---
schema_version: "library-reader-v1"
source_type: "original_book"
title: "Data and Goliath The Hidden Battles to Collect Your Data and Control Your World"
author: null
edition: null
publisher: null
year: null
isbn: "9780393244816"
library_document_id: "986eb0f2-d84e-42a0-a151-a1930391de43"
source_sha256: "73ac4b52441f5b9d571e4c35dc932aefa9638c03c9d30d990c4a88196e5b1b4a"
pdf_physical_page_count: 295
pdf_physical_page_index_base: 0
range_start: 120
range_count: 10
html_url: "https://workshop.closeclaw.top/api/ai/read/986eb0f2-d84e-42a0-a151-a1930391de43?start=120&limit=10"
markdown_url: "https://workshop.closeclaw.top/api/ai/read/986eb0f2-d84e-42a0-a151-a1930391de43.md?start=120&limit=10"
previous_url: "https://workshop.closeclaw.top/api/ai/read/986eb0f2-d84e-42a0-a151-a1930391de43.md?start=110&limit=10"
next_url: "https://workshop.closeclaw.top/api/ai/read/986eb0f2-d84e-42a0-a151-a1930391de43.md?start=130&limit=10"
---

# Data and Goliath The Hidden Battles to Collect Your Data and Control Your World

> 页码规则：PDF_PHYSICAL_PAGE_INDEX 是从 0 开始的权威文件物理页索引；PRINTED_PAGE 是页面中识别出的印刷页码，可能为空，二者不得混用。

## PDF_PHYSICAL_PAGE_INDEX=120 | PRINTED_PAGE=NOT_DETECTED

procedures which are publicly available and applied consistently in a fair and public hearing.

USER NOTIFICATION: Individuals should be notified of a decision authorizing surveillance of their communications. Except when a competent judicial authority finds that notice will harm an investigation, individuals should be provided an opportunity to challenge such surveillance before it occurs.

TRANSPARENCY: The government has an obligation to make enough information publicly available so that the general public can understand the scope and nature of its surveillance activities. The government should not generally prevent service providers from publishing details on the scope and nature of their own surveillance-related dealings with State.

PUBLIC OVERSIGHT: States should establish independent oversight mechanisms to ensure transparency and accountability of communications surveillance. Oversight mechanisms should have the authority to access all potentially relevant information about State actions.

INTEGRITY OF COMMUNICATIONS AND SYSTEMS: Service providers or hardware or software vendors should not be compelled to build surveillance capabilities or backdoors into their systems or to collect or retain particular information purely for State surveillance purposes.

SAFEGUARDS FOR INTERNATIONAL COOPERATION: On occasion, states may seek assistance from foreign service providers to conduct surveillance. This must be governed by clear and public agreements that ensure the most privacy-protective standard applicable is relied upon in each instance.

SAFEGUARDS AGAINST ILLEGITIMATE ACCESS: There should be civil and criminal penalties imposed on any party responsible for illegal electronic surveillance and those affected by surveillance must have access to legal mechanisms necessary for effective redress. Strong protection should also be afforded to whistleblowers who expose surveillance activities that threaten human rights.

I’m largely addressing the US, although the recommendations in this chapter are applicable elsewhere. In the US, the president can implement some of these recommendations unilaterally by executive order, some require congressional approval, and others require the passage of new legislation. Other countries have their own separation of powers with their own rules. In many countries, of course, implementing any of these recommendations would require radical changes in the government.

LESS SECRECY, MORE TRANSPARENCY

Since 9/11, the Bush and Obama administrations have repeatedly maintained that an extreme level of secrecy is necessary to prevent the enemy from knowing what we’re doing. The levels of secrecy we saw during World War I still make sense. Tactical facts can be very valuable for a limited time, and important to keep secret for that duration. And sometimes we need to keep larger secrets: our negotiating positions with other countries, the identities of foreign agents, military planning, and some areas of national intelligence. Getting back to the important difference between espionage and surveillance, our systems of espionage require a lot more secrecy than our systems of surveillance do.

However, we can be more transparent in many areas. Compare the intense secrecy surrounding NSA surveillance with a very similar domain where we routinely manage quite well without a lot of secrecy: police and crime-fighting. The Fourth Amendment regulates the police’s ability to conduct surveillance, and all the court rulings surrounding it are public. Criminals can read up on all of this, or hire a lawyer who understands it, and then create a detailed manual on how to precisely exploit any loopholes in the law. There are many loopholes, and plenty of defense attorneys who know their way through them. Yet police work continues undeterred, and criminals are routinely arrested and convicted.

## PDF_PHYSICAL_PAGE_INDEX=121 | PRINTED_PAGE=NOT_DETECTED

More generally, almost everything about police and crime-fighting is public. We know the budgets of all our nation’s police forces. We know their capabilities. We know how effective they are. We know what they do, and how well they do it. We don’t know the identities of undercover police officers, but we know generally how they’re used and what they can and cannot do. All of this is public, known by those of us who grant the police powers over us as well as those of us who want to commit crimes. Yet the police regularly manage to solve crimes.

This demonstrates that the current level of secrecy we have in counterterrorism is excessive. It applies a military level of secrecy to what has always been a domestic matter. Terrorists are not smarter and more formidable than organized crime. Terrorists don’t cause more damage or kill more people; we just fear them more. We need to transfer the traditional law enforcement transparency principles to national security, instead of increasing the secrecy surrounding law enforcement, as we have unfortunately begun to do. We have to design systems that keep us safe even if their details are public and known by the enemy. Secrets are harder to keep today, so we’re better off limiting their numbers.

In the 1980s, the US gave up trying to keep cryptography research secret, because all that did was put our mathematicians and engineers at a disadvantage with respect to their peers in other countries. More recently, the US has abandoned attempting to block research on creating biological viruses, because someone somewhere will publish the information regardless of what we do. Military thinkers now realize that many strategic military secrets are harder to keep because of the ubiquity of satellite imagery and other technologies. We need to think the same way about government secrecy surrounding surveillance.

Transparency laws for surveillance already exist in the US. The original 1968 wiretap law mandated extensive public reporting on the government’s use of wiretaps. The annual wiretap reports are over 200 pages long, and contain an enormous amount of detail. This made it possible for people to verify what the FBI was doing, and ensure that the agency wasn’t abusing its authority. The problem is that when other surveillance authorities were expanded after 9/11, no similar reporting requirements were established. We need to fix this.

The US government should publish detailed, unclassified descriptions of the scope and scale of intelligence gathering. It should publish the legal justifications for all intelligence programs. It should publish information on the type and amount of data collected under those different authorities, as well as details of minimization procedures and data retention rules. And it should declassify all general opinions of the FISA Court, which oversees NSA surveillance under FISA and the FISA Amendments Act. The names of the people and organizations being monitored are legitimately secret; the rules under which organizations operate are not.

MORE—AND BETTER—OVERSIGHT

To rein in NSA surveillance, we need much better oversight over both national intelligence and law enforcement.

## PDF_PHYSICAL_PAGE_INDEX=122 | PRINTED_PAGE=NOT_DETECTED

Strategic oversight comes first. The NSA has justified its actions by pointing to congressional oversight. Its leaders claim that agency staff merely follow the laws that Congress passes or the orders the president signs. According to one official press release, “NSA conducts all of its activities in accordance with applicable laws, regulations, and policies.” This is not true. In fact, it is deeply disingenuous. We know from recently declassified FISA Court opinions, especially those written by Judge John Bates, that the NSA frequently made misrepresentations to the court, did not follow minimization requirements, and regularly exceeded its legal authorizations.

The NSA has gamed the rules governing congressional oversight to ensure that no actual understanding or critical review happens. Documents the NSA provides to Congress are either propaganda pieces designed to convince or jargon-laden documents designed to confuse. Members of Congress can’t remove those documents from the secure room they’re stored in, nor can they remove any notes they make. They can only bring along security-cleared staffers to help them understand the meaning and significance of the material, but few lawmakers employ staffers with both a top-secret clearance level and appropriate expertise. Additionally, they’re lobbied heavily by the NSA. Senator Ron Wyden has stated that senior intelligence officials repeatedly made “misleading and deceptive statements” in congressional hearings. Senator Dianne Feinstein, chair of the Senate Select Committee on Intelligence and a longstanding supporter of government surveillance, regretfully concluded that her committee “was not satisfactorily informed” by the intelligence community about its activities. Congressman Alan Grayson of Florida called congressional oversight of the NSA a “joke.”

In 2014, I was invited by six members of Congress—members from both parties—to brief them on the NSA’s activities. Because I had reviewed many of the unpublished Snowden documents, I knew more about the NSA’s activities than they did. How can our democracy survive when the best information Congress can get about what the NSA was really doing comes from me?

On the other hand, many legislators don’t want to perform the oversight function assigned to Congress. Some of this reluctance stems from a desire for plausible deniability. It’s politically safer to let the executive branch make the decisions, then let it take the heat when something goes wrong. There’s also political risk in standing up to law enforcement. Few congressional committee members actually venture into that secure room.

The NSA interprets its authority very aggressively and self-servingly. In Chapter 5, I discussed the three different authorities the NSA uses to justify its surveillance activities: Executive Order 12333, Section 215 of the PATRIOT Act, and Section 702 of the FISA Amendments Act.

Executive Order 12333, the 1981 presidential document authorizing most of NSA’s surveillance, is incredibly permissive. It is supposed to primarily allow the NSA to conduct surveillance outside the US, but it gives the agency broad authority to collect data on Americans. It provides minimal protections for Americans’ data collected outside the US, and even less for the hundreds of millions of innocent non-Americans whose data is incidentally collected. Because this is a presidential directive and not a law, courts have no jurisdiction, and congressional oversight is minimal. Additionally, at least in 2007, the president believed he could modify or ignore it at will and in secret. As a result, we know very little about how Executive Order 12333 is being interpreted inside the NSA.

## PDF_PHYSICAL_PAGE_INDEX=123 | PRINTED_PAGE=NOT_DETECTED

Section 215 of the PATRIOT Act was never intended to authorize mass surveillance, and strong arguments can be made that the act’s language doesn’t allow it. The idea was that the FBI would be able to get information “relevant to an authorized [national security] investigation”—that is, about a specific subject of investigation—from a wider set of sources than it could previously. The example the administration talked about was information about what books a suspect checked out of the library; maybe he was reading The Anarchist’s Cookbook or something. In fact, when the bill was being debated, it was known as the “library provision.” It only empowered the FBI to demand information that it could have obtained with a grand jury subpoena—all metadata, no content—but it allowed it to do this without having to convene a grand jury. That made sense; there aren’t really grand juries in national security investigations.

However, after the PATRIOT Act was passed in 2001, the Department of Justice’s national security lawyers combed through the law looking for loopholes. Even though the law was intended to facilitate targeted surveillance, they decided it could be stretched to authorize mass surveillance. Even though it only empowered the FBI, they decided that the FBI could demand that information be sent to the NSA. At first they did this without any court approval at all. Eventually they decided to argue their case in front of the secret FISA Court. Because there was no one arguing the opposing position, they were able to convince a judge that everything was “relevant” to an investigation. This was a new interpretation of the word “relevant,” and one that doesn’t even pass the sniff test. If “relevant” doesn’t restrict collection because everything is relevant, then why was the limitation put into the law in the first place? Even Congressman Jim Sensenbrenner, the person who wrote the USA PATRIOT Act, was surprised when he learned that the NSA used it as a legal justification for collecting mass-surveillance data on Americans. “It’s like scooping up the entire ocean to guarantee you catch a fish,” he said.

Section 702 of the FISA Amendments Act was a little different. The provision was supposed to solve a very specific problem. Administration officials would draw diagrams: a terrorist in Saudi Arabia was talking to a terrorist in Cuba, and the data was flowing through the US, but the NSA had to eavesdrop outside of the US. This was inefficient, it argued, and Section 702 allowed it to grab that conversation from taps inside the US.

Again, there’s nothing in Section 702 that authorizes mass surveillance. The NSA justifies the use by abusing the word “incidental.” Everything is intercepted, both metadata and content, and automatically searched for items of interest. The NSA claims that only the things it wants to save count as searching. Everything else is incidental, and as long as its intended “target” is outside the US, it’s all okay. A useful analogy would be allowing police officers to search every house in the city without any probable cause or warrant, looking for a guy who normally lives in Bulgaria. They would save evidence of any crimes they happened to find, and then argue that none of the other searches counted because they hadn’t found anything, and what they found was admissable as evidence because it was “incidental” to the search for the Bulgarian. The Fourth Amendment specifically prohibits that sort of search as unreasonable, and for good reason.

## PDF_PHYSICAL_PAGE_INDEX=124 | PRINTED_PAGE=NOT_DETECTED

My guess is that by the time the FISA Amendments Act came around in 2008, the NSA knew what it was doing and deliberately wordsmithed the bill to allow for its preferred interpretation. Its leadership might have even briefed the Senate and House intelligence committees on how it was going to interpret that language. But they certainly didn’t brief all of Congress, and they never told the American people.

I believe that much of this will eventually be found to be unconstitutional. The Fourth Amendment protects not only against unreasonable searches but also against unreasonable seizures. I argued in Chapter 10 that computer searches are searches. The mere act of obtaining a copy of the data in bulk from companies like Verizon is an illegal seizure as well.

The problem is that all three branches of government have abrogated their responsibilities for oversight. The normal democratic process of taking a law, turning it into rules, and then turning those rules into procedures is open to interpretation every step of the way, and therefore requires oversight every step of the way. Without it, agencies abuse their power. We saw this in the 1970s, when the FBI and NSA illegally spied on Americans under projects SHAMROCK and MINARET, as well as under an unnamed program that was part of the war on drugs. And we’re seeing it again today.

Lest you think this is solely a US phenomenon, the same thing happened in the UK in 2000 around the passage of the Regulation of Investigatory Powers Act. Section 16(3), largely unnoticed when the bill was debated, has been used by GCHQ to spy on British citizens. It was intentionally drafted that way, with some members of Parliament in on it and stubbornly defending the obscure and convoluted language that didn’t actually legalize mass surveillance but nonetheless ended up being used to justify it. I believe the idea for FAA Section 702 came from RIPA Section 16(3).

In 2013, President Obama tried to reassure Americans that NSA surveillance programs are reviewed and approved by all three branches of government. His statement was deeply misleading. Before Snowden, the full range of government surveillance activity was known by only a few members of the executive branch, partially disclosed to a few senior members of the legislative branch, and approved by a single judge on the FISA Court—a court that rejected a mere 11 out of 34,000 warrant requests between its formation in 1979 and 2013. That’s not real oversight. However, to be fair, it’s much more oversight than you’ll find in other countries, including European democracies like France, Germany, and the UK.

Some members of Congress are trying to impose limits on the NSA, and some of their proposals have real teeth and might make a difference. Even so, I don’t have any hope of meaningful congressional reform right now, because all of the proposals focus on specific programs and authorities: the telephone metadata collection program under Section 215, bulk records collection under Section 702, and so on. It’s a piecemeal approach that can’t work. We are now beyond the stage where simple legal interventions can make a

## PDF_PHYSICAL_PAGE_INDEX=125 | PRINTED_PAGE=NOT_DETECTED

difference. There’s just too much secrecy, and too much shifting of programs amongst different legal justifications. When companies refuse National Security Letters, the government comes back with a Section 215 order. And the NSA has repeatedly threatened that if Congress limits its authority under Sections 215 and 702, it will shift curtailed programs to the more permissive, less regulated, and more secret EO 12333 authority.

There are other attempts at oversight. The president’s 2013 NSA review group had broad access to the agency’s capabilities and activities. They produced an excellent report outlining 46 policy recommendations, and President Obama agreed to implement many of them. The key question now is whether he will do so. In 2004, Congress created the Privacy and Civil Liberties Oversight Board on the recommendation of the 9/11 Commission to oversee national security issues. It was mostly unstaffed and unfunded until 2012, and has limited powers. (The group’s 2014 report only discussed NSA collection under Section 702. It was widely panned as inadequate.)

More members of Congress must commit to meaningful NSA reform. We need comprehensive strategic oversight by independent government agencies, based on full transparency. We need meaningful rules for minimizing data gathered and stored about Americans, rules that require the NSA to delete data to which it should not have access. In the 1970s, the Church Committee investigated intelligence gathering by the NSA, CIA, and FBI. It was able to reform these agencies only after extensive research and discovery. We need a similar committee now. We need to convince President Obama to adopt the recommendations of his own NSA review group. And we need to give the Privacy and Civil Liberties Oversight Board real investigative powers.

Those recommendations all pertain to strategic oversight of mass surveillance. Next, let’s consider tactical oversight. One primary mechanism for tactical oversight of government surveillance is the warrant process. Contrary to what many government officials argue, warrants do not harm security. They are a security mechanism, designed to protect us from government overreach.

Secret warrants don’t work nearly as well. The judges who oversee NSA actions are from the secret FISA Court. Compared with a traditional court, the FISA Court has a much lower standard of evidence before it issues a warrant. Its cases are secret, its rulings are secret, and no one from the other side ever presents in front of it. Given how unbalanced the process it is, it’s amazing that the FISA Court has shown as much backbone as it has in standing up to the NSA (despite almost never rejecting a warrant request).

Some surveillance orders bypass this process entirely. We know, for example, that US Cellular received only two judicially approved wiretap orders in 2012—and another 10,801 subpoenas for the same types of information without any judicial oversight whatsoever. All of this needs to be fixed.

Start with the FISA Court. It should be much more public. The FISA Court’s chief judge should become a position that requires Senate confirmation. The court should publish its opinions to the extent possible. An official public interest advocate should be assigned the task of arguing against surveillance applications. Congress should enact a process for appealing FISA rulings, either to some appellate court or to the Supreme

## PDF_PHYSICAL_PAGE_INDEX=126 | PRINTED_PAGE=NOT_DETECTED

Court.

But more steps are needed to put the NSA under credible tactical oversight. Its internal procedures are better suited to detecting activities such as inadvertent and incorrect surveillance targeting than they are to detecting people who deliberately circumvent surveillance controls, either individually or for the organization as a whole. To rectify this, an external auditor is essential. Making government officials personally responsible for overreaching and illegal behavior is also important. Not a single one of those NSA LOVEINT snoops was fired, let alone prosecuted. And Snowden was rebuffed repeatedly when he tried to express his concern internally about the extent of the NSA’s surveillance on Americans.

Other law enforcement agencies, like the FBI, have their own internal oversight mechanisms. Here, too, the more transparency, the better. We have always given the police extraordinary powers to investigate crime. We do this knowingly, and we are safer as a society because of it, because we regulate these actions and have some recourse to ensure that the police aren’t abusing them. We can argue about how well these are working in the US and other countries, but the general idea is a sound one.

PROTECT WHISTLEBLOWERS

Columbia law professor David Pozen contends that democracies need to be leaky— leaks and whistleblowing are themselves security mechanisms against an overreaching government. In his view, leaks serve as a counterpoint to the trend of overclassification and, ultimately, as a way for governments to win back the trust lost through excessive secrecy.

Ethnographer danah boyd has called whistleblowing the civil disobedience of the information age; it enables individuals to fight back against abuse by the powerful. The NGO Human Rights Watch wrote that “those who disclose official wrongdoing … perform an important service in a democratic society… .”

In this way of thinking, whistleblowers provide another oversight mechanism. You can think of them as a random surprise inspection. Just as we have laws to protect corporate whistleblowers, we need laws to protect government whistleblowers. Once they are in place, we could create a framework and rules for whistleblowing legally.

This would not mean that anyone is free to leak government secrets by claiming that he’s a whistleblower. It just means that conscience-driven disclosure of official wrongdoing would be a valid defense that a leaker could use in court—juries would have to decide whether it was justified—and that reporters would legally be able to keep their sources secret. The clever thing about this is that it sidesteps the difficult problem of defining “whistleblower,” and allows the courts to decide on a case-by-case basis whether someone’s actions qualify as such or not. Someone like Snowden would be allowed to return to the US and make his case in court, which—as I explained in Chapter 7— currently he cannot.

Additionally, we need laws that protect journalists who gain access to classified information. Public disclosure in itself is not espionage, and treating journalism as a crime is extraordinarily harmful to democracy.

## PDF_PHYSICAL_PAGE_INDEX=127 | PRINTED_PAGE=NOT_DETECTED

In Chapter 7, I mentioned the Obama administration’s overzealous prosecution of whistleblowers. That policy is both hypocritical and dangerous. We encourage individuals to blow the whistle on violations of law by private industry; we need to protect whistleblowing in government as well.

TARGET MORE NARROWLY, AND ONLY WITH JUDICIAL APPROVAL

Electronic surveillance is a valuable tool for both law enforcement and intelligence gathering, and one we should continue to use. The problem is electronic surveillance on the entire population, especially mass surveillance conducted outside of a narrow court order. As we saw in Chapter 11, it doesn’t make us any safer. In fact, it makes us less safe by diverting resources and attention from things that actually do make us safer. The solution is to limit data collection and return to targeted—and only targeted—surveillance.

Cybersecurity and information law researcher Axel Arnbak said about government surveillance, “The front door governed by law; the backdoor governed by game theory.” What he meant is that the targeted surveillance process is subject to probable cause, warrants, limits in scope, and other laws designed to protect our security and privacy. Mass surveillance is subject to an organization’s cold analyses of what it can collect and how likely it is to get away with it. When we give the NSA the ability to conduct mass surveillance by evading the warrant process, we allow NSA staff to think more in terms of what’s possible than in terms of what’s legal. We let them grow arrogant and greedy, and we pay the price.

Bulk surveillance turns the traditional investigative process on its head. Under a normal sequence of operations, law enforcement has reason to suspect an individual, and applies for a warrant to surveil that person. Bulk surveillance allows law enforcement to surveil everyone—to develop grounds for suspicion. This is expressly prohibited by the US Constitution, and with good reason. That’s why a 2014 UN report concluded that mass surveillance threatens international law.

We need legislation that compels intelligence agencies and law enforcement to target their surveillance: both new legislation and new enforcement of existing legislation. That combination will give law enforcement only the information it needs, and prevent abuse.

The US Supreme Court took a baby step in this direction in 2013 when it required police officers to obtain a warrant before attaching a GPS tracking device to a suspect’s car, and another in 2014 when it required police officers to obtain a warrant before searching the cell phones of people they stopped or arrested.

In the US, we need to overturn the antiquated third-party doctrine and recognize that information can still be private even if we have entrusted it to an online service provider. The police should need a warrant to access my mail, whether it is on paper in my home, on a computer at my work, or on Google’s servers somewhere in the world.

## PDF_PHYSICAL_PAGE_INDEX=128 | PRINTED_PAGE=NOT_DETECTED

Many of these issues are international. Making this work is going to mean recognizing that governments are obligated to protect the rights and freedoms not just of their own citizens but of every citizen in the world. This is new; US legal protections against surveillance don’t apply to non-US citizens outside the US. International agreements would need to recognize that a country’s duties don’t entirely stop at its borders. There are fundamental moral arguments for why we should do this, but there are also pragmatic ones. Protecting foreigners’ privacy rights helps protect our own, and the economic harms discussed in Chapter 9 stem from trampling on them.

FIX ALMOST ALL VULNERABILITIES

As I discussed in Chapter 11, a debate is going on about whether the US government —specifically, the NSA and US Cyber Command—should stockpile Internet vulnerabilities or disclose and fix them. It’s a complicated problem, and one that starkly illustrates the difficulty of separating attack and defense in cyberspace.

An arms race is raging in cyberspace right now. The Chinese, the Russians, and many other countries are also hoarding vulnerabilities. If we leave a vulnerability unpatched, we run the risk that another country will independently discover it and use it in a cyberweapon against us and our allies. But if we patch all the vulnerabilities we find, there goes our armory.

Some people believe the NSA should disclose and fix every bug it finds. Others claim that this would amount to unilateral disarmament. President Obama’s NSA review group recommended something in the middle: that vulnerabilities should only be hoarded in rare instances and for short periods of time. I have made this point myself. This is what the NSA, and by extension US Cyber Command, claims it is doing: balancing several factors, such as whether anyone else is likely to discover the vulnerability—remember NOBUS from Chapter 11—and how strategic it is for the US. The evidence, though, indicates that it hoards far more than it discloses.

This is backwards. We have to err on the side of disclosure. It will especially benefit countries that depend heavily on the Internet’s infrastructure, like the US. It will restore trust by demonstrating that we’re putting security ahead of surveillance. While stockpiled vulnerabilities need to be kept secret, the more we can open the process of deciding what kind of vulnerabilities to stockpile, the better. To do this properly, we require an independent government organization with appropriate technical expertise making the decisions.

In today’s cyberwar arms race, the world’s militaries are investing more money in finding and purchasing vulnerabilities than the commercial world is investing in fixing them. Their stockpiles affect the security of us all. No matter what cybercriminals do, no matter what other countries do, we in the US need to err on the side of security by fixing almost all the vulnerabilities we find and making the process for disclosure more public. This will keep us safer, while engendering trust both in US policy and in the technical underpinnings of the Internet.

## PDF_PHYSICAL_PAGE_INDEX=129 | PRINTED_PAGE=NOT_DETECTED

DON’T SUBVERT PRODUCTS OR STANDARDS

Trust is vitally important to society. It is personal, relative, situational, and fluid. It underpins everything we have accomplished as a species. We have to be able to trust one another, our institutions—both government and corporate—and the technological systems that make society function. As we build systems, we need to ensure they are trustworthy as well as effective.

The exact nature of Internet trust is interesting. Those of us who are techies never had any illusions that the Internet was secure, or that governments, criminals, hackers, and others couldn’t break into systems and networks if they were sufficiently skilled and motivated. We never trusted that the programmers were perfect, that the code was bugfree, or even that our crypto math was unbreakable. We knew that Internet security was an arms race and that the attackers had most of the advantages.

What we did trust was that the technologies would stand or fall on their own merits. Thanks to Snowden’s revelations, we now know that trust was misplaced. This is why the NSA’s and GCHQ’s surveillance programs have generated so much outcry around the world, and why the technical community is particularly outraged about the NSA’s subversion of Internet products, protocols, and standards. Those agencies’ actions have weakened the world’s trust in the technology behind the Internet.

I discussed in Chapter 6 that the FBI is continually trying to get laws passed to mandate backdoors into security. I discussed in Chapter 11 how the NSA is surreptitiously inserting backdoors into Internet products and protocols so it can spy. We also have to assume that other countries have been doing the same thing to their own products (and to each other’s). A number of observers have concluded that companies with Israeli development teams, such as Verint, Narent, and Amdocs, are in bed with the Israeli government, and that Huawei equipment is backdoored by the Chinese government. Do we trust US products made in China? Do we trust Israeli nationals working at Microsoft? Or hardware and software from Russia? France? Germany? Anything from anywhere?

This mistrust is poison. Security has to come first, eavesdropping second. Law enforcement can obtain a warrant and attempt to eavesdrop, but should not be able to force communications companies to guarantee that eavesdropping attempts will be successful. What we actually need to do is repeal CALEA and get back into the business of securing telephone networks and the Internet.

The response to this from law enforcement people is to try to frighten us with visions of kidnappers, pedophiles, drug dealers, and terrorists going scot-free because they can’t decrypt their computer and communications. We saw this in late 2014 when Apple finally encrypted iPhone data; one after the other, law enforcement officials raised the specter of kidnappers and child predators. This is a common fearmongering assertion, but no one has pointed to any actual cases where this was an issue. Of the 3,576 major offenses for which warrants were granted for communications interception in 2013, exactly one involved kidnapping—and the victim wasn’t a child. More importantly, there’s no evidence that encryption hampers criminal investigations in any serious way. In 2013, encryption foiled the police nine times, up from four in 2012—and the investigations proceeded in some other way.

下一段：[继续读取](https://workshop.closeclaw.top/api/ai/read/986eb0f2-d84e-42a0-a151-a1930391de43.md?start=130&limit=10)