British and American spooks mine data collected by private companies. Those companies have a duty of openness too
Timothy Garton AshSource:
Close the entire text of the article here
Edward Snowden’s revelations about massive data-mining by American and British electronic spying agencies show that most of the sources they are digging into are privately owned. Often, they merely exploit the piles of revealing data that we have ourselves consented to share with the commercial giants of the IT world, usually by clicking the ‘I Agree’ button on a legal terms and conditions document that we never read. What our spooks collect directly, through undercover agents and the like, is a tiny proportion of what they gather electronically from these commercially owned sources. The conclusion is clear: were Big Brother to come back in the 21st century, he would return as a public-private partnership.
Our motorways may be public property, but our information superhighways are privately owned. Thus, for example, the UK’s Government Communications Headquarters (GCHQ) in Cheltenham apparently tapped into the super-capacity communications cables that pass through Britain on the basis of secret agreements with the companies that own them. According to reports in the Guardian and Washington Post, the Prism programme of the US National Security Agency (NSA) secured the cooperation of Microsoft, Yahoo, Google, Facebook, Skype, YouTube and Apple.
All these companies are interested in learning as much as possible about the people that use their products – but for their own purposes, not for the state. The acceptable reason they have for monitoring you and me so closely is to give us the best service. I like Google search coming up with the most relevant results for me. I like Amazon popping up with book suggestions because they are often rather good suggestions.
Yet there is also a more troubling reason. Especially if they do not charge you directly for the service they offer, many of these companies make their money by selling you to advertisers. The more they know about your habits, tastes and innermost desires, the better placed they are to offer you as a target for customising advertising. You search for, say, pink panthers – next thing you know, there are ads popping up for pink panthers.
This commercial accumulation of intimate personal information is worrying in itself. The reassurance we are offered from Facebook, Google and others – ‘trust us’ – is just not good enough. After all, it now turns out they’ve been sharing some of it with the spooks. On the whole, I credit them with doing this unwillingly - although it is unsettling to learn that the chief security officer for Facebook, Max Kelly, went on to work for the National Security Agency.
I first smelled this rat a couple of years ago, when I talked with senior executives at Facebook and Twitter. They became visibly embarrassed when our conversation turned to the so-called FISA (Foreign Intelligence Surveillance Act) orders, under which they are compelled to turn over what they know about some individuals or groups to US security agencies. With a grimace, they said they were not allowed to give me even a ballpark figure for the number of FISA orders they had received.
Several of the companies named by the Guardian and Washington Post have come back protesting that they had never heard of Prism, but offering figures for the total number of US law enforcement requests they received in the six months to the end of May, most of them apparently related to criminal rather than FISA cases. Thus, Uncle Sam demanded info on some 31,000 to 32,000 Microsoft users, 18,000-19,000 Facebook users, and up to 10,000 Apple accounts and devices. Is that a lot or a little? If the user is you, it’s a lot. Yahoo! makes their embarrassment explicit: ‘Like all companies, Yahoo! cannot lawfully break out FISA request numbers at this time because those numbers are classified; however, we strongly urge the federal government to reconsider its stance on this issue’.
Some readers will have stumbled over my subjunctive: ‘were Big Brother to come back…’ ‘Whaddya mean were?’ they will exclaim. ‘Big Brother is back already, in the NSA and Facebook, Google and GCHQ’. This is hyperbole. Yes, the quantity and intimacy of what the spooks and companies together know about you and me outstrips a Stasi general’s wettest dream. That’s already dangerous. But Britain and America are not totalitarian states. We face a real threat of violence from diverse and elusive radicalised people, as the Boston marathon bombings and the London murder of an off-duty soldier have again showed. They are harder to track than a Soviet nuclear arsenal.
Yet the British and American governments cannot simply assert that the end of keeping us safe justifies the means. It is not sufficient for them to repeat that everything is done within the law – especially when the laws used, such as Britain’s Regulation of Investigatory Powers Act, are made of stretchable old elastic. It is insulting for ministers to fob us off with ‘we never comment on intelligence matters’.
Without telling terrorists anything they don’t already know, the US government could, for example, perfectly well allow companies to reveal the number of FISA orders they have complied with. As the admirably privacy-sensitive German government has insisted, the British government owes us – not just Brits, but all other Europeans whose metadata it vacuumed up - a proper statement on GCHQ’s seemingly gargantuan Tempora programme.
There are many operational details that we will always have to take on trust, but in a democracy it is ultimately for us, the citizens, to make the judgement on where to place the balance between security and privacy, safety and liberty. It’s our lives and liberties that are threatened, not only by terrorism but also by massive depredations of our privacy in the name of counter-terrorism. If those companies from which governments actually take most of our intimate details want to show that they are still on the side of the angels, they had better join this struggle for transparency too. A good starting place would be to offer more transparency about the data they themselves collect on us. Our ‘right to know’ does not only apply to governments.
Timothy Garton Ash is Professor of European Studies at Oxford University, where he directs www.freespeechdebate.com, and a Senior Fellow at the Hoover Institution, Stanford University. He is the author, most recently, of Facts are Subversive: Political Writing from a Decade Without a Name