Data and Goliath The Hidden Battles to Collect Your Data and Control Your World

Solutions for the Rest of Us

Surveillance is both a technological and a legal problem. Technological solutions are often available to the user. We can use various privacy and anonymity technologies to protect our data and identities. These are effective, but can be thwarted by secret government orders. We need to fight the political battle as well.

Political solutions require group effort, but are generally limited to specific countries. Technological solutions have the potential to be global. If Microsoft designs its Windows operating system with ubiquitous file encryption, or if the Internet Engineering Task Force decides that all Internet traffic will be encrypted by default, then those changes will affect everyone in the world who uses those products and protocols.

The point is that politics can undermine technology, and also that technology can undermine politics. Neither trumps the other. If we are going to fix things, we need to fight on both the technological and the political fronts. And it’s not just up to governments and corporations. We the people have a lot of work to do here.

DEFEND AGAINST SURVEILLANCE

Law professor Eben Moglen wrote, “If we are not doing anything wrong, then we have a right to do everything we can to maintain the traditional balance between us and power that is listening. We have a right to be obscure. We have a right to mumble. We have a right to speak languages they do not get. We have a right to meet when and where and how we please.” If a policeman sits down within earshot, it’s within your rights to move your conversation someplace else. If the FBI parks a van bristling with cameras outside your house, you are perfectly justified in closing your blinds.

Likewise, there are many ways we personally can protect our data and defend ourselves against surveillance. I’m going to break them down into categories.

Avoid Surveillance. You can alter your behavior to avoid surveillance. You can pay for things in cash instead of using a credit card, or deliberately alter your driving route to avoid traffic cameras. You can refrain from creating Facebook pages for your children, and tagging photos of them online. You can refrain from using Google Calendar, or webmail, or cloud backup. You can use DuckDuckGo for Internet searches. You can leave your cell phone at home: an easy, if inconvenient, way to avoid being tracked. More pointedly, you can leave your computer and cell phone at home when you travel to countries like China and Russia, and only use loaner equipment.

You can avoid activating automatic surveillance systems by deliberately not tripping their detection algorithms. For example, you can keep your cash transactions under the threshold over which financial institutions must report the transaction to the feds. You can decline to discuss certain topics in e-mail. In China, where automatic surveillance is common, people sometimes write messages on paper, then send photographs of those messages over the Internet. It won’t help at all against targeted surveillance, but it’s much harder for automatic systems to monitor. Steganography—hiding messages in otherwise innocuous image files—is a similar technique.

15

Block Surveillance. This is the most important thing we can do to defend ourselves. The NSA might have a larger budget than the rest of the world’s national intelligence agencies combined, but it’s not made of magic. Neither are any of the world’s other national intelligence agencies. Effective defense leverages economics, physics, and math. While the national security agencies of the large powerful countries are going to be able to defeat anything you can do if they want to target you personally, mass surveillance relies on easy access to our data. Good defense will force those who want to surveil us to choose their targets, and they simply don’t have the resources to target everyone.

Privacy enhancing technologies, or PETs, can help you block mass surveillance. Lots of technologies are available to protect your data. For example, there are easy-to-use plugins for browsers that monitor and block sites that track you as you wander the Internet: Lightbeam, Privacy Badger, Disconnect, Ghostery, FlashBlock, and others. Remember that the private browsing option on your browser only deletes data locally. So while it’s useful for hiding your porn viewing habits from your spouse, it doesn’t block Internet tracking.

The most important PET is encryption. Encrypting your hard drive with Microsoft’s BitLocker or Apple’s FileVault is trivially easy and completely transparent. (Last year, I recommended TrueCrypt, but the developers stopped maintaining the program in 2014 under mysterious circumstances, and no one knows what to think about it.) You can use a chat encryption program like Off the Record, which is user-friendly and secure. Cryptocat is also worth looking at. If you use cloud storage, choose a company that provides encryption. I like Spideroak, but there are others. There are encryption programs for Internet voice: Silent Circle, TORFone, RedPhone, Blackphone.

Try to use an e-mail encryption plug-in like PGP. Google is now offering encrypted email for its users. You’ll lose some search and organization functionality, but the increased privacy might be worth it.

TLS—formerly SSL—is a protocol that encrypts some of your web browsing. It’s what happens automatically, in the background, when you see “https” at the beginning of a URL instead of “http.” Many websites offer this as an option, but not as a default. You can make sure it’s always on wherever possible by running a browser plug-in called HTTPS Everywhere.

This is not meant to be a comprehensive list. That would take its own book, and it would be obsolete within months. Technology is always changing; go on the Internet to find out what’s being recommended.

I’m not going to lead you on; many PETs will be beyond the capabilities of the average reader of this book. PGP e-mail encryption, especially, is very annoying to use.

The most effective encryption tools are the ones that run in the background even when you’re not aware of them, like HTTPS Everywhere and hard-drive encryption programs. In Chapter 14, I discussed some things companies are doing to secure the data of their users. Much more is going on behind the scenes. The standards bodies that run the Internet are sufficiently incensed at government surveillance that they’re working to make encryption more ubiquitous online. Hopefully there will be more options by the time this book is published. Also remember that there’s a lot that encryption can’t protect. Google encrypts your connection to Gmail by default, and encrypts your mail as it sits on its servers and flows around its network. But Google processes your mail, so it has a copy of the keys. The same is true for anything you send to any social networking site. Most metadata can’t be encrypted. So while you can encrypt the contents of your email, the To and From lines need to be unencrypted so the e-mail system can deliver messages. Similarly, your cell phone can encrypt your voice conversations, but the phone numbers you dial, the location of your phone, and your phone’s ID number all need to be unencrypted. And while you can encrypt your credit card data when you send it over the Internet to an online retailer, that company needs your name and address so it can mail your purchases to you. And finally, encryption doesn’t protect your computer while in use. You can still be hacked, either by criminals or governments. But, again, this is likely to be targeted surveillance rather than mass. All this means that while encryption is an important part of the solution, it’s not the whole of it. The current best tool to protect your anonymity when browsing the web is Tor. It’s pretty easy to use and, as far as we know, it’s secure. Similarly, various proxies can be used to evade surveillance and censorship. The program Onionshare anonymously sends files over the Internet using Tor. Against some adversaries, web proxies are adequate anonymity tools. There are more low-tech things you can do to block surveillance. You can turn location services off on your smartphone when you don’t need it, and try to make informed decisions about which apps may access your location and other data. You can refrain from posting identifying details on public sites. When Snowden first met journalists in Hong Kong, he made them all put their cell phones in a refrigerator to block all signals to and from the devices, so they couldn’t be remotely turned into listening devices. Sometimes surveillance blocking is remarkably simple. A sticker placed over a computer’s camera can prevent someone who controls it remotely from taking pictures of you. You can leave the return address off an envelope to limit what data the post office can collect. You can hire someone to walk behind your car to obscure your license plate from automatic scanners, as people do in Tehran. Sometimes it is as easy as saying “no”: refusing to divulge personal information on forms when asked, not giving your phone number to a sales clerk at a store, and so on. Some sorts of blocking behaviors are illegal: you’re not allowed to actually cover your

car’s license plate. Others are socially discouraged, like walking around town wearing a mask. And still others will get you funny looks, like wearing face paint to fool facial recognition cameras or special clothing to confuse drones.

Distort Surveillance. I have my browser configured to delete my cookies every time I close it, which I do multiple times a day. I am still being surveilled, but now it’s much harder to tie all those small surveillances back to me and ads don’t follow me around. When I shop at Safeway, I use a friend’s frequent shopper number. That ends up distorting the store’s surveillance of her.

Sometimes this is called obfuscation, and there are lots of tricks, once you start thinking about it. You can swap retailer affinity cards with your friends and neighbors. You can dress in drag. In Cory Doctorow’s 2008 book, Little Brother, the lead character puts rocks in his shoes to alter the way he walks, to fool gait recognition systems.

There is also safety in numbers. As long as there are places in the world where PETs keep people alive, the more we use them, the more secure they are. It’s like envelopes. If everyone used postcards by default, the few who used envelopes would be suspect. Since almost everyone uses envelopes, those who really need the privacy of an envelope don’t stand out. This is especially true for an anonymity service like Tor, which relies on many people using it to obscure the identities of everyone.

You can also, and I know someone who does this, search for random names on Facebook to confuse it about whom you really know. At best, this is a partial solution; data analysis is a signal-to-noise problem, and adding random noise makes the analysis harder.

You can give false information on web forms or when asked. (Your kids do it all the time.) For years, well before consumer tracking became the norm, Radio Shack stores would routinely ask their customers for their addresses and phone numbers. For a while I just refused, but that was socially awkward. Instead, I got in the habit of replying with “9800 Savage Road, Columbia, MD, 20755”: the address of the NSA. When I told this story to a colleague some years ago, he said that he always gave out the address “1600 Pennsylvania Avenue, Washington, DC.” He insisted that no one recognized it.

You can also get a credit card in another name. There’s nothing shady about it, just ask your credit card company for a second card in another name tied to your account. As long as the merchant doesn’t ask for ID, you can use it.

Deception can be extremely powerful if used sparingly. I remember a story about a group of activists in Morocco. Those who didn’t carry cell phones were tracked physically by the secret police and occasionally beaten up. Those who did weren’t, and could therefore leave their phones home when they really needed to hide their movements. More generally, if you close off all the enemy’s intelligence channels, you close off your ability to deceive him.

Break Surveillance. Depending on the technology, you can break some surveillance systems. You can sever the wires powering automatic speed traps on roads. You can spraypaint the lenses of security cameras. If you’re a good enough hacker, you can disable

Internet surveillance systems, delete or poison surveillance databases, or otherwise monkey wrench. Pretty much everything in this category is illegal, so beware.

Some of these methods are harder than others. Some of us will be able to do more than others. Many people enter random information into web forms. Far fewer people—I’ve only ever met one who did this—search for random things on Google to muddle up their profiles. Many of these behaviors carry social, time, or monetary costs, not to mention the psychological burden of constant paranoia. I rarely sign up for retail affinity cards, and that means I miss out on discounts. I don’t use Gmail, and I never access my e-mail via the web. I don’t have a personal Facebook account, and that means I’m not as connected with my friends as I might otherwise be. But I do carry a cell phone pretty much everywhere I go, and I collect frequent flier miles whenever possible, which means I let those companies track me. You’ll find your own sweet spot.

We should all do what we can, because we believe that our privacy is important and that we need to exercise our rights lest we lose them. But for Pete’s sake, don’t take those silly online surveys unless you know where your data is going to end up.

AID GOVERNMENT SURVEILLANCE

A call to help the government in its surveillance efforts might seem out of place in this book, but hear me out.

There are legitimate needs for government surveillance, both law enforcement and intelligence needs, and we should recognize that. More importantly, we need to support legitimate surveillance, and work on ways for these groups to do what they need to do without violating privacy, subverting security, and infringing upon citizens’ right to be free of unreasonable suspicion and observation. If we can provide law enforcement people with new ways to investigate crime, they’ll stop demanding that security be subverted for their benefit.

Geopolitical conflicts aren’t going away, and foreign intelligence is a singular tool to navigate these incidents. As I write this in the late summer of 2014, Russia is amassing forces against Ukraine, China is bullying Japan and Korea in the South China Sea, Uighur terrorists are killing Han Chinese, Israel is attacking Gaza, Qatar and Turkey are helping Gaza defend itself, Afghanistan is a chaotic mess, Libya is in decline, Egypt is back to a dictatorship, Iran’s nuclear program might be resuming, Ebola is sweeping West Africa, North Korea is testing new missiles, Syria is killing its own people, and much of Iraq is controlled by a nominally Islamic extremist organization known as ISIS. And this is just the stuff that makes the news. When you read this book, the list will be different but no less serious. I assure you that no one in the White House is calling for the NSA to minimize collection of data on these and similar threats. Nor should they.

Additionally, governments around the world have a pervasive fear of cyberattack. A lot of this is overreaction, but there are real risks. And cyberdefense is mired in a classic collective action problem. Most of the infrastructure of cyberspace is in private hands, but most of the harm of a major cyberattack will be felt by the population as a whole. This

means that it’s not going to work long-term to trust the companies that control our infrastructure to adequately protect that infrastructure. Some sort of government involvement is necessary. In 2013, NSA director General Keith Alexander said, “I can’t defend the country until I’m into all the networks.” That’s the prevailing view in Washington.

Yes, we need to figure out how much we want the NSA in all of our networks. But we also need to help the NSA not want to get into all of our networks. If we can give governments new ways to collect data on hostile nations, terrorist groups, and global criminal elements, they’ll have less need to go to the extreme measures I’ve detailed in this book. This is a genuine call for new ideas, new tools, and new techniques. Honestly, I don’t know what the solutions will look like. There’s a middle road, and it’s up to us to find it.

This isn’t a task for everyone. It’s something for industry, academia, and those of us who understand and work with the technologies. But it’s an important task, and not one that either the intelligence or the law enforcement communities will do for us. If we want organizations like the NSA to protect our privacy, we’re going to have to give them new ways to perform their intelligence jobs.

CHOOSE YOUR ALLIES AND ENEMIES

Our laws are based on geographical location. For most of human history, this made a lot of sense. It makes less sense when it comes to the Internet; the Internet is just too international.

You’re obviously subject to the legal rules of the country you live in, but when you’re online, things get more complicated. You’re going to be affected by the rules of the country your hardware manufacturer lives in, the rules of the country your software vendor lives in, and the rules of the country your online cloud application provider lives in. You’re going to be affected by the rules of the country where your data resides, and the rules of whatever countries your data passes through as it moves around the Internet.

The PATRIOT Act, for example, compels US companies to turn data over to the US government when asked, no matter where it is stored. You might be a French citizen living in France, and Microsoft might store your e-mail solely on servers in Ireland. But because Microsoft is a US company, the US maintains that it is compelled to produce your data on demand. The UK wants similar access.

This means you have to decide: which countries do you trust with your data, and which companies do you trust with your data?

Corporations are not all equally bad. You can get your e-mail, calendar, and address book from either Google or Apple. They will both protect your data from bulk government collection, but will give your data to many of the world’s governments when legally compelled. Google is embarking on a major project to improve the security of its users against government surveillance. But Google is in the business of collecting your data and using it for advertising, whereas Apple’s business model protects its customers’ privacy.

Do you trust a company in the US that is unfettered in what it can do with your data and is also subject to NSA and FBI legal requests? Or do you trust a company in Europe that is tightly regulated by the government with regard to corporate surveillance, but is also subject to unfettered surveillance by both its own government and that of the US, and whose use means your data crosses international borders? If you don’t buy networking equipment from Cisco because you are concerned about NSA backdoors, whom will you buy it from? Huawei? Remember my feudal analogy from Chapter 4; which lord do you trust more?

It is hard to know where to start. In today’s cloud computing world, we often have no idea which companies actually host our data. An Internet company like Orbitz might host its infrastructure on a provider like Atlassian, which in turn hosts its infrastructure on a provider like Rackspace. Do you have any idea where your Orbitz data actually is?

We need to be able to know where our data is stored, and to specify which countries we want our data stored in, and which countries we want our data never to go near. In the meantime, we have to do the best we can. And recognize that in most cases we simply don’t know.

But when it comes to governments, unhappy as I am to say it, I would rather be eavesdropped on by the US government than by many other regimes.

AGITATE FOR POLITICAL CHANGE

In 2014, the European Court of Justice struck down the EU’s data retention rules, which required service providers to save e-mail and information about phone calls for two years. In response, the UK government rushed through a new law that reinstated the data retention requirement and also gave the police new surveillance powers over its citizens. It was an ugly political railroad job, but what’s interesting is how Prime Minister David Cameron justified the law on a radio program: “I am simply not prepared to be a prime minister who has to address the people after a terrorist incident and explain that I could have done more to prevent it.”

That’s fear talking, but it’s not fear of terrorists. It’s political fear of being blamed when there’s a terrorist attack. The career politician wants to do everything possible, regardless of the cost, regardless of whether it actually makes anyone safer, regardless of the side effects, to avoid blame for not having done enough. This fear explains most post-9/11 anti-terrorism policy, and much of the NSA’s mass-surveillance programs. Our politicians are scared that we’ll blame them because they didn’t do everything the intelligence agencies said they could have done to prevent further terrorism.

We have to convince them—and our fellow voters—that they should do the right thing anyway.

Most of the solutions offered in the preceding two chapters require the government to either enforce existing laws or change the law. By and large, neither of these things will happen unless we demand them. Politicians are reluctant to engage in these debates, and even more reluctant to enact meaningful constraints on government surveillance.

Legislatures are naturally deferential to law enforcement demands, and the vast surveillance-industrial complex employs a powerful lobbying force to back them up. No one wants to be painted as being soft on crime or terrorism. And today, when US intelligence agencies are caught breaking the law, the only ones threatened with jail time are the whistleblowers.

On the corporate side, throngs of lobbyists are doing their best to ensure that there’s no meaningful reform of corporate surveillance. Free markets are held up as a justification to continue to do nothing. And the police and the national security apparatus are also pushing to ensure that all of our data remains available to them for their own use.

If we want our legislators to vote against the powerful interests of the military, law enforcement, and lobbyist-laden corporations (both the ones that supply the government and the ones that spy on us directly), we’re going to have to make ourselves even more powerful. And that means we have to engage in the political process. I have three specific recommendations here.

Notice Surveillance. This is the first step. Lots of surveillance is hidden, but not completely invisible. The cameras might be small, but you can still see most of them if you look. You can notice when someone scans your ID when you enter a bar. You can install a browser plug-in and see who’s tracking you online. You can pay attention to news stories about surveillance. There are online sites that identify surveillance cameras. The more you know, the more you’ll understand what’s going on.

Talk about Surveillance. This is the next step. The more we talk about it, the more people realize what’s going on. And the more they realize what’s going on, the more they’re going to care about it. And the more we talk about it publicly, the more our elected representatives will realize that we care about it.

I mean this very generally. Talk about surveillance with your family, friends, and colleagues. Don’t be one of those annoying people who never posts about anything else, but share interesting news stories on social media. Attend rallies and sign petitions. Write to your elected representatives. Give copies of this book to all your friends as gifts. Make your opinions known. This is important.

Talk about the laws in your country. What kinds of government surveillance are legal in your country? How are your country’s businesses complicit in this, and what sorts of surveillance are legal for them to conduct? What rights do people have to use privacy enhancing technologies? Find out.

One of the most surreal aspects of the NSA stories based on the Snowden documents is how they made even the most paranoid conspiracy theorists seem like paragons of reason and common sense. It’s easy to forget the details and fall back into complacency; only continued discussion of the details can prevent this.

Organize Politically. This is our most effective strategy. There are many good recent examples of people organizing against surveillance: South Korean teachers objecting to new student databases, German consumers opposing RFID-enabled shopping carts, Facebook users objecting to new terms of service, US airline travelers objecting to airport full-body scanners. The campaigns are not always successful and the outcomes are imperfect, but the significance of collective action can’t be overstated. We need to see these problems as common to us all, and the solutions as general.

This isn’t a book about political organizing, and there are far better people than me at advising how to agitate for political change. I do know that politics isn’t just something that happens at election times. It’s a continual process that involves engaging with legislators, protesting in public, and supporting relevant nonprofit groups. Look at the Electronic Frontier Foundation, the Electronic Privacy Information Center, the Center for Democracy and Technology, Privacy International, the Open Technology Institute, and others. They’re all fighting for more privacy and less surveillance. Help them.

There’s nothing we can do about much of the world, of course, but we can push for change where we can. And then we can slowly move outwards. It’s how worldwide change happens.

DON’T GIVE UP

Fatalism is the enemy of change. Fatalism as in: governments and large corporations are both all-powerful, and the majority of politicians have no desire to restrain either of them, so there’s nothing we can do to change things. And fatalism as in: mass surveillance is so ubiquitous that there’s nothing we can do to resist it, and resistance only makes us more interesting to them anyway.

The assertions have some truth to them, but the conclusions are false. Good computer security and pervasive encryption make mass surveillance difficult. Choosing companies to do business with on the basis of their privacy policies makes companies more likely to have good privacy policies. Political organization is effective. Our infatuation with big data and our irrational fear of terrorism will both wane over time. Laws will eventually constrain both government and corporate power on the Internet.

The policy shifts I advise are major, and they’re going to take work. Every major policy shift in history looked futile in the beginning. That’s just the way of it. We need to fight for political change, and we need to keep fighting until we prevail. And until then, there are lots of little battles we can win along the way.

There is strength in numbers, and if the public outcry grows, governments and corporations will be forced to respond. We are trying to prevent an authoritarian government like the one portrayed in Orwell’s Nineteen Eighty-Four, and a corporateruled state like the ones portrayed in countless dystopian cyberpunk science fiction novels. We are nowhere near either of those endpoints, but the train is moving in both those directions, and we need to apply the brakes.