04 Nov 13 | Digital Freedom, News and features
We can partially blame gerrymandering for the current gridlock in the U.S. Congress. By shaping the electoral map to create politically safe spaces, we have generated a fractious body that often clashes rather than collaborates, limiting our chances of resolving the country’s toughest challenges. Unfortunately, revelations about the global reach of American security surveillance programs under the National Security Agency (NSA) are leading some to propose what amounts to gerrymandering for the internet in order to route around NSA spying. This will shackle the internet, inherently change its technical infrastructure, throttle innovation, and likely lead to far more dangerous privacy violations around the globe.
Nations are rightly upset that the communications of their citizens are swept up in the National Security Agency’s pervasive surveillance dragnet. There is no question the United States has overreached and violated human rights in its collection of communications information on innocent people around the globe; however, the solution to this problem should not, and truly cannot, be data localization mandates that restrict data storage and flow.
The calls for greater localization of data are not new, but the recent efforts of Brazil’s President, Dilma Rouseff, to protect Brazilians from NSA spying reflected the view of many countries suddenly faced with a new threat to the privacy of the communications of their citizens. Rouseff has been an advocate for internet freedom, so undoubtedly her proposal is well intentioned, though the potential unintended repercussions are alarming.
First, it’s important to consider the technical reasons why data location requirements are a really bad idea. The Internet developed in a widely organic manner, creating a network that allowed data to flow from all corners of the world – regardless of political boundaries, residing everywhere and nowhere at the same time. This has helped increase the resilience of the internet and it has promoted significant efficiencies in data flow. As is, the network routes around damage, and data can be wherever it best makes sense and take an optimal route for delivery.
Data localization mandates would turn the internet on its head. Instead of a unified internet, we would have a fractured internet that may or may not work seamlessly. We would instead see districts of communications that cater to specific needs and interests – essentially we would see Internet gerrymandering at its finest. Countries and regions would develop localized regulations and rules for the internet to benefit them in theory, and would certainly aim to disadvantage competitors. The potential for serious winners and losers is huge. Certainly the hope for an internet that promotes global equality would be lost.
Data localization may only be a first step. Countries seeking to keep data out of the United States or that want to exert more control over the internet may also mandate restrictions on how data flows and how it is routed. This is not far-fetched. Countries such as Russia, the United Arab Emirates, and China have already proposed this at last year’s World Conference on International Telecommunications.
As internet traffic begins to demand more bandwidth, especially as we witness more real-time multimedia applications, efficient routing is essential to advance new internet services. High capacity applications like Apple’s FaceTime may slow to the painful crawl reminiscent of the dial-up days of the internet.
This only begins to illustrate the challenges internet innovators would face, but big established players like Facebook, Google and Microsoft, would potentially have the resources to abide by localization mandates – of course, only if the business case supports working in particular locales. Some countries with local storage rules may be bypassed altogether. For small or emerging businesses, data localization requirements would be a greater challenge. It would build barriers to markets and shut off channels for innovation. Few emerging businesses could afford to locate servers in every new market, and if local data server requirements become ubiquitous, it will be businesses in emerging markets that are most disadvantaged. The reality for developing nations is that protectionist measures such as data localization will further isolate local business from the global market, depriving them of the advantages for growth that are provided by the borderless internet.
Most important though, is the potential for fundamental harm to human rights due to data localization mandates. We recognize that this is a difficult argument to accept in the wake of the revelations about NSA surveillance, but data localization requirements are a double-edged sword. It is important to remember that human rights and civil liberties groups have long been opposed to data localization requirements because if used inappropriately, such requirements can become powerful tools of control, intimidation and oppression.
When companies were under intense criticism for turning over the data of Chinese activists to China, internet freedom activists were united in theirs calls to keep user data out of the country. When Yahoo! entered the Vietnamese market, it placed its servers out of the country in order to better protect the rights of its Vietnamese users. And the dust up between the governments of the United Arab Emirates, Saudi Arabia, India, and Indonesia, among others, demanding local servers for storage of BlackBerry messages in order to ensure legal accountability and meet national security concerns, was met with widespread condemnation. Now with democratic governments such as Brazil and some in Europe touting data localization as a response to American surveillance revelations, these oppressive regimes have new, albeit inadvertent, allies. While some countries will in fact store, use and protect data responsibly, the validation of data localization will unquestionably lead to many regimes abusing it to silence critics and spy on citizens. Beyond this, data server localization requirements are unlikely to prevent the NSA from accessing the data. U.S. companies and those with a U.S. presence will be compelled to meet NSA orders, and there appear to be NSA access points around the world.
Data localization is a proposed solution that is distracting from the important work needed to improve the Internet’s core infrastructural elements to make it more secure, resilient and accessible to all. This work includes expanding the number of routes, such as more undersea cables and fiber runs, and exchange points, so that much more of the world has convenient and fast Internet access. If less data is routed through the U.S., let it be for the right reason: that it makes the Internet stronger and more accessible for people worldwide. We also need to work to develop better Internet standards that provide usable privacy and security by default, and encourage broad adoption.
Protecting privacy rights in an era of transborder surveillance won’t be solved by ring fencing the Internet. It requires countries, including the U.S., to commit to the exceedingly tough work of coming to the negotiating table to work out agreements that set standards on surveillance practices and provide protections for the rights of privacy and free expression for people. Germany and France have just called for just such an agreement with the U.S. This is the right way forward.
In the U.S., we must reform our surveillance laws, adopt a warrant requirement for stored email and other digital data, and implement a consumer privacy law. The standards for government access to online data in all countries must likewise be raised. These measures are of course much more difficult in the short run that than data localization requirements, but they are forward-looking, long-term solutions that can advance a free and open internet that benefits us all.
Joseph Lorenzo Hall, Chief Technologist at Center for Democracy and Technology, co-authored this piece with Leslie Harris.
This article was originally posted on 4 Nov 2013 at indexoncensorship.org
06 Aug 13 | Digital Freedom, France, Germany, Guest Post, News and features, Politics and Society, Russia, United Kingdom, United States
(Photo illustration: Shutterstock)
Around the world, there is confusion and alarm over the impact of the U.S. National Security Agency’s (NSA) surveillance program on human rights. In the U.S., the debate is focusing on the gross violations of privacy rights of Americans. Barely a word is being spoken about the human rights of people outside the country whose personal communications are being targeted, and whose communications content is collected, stored, analyzed and used with little legal protection.
A growing group of international civil society groups and individuals wants that to change and is coming together to present the newly empowered U.S. Privacy and Civil Liberties Board (PCLOB) with a joint letter, asking the Board to make “recommendations and findings designed to protect the human rights not only of U.S. persons, but also of non-U.S. persons.” Before PCLOB’s mid-September deadline for public comments, I encourage global civil society to add their name to this powerful statement.
As the letter makes clear, there is great concern from the global community that the recently revealed surveillance program conducted under Section 702 of the Foreign Intelligence Surveillance Act (FISA) poses a severe threat to human rights. It rightly notes that the surveillance “ strikes at the heart of global digital communications and severely threatens human rights in the digital age.” “The use of unnecessary, disproportionate, and unaccountable extra-territorial surveillance not only violates rights to privacy and human dignity, but also threatens the fundamental rights to freedom of thought, opinion and expression, and association that are at the center of any democratic practice. Such surveillance must be scrutinized through ample, deep, and transparent debate. Interference with the human rights of citizens by any government, their own or foreign, is unacceptable.”
Why then is all the attention in the U.S. focused on just the rights of Americans? The U.S. draws its obligations to protect rights in conducting surveillance from the U.S. Constitution, specifically the Fourth Amendment, which protects “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” The “people” generally means all people located within the United States regardless of citizenship, and then only when they have a “ reasonable expectation of privacy.”
Except in the most extraordinary circumstances, and for U.S. citizens and lawful residents when they are travelling abroad, people outside the U.S. have no privacy protections under the Fourth Amendment. This is a feature in the U.S. Constitution and it animates every part of U.S. surveillance law and practice. That is why Section 702 of FISA requires targeting and minimization guidelines that are aimed (albeit inadequately) at ensuring that the communications being targeted are those of people reasonably believed to be outside the U.S. It’s also why they provide some level of protection for ordinary Americans whose communications are ensnared in foreign intelligence activities and take no notice of the rights of ordinary people all over the world whose personal communications now reside in NSA databases.
It may be hard to fathom now, but Congress created the FISA Court to rein in surveillance after revelations about illegal political spying on Americans surfaced in the 1970’s. The Court had a narrow charge: to ensure that electronic surveillance conducted in the United States for intelligence purposes is conducted pursuant to a warrant. The warrant protection did not apply to surveillance conducted outside the U.S., so it did not protect the rights of foreigners outside the U.S. However, in those days, communications surveillance within the U.S. was a limited and highly targeted activity aimed at hostile foreign powers and their agents. The phone conversations of ordinary people were of no interest. International phone calls between a person in the U.S. and person abroad were quite expensive and relatively rare.
Today, the assumptions that informed the enactment of FISA have been worn thin by a radical shift in threats – from states to diffuse non-state actors – and an even more radical shift in technology. The advent of the internet, the data storage revolution and big data analytics, fueled by fears about terrorism, have, in the post-PATRIOT Act world, fueled a growing government appetite for data. Today, the NSA isn’t just trying to listen in on the embassy abroad of a Cold War rival; instead, it doesn’t know whom to listen in on because it does not know who might pose a threat. In the process, individualized targeting based on specific indicia of threat has given way to bulk programmatic targeting of foreign communications without any consideration of human rights of people beyond our borders.
This position is simply untenable in today’s much smaller world, where the Cold War line between “us” and “them” has blurred.
When FISA was enacted, there was no global internet and the cost of international calls was prohibitive. Large parts of the world were unreachable for political or technical reasons. Now, we are a nation of more immigrants, global businesses and frequent travelers. We live online and carry our cell phones everywhere. The cost of an international call has plummeted by more than 90% and the number of U.S. billed international calls and the use of VOIP has skyrocketed. Skype calls worldwide alone grew 44% to 167 billion minutes in 2012.
Everyday, Americans are calling, emailing, texting and “friending” family, friends, colleagues and customers around the world, engaging in so-called “foreign communications.” For those on the other side of our emails and calls, there is no protection for free expression or privacy rights. In fact, their communications may be collected, examined and used by the government for any legal purpose.
The U.S. is certainly not alone in the breadth of its surveillance activities. Britain’s spy agency monitors the cables that carry the world’s phone calls and internet traffic in close cooperation with the NSA. Indeed, according to leaked documents, Britain’s GCHQ collects more metadata than the NSA with fewer limitations. Germany’s foreign intelligence agency, the BND, is monitoring communications at a Frankfurt communications hub that handles international traffic to, from and through Germany, and the BND is seeking to significantly extend its capabilities. Le Monde reports that France runs a vast electronic spying operation using NSA-style methods, but with even fewer legal controls. And Russia’s notorious SORM system is reportedly even more advanced than the American system.
The U.S. is also not alone in focusing most of the protections of its surveillance laws internally. Such focus is also a feature of the surveillance laws and practices in democratic countries around the world, most of which take a highly territorial view of their human rights obligations and are unlikely to willingly give them extraterritorial application.
There is an urgent conversation to be had in the U.S and beyond about the implications of cross-border surveillance. Given the globalization of information society services, we now must assume that the data pertaining to the citizens of one country will flow through the infrastructure of another and be subject to collection and use for national security purposes. Surveillance standards must be strengthened everywhere to ensure that robust judicial oversight and that principles of specificity, necessity, proportionality, data minimization, use limitation and redress for misuse are the norm. In a globally networked world, legal standards must also recognize the human rights implications of cross-border surveillance and set out a way forward to protect the rights of people beyond state borders. There is ambiguity about whether our largely territorial human rights paradigm is adequate to meet the challenge.
That is why the call to PCLOB to speak to the rights of non-Americans is so important. PCLOB has a simple mission: to make sure privacy and civil liberties are at the table as new security measures to protect the nation are considered. It has boldly taken on the NSA surveillance program as its first task, but it is too soon to know whether it has the muscle or the will power to push meaningful reforms. It has an opportunity to show global leadership by heeding the call to make concrete recommendations about the rights of non-U.S. persons that can frame the global discussion about surveillance and human rights going forward. Add your name to the letter and tell PCLOB to seize the opportunity.
