Excerpt:
Yet the idea that one can hide in the crowd-“security through obscurity”, as some call it-is mostly fiction. The combination of powerful algorithms, greater processing power, almost limitless computer memory and huge capabilities in data collection mean that people are far more visible than many realise-to private firms if not to governments. Most people give away vast amounts of private personal information in exchange for services such as “free” e-mail (far from being the customer, they are the product: their attention and profile is being sold to advertisers). Every website can record the details of the visitor’s browser and computer settings that often make up a unique fingerprint.
After the Paris attacks, democratic societies can reasonably ask whether the right to remain anonymous, be it online or travelling around Europe, should remain near-absolute. As long as there is proper democratic oversight of those handling the data, Europeans will have to give up some anonymity to preserve the liberty and security that matter. In an open internet, the security of personal data and identities should be preserved with strong and ubiquitous encryption. In an open Europe, personal safety is best safeguarded by police and intelligence services sharing information as seamlessly as do the terrorists.
THE final text message from one of the Paris attackers was grim: On est parti on commence, “We’re off, we’re starting”. It was found on a mobile phone dumped in a bin near the Bataclan theatre, where gunmen killed 89 people at a rock concert on November 13th. The phone’s digital trail helped lead investigators to a flat in Paris that was raided by armed police on November 18th; the presumed mastermind, Abdelhamid Abaaoud, and two others died there during a siege. The spoor of another phone linked an abandoned suicide-vest to Salah Abdeslam, a plotter who fled to Belgium and is now the most wanted man in Europe.
The vast stores of digital information generated by everyday lives-communications data, CCTV footage, credit-card records and much more-are yielding invaluable clues about the attack and are helping guide the hunt for the surviving plotters. Yet it is also painfully apparent that much information that could and should be known is not: France complains that no European country had warned it that Mr Abaaoud, who fled to Syria and was wanted by the Belgian police, had returned to France though he must have passed one or other European frontier (the tip-off eventually came from Morocco). At least two attackers slipped into Europe via Greece, posing as refugees. Yet police forces do not have routine access to the database of asylum-seekers’ fingerprints.
All of which raises troubling questions: should the digital clues have been picked up sooner; do Western intelligence agencies and police forces share information properly; do they need to collect even more data and have greater powers to search it; and should encryption that scrambles data be regulated? In other words, the Paris attacks are forcing Europe once again to weigh the proper balance between security and privacy.
Picking up the pieces
Attitudes to data privacy in the West vary markedly between countries, not least because the debate has been polarised by the revelations of Edward Snowden, a fugitive contractor for America’s signals-intelligence outfit, the National Security Agency (NSA). He disclosed large-scale spying by America on its friends and foes alike. Some see Mr Snowden, who now lives in Moscow, as a heroic whistle-blower; Western spooks are furious about the damage he has caused.
Each government sets different rules for what spies may look at, and who should oversee them. These apply to what may be done by way of bulk collection (vacuuming up vast quantities of metadata, such as the destination of calls, in order to find patterns) and targeted surveillance (eavesdropping on the content of communications of a specific person or group). America and Britain gather the largest haystacks of data to seek traces of terrorists and criminals. In part they do so because they can: the biggest internet firms are American, and some of the most important undersea fibre-optic cables run from Britain.
America has an intelligence court, where judges must give warrants for surveillance that includes Americans’ private data; the system is also overseen by well-staffed congressional committees (though American privacy campaigners find even this too weak). In Britain responsibility for approving eavesdropping rests with the home secretary. France allows its intelligence and security services even looser reins, especially after theCharlie Hebdo murders in January.
The latest slaughter in Paris, and the subsequent manhunts in Brussels, the home or base of several of the attackers, suggest that European rules will shift further towards security. European interior ministers agreed on November 20th to make a renewed push to adopt a plan to share Passenger Name Record (PNR) data for all travellers to, from and within the European Union (it is being held up by the European Parliament because of concerns about data privacy). They also vowed to exchange more information about fighters travelling to and from Syria; check biometric data of all EU citizens at the external borders of the Schengen free-travel zone; and link European and national police databases more effectively.
The appetite for this is, understandably, strongest in France. It is weakest in Germany, which has a particularly fastidious approach to protecting data about its citizens: information can be shared only with the person’s explicit consent, or with specific (and rare) legal authorisation. That stems from the country’s grim past of Nazi and communist totalitarianism. Moreover Germany has suffered just one serious jihadist terror attack in recent times-when an Albanian Muslim shot dead two American airmen at Frankfurt airport in 2011. Germans reckon smugly that their foreign policy has been less reckless and therefore made fewer enemies. Germany’s Muslims, mainly of Turkish extraction, are more secular and less alienated than those of Arab origin in France’s banlieues. Germany’s safety also rests on good intelligence, both from its own agencies and from allies, notably America. This has thwarted several plots. On November 17th a Germany-Netherlands friendly football match in Hanover was cancelled for fear that it would be attacked with bombs.
In truth, Germany has yet to have an honest debate about its spooks’ powers. After Mr Snowden revealed that the NSA had perhaps tapped Angela Merkel’s mobile phone, the chancellor said sanctimoniously: “Spying among friends is just not on.” A parliamentary inquiry then found that Germany’s spies had been collaborating gratefully (subserviently, critics said) with America. They were also spying on other European governments, bodies such as the International Red Cross and Oxfam, and on individuals. So whereas France is giving its spies even more powers, Germany is drafting a law to rein them in. A new and beefed-up parliamentary committee, staffed with experts, will oversee Germany’s foreign and domestic spies.
For many privacy campaigners, even the most carefully monitored spooks should not be allowed to collect vast amounts of information. Many Europeans see digital privacy as a fundamental human right; America considers it mainly in terms of consumer protection, which allows exceptions to be made when national security is at stake. The idea that PNR data should be shared freely among European states, let alone with America, is contentious. The European Court of Justice has struck down the EU’s “Safe Harbour” agreement with America under which tech firms were allowed to move personal data across the Atlantic. It ruled that, because any data in America are subject to NSA snooping “on a generalised basis”, Europeans’ right to privacy was under threat. Britain is worried that the court may rule in a case next year that much of its electronic eavesdropping is simply illegal.
Beyond the collection of data, a related problem is encryption, which allows people to communicate so securely that even spy services such as the NSA cannot crack messages by brute force. The director of America’s FBI, James Comey, notes that the jihadists of Islamic State use encryption to communicate with new recruits, “going dark”, as he puts it. John Brennan, director of the CIA, says new capabilities make it “exceptionally difficult both technically as well as legally” to intercept terrorists’ communications. The Manhattan district attorney, Cyrus Vance, says “encryption blocks justice”: he cites 111 criminal cases in which his office had been unable to tap encrypted phones. A few days before the Paris attacks Jan Jambon, the Belgian interior minister, expressed concern that terrorists were communicating through internet-linked gaming consoles, saying: “PlayStation 4 is even more difficult to keep track of than WhatsApp.”
Law-enforcement officials worry about any kind of “no go” zones where their search warrants cannot reach. Just as child-abusers, gangsters and money-launderers can be hunted always and everywhere in the real world, the same should apply to cyberspace, they argue. Western spymasters, long used to having the upper hand because of their colossal abilities to collect, sift and crunch the data flowing across the internet, note with dismay that there are now some areas where an individual with a cheap computer may have the advantage: it is easy to scramble messages, and can be fiendishly hard to unscramble them without the encryption keys.
Security hawks want to counter the spread of encryption with four powers. First (in rising order of controversy), technology firms should be obliged to store messages that their clients send across their networks and from their devices, meaning that the government code-crackers at least have the raw material they need to work on. Second, companies should be required to crack any code they sell, when presented with a warrant. Third, they should be banned from selling computer programs (or apps, in the case of smartphones) which encrypt messages in a way that the provider of the service cannot break. And fourth, companies that sell encryption programs should build in deliberate weaknesses so that police (or spooks) can break the codes themselves.
The trouble with such proposals is that encryption is already widespread. Some law-abiding citizens and malefactors will switch to providers in countries that are not subject to tighter rules on encryption, or devise their own systems. Protonmail, for example, is a provider of heavily encrypted e-mail based in Switzerland, where it is protected by that country’s strong privacy laws. But even if foreign law-enforcement officials or intelligence agencies surmounted that obstacle, they would encounter another. Protonmail by design does not store its users’ messages on its servers, or hold copies of their encryption keys. Even the most ferocious government intervention cannot force firms to hand over things they do not have, or betray secrets they do not know.
Robert Hannigan, the director of GCHQ, the British signals-intelligence service, says that internet companies’ desire to be “neutral conduits of data and to sit outside or above politics” meant that they were, in effect, providing the “command-and-control networks of choice for terrorists and criminals”. It would be better to face up to such uncomfortable truths now, he wrote in the Financial Times, than in the “aftermath of greater violence”. Ten days later Islamic State killers struck Paris.
Forcing companies to weaken their encryption software arouses strong opposition among tech firms and privacy campaigners alike. America’s Information Technology Industry Council, which represents giants such as Apple and Microsoft, said: “Weakening security with the aim of advancing security simply does not make sense.” Compromising it would endanger the security of, among other things, the banking system and the electrical grid.
On this the tech firms are on strong ground: weakening encryption in the name of the fight against terrorism will make it easier for cyber-criminals and other malefactors to steal money, identities and more. If anything, the world needs more encryption, not less of it.
Cybercrime is booming (see breakdown in chart 1)-the global cost was up to $575 billion in 2014, according to a guesstimate by McAfee, a computer-security firm. Far too many people, firms, organisations and government agencies lack the skill or will to encrypt data consistently on their networks and computers, even when they hold sensitive information about others (see chart 2).
Encryption is the essential enabler of an increasingly digital world. It allows people to establish their identity reliably, and keeps transactions out of criminals’ reach. The simplest identifying protocol is a username and password, but these are easily guessed or stolen. Much better is to use so-called “two-factor authentication” which combines a permanent credential (such as a password) with one generated by an electronic device-for example a code produced on a mobile phone. These are not invulnerable, but criminals are lazy: just as burglars prefer a house with an open window to one with stout locks, cyber-criminals seek the easiest targets.
Stealing digital candy
Even big firms fail to understand cyber-security. Recent breaches at TalkTalk, a big British telecoms company, exposed a striking level of ignorance. Its chief executive, Dido Harding, was unable to say whether her company’s database of users’ personal and banking information was encrypted (it wasn’t). In America, prosecutors recently laid bare the way in which criminals stole 100m people’s personal details from companies such as JPMorgan Chase.
Governments have proven incompetent, too. A breach at America’s Office of Personnel Management led to the loss of sensitive information, including security clearances, on about 20m current and former federal employees. Given such a lamentable record, it would be hard to trust governments or firms to collect encryption keys and keep them safe.
Some Western spymasters accept the need for stronger encryption. Mr Hannigan says the idea that GCHQ wants to weaken it is a myth; what it seeks is access to stored information when it is needed to ensure national security and investigate serious crime. Perhaps Mr Hannigan is just being realistic. Or perhaps he is conceding that the pattern of terrorists’ communications-who is in touch with whom and when-can be just as important as the content of messages, which is often ambiguous anyway. Another possibility is that the intelligence agencies have learned how to crack at least some of the previously impenetrable codes. Neither the NSA nor GCHQ talks about rumours to this effect that have long trickled around the internet.
In any case, even the best encryption has a weakness, in the form of the humans at either end of the message. Encryption is best thought of as a tunnel between two computers. However deep, secret and well-protected it may be, it must have an entrance and an exit. At the point at which the message becomes visible or audible to human beings, it is also potentially accessible to snoopers: they can take an image off a screen, or a copy of whatever is typed on a keyboard, or, indeed, bug the room with a pinhole camera and microphone. So long as the authorities know which people and devices to concentrate on, they have a good chance of intercepting their communications. A draft bill on surveillance oversight now before the British Parliament would give explicit legal authority to GCHQ to break into computers and mobile phones for the first time.
All this suggests that, rather than attacking encryption, Western governments would do better to deal with a related but distinct problem: anonymity. On the internet users can adopt any name they want when they open an e-mail or social-media account, write comments on a web page or set up a website. People can buy and use a smartphone while giving flimsy or false personal details, or none at all. These freedoms are convenient and cherished. They allow people living under authoritarian regimes to mask their activities from the authorities. They allow people to experiment and play in private. But they also allow criminals and terrorists to hide.
Many countries now require those who buy mobile devices to provide some form of identification (Britain is an exception). But these rules are rarely enforced and the data collected are not shared automatically with law-enforcement authorities. Many countries are tightening their rules. Belgium is considering banning the sale of SIM cards-the chips that enable phones to connect to the mobile network-to customers without ID. Bangladesh is rolling out plans for biometric identification of all mobile-phone users. Nigeria has fined a big mobile-phone firm $5 billion for failing to register SIM cards properly-the authorities say that they are used by Boko Haram, a jihadist group.
Such moves are controversial. But in real life anonymity is constrained, too. In most countries it is not possible to drive a car without registration plates, a licence or insurance. Most require babies to be registered at birth, and issue numbers to track payments in and out of social-security systems. People do not expect to live in an anonymous house, draw an anonymous income or (nowadays) open an anonymous bank account. The history of technology is full of examples of belated regulation of new devices and capabilities. Cars and planes used not to have numbers; drones are now coming under scrutiny.
The strongest case for anonymity is the protection of privacy. It allows people to do things they would not do if their names were attached to those actions. Just as they have the right to slip into a busy street without being observed, goes the argument, so too should they have the right to go online anonymously.
Yet the idea that one can hide in the crowd-“security through obscurity”, as some call it-is mostly fiction. The combination of powerful algorithms, greater processing power, almost limitless computer memory and huge capabilities in data collection mean that people are far more visible than many realise-to private firms if not to governments. Most people give away vast amounts of private personal information in exchange for services such as “free” e-mail (far from being the customer, they are the product: their attention and profile is being sold to advertisers). Every website can record the details of the visitor’s browser and computer settings that often make up a unique fingerprint.
After the Paris attacks, democratic societies can reasonably ask whether the right to remain anonymous, be it online or travelling around Europe, should remain near-absolute. As long as there is proper democratic oversight of those handling the data, Europeans will have to give up some anonymity to preserve the liberty and security that matter. In an open internet, the security of personal data and identities should be preserved with strong and ubiquitous encryption. In an open Europe, personal safety is best safeguarded by police and intelligence services sharing information as seamlessly as do the terrorists.
No comments:
Post a Comment