Snowden Revelations Research Articles

Technological solutions to privacy questions: what is the role of law?

In spite of its recognition as a fundamental human right, privacy is sometimes criticised as an anachronistic value in modern life [James Rule, Privacy in Peril (OUP, 2007) xi]. While the prominence of this view has lessened in the wake of the Snowden revelations and increased public concern with online privacy [Maria Helen Murphy, ‘The Pendulum Effect: Comparisons Between the Snowden Revelations and the Church Committee. What are the Potential Implications for Europe?’ (2014) 23(2) Information and Communications Technology Law 192], the right continues to struggle for support when it is portrayed as being in competition with national security, personal safety, and economic prosperity [Daniel Solove, ‘“I've Got Nothing to Hide” and other Misunderstandings of Privacy’ (2007) 44 San DLR 745]. As developments in technology continue to threaten the right to privacy, interest in technological solutions to privacy problems continues to grow. This article seeks to consider current privacy debates from the perspectives of multiple stakeholders in order to assess whether technological and design approaches offer the best path forward, or whether an essential role remains to be played by law.

US Surveillance Law, Safe Harbor, and Reforms Since 2013

This White Paper is a submission to the Belgian Privacy Authority for its December 18, 2015 Forum on “The Consequences of the Judgment in the Schrems Case.” The Forum discusses the decision by the European Court of Justice in Schrems v. Data Protection Commissioner that the EU/US Safe Harbor was unlawful under the EU Data Protection Directive, particularly due to concerns about US surveillance law.For the Forum, I have been asked to comment on two issues:1) Is US surveillance law fundamentally compatible with EU data protection law? 2) What actions and reforms has the US taken since the Snowden revelations began in June 2013?The White Paper draws on my background as a scholar of both EU data protection law and US surveillance law. It addresses serious misunderstandings of US national security law, reflected in official statements made in the Schrems case and elsewhere. It has three chapters:(1) The fundamental equivalence of the United States and EU member States as constitutional democracies under the rule of law. In the Schrems decision, the US was criticized for failing to ensure “a level of protection of fundamental rights essentially equivalent to that guaranteed in the EU legal order.” This chapter critiques that finding, instead showing that the United States has strict rule of law, separation of powers, and judicial oversight of law enforcement and national security surveillance, which together make the US legal order “essentially equivalent” to the EU legal order.(2) The Section 702 PRISM and Upstream programs are reasonable and lawful responses to changing technology. The Advocate General’s opinion in the Schrems case said that the PRISM program gave the NSA “unrestricted access to mass data” stored in the US, and that Section 702 enabled NSA access “in a generalised manner” for “all persons and all means of electronic communications.” This chapter refutes those claims, which appear to be based in part on incorrect stories in the press. Instead, the Section 702 programs operate with judicial supervision and subject to numerous safeguards and limitations. They examine the communications only of targeted individuals, and only for listed foreign intelligence purposes. The total number of individuals targeted under Section 702 in 2013 was 92,707, a tiny fraction of Internet users in the EU or globally.(3) The US Congress and executive branch have instituted two dozen significant reforms to surveillance law and practice since 2013. The Schrems decision said that US privacy protections must be evaluated in the “current factual and legal context,” but did not address the numerous changes put in place since 2013. This chapter provides a readable explanation of each of these actions, which together constitute the biggest set of pro-privacy actions in US surveillance law since creation of the Foreign Intelligence Surveillance Act in 1978.

Criptopunks y América Latina: de la soberanía tecnológica a la era de las filtraciones

The emergence of Wikileaks in the world strengthened the historical geopolitical link between Latin American governments and global hackers. In addition, it was a turning point in the imaginary and the method of historical Latin American struggles: leaks and cryptography renewed the wheel of technological sovereignty. Edward Snowden's revelations, occurred in June 2013, led to an acceleration of the idyll of criptopunks and global hackers with Latin American governments and were deeply influential in the aproval of Brazilian Marco Civil. This study attempts to review the relationship between criptopunks and global hackers and Latin America, especially with the progressive governments. We performed a study of data to see the impact of conversations that linked Snowden and Brazil Civil Marco during 2013 and 2014.

LSE Law Department Briefings on the Investigatory Powers Bill - Beyond Privacy: The Data Protection Implications of the IP Bill

In an era of digital communications, personal data flows do not respect national borders. UK residents communicate with friends and family living outside the UK’s borders while internet communications are routed all over the world when making their way from our computers and other connected devices to their final destination. At the same time, there is increasing public awareness of the dangers caused by mass data collection and data profiling. The Talk Talk and Ashley Madison data breaches, the Snowden revelations, the suspension of Safe Harbor data transfers between the EU and the US and the (misnamed) ‘Right to be Forgotten’ judgment by the EU Court of Justice (CJEU) have all made news headlines in recent years, and stakeholders – activists, businesses, policy-makers, the judiciary – are increasingly aware of the need to take personal data protection seriously.This dual dynamic – the global nature of digital information flows and the increased awareness of data protection and privacy issues – poses a challenge for national lawmakers. Any law introduced influencing the flow of information, such as the proposed Investigatory Powers Bill (IP Bill), will have effects in other countries beyond the UK, and will influence where companies outside choose to invest and to develop their operations. This Briefing Paper will therefore put the IP Bill in its EU law context. It suggests that, beyond privacy, the IP Bill will jeopardise two aspects of the right to data protection: individual autonomy and personal data security. In addition to these rights implications, the IP Bill may also have economic implications by discouraging technology industry investment in the UK.

National security and surveillance: the public impact of the GCSB Amendment Bill and the Snowden revelations in New Zealand

In New Zealand, Edward Snowden’s revelations about the extraordinary scope of the National Security Agency’s surveillance capabilities and the facilitating role of the Five Eyes alliance converged with increasing public concerns about the Government Communications Security Bureau Amendment and Related Legislation Bill in 2013. This generated an intense and sustained debate in the country about surveillance policy. It was a debate in which Prime Minister John Key has featured prominently. While apparently unable to clearly refute Snowden’s claims concerning mass surveillance in New Zealand, Key’s vigorous public interventions helped counter the short-term political and diplomatic fallout. However, the long-term impact of public concerns over the surveillance policies of the Key government may be much harder to predict in what is an intimate democracy, and the prospect of substantial political blowback cannot be ruled out.

The (Big) Data-security assemblage: Knowledge and critique

The Snowden revelations and the emergence of ‘Big Data’ have rekindled questions about how security practices are deployed in a digital age and with what political effects. While critical scholars have drawn attention to the social, political and legal challenges to these practices, the debates in computer and information science have received less analytical attention. This paper proposes to take seriously the critical knowledge developed in information and computer science and reinterpret their debates to develop a critical intervention into the public controversies concerning data-driven security and digital surveillance. The paper offers a two-pronged contribution: on the one hand, we challenge the credibility of security professionals’ discourses in light of the knowledge that they supposedly mobilize; on the other, we argue for a series of conceptual moves around data, human–computer relations, and algorithms to address some of the limitations of existing engagements with the Big Data-security assemblage.

EU Law and Mass Internet Metadata Surveillance in the Post-Snowden Era

Legal frameworks exist within democracies to prevent the misuse and abuse of personal data that law enforcement authorities obtain from private communication service providers. The fundamental rights to respect for private life and the protection of personal data underpin this framework within the European Union. Accordingly, the protection of the principles and safeguards required by these rights is key to ensuring that the oversight of State surveillance powers is robust and transparent. Furthermore, without the robust scrutiny of independent judicial review, the principles and safeguards guaranteed by these rights may become more illusory than real. Following the Edward Snowden revelations, major concerns have been raised worldwide regarding the legality, necessity and proportionality standards governing these laws. In 2014, the highest court in the EU struck down the legal framework that imposed a mandatory duty on communication service providers to undertake the mass retention of metadata for secret intelligence and law enforcement authorities across the EU. This article considers the influence of the Snowden revelations on this landmark judgment. Subsequently, the analysis explores the significance of this ruling for the future reform of EU law governing metadata surveillance and its contribution to the worldwide debate on indiscriminate and covert monitoring in the post-Snowden era.

Protecting sources: from shield laws to Wikileaks

This paper focuses on recent developments in the right and ability of journalists to protect their sources’ anonymity in the United Kingdom, particularly in light of the Snowden revelations of June 2013, and the significance of collaboration between the global online media organization Wikileaks and mainstream news organisations. It explores two key difficulties faced by journalists: the notion of a qualified professional privilege and the unknown extent of covert requests by public authorities for disclosure involving communications data and metadata. In doing so, it comments upon the opening filled by Wikileaks, which protects its sources’ anonymity through high data security and encryption. This paper’s findings tend to show that the covert practice of blanket mass digital surveillance of individual communications including journalists’ is undermining source protection and the rise of Wikileaks as an alternative model is challenging the traditional role of journalists as mediators and gatekeepers in the digital era.

Crowdsourcing Ideas as an Emerging Form of Multistakeholder Participation in Internet Governance

The online crowdsourcing of ideas for institutional change and legislation drafting has been widely adopted by public bodies from the local to the international level, for improving legitimacy, transparency, and accountability. In multistakeholder set-ups, such an approach seems to fulfill the promise of openness, real-time engagement and cross-fertilization of ideas. Global Internet policy-making appears as a natural experiment for harnessing the potential of crowdsourcing, in particular, as a means to restore trust after the Snowden revelations of mass surveillance. This article investigates two key initiatives of online collective brainstorming for digital policies: ICANN's Strategy Panel on Multistakeholder Innovation and the NETmundial process, highlighting the merits and limitations of crowdsourcing as an emerging form of multistakeholder participation. Our findings underscore the need for leveraging sufficient community interest for substantial input; defining procedures for the collection and screening of inputs; and committing to institutionalizing rules for incorporating feedback.

Hielke Hijmans and Herke Kranenborg (eds.),Data Protection Anno 2014: How to Restore Trust?Cambridge: Intersentia 2014, ISBN 978-1-78068-213-6

In 2014, Peter Hustinx stood down as the first European Data Protection Supervisor (EDPS), having served for over 10 years. This Festschrift is a fitting tribute to Hustinx, honouring his pioneering and exemplary performance as EDPS and covering a large range of topics and issues in the field of privacy and data protection, not only in the EU but in the USA and on the international level. Twenty-four contributions by distinguished academics and regulatory or legislative practitioners illuminate and debate many corners of the field in which Hustinx left a deep mark over many decades. The editors have put together a timely inventory of topics. They are well introduced, organized into themes, and capped by a gracious Preface by Viviane Reding, the former Vice-President of the European Commission (EC). The Snowden revelations of 2013 are foremost in the editors' minds in the Introduction. They dwell on the question of how trust can be restored following this alarming episode (‘scandal’) of privacy-invasive mass surveillance: trust between citizens and companies or governments, trust in the EU, trust in the law, and trust between countries. The book aims to elevate the importance of privacy and the protection of personal data in contributing to the debate on trust in information processes in the increasingly blurred public and private sectors, and in the global flow of personal data.

Data flows and water woes: The Utah Data Center

Using a new materialist line of questioning that looks at the agential potentialities of water and its entanglements with Big Data and surveillance, this article explores how the recent Snowden revelations about the National Security Agency (NSA) have reignited media scholars to engage with the infrastructures that enable intercepting, hosting, and processing immeasurable amounts of data. Focusing on the expansive architecture, location, and resource dependence of the NSA’s Utah Data Center, I demonstrate how surveillance and privacy can never be disconnected from the material infrastructures that allow and render natural the epistemological state of mass surveillance. Specifically, I explore the NSA’s infrastructure and the million of gallons of water it requires daily to cool its servers, while located in one of the driest states in the US. Complicating surveillance beyond the NSA, as also already imbricated with various social media companies, this article questions the emplacement and impact of corporate data centers more generally, and the changes they are causing to the landscape and local economies. I look at how water is an intriguing and politically relevant part of the surveillance infrastructure and how it has been constructed as the main tool for activism in this case, and how it may eventually help transform the public’s conceptualization of Big Data, as deeply material.

Technologies of attribution: characterizing the citizen-consumer in surveillance performance

Many accounts of surveillance and its subjective effects tend to focus on privacy. Along with this focus comes the assumption that surveillance’s objects are simply facts and attributes, straightforwardly ‘mined’ (or stolen) from people’s private lives. Yet, the habits and propensities ascribed to individuals through surveillance apparatuses are complex, relational phenomena: co-produced, selected and interpreted with interest by various actors. This essay begins to develop a critical language for surveillance as a form of characterization, by analysing SWAMP's McService (2003), Hasan Elahi’s Tracking Transience (2005–) and Erica Scourti’s Life in AdWords (2012–2013). Following Sara Ahmed, I theorize characterization as a ‘technology of attribution’ that attaches such interpretations of character to people within surveillant scenarios. Drawing from literary studies as well as recent work on the surveillance economy, I analyse the forms of attribution made possible within the surveillant scenarios in each of the artworks I analyse. Within these works, which span a decade between 9/11 and the Snowden revelations, one can trace an evolution of structures through which such attributions manifest: from self as threat, to self as set, to self as product.

The Snowden Stakes: Challenges for Understanding Surveillance Today

The drip-feed disclosures about state surveillance following Edward Snowden’s dramatic departure from his NSA contractor, Booz Allen, carrying over one million revealing files, have ired some and prompted some serious heart-searching in others. One of the challenges is to those who engage in surveillance studies. Three kinds of issues present themselves: One, research disregard: responses to the revelations show a surprising lack of understanding of the large-scale multi-faceted panoply of surveillance that has been constructed over the past 40 years or so that includes but is far from exhausted by state surveillance itself. Two, research deficits: we find that a number of crucial areas require much more research. These include the role of physical conduits including fibre-optic cables within circuits or power, of global networks of security and intelligence professionals, and of the minutiae of everyday social media practices. Three, research direction: the kinds of surveillance that have developed over several decades are heavily dependent on the digital – and, increasingly, on so-called big data -- but also extend beyond it. However, if there is a key issue raised by the Snowden revelations, it is the future of the internet. Information and its central conduits have become an unprecedented arena of political struggle, centred on surveillance and privacy. Those concepts themselves require rethinking.

One Warrant to Rule Them All: Re-Conceiving the Judicialization of Extraterritorial Intelligence Collection

Spies have always crossed borders. And in the close allied relationship between the so-called Five Eyes, intelligence has also crossed borders. These practices are occasionally controversial. Intelligence sharing was at the heart of the Maher Arar inquiry, examining the conduct by Canadian police in providing (incorrect) intelligence on Canadian Maher Arar that culminated in his maltreatment in Syria. Foreign electronic surveillance provoked sustained debate after the 2013 Snowden disclosures. More quietly, however, and sometimes clearly provoked by these public controversies, courts too have begun building legal pickets around these sorts of practices. In Canada, the result has been the ‘judicialisation’ of intelligence collection and sharing. This chapter examines recent developments in this area.

'Gendering Big Brother': What Should a Feminist Do?

Set in the context of an imaginary dialogue between a straight, white, middle-aged radical feminist law professor and her Cyber-feminism student, this paper explores various theories about stereotypes and other tools of discrimination, as well as the emancipatory potential of digitized communications for equality-seeking groups. It suggests that the Snowden revelations about widespread government surveillance of citizens and concerns around “big data” present an opportunity for coalition between feminists and civil libertarians on the issue of surveillance. In the final analysis though, the paper cautions that this context may simply reflect a moment of interest convergence in which collaboration is unlikely to produce real change for subordinated groups unless the discriminatory tropes that disproportionately expose members of subordinated groups to surveillance are first addressed.

Bridging the Cybersecurity Gap

There is a massive disconnect between the academic/civilian government cybersecurity community and the industry/defense/law enforcement cybersecurity community. This paper explores the causes of this disconnect and attempts to find common ground on which to develop legislative and policy responses to the incredible cybersecurity concerns facing the country. It concludes with a specific legislative and policy proposal. The disconnect between these cybersecurity communities is in a sense unsurprising – particularly following post-Snowden understandings of US intelligence policy. The academic/civilian government community has long been concerned with information security and surveillance. This community has long advocated encryption as a critical component of any approach to cybersecurity – this view has redoubled since the Snowden revelations. On the other side, the industry, defense, and law-enforcement communities largely do not view encryption as a meaningful part of a cybersecurity solution. Importantly, this is not because encryption conflicts with government surveillance – or other information gathering (e.g., subpoena) – efforts. Rather, it is because encryption does little to improve security; rather mitigates the effects of security breaches. Moreover, encryption introduces substantial complexity which can introduce new attack vectors, increasing risk. This captures an essential part of the disconnect between these communities: the difference between information and system security. Importantly, these lead to very different, and at times conflicting, policy foci. From here, the paper considers various components to policies that may improve cybersecurity – considering both issues that make cybersecurity challenging and approaches to addressing those issues. Perhaps most important, it considers the role of insecure software, insecure implementation of software (i.e., bad security practices), the importance of threat and data breach disclosure, and the difficulty of assessing liability. Based on this analysis, this paper proposes a policy approach to improving the current state of cybersecurity in the US. This proposal is based around a two-part statutory damages regime for data breaches: generally, firms that experience data breaches would be subject to substantial statutory damages, on a per-record and per-record-type, basis. For instance, there may be a fine of $5 per lost username, $15 per lost password, and $20 per lost SSN. But these damages would only apply to firms that do not have cybersecurity insurance; damages for firms that do have such insurance would be capped at actual damages. This approach would address liability and damages concerns; give firms access to sophisticated cybersecurity guidance; facilitate sharing of breach information without raising collusion or government surveillance concerns; and create strong incentives for sophisticated and resource-rich entities (the insurance industry) to promote better software design. The ultimate goal of this paper is not to “solve” cybersecurity – while the proposed policy would hopefully bring about meaningful improvements, it certainly would not “solve” cybersecurity. Rather, the more substantial goal is to identify some of the key impediments to meaningfully addressing cybersecurity issues – largely the competing high-level perspectives of various stakeholders – and to prompt discussion of viable policy prescriptions. * Not for poster consideration.

Is it Research or is it Spying? Thinking-Through Ethics in Big Data AI and Other Knowledge Sciences

“How to be a knowledge scientist after the Snowden revelations?” is a question we all have to ask as it becomes clear that our work and our students could be involved in the building of an unprecedented surveillance society. In this essay, we argue that this affects all the knowledge sciences such as AI, computational linguistics and the digital humanities. Asking the question calls for dialogue within and across the disciplines. In this article, we will position ourselves with respect to typical stances towards the relationship between (computer) technology and its uses in a surveillance society, and we will look at what we can learn from other fields. We will propose ways of addressing the question in teaching and in research, and conclude with a call to action.

Surveillance and Privacy in the Snowden Era

Surveillance and Privacy in the Snowden Era

“ABSOLUTE FRIENDS”: UNITED STATES ESPIONAGE AGAINST GERMANY AND PUBLIC INTERNATIONAL LAW

Since 2014, the USA stands accused of engaging in espionage against Germany, a NATO partner and supposedly close ally. Many, though by no means all of these allegations became known because of the Snowden revelations. In Germany, this has led to a public backlash and has caused many to criticize the German government’s feeble reaction. Against this backdrop, this article considers whether the alleged US conduct may have even gone beyond abusing Germany’s trust by actually violating public international law. After summarizing the main accusations, the state of the debate on the legality of espionage in international law will be analysed. This will allow the conclusion that there is so far no convincing answer to the question of whether espionage violates public international law or not. This is due to the imprecise, contradictory and changing definitions of the term “espionage”, but also, more importantly, to the fact that there is no necessity for international law to deal with “espionage”. Rather, customary international law already provides clear guidance as to the lawfulness or unlawfulness of most, if not all, activities commonly associated with espionage. A detailed legal analysis of the alleged US spying activities will confirm this proposition and reveal that US conduct, if proven, did indeed violate public international law in each case. The USA not being able to rely on any legal justification for its actions, Germany would consequently be well within its rights to adopt countermeasures.

Lawful Illegality: What Snowden Has Taught Us About the Legal Infrastructure of the Surveillance State

The Snowden revelations have revealed to us, with impressive documentation, the technical infrastructure of contemporary state surveillance. What is less obvious, but of great importance, is the revelation of the legal infrastructure of this surveillance. We need to stop thinking that the issue is illegal activity on the part of our national security agencies and instead start from the proposition that our national security agencies do understand themselves to be acting within the law. The problem, I argue, is that this legal infrastructure is best understood as one of “lawful illegality.” Unlike other discussions of the rule of law and terrorism, which have focused on the nature of emergencies and the perceived need to preserve executive discretion to respond to exceptional circumstances, I argue that state surveillance raises a very different rule of law question. Surveillance is a mode of rational social ordering and the question is whether it is in conflict with the deepest commitments of law as a mode of rational social ordering.I claim that the issues of secrecy, complexity, and jurisdiction work together to create “lawful” paths for state surveillance for national security purposes that are nevertheless in deep tension with a general commitment that this surveillance be subject to the oversight and accountability demanded by the rule of law. Throughout, I illustrate these issues with a set of examples largely taken from the Snowden revelations, with a Canadian perspective. These examples are not meant to provide an exhaustive overview of the issues but to highlight the importance of attending to these larger questions of legality if we are going to move forward and design a better system of oversight.