For real reform we must demand 'surveillance minimisation'

UK privacy expert : For real reform we must demand 'surveillance minimisation'

  by LIAT CLARK

A UK expert in online privacy and human rights has called for "surveillance minimisation", where monitoring is the exception not the rule. The practice, he says, will restore public trust, increase transparency and encourage the public to expect more from both their governments, and private companies carrying out their own potential privacy breaches through data collection.

Paul Bernal, a law academic from the University of East Anglia, will make the public call at the Computers, Privacy and Data Protection conference in Brussels today, 23 January, where global academics, civil liberties groups, legal experts, law enforcement and private companies including Facebook are coming together to debate the most prevalent issues affecting user privacy. The NSA is obviously due to be put under the microscope, and Wired.co.uk caught up with Bernal before his speech to delve into exactly how he thinks the power can be returned to the people.

"At the moment the debate is driven by those whose interests it is to have as much surveillance as possible, and they do their best to manage that debate, often being deliberately deceptive," said Bernal. "We need to find a language to oppose that deception, and to be able to say what we actually want."

The principle he wants to replace that conversation with is essentially very simple: do less surveillance. On the surface it does not sound like a particularly complex, groundbreaking response to the conversation. But put in context of President Obama's NSA "reforms", and it becomes a pertinent principle to start from. Rather than curtailing the agency's mass surveillance operations, Obama has worked to address some of the concerns relating to transparency and the phone metadata collection. It's been stipulated that all requests for information relate to a national security investigation (but that can of course be broad) and it's been made more difficult to carry out surveillance on world leaders (a drop in the ocean in the NSA's mass surveillance of the global public).

"What Obama said last week very specifically only answered the questions that he (or his advisers) seemed to think that people would care about," explains Bernal. "Phone metadata, for me, is not the most important issue -- internet surveillance is much wider than that -- but it's the one that people seem to care about, so it's the one Obama has done something (but not nearly enough) about. We need much more.

"I think he's only said the minimum that he or his advisers think he can get away with. He's still talking about continuing with mass surveillance, and putting controls only on the access stage."

Surveillance minimisation would mean that for every request for data there is a concrete reason -- that controls are put in place "at the gathering stage, not at the accessing stage". A mass sweeping would be defunct in this utopia. "At the moment the principle seems to be to gather all data, 'just in case', and put the controls in only at the accessing stage."

It would also apply to both the commercial and governmental sector. "One key lesson from Snowden's leaks is that governments use what commerce does, piggybacking on the massive data gathering systems built by Google, Facebook and so forth. We shouldn't be so simplistic as to care only about one or the other -- we need to be concerned with both."

Without this founding principle, says Bernal, we remain "at the mercy of the authorities' judgment at any time". It also means all that mass-collected data leaves the public vulnerable to "mission creep or hacking" -- i.e. if we have your data, we may as well check it for x, y and z, even if that wasn't the original intention. Bernal echoed the words of web founder Tim Berners-Lee by referring to the collective public conscience as being "chilled" by the revelation that their fate is in the hands of the authorities. It means that on top pf self-censorship being on the uptake, "classical civil liberties like freedom of assembly and association -- both online and offline -- are also at risk".

Initial implementation of the principle has to come from the people though. This is significant. Just as Obama only reacted to what he thought the public wanted, while keeping his agenda intact, the public needs to voice the principle of minimisation and tell governments that they must work to their citizen's agenda first and foremost, and to the founding principles of freedom. 

"Businesses are more likely to comply with things that they believe their customers want. Governments are more likely to implement things that they think are popular," said Bernal.

By informing and educating the public about privacy issues and their rights, concern will be suitably directed at the heart of the problem. "Once people care, things start to happen -- and then can come declarations, laws, business models and so forth. First we need the language, the ideas, the principles from which they grow. Surveillance minimisation is just intended to help the process of finding that language.

"In general, it appears that the more that people know about what is going on -- and more importantly understand what's going on -- the more they care. That goes for privacy invasions both by businesses and by governments. That means that transparency is important -- but that it's only a first step."

By returning the debate into the hands of the public, the conversation will also be moved away from the idea that the government is tirelessly working to strike a balance between the freedom of the individual and the security of a whole nation. According to Bernal, this focus is totally missing the point and is working to mislead public opinion away from the heart of the issue.

"Privacy is not just an individual issue -- privacy provides key protection for collective rights such as freedom of assembly, association and of expression. Internet surveillance doesn't just impinge on privacy, it impinges on all of these. Society simply functions better when people have a reasonable expectation of privacy -- so to characterise the right as an individual one, suggesting even that it's 'selfish' is to miscast the debate.

"Secondly, characterising the debate in that way makes the assumption that mass surveillance actually helps collective security -- when this is far from proven. The evidence in support of it has been hugely elusive, and there are downsides too. The real 'bad guys' are likely to be able to evade this kind of surveillance, and the amount of resources -- time, money, expertise -- wasted on mass surveillance could have been spent on the kind of 'traditional' intelligence work that does seem to work." 

Considering the fact that we have probably only been privy to a fraction of the surveillance being carried out by governments -- both because there are more of Snowden's leaks yet to be released, and much will be held back for national security reasons -- it's important to see the debate for what it truly is: just at the start. Obama may have delivered a handful of reforms that provide, more than anything else, the illusion of transparency and the illusion of a degree of public control through the introduction of a public interest advocate. But there have been no signs that the amount of surveillance already unveiled will slow at all.

"Currently, I suspect it's a reasonable assumption that pretty much every system has been compromised, and pretty much every activity is monitored," comments Bernal. "One thing to add here is that the deception perpetrated on us -- for example during the debate over the Communications Data Bill (the 'Snoopers' Charter') -- is an extra reason not to trust the authorities.

"And an extra reason that we should be demanding not just more transparency, but less surveillance."

http://www.wired.co.uk/news/archive/2014-01/23/surveillance-minimisation