German Minister Calls Security A 'Super Fundamental Right' That Outranks Privacy; German Press Call Him 'Idiot In Charge'

One of the striking features of the Snowden story is that there has been no serious attempt to deny the main claims about massive, global spying. Instead, the fall-back position has become: well, yeah, maybe we did some of that, but look how many lives were saved as a result. For example, the day after the first leaks appeared, it was suggested that PRISM was responsible for stopping a plot to bomb the NYC subways. However, further investigation showed that probably wasn't the case. 

On Techdirt.

Leaked EU Policy Papers Show TAFTA/TTIP's Huge Challenges -- And Some Subtle Signals

After last Wednesday's debate, the European Parliament passed a resolution on the subject of NSA surveillance, which included the following mild wrist-slap: 

On Techdirt.

Bolivian President's Jet Rerouted On Suspicions Snowden Could Be On Board; Multi-Country Outrage Ensues

The Snowden saga continues to deliver surprising twists and turns that may well have important geopolitical knock-on effects. The latest involves the President of Bolivia, Evo Morales, whose country is rumored to be willing to offer political asylum to Snowden. Here's what happened, as reported by The Guardian: 

On Techdirt.

Germans Want To Give Snowden A Medal, French Want To Give Him Asylum -- And To Call Off TAFTA/TTIP

Although nobody seems to know what Edward Snowden is up to at the moment, there have been plenty of reactions from others to the earlier revelations about US spying in Europe. Alongside the outrage, there is also a certain gratitude towards Snowden in some quarters for providing information about what has been going on. For example, one of the local wings of the German Pirate Party has suggested that he should be awarded a Federal Order of Merit (original in German.) In France, a surprisingly broad spectrum of politicians are calling for him to be offered political asylum according to this report from France 24 : 

On Techdirt.

Turning the Sow's Ear of Surveillance into a Silk Purse

On Wednesday I wrote about the Houses of Parliament deciding to use cloud computing solutions, despite the fact that we now know - not just surmise - that this is like handing your documents to the NSA. As I noted, that may not be problematic if your documents were going to be in the public domain anyway. But of course, that's only the case for a tiny fraction of most companies' documents. And for those, it is clearly the height of irresponsibility to place them with cloud-based systems that are wide open to demands from the US government for any and all data to be handed over, decrypted where possible.

On Open Enterprise blog.

Clear Thinking Needed in a Cloudy World

Last week I wrote about the perils of using proprietary software, where companies regularly hand over zero-day vulnerabilities to the US authorities who then go on to use them to break into foreign systems (and maybe domestic ones, too, but they're not owning up to that, yet....). Of course, cloud-based solutions are even worse, as we've known for some time. There, you are handing over all your data to the keeping of a company that may be on the receiving end of a secret US government order to pass it on to them - perhaps with necessary encryption keys too.

On Open Enterprise blog.

UK Police Routinely Spy On 9000 'Domestic Terrorists' Very Loosely Defined

In the wake of the news that spies at GCHQ -- the UK equivalent of the NSA -- have been tapping into every fiber optic cable that comes into and goes out of the country, downloading and storing phone calls and Internet traffic for up to 30 days, you might think the British authorities have enough information at their disposal, without needing to turn to other sources. But it seems not, according to the latest revelations in The Guardian: 

On Techdirt.

How Much Would It Cost To Store All US Phone Calls Made In A Year?

An early criticism of Snowden's leak about NSA spying activity was that the $20 million annual cost for PRISM -- whatever that turns out to be -- was simply too low to be credible. One person who knows more about storage costs than practically anyone -- well, outside the NSA, at least -- is Brewster Kahle, who set up the Internet Archive, essentially a backup for the entire Web plus a wonderfully rich store of many other materials. He's carried out a fascinating back-of-the envelope calculation of how much it would cost annually to record every phone call made in the US and store it in the cloud: 

On Techdirt.

Germany's Spies Have NSA Envy: Currently Working To Build Their Own Comprehensive Snooping System

One unfortunate knock-on effect of the revelations about the extent of NSA information gathering seems to be that the spies in other countries are starting to feel under-informed by comparison. Of course, many of them already knew about what was going on: in addition to the British and the Dutch, there are now reports that Germany was also kept informed at the highest levels (original in German.) That would probably explain the revelation by the news magazine Der Spiegel that Germany has been trying to beef up its own snooping capabilities for a while: 

On Techdirt.

How Can Any Company Ever Trust Microsoft Again?

Irrespective of the details of the current revelations about US spying being provided by Edward Snowden in the Guardian, there is already a huge collateral benefit. On the one hand, the US government is falling over itself to deny some of the allegations by offering its own version of the story. That for the first time gives us official details about programmes that before we only knew through leaks and rumours, if at all. Moreover, the unseemly haste and constantly-shifting story from the US authorities is confirmation, if anyone still needed it, that what Snowden is revealing is important - you don't kick up such a fuss over nothing.

On Open Enterprise blog.

How Does Prism Change the Way We See Things?

The extraordinary revelations about the NSA's global spying programme Prism have only just started - was it really just last Thursday that things began? So it would be extremely rash to attempt any kind of definitive statement about what is going on. But that doesn't preclude a few preliminary comments, as well as initial thoughts on what action those of us in Europe might take in response.

 
On Open Enterprise blog.

Is Encryption Effective Against Snooping? German Government Says No, Snowden Says Yes

The revelations of Edward Snowden about the NSA's snooping of citizens both inside and outside the US are posing more questions than they answer at the moment. One key area is whether the use of encryption -- for example for email -- is effective against the techniques and raw power available to the NSA (and equivalents in other countries). That's something that has come up before in the context of the UK's Snooper's Charter. When a top official there was asked whether the proposed surveillance technology would be able to cope with encrypted streams, he replied: "it will." Snowden's claims about massive, global spying makes the issue even more pertinent. 

On Techdirt.

Do Dutch Spies Also Have Access To PRISM's Data? And If So, Who Else Does?

In the wake of the leaks about NSA's spying activities around the world, one of the interesting subsidiary questions is: who else had access to this stuff? We know that the UK did, and now there are indications the Dutch did as well, according to this report on DutchNews.nl: 

On Techdirt.

Is The US Using Prism To Engage In Commercial Espionage Against Germany And Others?

As we noted last week, one of the key claims following the revelations about the Prism program was that it was aimed at those outside the US, and that US citizens were caught up in it only incidentally. A further leak concerned the Boundless Informant analysis tool, one of whose maps showed which regions of the world were subject to most surveillance. Along with obvious hotspots like Iran and Pakistan, Germany too was among those of particular interest, as was the US (whoops.) A story on reason.com offers a clue as to why that might be. 

On Techdirt.

NSA Spying Revelations Start To Cause Outrage In Europe; China Next?

News that the NSA has unfettered access to most of the leading Internet services inevitably has an international dimension. After all, Microsoft, Yahoo!, Google and the rest of the Naughty Nine all operate around the world, so spying on their users means spying on people everywhere. Indeed, as Mike explained earlier today, the NSA is actually trying to quell criticism by selling this news as something that purely concerns non-Americans (although that's clearly rubbish.) 

On Techdirt.

Why CISPA Shows We Need Strong EU Data Protection

It seems hard to believe that it was only a little over a year ago that the threat from the US SOPA (Stop Online Piracy Act) was averted (and that ACTA was still with us in the EU). But of course the war is never won: new threats to freedom and openness on the Internet just keep on coming. 

On Open Enterprise blog.

What "Nothing to Hide" is Hiding

As governments around the world - but particular in the UK - increase the surveillance of their hapless citizens, one argument above all is made in favour of doing so: "if you have nothing to hide, you have nothing to fear."

Of course, the rebuttal is that, indeed, we have nothing to hide, but we do value our privacy, and we should not be asked to sacrifice that for dubious government convenience. But as this excellent paper entitled "I've got nothing to hide, and other misunderstanding of privacy" points out, there is a particularly dangerous "strong" form of this argument that is harder to brush off so easily:

Grappling with the nothing to hide argument is important, because the argument reflects the sentiments of a wide percentage of the population. In popular discourse, the nothing to hide argument’s superficial incantations can readily be refuted. But when the argument is made in its strongest form, it is far more formidable.

...


The NSA surveillance, data mining, or other government information- gathering programs will result in the disclosure of particular pieces of information to a few government officials, or perhaps only to government computers. This very limited disclosure of the particular information involved is not likely to be threatening to the privacy of law-abiding citizens. Only those who are engaged in illegal activities have a reason to hide this information. Although there may be some cases in which the information might be sensitive or embarrassing to law-abiding citizens, the limited disclosure lessens the threat to privacy. Moreover, the security interest in detecting, investigating, and preventing terrorist attacks is very high and outweighs whatever minimal or moderate privacy interests law-abiding citizens may have in these particular pieces of information. Cast in this manner, the nothing to hide argument is a formidable one. It balances the degree to which an individual’s privacy is compromised by the limited disclosure of certain information against potent national security interests. Under such a balancing scheme, it is quite difficult for privacy to prevail.

One of the key arguments of the paper revolves around data aggregation (not surprisingly):

Aggregation...means that by combining pieces of information we might not care to conceal, the government can glean information about us that we might really want to conceal. Part of the allure of data mining for the government is its ability to reveal a lot about our personalities and activities by sophisticated means of analyzing data. Therefore, without greater transparency in data mining, it is hard to claim that programs like the NSA data mining program will not reveal information people might want to hide, as we do not know precisely what is revealed. Moreover, data mining aims to be predictive of behavior, striving to prognosticate about our future actions. People who match certain profiles are deemed likely to engage in a similar pattern of behavior. It is quite difficult to refute actions that one has not yet done. Having nothing to hide will not always dispel predictions of future activity.

Moreover:

Another problem in the taxonomy, which is implicated by the NSA program, is the problem I refer to as exclusion.85 Exclusion is the problem caused when people are prevented from having knowledge about how their information is being used, as well as barred from being able to access and correct errors in that data. The NSA program involves a massive database of information that individuals cannot access. Indeed, the very existence of the program was kept secret for years.86 This kind of information processing, which forbids people’s knowledge or involvement, resembles in some ways a kind of due process problem. It is a structural problem involving the way people are treated by government institutions. Moreover, it creates a power imbalance between individuals and the government. To what extent should the Executive Branch and an agency such as the NSA, which is relatively insulated from the political process and public accountability, have a significant power over citizens? This issue is not about whether the information gathered is something people want to hide, but rather about the power and the structure of government.

Finally:

A related problem involves “secondary use.” Secondary use is the use of data obtained for one purpose for a different unrelated purpose without the person’s consent. The Administration has said little about how long the data will be stored, how it will be used, and what it could be used for in the future. The potential future uses of any piece of personal information are vast, and without limits or accountability on how that information is used, it is hard for people to assess the dangers of the data being in the government’s control.

None of these will come as any surprise to people thinking about privacy and computers, but it's interesting to read a lawyer's more rigorous take on the same ideas.

Follow me @glynmoody on Twitter or identi.ca.

Why Openness Matters - Doubly

Here's a great demonstration of why openness is so important.

Wikipedia is famously open, so in general anyone can edit stuff. But this editing is also done in the open, in that all changes are tracked. Now, some people edit anonymously, but their IP addresses are logged. This information too is freely available, so here's an idea that some bright chap had:

Griffith thus downloaded the entire encyclopedia, isolating the XML-based records of anonymous changes and IP addresses. He then correlated those IP addresses with public net-address lookup services such as ARIN, as well as private domain-name data provided by IP2Location.com.

The result: A database of 5.3 million edits, performed by 2.6 million organizations or individuals ranging from the CIA to Microsoft to Congressional offices, now linked to the edits they or someone at their organization's net address has made.

As a result, dedicated crowd-sourcers are poring over Wikipedia, digging out those embarrassing self-edits. For example:

On Christmas Eve 2004, a Disney user deleted a citation on the "digital rights management" page to DRM critic Cory Doctorow along with a link to a speech he gave to Microsoft's Research Group on the subject. Later, a Disney user altered the "opponents" discussion of the entry, arguing that consumers embrace DRM: "In general, consumers knowingly enter into the arrangement where they are granted limited use of the content."

or:

"Removed ECHELON link, irrelevant to article," reads the comment explaining this cut. The contributor's IP address belongs to the National Security Agency.

or even:

Microsoft's MSN Search is now "a major competitor to Google". Take it from this anonymous contributor, whose IP address belongs to Waggener Edstrom, Microsoft's PR firm.

Now that's what I call openness.

Microsoft Vista: "Checked" by the NSA

News that the US's official eavesdropper, the National Security Agency, has had a hand in Vista is going to go down really well with the governments of China, Russia, India, etc. etc.:

For the first time, the giant software maker is acknowledging the help of the secretive agency, better known for eavesdropping on foreign officials and, more recently, U.S. citizens as part of the Bush administration's effort to combat terrorism. The agency said it has helped in the development of the security of Microsoft's new operating system -- the brains of a computer -- to protect it from worms, Trojan horses and other insidious computer attackers.

Interestingly:

Novell, which sells a Linux-based operating system, also works with government agencies on software security issues, spokesman Bruce Lowry said in an e-mail, "but we're not in a position to go into specifics of the who, what, when types of questions."

But at least you can look at the code to find out what they did - unlike with Vista.... (Via The Inquirer.)