Quis custodiet?

Good piece by Nick Davies on the Stockholm Syndrome that enslaves our politicians to the spooks whom they nominally control.

Ignore for a moment the vexing sight of journalists denouncing their own worth. Set aside too the question of why rival newspapers might want to attack the Guardian’s exclusives. Follow the argument. Who should make the judgment?

The official answer is that we should trust the security agencies themselves. Over the past 35 years, I’ve worked with a clutch of whistleblowers from those agencies, and they’ve all shared one underlying theme – that behind the screen of official secrecy, they had seen rules being bent and/or broken in a way which precisely suggested that the agencies should not be trusted. Cathy Massiter and Robin Robison, for example, described respectively MI5 and GCHQ pursuing politically motivated projects to spy on peace activists and trade unionists. Peter Wright told of MI5 illegally burgling its way across London “while pompous bowler-hatted civil servants in Whitehall pretended to look the other way”. David Shayler exposed a plot both lawless and reckless by MI5 and MI6 to recruit al-Qaida supporters to assassinate Colonel Gaddafi.

All of this was known to their bosses. None of it should have been happening. But the agencies in whom we are invited to place our trust not only concealed it but without exception then attacked the whistleblowers who revealed it.

Would we do better to trust the politicians who have oversight of the agencies? It’s instructive to look back from our vantage point, post-Snowden, to consider what was happening only two years ago when the government attempted to introduce new legislation which came to be known as the snooper’s charter. If the oversight politicians are as well-informed as they claim, they must have known that this was in part a cynical attempt to create retrospective legal cover for surveillance tools that were already secretly being used, but they said nothing. And when parliament refused to pass that law, clearly indicating that there was no democratic mandate for those tools, they still stayed silent…

The banality of organisational evil

Seb Schmoller (whom God Preserve) drew my attention to a fascinating essay in the New York Times in which the philosopher Peter Ludlow makes an insightful link between Establishment hysteria over Edward Snowden’s whistleblowing and the furore generated by Hannah Arendt’s reporting of the Eichmann trial in 1961 (currently being highlighted in the feature film about Arendt which is in cinemas as I write).

Hannah Arendt made an observation about what she called “the banality of evil.” One interpretation of this holds that it was not an observation about what a regular guy Adolf Eichmann seemed to be, but rather a statement about what happens when people play their “proper” roles within a system, following prescribed conduct with respect to that system, while remaining blind to the moral consequences of what the system was doing — or at least compartmentalizing and ignoring those consequences.

In his essay, Ludlow draws on Robert Jackall’s analysis (in his book Moral Mazes: The World of Corporate Managers, a study of how membership of an organisation makes people adopt different moral codes from those they might hold as individuals. Jackall is a sociologist and his book is a study of the ethics of decision-making in corporations. Mostly, he argues, corporate employees are not evil people, but in their organisational roles they tend to follow five rules:

(1) You never go around your boss. (2) You tell your boss what he wants to hear, even when your boss claims that he wants dissenting views. (3) If your boss wants something dropped, you drop it. (4) You are sensitive to your boss’s wishes so that you anticipate what he wants; you don’t force him, in other words, to act as a boss. (5) Your job is not to report something that your boss does not want reported, but rather to cover it up. You do your job and you keep your mouth shut.

This was the code by which operatives like Ed Snowden (or Bradley Manning) were expected to live. In the end, the tension between obeying the codes and the imperatives of their consciences caused them to break ranks. The moral courage implicit in this seems admirable to many of us, but it’s also what infuriates those who regard them as traitors or worse. (Which includes most of the mass media btw, to their eternal shame.)

“Who do these people think they are, to put themselves in the position of passing moral judgement on matters that are way above their pay grades?” is the general tenor of the spluttering rage directed at Snowden and Manning. But the people who hold such views are generally the folks who either run or have risen in the organisations on which the whistleblowers blew the whistle. They are people, in other words, who signed up to Jackall’s Five Rules and checked their consciences in at the door when they signed on. Whenever I hear them ranting on about “betrayal” or “treason” I am reminded of Bertrand’s G.K. Chesterton’s* observation that the slogan “My Country Right or Wrong” is as daft as “My Mother, Drunk or Sober”.

* Thanks to Roger Whittaker for correction.

The US fears back-door routes into the net because it’s building them too

This morning’s Observer column.

At a remarkable conference held at the Aspen Institute in 2011, General Michael Hayden, a former head of both the NSA and the CIA, said something very interesting. In a discussion of how to secure the “critical infrastructure” of the United States he described the phenomenon of compromised computer hardware – namely, chips that have hidden “back doors” inserted into them at the design or manufacturing stage – as “the problem from hell”. And, he went on, “frankly, it’s not a problem that can be solved”.

Now General Hayden is an engaging, voluble, likable fellow. He’s popular with the hacking crowd because he doesn’t talk like a government suit. But sometimes one wonders if his agreeable persona is actually a front for something a bit more disingenuous. Earlier in the Aspen discussion, for example, he talked about the Stuxnet worm – which was used to destroy centrifuges in the Iranian nuclear programme – as something that was obviously created by a nation-state, but affected not to know that the US was one of the nation-states involved.

Given Hayden’s background and level of security clearance, it seems inconceivable that he didn’t know who built Stuxnet. So already one had begun to take his contributions with a modicum of salt. Nevertheless, his observation about the intractability of the problem of compromised hardware seemed incontrovertible…

Read on.

LATER: I come on this amazing piece of detective work which uncovers a backdoor installed in some D-Link routers.

NSA/GCHQ surveillance and human rights

Frank Schirrmacher, publisher of the Frankfurter Allgemeine Zeitung commenting on the attacks on the Guardian‘s reporting of the Snowden revelations.

The Snowden affair, one day, will be understood as a historic milestone at which democratic societies began to realize that the political cost of new technologies still needed to be negotiated. Hans-Magnus Enzensberger, one of Germany’s last great intellectuals and certainly not a leftist, sees it as a transition to a post-democratic society. And had the Snowden files not opened our eyes to this transition already, the way how the current debate about these documents unfolds, certainly did.These revelations are not only about secret services, but just as much about all the new social touchpoints of every citizen who is equipped with a smartphone and online access: Who controls and analyses these touchpoints and why? Is it so difficult to understand that in a world in which – according to Eric Schmidt’s concise formulation – the digital self not only mirrors but substitutes our true selves, all these issues become questions of human rights?

More unintended consequences of NSA snooping

This is a really intriguing statement by ICANN. It’s couched in diplomatic language, so I have added my interpretations in less diplomatic language.

Montevideo Statement on the Future of Internet Cooperation

7 October 2013
Montevideo, Uruguay – The leaders of organizations responsible for coordination of the Internet technical infrastructure globally have met in Montevideo, Uruguay, to consider current issues affecting the future of the Internet.

The Internet and World Wide Web have brought major benefits in social and economic development worldwide. Both have been built and governed in the public interest through unique mechanisms for global multistakeholder Internet cooperation, which have been intrinsic to their success. The leaders discussed the clear need to continually strengthen and evolve these mechanisms, in truly substantial ways, to be able to address emerging issues faced by stakeholders in the Internet.

In this sense:

They reinforced the importance of globally coherent Internet operations, and warned against Internet fragmentation at a national level. They expressed strong concern over the undermining of the trust and confidence of Internet users globally due to recent revelations of pervasive monitoring and surveillance.

[Translation: We are concerned that one effect of the revelations about the NSA’s activities will be to hasten moves towards the ‘Balkanization’ of the Internet. We are also worried about the way trust and confidence in the Internet has been undermined by these revelations.]

They identified the need for ongoing effort to address Internet Governance challenges, and agreed to catalyze community-wide efforts towards the evolution of global multistakeholder Internet cooperation.

[Translation: the old system, by which the US exercised de-facto control over the central governance institutions of the Internet, has to be scrapped and replaced by something based on genuine global representation.]

They called for accelerating the globalization of ICANN and IANA functions, towards an environment in which all stakeholders, including all governments, participate on an equal footing.

[Translation: the days when the US was primus inter pares are over.]

They also called for the transition to IPv6 to remain a top priority globally. In particular Internet content providers must serve content with both IPv4 and IPv6 services, in order to be fully reachable on the global Internet.

The Failing States

Good blog post by Jonathan Freedland prompted by the paralysis in Washington. His conclusion:

Perhaps this doesn’t matter much to American voters. They might not realize how closely the rest of the world—their economies as well as their media and popular culture—follow, react to, and are affected by the ups and downs of US political life. But they do. And right now, they look at the stalemate in Washington the same way they look at the periodic gun massacres that afflict the United States: with a bafflement that America, mighty America, for so long the most innovative, creative, energetic society on the planet, cannot solve problems that smaller, poorer, feebler countries cracked long ago. Americans might not realize it, but this shutdown, like the gun epidemic, reduces US influence in the world. It makes nations, and individuals, who still want to regard America as a model see it instead as a basket case.

Twitter and the transformation (?) of democracy

My Comment piece about news of Twitter’s impending IPO.

One of the most striking aspects of the epoch-making Commons debate on Syria was the way many MPs cited the emailed opposition of their constituents to armed intervention as a reason for voting against the proposed action.

In the United States, members of Congress told much the same story. It’s impossible to know whether MPs and congressmen were using constituents’ hostility as a way of legitimising their own, private, views, but their protestations gave a dramatic new twist to an old conundrum: are parliamentarians representatives (legislators who make up their own minds) or mere delegates (people who vote as instructed by their constituents)?

Edmund Burke famously raised the question in a speech to the electors of Bristol on 3 November 1774. “Government and legislation,” he said, “are matters of reason and judgment, and not of inclination; and what sort of reason is that, in which the determination precedes the discussion; in which one set of men deliberate, and another decide; and where those who form the conclusion are perhaps three hundred miles distant from those who hear the arguments?”

In Burke’s time, when Bristol was two days’ ride from London, the idea that constituents might determine the votes of their MP in Westminster in anything resembling real time was moot. So deliberative democracy was the only option available.

MPs’ recent rationalisations of their votes suggest that some of our politicians have embarked down a slippery slope. Technologies such as Twitter, which offer real-time tracking of public opinion, do make Burke’s nightmare realisable. Which means that a company that can regulate expressions of that opinion might be very powerful indeed. And that should make us nervous.

Eagle fouls its own nest

This morning’s Observer column

‘It’s an ill bird,” runs the adage, “that fouls its own nest.” Cue the US National Security Agency (NSA), which, we now know, has been busily doing this for quite a while. As the Edward Snowden revelations tumbled out, the scale of the fouling slowly began to dawn on us.

Outside of the United States, for example, people suddenly began to have doubts about the wisdom of entrusting their confidential data to cloud services operated by American companies on American soil. As Neelie Kroes, European Commission vice president responsible for digital affairs, put it in a speech on 4 July: “If businesses or governments think they might be spied on, they will have less reason to trust the cloud and it will be cloud providers who ultimately miss out. Why would you pay someone else to hold your commercial or other secrets, if you suspect or know they are being shared against your wishes? Front or back door – it doesn’t matter – any smart person doesn’t want the information shared at all. Customers will act rationally and providers will miss out on a great opportunity.”

Which providers? Why, the big US internet companies that have hitherto dominated the market for cloud services – a market set to double in size to $200bn (£126bn) over the next three years. So the first own goal scored by the NSA was to undermine an industry that many people had regarded as the next big thing in corporate computing.

Mission Creep and the NSA

The big question, it seems to me, is whether comprehensive surveillance of the kind we now know the NSA and its sister agencies conduct, is compatible with democracy in any meaningful sense. This is one post in that ongoing thread.

The NSA’s Mission statement says:

The National Security Agency/Central Security Service (NSA/CSS) leads the U.S. Government in cryptology that encompasses both Signals Intelligence (SIGINT) and Information Assurance (IA) products and services, and enables Computer Network Operations (CNO) in order to gain a decision advantage for the Nation and our allies under all circumstances.

Note the phrase “a decision advantage for the Nation and our allies under all circumstances“. [Emphasis added.]

When the NSA was set up by Harry Truman on October 24, 1952, the mission involved monitoring all the electronic communications technologies of the time — radio, television, telex, telephone, telegraph. When the ARPAnet arrived in 1968, cellular telephony in 1973 and the Internet in 1983 it was logical to include monitoring of these systems within the NSA’s remit.

But, guess what? Exponential growth is more or less baked into the Internet because of its architecture. So it grows like crazy, and so — therefore — does the NSA’s remit. But surveilling the Net isn’t the same as doing the old wiretapping stuff with telephones. You can’t just dip into the firehose to pick out the stuff you’re interested in: you need the whole firehose. Or, to use another metaphor: if you’re looking for needles in a haystack, you need the entire haystack.

Which the NSA has been collecting. Which in turn means that mission creep is effectively built into the NSA’s remit. For if the Agency is conscientiously to fulfil its mission, then it too has to grow continuously, in line with the growth of the Internet. Of course Moore’s Law helps a bit, but only a bit: the incessant expansion of the Net — 2+ billion users today, the next five billion in the next decade or so — means that the NSA will always be running just to keep up. And that’s not taking into account the surges that will come from the “Internet of things”.

So if nothing changes, the NSA will continue to grow.

What forces might constrain this growth?

One is politics. Could it happen that lawmakers, driven perhaps by public revulsion at comprehensive surveillance, might decide to curtail the Agency financially. Its budgets might be frozen, or even cut.

Dream on. Post-9/11 hysteria and the ‘war on terror’ mean that instead of rational budgetary considerations coming into play, with the NSA having to tighten its belt just as other public agencies do in times of financial stringency, exactly the opposite happens: the NSA continues to get whatever public resources it claims to need — currently $10.8B. And I haven’t even mentioned the pressures coming from the powerful — and vast — military-industrial-information complex which is parasitic upon the US government (one of which parasites, ironically, employed Edward Snowden as a sysadmin.)

The obvious conclusion therefore, is that unless some constraints on its growth materialise, the NSA will continue to expand. It currently has 35,000 employees. How many will it have in ten years’ time? Who can say: 50,000, maybe? Maybe even more? So we’re confronted with the likelihood of the growth of a bureaucratic monster.

How will such a body be subjected to democratic oversight and control? Let me rephrase that: can such a monster be subjected to democratic control?

Optimists might answer ‘yes’ and point to the FBI as an example of a security apparatus which is under fairly tight legal control.

On the other hand, those with long memories recall the fear and loathing that J. Edgar Hoover, the founder — and long-term (48 years) Director — of the FBI aroused in important segments of the American polity. The relatively restrained Wikipedia entry for him claims that even US presidents feared him and quotes Harry Truman as saying that “Hoover transformed the FBI into his private secret police force”. “We want no Gestapo or secret police”, Truman is reported as saying. “FBI is tending in that direction. They are dabbling in sex-life scandals and plain blackmail. J. Edgar Hoover would give his right eye to take over, and all congressmen and senators are afraid of him.”

Hoover’s power was based on a combination of astute PR, sycophantic or intimidated mass media, his absolute control of an army of agents, and the databases they could compile using the relatively crude tools of the time. He assiduously collected information about the private lives of politicians, public figures and journalists and used it to secure their approval or silence. When the journalist Ray Tucker hinted at Hoover’s homosexuality in an article for Collier’s Magazine, he was investigated by the FBI and information about his private life was leaked to the media. When this became known, other hacks were frightened off, with the result that his sexual activities were never disclosed to the American public during his lifetime — despite the fact that he effectively blackmailed public figures who were themselves homosexual. Under him, the FBI investigated many Americans –like Martin Luther King — who held what Hoover regarded as dangerous political views; the Bureau also investigated protestors against the Vietnam war and other political dissidents.

The idea that the FBI, under Hoover, was subjected to tight democratic oversight is, well, fanciful. That doesn’t mean that the Bureau didn’t also do excellent law-enforcement work during Hoover’s tenure — just that, even in those technologically-limited circumstances, the level of democratic oversight was patchy.

Now spool forward a decade or so and imagine a Director of the NSA, a charismatic ‘securocrat’ imbued with a mission to protect the United States from terrorists and whatever other threats happen to be current at the time. He (or she) has 50,000+ operatives who have access to every email, clickstream log, text message, phone call and social-networking post that every legislator has ever made. S/he is a keystroke away from summoning up cellphone location logs showing every trip a lawmaker has made, from teenager-hood onwards, every credit- and debit-card payment. Everything.

And then tell me that lawmakers will not be as scared of that person as their predecessors were of Hoover.

The NSA never takes “no” for an answer

Terrific column by Jack Shafer.

The NSA’s techno-dodges give civil libertarians a choice of two large pitches on which to throw their fits. Should they be more angry about the national security bureaucracy first seeking the public’s consent to drink from the national information stream and then, when told “no,” ignoring the thumb down? Or is the greater outrage the fact that the vast and secret surveillance program was established at all, and not how it was established? As a fit-throwing civil libertarian, I intend to alternate from one field to the other. On even days I’ll scream about the basic outrage. On odd days, I’ll stamp my feet over the “you asked for permission, I said ‘No,’ and you went ahead and did it anyway” transgression.

Who made the U.S. government’s decision to bootleg its expansive surveillance system into place? To compromise the Internet and the devices we use to connect? To intentionally weaken the existing security systems by installing secret “back doors,” thereby making us all more vulnerable to a hostile cyber-attack by foreign powers or individuals who discover them? To reverse the popular will — or least the politically possible — without any further discussion? That last move would smack of totalitarianism, except that totalitarians make no pretext about needing the consent of their citizens to rule.

And there’s more…

Can somebody explain to the NSA that Snowden has merely done to the NSA what the NSA has been doing to U.S. citizens and business for decades? Snowden deceitfully ignored the legally binding promises he made to the NSA; the NSA similarly runs roughshod over both the letter and the spirit of surveillance legislation (and systematically lies about it, something Snowden doesn’t do). Snowden stole secrets; the NSA steals secrets (and encryption keys, according to yesterday’s reports), only at a more colossal level. Snowden took it upon himself that he, not the NSA or his government, knows best; the NSA and its governmental partners believe they know best; Snowden creatively exploited the technical weaknesses in the computer matrix to accomplish his goals; so does the NSA.

Neatly highlights the question that’s been bothering me for months. Is it possible to have the kind of comprehensive surveillance that the NSA and its overseas franchises operate and also have democracy. My answer: no.