Have security professionals helped make the privacy of citizens around the world ‘collateral damage’ in the hunt for terrorists?
Due to Edward Snowden’s disclosures we are now aware that millions of people have been unwittingly monitored by systems of indiscriminate surveillance. Many of these systems, having been developed in secret, were only possible due to the support of a large number of security professionals. We can suppose that the creators and operators of these systems are attempting to achieve legitimate objectives on behalf of their respective societies. What is less clear is if these systems do more harm than good or if the costs and risks of these activities have been fully understood, let alone accepted by the societies that bear the costs. Do the costs and potential harms of indiscriminate systems outweigh the benefits? Has privacy been compromised without due cause? If so, is it ethical for security professionals to support such systems?
The Privacy Verses Safety Debate
In seeking to answer these questions we need to weigh the pros and cons of indiscriminate surveillance. To do this we need to acknowledge that safety and privacy are both important concepts. The safety of citizens is an essential priority for a nation state. It is vital that intelligence services and law enforcement are able to deploy targeted surveillance to protect societies from harm. Usually this is achieved through the practice of warrants being issued by a judge upon probable cause which is widely accepted in societies around the world. The benefits of surveillance are twofold: there is the opportunity to detect and prevent an atrocity before it occurs and also the ability to hold the perpetrators to account after the event. 9/11 was a devastating shock that caused horror around the world. It was entirely appropriate that the United States reviewed its security abilities in order to protect its citizens.
Privacy is also an important concept because of the harm that can result to individuals from the uncontrolled disclosure of personal information. Life, liberty and the pursuit of happiness is impossible if we do not have the freedom to choose what information we want to share. Some argue that only those with something to hide need to worry which is extraordinarily naive. On a regular basis we choose not to share information with others such as that we’re pregnant, gay, lonely, irritated or any number of a thousand other human conditions. We do it every time we draw our curtains. We expect both privacy and confidentiality as a matter of course when we deal with our doctor, priest, lawyer and banker. Just as some find happiness by sharing their medical conditions on social media, others find solace by keeping to themselves. Privacy is in fact a fundamental human right which societies have formally defined at various points in history. The 4th Amendment, which prohibits government intrusion without probable cause, was a response to perceived colonial abuses involving Writs of Assistance in the 1700’s. These writs allowed officials on behalf of the British Crown to perform general searches at times and place of their discretion. The searchers were also indemnified against claims of harm from the individuals being searched. As you can imagine, these writs were somewhat unpopular and contributed to something of a minor rebellion. The scope of the Fourth Amendment was strengthened in Katz v. United States which held that people’s right to privacy extended beyond their property and applied to situations where they had a reasonable expectation of privacy such as a public phone booth. In Europe, privacy controls are enshrined in law through the Data Protection Principles. A central concept to these principles is proportionality. That is, the benefits of processing personal information need to be weighed against the potential harm that might result. Basically, it means that personal information should not be collected, let alone processed unless strictly necessary.
So, what is the safety verses privacy trade off being made through indiscriminate surveillance? Firstly let’s look at some of the claims that have been made for the benefits of indiscriminate surveillance. In the days following 9/11, we were told that there were approximately 5000 al-Qaeda supporters in the US and that it was a certainty that more attacks would be launched. When these predictions failed to eventuate, instead of questioning how common terrorists really were, the response of the intelligence agencies has been to look harder. The result is underwhelming. On multiple occasions the US government has been provided with the opportunity to make the case of why targeted surveillance has proved inadequate to deal with terrorist threats. In June 2013 General Alexander claimed that indiscriminate programmes had stopped 54 terrorist plots. In October it was revised to 13. Then it emerged that there was only one case that would not have been detected without indiscriminate surveillance – a San Diego man who sent money to an African militant group. To date, the US government has not made a case for a single terrorist attack that would have succeeded but for indiscriminate surveillance. The problem is the maths. Finding rare events in large populations produces astronomical numbers of false positives. Since terrorists are relatively rare and the population of the world is so large, even a method which allowed a detection confidence of 99% would throw up hundreds of thousands of false positives in a population the size of the US. The maths gets even worse if you take into account that detection rates are unlikely to be anywhere near 99%. Computers struggle just to recognise a cat let alone someone’s political intent or state of mind.
Absolute Surveillance Corrupts…And Leaks Eventually
Then let’s look at the costs. Surveillance is big business. US homeland security has cost a half a trillion dollars since 9/11. Politicians are afraid of being caught out if there is an atrocity. The public are scared from the rolling news coverage and vastly overestimate the likelihood of rare Black Swan events. The result is an ever expanding effort to ‘do something’. However, in addition to the vast fortunes that have been spent on a multitude of programmes, the longer term cost is what economists would call an externality. That is, the future harm to private individuals and businesses that is likely to result from surveillance information eventually being leaked or otherwise used inappropriately. Given a long enough time frame, everything leaks eventually. This is as true for UK MPs’ expenses as it is for US diplomatic cables. There is an inescapable maxim that the more information stockpiled, the greater the impact when it eventually leaks. The huge volumes of data being collected in specially built data centres will one day cause a spectacular fallout. Consider for a moment that there are over a million Americans with top secret security clearance. Nearly half of them are contractors. Those numbers are huge even before information is then shared throughout the Five Eyes intelligence community. Presumably, most of those who have access will have completed their security awareness training and only some of them have USB drives.
While there is a strong culture in America for supporting those in uniform and members of homeland security, like any large organisations, US and UK intelligence staff will be a mix of professionalism, diligence and conscientiousness and as well as ineptitude, malice and incompetence. An interesting test of trust is to ask what would happen if someone like J Edgar Hoover had access to everyone’s browsing history? Law enforcement agencies tend to be conservative institutions and from time to time do intervene in politics such as the FBI’s attempt to blackmail Martin Luther King.
While the proponents of widespread surveillance express noble intentions, the purpose of surveillance is largely irrelevant since the potential for harm still remains regardless of the intentions of those collecting the information. As the NSA has so visibly demonstrated, no organisation can guarantee the confidentiality of the information it holds.
A Problem of Trust
When considering the trade off between safety and privacy, there is also a question if the current surveillance regime in the NSA and the GCHQ can be trusted to operate it. It appears that those in charge of surveillance programmes have gone to significant efforts to deceive the public as to the scope, costs and risks of surveillance programmes. There have been word games, misdirection and outright falsehoods. The agencies involved appear to have out-manoeuvred the legal frameworks that they operated in. Defenders of US surveillance programmes have claimed that they were legal because they were governed by all three branches of government. However, as security professionals we usually look to confirm the effectiveness of a control, not just its existence. The mechanism for judicial oversight, FISA, has said that there was an “apparent widespread disregard of [Fisa court imposed] restrictions ” which seems to be legal speak for out of control. There are allegations that the Director of National Intelligence has lied to congress. Members of congress who were supposed to be providing oversight and were previously vocal defenders have now come forward to say they didn’t actually understand what was going on. In fact, all three branches of government are making the case for reform. Meanwhile, the defenders of the surveillance state continue to talk up threats in order to justify their budgets in an age when Americans are just as likely to be killed by falling furniture as a terrorist.
The UK intelligence services also have questions about their integrity. In 2012 the UK parliament considered and rejected a draft data communications bill to give more powers of surveillance to the security services. MP’s were not told that the bill covered activities that were already being performed in secret. While publicly stating that the UK agencies operated under a tough governance regime, internal documents released by Snowden show the GCHQ bragging about having a “light oversight regime compared with the US”. This is a very important statement given how weak we now know the US oversight to have been.
Are we able to trust these agencies if there is no mechanism for ordinary people to hold them to account? Another way of asking if we have an acceptable balance between the power of state surveillance agencies and the public is to look at the consequences that result from false positives and false negatives. The current overwhelming focus is on preventing an atrocity. Agencies face severe criticisms for false negatives where plots are missed. However, the costs to decision makers of false positives appear to be low or non-existent. People could find their lives ruined by mistakes with indiscriminate surveillance and there is no clear avenue for them to claim compensation or hold anyone to account.
So what should we conclude from the pros and cons of indiscriminate surveillance? The poor results from indiscriminate surveillance, the stored up future costs to privacy through breaches and problems trusting the agencies currently performing the surveillance all point to systems that do more harm than good. Major compromises to privacy have been made in exchange for minimal or non-existent gains in safety. It is possible that indiscriminate surveillance is justified, but such a conclusion is difficult to reach based on the evidence presented so far.
The Ethical Dilemma for Security Professionals
What does this mean for security professionals? Is it ethical to support indiscriminate surveillance programmes? One of the common responses to complaints about the activities of the NSA and GCHQ is to excuse them by alleging that other intelligence agencies are doing the same thing. While appealing at first glance, this position fails a basic test of ethics and morality. It is an argument that acts of harm are ok as long as other people do it too. Potentially, we’re having trouble recognising the moral frailty of the ethical positions adopted by ‘our’ intelligence agencies. Imagine for a second that Snowden had exposed the mass surveillance of Americans by China. Would the defenders of the NSA and GCHQ positions then defend the Chinese position by saying that everyone was doing it? What if China said that they had a secret court which provided oversight of their surveillance activities? Presumably that would make everything ok? Imagine for a moment how we would respond if there were allegations that that a major security vendor had accepted money from a Russian intelligence service to recommend a flawed security mechanism to its global customers.
Can we support the actions of any one state indiscriminately invading the privacy of people around the world and exposing them to future harm through leaks? If so then despite the privacy laws of our own countries, we are apparently legitimate targets for other countries since we have to plan for reciprocation. In the internet age, there will be no privacy left if each nation collects and then eventually leaks the personal information of foreigners. That would be a zero sum game where we all lose our privacy rights.
Is it ethical for security professionals to design or operate surveillance systems to break laws in other countries? Do the NSA and their agents have an exemption from privacy and hacking laws around the world? Yes, in so far as there are specific situations of necessity and there remain compelling reasons to support targeted surveillance. Indiscriminate surveillance however is by nature without probable cause and a test of balance or reasonableness is impossible. In society we have numerous situations where we allow agents of the state to break the rules. Fire engines and ambulance drivers exceed the speed limit. Armed police sometimes have to shoot and kill people. The common theme is that there is a principle of necessity. In each circumstance we expect to weigh the benefits against the costs and potential for harm. It seems unlikely on the evidence so far that the necessity of indiscriminate surveillance has been demonstrated in a way that convincingly outweighs future harm.
Snowden’s leaks have built a picture of intelligence agencies using surveillance simply because they can. Vast amounts of data are being stored, at great risk to the affected individuals, on the chance that it might one day be useful. Most of the professional security associations include requirements covering ethics and the public good. What if the public good and the objectives of surveillance agencies are divergent? Should we really leave the NSA alone to get on with its job? A lack of oversight and transparency in any organisation breeds ineffectiveness and inefficiency. If people are saying that they don’t want strong oversight of surveillance agencies then in addition to ignoring the harm to individuals that will result, they’re also saying it’s ok for these agencies to waste a lot of money and not be terribly effective.
What Next for Security Professionals?
As a profession, we need to start having a conversation about what we think is acceptable behaviour for security professionals. The medical profession is starting to confront how its members were co-opted to cause harm in the war on terror and it’s time that the security profession did the same. If as a profession we did reach the conclusion that indiscriminate surveillance in support of American and British interests was acceptable then where do we draw the line? How do we feel about being paid to do the same for Canada? Or Italy? How about Egypt? What about if North Korea was hiring? For some security professionals these are real questions that they’ve already had to face.
So there’s the choice laid bare for the security profession – the money or the ethics. It seems that the profession has sleepwalked into implementing and supporting systems that have the potential for disproportionate harm. These systems exist predominantly because the customers of this service, the public, have been the subject of a deception campaign. ‘I was only following purchase orders’ as a variation on the Nuremberg defence is hardly an ethical position for a supposed ethical profession. To remain silent on the issue of indiscriminate surveillance gives the appearance of consent and the perception that the only thing the security profession stands for is the US national anthem. If the ‘highest ethical principles’ and compliance with ‘all applicable laws’ isn’t actually what the security profession is about then perhaps we ought to update our stationery.
Published in the March 2014 edition of the ISSA International Journal.