA)surveillance programmes (PRISM) and
Foreign Intelligence Surveillance Act (FISA) activities and their impact
on EU citizens' fundamental rights, Caspar notes that the collection of foreign intelligence information under the PRISM programme is based on the
Patriot Act s215 power. This power is subject to originally classified “minimization” and “targeting” procedures, which were
published in full by the Guardian on 20 June this year. These procedures provide no limitations or protections whatsoever for non US nationals. As the report says,
One therefore suspects that
US
operational practice places no limitations on exploiting or intruding a non
-
US
person's privacy, if the broad definitions of
foreign intelligence information
are
met.
Moreover in a May 2012 letter to the Congress intelligence review committees the
government states that:
Because NSA has already made a “foreignness” determination for these selectors·in
accordance with its FISC
-
approved targeting procedures, FBI's targeting role differs
from that of NSA. FBI is not
required to second
-
guess NSA's targeting
determinations...
The versions of the targeting procedures released are generic, but the
American Civil
Liberties Union
(ACLU) obtained redacted copies of slides related to FBI staff training that
referred specifically to FISAAA for counter-terrorism purposes. The letter continues:
Once acquired, all communications are routed to NSA. NSA also can designate the
communications from specified selectors acquired through PRISM collection to be
"dual
-
routed''
to other intelligence Community elements.
(emphasis added)
(Note FISAAA is the Foreign Intelligence Surveillance Act Amendments Act 2008. s1881 of FISAAA was incorporated into the Foreign Intelligence Surveillance Act as s702)
If data flowing to the NSA is adjudged to be 50% likely to be associated with foreigners, it is fair game. (The "targeting procedures" say analysts may only proceed to use data under the FISA s702 power if there is more than a 50% likelihood the target is not American and located outside the US). All of this data, i.e. data not filtered out as American only, is then available to the CIA, amongst others, of the sixteen US intelligence community agencies.
We don't know the scope of intelligence agency data Edward Snowden had access to but it is unlikely he access to all of the intelligence agencies compartmentalised information exploitation guidelines. It is highly significant, however, that each of these agencies can have their own copies of the 50% non American data flowing from the NSA electronic fire hose.
Meanwhile on the EU side of the pond our general approach to data protection and control of data flows to the US exhibits all the features of EU regulators being asleep at the wheel (section 2.3). That's the case whether we are talking about the EU-US "safe harbour" provisions, Binding Corporate Rules (BCRs) for processors or cloud computing. One of the central issues in the whole
report is that there are enormous loopholes in these supposed privacy safeguards for EU citizens. Caspar accused EU Commission officials of knowingly or unknowingly permitting or designing these loopholes into the text of the regulations. Get out clause typically include terms like "national security" (that old catch all) and "a legally binding request" and give US government and commerce a blanket licence to collect, process, store, copy and analyse any and all EU data they can get their hands on. "A legally binding request", for example, will include the all encompassing "foreign intelligence information" net which in turn includes any data of assistance to US foreign policy, not least expressly political surveillance over ordinary lawful democratic
activity of citizens of EU countries.
Caspar strongly suggests it is the duty of the
LIBE committee to investigate the 10 years or more incompetence and/or complicity of the Commission in creating instruments supposed/believed/claimed to protect the privacy of EU citizens but in practice undermining it. He wants Commission papers thoroughly scoured to analyse who made the key decisions, whether they were made in good faith and was it bungling, ineptitude or complicity that led to the prevailing state of affairs where EU privacy is wide open to US abuse. He reckons he delves into this criticism a bit more with less restraint in the report. Whilst it's true he does go into more detail there, I'm not sure he is quite so blunt about the failure of the Commission in their duty of care to protect privacy of the citizens they are supposed to represent.
He then moves onto the recommendations. In the summer of 2013 it became know that the EU Commission had dropped provisions in proposed new data protection regulations that would block the kind of data hoovering that the NSA are doing. The deletion of what would have been article 42 of the regulations was
reportedly due to diplomatic pressure coming from the US government. (This is also covered in section 3.2 of the
report). You can read article 42 in a
draft version of the regulations leaked towards the end of 2011 (p69). Caspar makes his recommendations conscious of the fact that there is talk of re-instating article 42. But as things stand now, EU citizens are placing their data in jeopardy by using US services and websites.
The 1995 data protection directive 95/46 already requires that the basis of processing is consent and that must be informed consent - informed of all relevant risks. Under directive 95/46 EU citizens should be informed of the fact that if they use a US web server their data is going to be subject to political surveillance by the US intelligence communities. So he recommends:
-
Prominent notices should be displayed by every US web site offering services in the
EU to inform
consent to collect data from EU citizens. The users should be made
aware that the data may be subject to surveillance (under FISA 702) by the US
government for any purpose which furthers US foreign policy. A consent
requirement will raise EU citizen awareness...
-
Since the other main mechanisms for data export (model contracts, Safe Harbour)
are not protective against FISA or PATRIOT, they should be revoked and re-negotiated...
There simply is no case for allowing data transfers from the EU to the US under model contracts or safe harbour. He recognises disengaging these is a very serious matter and that it will have to be done in a phased and strategic way but it must be done. In addition, thinking strategically,
-
A full industrial policy for development of an autonomous European Cloud computing
capacity based on free/open
-
source software should be supported. Such a policy
would reduce US control over the high end of the Cloud e-commerce value chain
and EU online advertising markets. Currently European data is exposed to
commercial manipulation, foreign intelligence surveillance and industrial espionage.
Investments in a European Cloud will bring economic benefits as well as providing
the foundation for durable data sovereignty.
In relation to this EU cloud infrastructure, when the forthcoming report on Sigint (signals intelligence) in the EU gets published some member states may find themselves in a problematic position. Cryptically, Caspar then said he would say no more about that.
On the potential re-instatement of article 42 in the new data protection regulations (section 3.2 of the report) he is of the opinion that it does not go far enough. The CEO of Yahoo! recently said she could have been jailed for 10 years if she'd said more about government coercion under s702 powers. Depending on how and who interprets the law the penalty could be up to 30 years in jail or conceivably even the death penalty. The latter is unlikely but is part of US law.
By comparison Article 42 would create a conflict of law where the penalty on the EU side is a 2% fine. From Caspar's experience of working for Microsoft this is not going to work. Tiny proportionate penalties in the EU compared to more severe punishment in the US means the data controllers & processors will always take the smaller risk in the EU and comply with US government coercion.
So a re-instated Article 42 should make non compliance at the very least a serious criminal offence.
At the moment the way article 42 is structured there is complete discretion for member states to set penalties. This won't work. Also the imposition of fines won't work. The biggest fine the EU has ever dished out was $1 billion relating to Microsoft's anti-competitive practices in local area networks. Microsoft's profits over the 10 year operation of that monopoly were about $20 billion and that's a conservative estimate. The Microsoft lawyer who "lost" the case got promoted. A fine level of 20% of global revenue may be needed to persuade such corporations to take Article 42 compliance seriously. That might sound extraordinary but such large economic actors actually factor $1 billion fines into their corporate strategies as acceptable write-offs/losses.
The final point he wanted to emphasise before taking questions was in relation to BULLRUN, the NSA project to subvert cryptographic security -
Even after BULLRUN, cryptography is probably intact in theory, however it is not
known which encryption implementations and products may have been rendered
insecure.
Therefore consideration should be given
to extending the scope of
'Art.42' also to cover vendors of systems/products (as well as
Controllers/Processors) in EU markets.
Existing encryption security product
accreditations, especially if influenced by NSA or GCHQ, must be regarded as
suspect.
So if vendors of security products are coerced by the NSA to build back doors into their systems, even if they are not processing personal data, there should be a requirement for them to tell the EU about the backdoor. This would create a further conflict of law and further jeopardy and penalties for those companies that choose to comply with US rather than EU law. Again the sanctions have to be proportionately as severe or more so for non compliance as they would be in the US.
At that point he opened the session to the floor for a Q&A which ran for a further 40 minutes or so. Well done Mr Bowden on an impressive performance.
The Brazilian President, H.E. Dilma Rousseff, lambasted the US mass surveillance practices with her
opening speech at the UN General Assembly in New York on Tuesday, September 24, 2013, just as President Obama was due to step on the same platform in her wake. That same day the EU Parliament held this whole day hearing criticising the US for those same practices (full videos of the
morning and
afternoon sessions are available via the Parliament website).
A day to remember for privacy advocates. Will it also prove to be a small step forward in reigning in the excesses of the digital surveillance state or just get lost in the noise of history and our mass electronic data addicted society?
Lucian,
Whilst agreeing with your broad theme – on disproportionate societal fear, the consequent attraction of simplistic paternalistic securocratic governance and our undermining of fundamental liberties through e.g. trading privacy for convenience with modern communications technologies – I don’t completely subscribe to the notion that the biggest threat to liberty is ourselves.
At the moment a bigger issue is that the interests of the state and corporate establishments happen to be aligned in relation to big data. The collection and processing of personal data is [wrongly] perceived to be a silver bullet route to solving a range of political issues in the case of the state (e.g. terrorism as you mention) and to financial success in the markets in the case of the private sector. Simplistic and ill-informed though these mindsets are – computers do not magically solve complex political, social, economic, environmental, security or market problems just by chucking money at them or by making them bigger/faster or capable of collecting & processing more data – they fundamentally undermine privacy/liberty interests of the individual.
Whilst the state is subject to significantly tighter formal checks and balances than the private sector in relation to mass surveillance – the rule of law theoretically precludes the engagement in indiscriminate fishing expeditions in the hope of finding smoking gun evidence – the arguments rolled out by politicians, under the pressure of the modern 24/7 news cycle, relay a persuasive if misleading message to the contrary on preferred policy. We can, it is said, have liberty OR security; security OR privacy; or in more subtle form, we have to BALANCE privacy and security. This is a false dichotomy. As you rightly point out, security and liberty are mutually dependant not opposing forces.
Additionally we have the powerful but false and, frankly, poisonous ‘nothing to hide, nothing to fear’ meme repeated by William Hague and others in response to the PRISM revelations recently. When you cast the apparently small privacy need of the individual against the national security gain of the state which will seemingly benefit society as a whole, it is impossible to argue the needs of the individual outweigh the common good.
The ‘nothing to hide…’ argument, however, is based on two huge and erroneous foundations.
The first is that it assumes all privacy is only about hiding bad things. Yet without personal privacy/liberty our society would be suffocating – privacy, liberty and the common good are inextricably interlinked and mutually dependent.
The second is that decimating privacy is the solution to the problem du jour – security, terrorism, serious crime, benefit fraud, NHS patient care etc. It’s possible to prove this thesis wrong mathematically but for the present purposes think of terrorist detection as a needle in a haystack problem. You don’t make it easier to find the needle by throwing more electronic data hay on the stack. Mass data collectors can dig deeply into the digital persona of anyone but don’t have the resources to do so with everyone. The resultant pursuit of false positive leads mean the real bad guys often get lost in the noise, as happened with the 9/11 attackers who were known to US authorities but not considered sufficiently important to intercept.
There is no magic computer solution to the rare terrorism problem.
Don’t get me wrong. Law enforcement and security services need to be able to move with the times, use modern digital technologies intelligently in their work and through targeted data preservation regimes – not a mass surveillance regime – engage in technological surveillance of individuals about whom they have reasonable cause to harbor suspicion. That is not, however, the same as building an infrastructure of mass surveillance.
This brings us back to the current alignment of state and corporate interests in relation to the architectures of our digital communications technologies. We could architect systems that enhance privacy and facilitate anonymity and net neutrality. We don’t.
The organisations that construct and operate these technologies have no market or regulatory incentives to build or run them this way. We, I agree, contribute enormously to this state of affairs by trading our privacy for the convenience/ attraction/gratification/access/community/conformity of the services that we use on the internet. We additionally contribute by failing to engage in a meaningful and persuasive way in the public debate on these issues. Our much maligned politicians are busy generalists subject to the constant glare of the media spotlight who really do not understand the technology and we have to be better at explaining it to them.
The state, likewise, has no incentive either to direct its vast purchasing power towards or to pass regulations to require the building and operation of liberty respecting network architectures. [Neither, in relation to regulations, has it got the required understanding of the technology to do so.] The state establishment, at the highest levels of its requisite parts, has largely bought into the belief that big data is good and their unfettered access to it even better.
We have to be more active/persuasive/engaged as individuals, citizens, employees, consumers or prosumers in convincing ourselves, our organisations, communities, society, the market and the state that an infrastructure of mass surveillance is not conducive to the public good. As long as the most powerful actors in this calculus, however, the state and the corporate sector, continue to share the belief that the continued building and operation of such an infrastructure of mass surveillance is in their mutual interest, it will be a difficult argument to win.
Regards,
Ray
PS Aside from the Snowden story, on the positive side, if the earlier Bradley Manning Wikileaks leaks revealed anything it was the huge numbers of dedicated US government officials and diplomats working day to day, above and beyond the call of duty, to uphold the values of the US Constitution and Bill of Rights. Having worked yourself at senior level in the civil service, you’ll no doubt be aware of equivalent commitment to democratic values on the part of UK government officials. There are a multitude of similarly dedicated individuals in the the state and corporate establishment across the globe. So it can’t be beyond us to evolve the surveillance state that is the internet of 2013 into something more respecting of democratic values and freedoms.