A BRIEF GUIDE TO COMBATTING MASS SURVEILLANCE

by Vera Wilde

Mass surveillance has been the norm for decades, and is growing rather than shrinking even as public knowledge of it increases. Spy agencies surveil entire countries the world over, targeting political dissidents and minorities more than terrorists and subverting the free expression essential to democratic processes. These practices harm liberty and security alike according to the math. The spy agencies know this and proceed anyway, because mass spying enables highly lucrative economic espionage. But the same technological vulnerabilities that enable mass spying by governments on their own people also enable widespread hacking by foreign intelligence services and criminals—and attribution of attacks is all but impossible. This is not an imagined dystopian future, but reality today. How do we end mass surveillance?

It’s a question many are asking as Donald Trump prepares to take power over the surveillance economy President Obama significantly expanded. But it’s like asking how we end racism. There is no official racist policy behind many laws and practices that end up having tremendously racially disparate effects, entrenching structural inequalities as effectively as Jim Crow laws—the old regime for enforcing explicit racial segregation in the U.S. South. So there is no Racism Policy to end. And there is no We. To paraphrase Walt Whitman, individuals, organizations, governments, and supra-national alliances all contain multitudes.

Ending mass surveillance is impossible for these reasons, and because it’s like plastic. Too useful to not do something with. Even though it hurts liberty and security alike according to the math. Even though it bleeds limited resources away from actual civilizational threats like climate change. Even though it’s creepy. We have mass surveillance as an application of widespread information technology now. The infrastructure is there and we’re stuck with it for the foreseeable future. That’s why it was significant that we lost the crypto war: we can’t roll back the loss. But mourning or trying in vain to end mass surveillance is useless. The only thing to do now is resist.

All resistance is imperfect. The political philosophy meliorism suggests that mature political engagement involves taking that limitation in stride and working toward worthwhile improvements anyway. At the same time, individuals resisting mass surveillance should know that even their encrypted communications are not really safe from targeted surveillance by state-level actors. Take heart and be smart.

Entire populations can resist mass surveillance better than isolated individuals or social networks. Increasing costs by enhancing general information security is the only way to force state hackers and other attackers to curtail their surveillance activities. Mass surveillance is possible today because it’s cheap. But by encrypting everything, insisting on relatively secure endpoints—the devices on which one might use encrypted email, like phones and computers, that can themselves be compromised in software and hardware alike—and diversifying communication methods, populations can greatly increase its costs.

Disincentives for having better information security practices than others are large. It takes time and technical knowledge to learn new ways of communicating. It violates social norms. So by insisting on relatively secure endpoints, you might miss out on a date to the dance. And it violates professional norms. So by insisting on encryption, you might miss out on a job offer. And above all, people don’t understand why they should fight the surveillance state, and you can’t make them.

These disincentives disproportionately penalize the vanguard—isolated individuals and social networks working to change social and professional norms, perhaps because mass surveillance has already led them to experience more targeted surveillance. So rather than only targeting these vulnerable individuals who are most likely to ask for infosec help themselves in the first place, information security advocates might also focus outreach efforts on groups who are unlikely to be targeted. This strategy better socializes the costs of resisting mass surveillance while also privatizing increased surveillance costs on surveillors by increasing the size of the haystack of encrypted communications and secure endpoints that state hackers have to compromise. For example, Christians who are concerned about mass surveillance of Muslims might recruit large church groups to learn and help others learn better information security practices as a mode of resistance. University Institutional Review Boards and the parties that help standardize their data protection trainings, like CITI, might require everyone doing human subjects research to certify that they will uphold appropriate data protection norms by encrypting everything, using relatively secure endpoints, collecting as little data as possible to answer the research questions at hand and storing less data long-term, and otherwise implementing current infosec standards.

Becoming the vanguard in information security is especially important for academic researchers who are able to set the terms of their own data collection. Keeping and collecting less can be a difficult choice under the pressure to publish or perish. But de-anonymizing data is now so easy that there is no anonymizing data. Even if you collecting Internet survey data from subjects using an tool (like Tor) or service (like a Virtual Private Network, or VPN) that ostensibly anonymizes their browsing history, it will probably not work if a state-level attacker really wants to know who they are and what they are doing. Especially not after Dec. 1, when the FBI can legally hack any computer anywhere in the world that is using one of these anonymizing tools, unless Congress acts before then to prevent a change in the rules of criminal procedure. And even if Congress prevents that change (spoiler alert: they won’t), state-level attackers will still basically do whatever they want, because there is zero accountability in this realm.

Encrypting Everything

Is important but hard enough to scare most people off.

If you only do one thing, get Signal—like a lot of people already have since the U.S. Presidential election. If you do a second thing, get Privacy Badger and Https Everywhere. If you do a third thing, encrypt your hard drive so that if your laptop is stolen, your device is lost but your data are not compromised. And if you want to do more…

These are the current best tools for encrypting everything:

These are organizations that help people learn to use such tools, IRL and/or by offering online resources:

Normal people can use these encryption tools, with or without the help of these organizations. Super hackers can do better—by being wary of the social engineering behind the vast majority of successful cyber-attacks.

So can non-profit organizations, universities, religious groups, and private corporations. Hospital systems, police departments, and all offices that take confidential complaints (such as Inspectors General, Women’s Centers, police, and many hotlines) can and should emphatically encrypt everything. U.S. client states such as Mexico and Iraq can encrypt everything. Competitor states such as Germany can encrypt everything. The U.S. can encrypt everything. Supranational bodies and alliances can encrypt everything.

Everyone can encrypt everything. It should have been the norm of telecommunications from the start. It’s not in part because of alleged interference from security services (that some players detail off the record while others dispute), in part because of apathy and political ignorance among technologists in particular, and in part because random error happens. But the norm of non-encryption is a very serious mistake for liberal democracy as a human phenomenon, and we need to fix it now. That alone is not enough to resist mass surveillance, though…

Perfect end-to-end encryption won’t do you any good against a state-level attacker who can compromise your endpoint. This is why securing endpoints is also essential to enhancing the information security without which mass surveillance will remain the norm.

Securing Endpoints

Is impossible but worth trying if you really want to keep your data (or others) secure.

Here are some examples of more secure endpoints:

But lots of top security experts use iPhones or Android phones and MacBooks or Windows PCs like everybody else—which some people argue have known vulnerabilities to surveillance. Alternatives like Thinkpads, popular among Linux fans, are not themselves secure endpoints. There is not really any such thing, especially once you connect to the Internet or run an operating system other than Qubes or Tails. You can try to get more as opposed to less secure endpoints yourself. But an individual subjected to targeted surveillance by a state-level attacker is unlikely to successfully secure her endpoints without specialized skills most of us lack. The best way for everyone to get access to relatively more secure endpoints is to get more companies making software and hardware that works well and is really easy to use.

Boycotting U.S. information technology (IT) products and services while buying and funding the development of alternative, open-source software and hardware is the most politically possible way to break the American IT dominance that enables weak endpoints to be the norm—keeping mass surveillance relatively cheap even if everyone starts encrypting everything tomorrow. An American IT boycott is politically impossible for American governments at the local, state, and federal level, even though it supports the end of stronger cybersecurity that is a national security priority. A private American IT boycott is unlikely to gain support among private American institutions, organizations, and groups of individuals. It is politically impossible. Even a small subset of such a boycott—a private individual boycott of Google, Facebook, Twitter, and Yahoo until they commit to a shared norm of not collecting and sharing huge swaths of customer data with governments and corporations—isn’t really socially possible. People just won’t do it.

But Europe as a nation-state bloc could conceivably boycott American tech until Silicon Valley lobbies the U.S. Government to strengthen instead of weakening information security by ceasing pressure to backdoor software and hardware, and funding open-source code auditing efforts and bug hunts instead. By leveraging corporate corruption competitive interests like Madison intended, a foreign boycott of American IT has the potential to help American political institutions check and balance expansions of executive branch agency surveillance powers in a way our legislative and judicial bodies have proven unwilling or incapable of doing thus far. It would require more political will than European nation-states can likely manifest though, because the Continent is dependent on American military dominance over Russia.

Diversifying Communication Methods

Collecting and storing less data to begin with is a good idea. Like NSA whistleblower Bill Binney says, smoke signals are the best way to resist mass surveillance. They don’t last long and annoy the NSA.

These are other ways to diversify communication methods:

  • Take a walk in the park to have a conversation in person
  • Have a cup of coffee in a new café, somewhere non-routine for you—sometimes alone, sometimes to have a conversation in person
  • Incorporate other non-routine routines into your life, to throw off surveillance and have more fun besides

If this sounds like individuals are having to do the job governments are cut out for—going up against big, organized, powerful nation-state interests that work against regular people’s best interests—that’s because we are. This raises the question of why governments aren’t doing their jobs, helping populations solve collective action problems like mass surveillance and the resultant death of what we used to think of as the universal human right to privacy.

Legal Resistance

Doesn’t work.

Legally constraining what countries and telecoms can do with Internet, phone, and TV data won’t work in practice, because telecoms have long, deep relationships with intelligence services that have long lacked effective oversight. Legally constraining the U.S. won’t work on Russian, Chinese, French, UK, or Israeli intelligence agencies. In fact, legally constraining U.S. intelligence agencies didn’t work on those agencies. FISA, the Foreign Intelligence Service Act intended to reign in domestic surveillance activities post-Watergate, was backdoored with a loophole allowing the NSA to make a deal with other intelligence services, like the Germans and the Brits, to swap data from each other’s surveillance apparatus. Such swaps, often involving the NSA giving lists of selectors (or search terms) to foreign intelligence agencies to use on huge swaths of data, circumvent prohibitions on surveillance—both mass domestic surveillance in the U.S. case, and surveillance that violates other countries’ national and group interests in the case of Germany and the EU. 

Political Resistance

Also doesn’t work.

Only one legislative body in the world is holding hearings into illegal U.S. mass surveillance. The German Bundestag (Parliament) is investigating U.S. surveillance as part of the NSAUA, or NSA Untersuchungsausschuss—the National Security Agency Investigation Committee. The NSAUA is the only Parliamentary inquiry globally to date investigating American mass surveillance of non-Americans abroad and targeted surveillance of allied foreign political leaders like German Chancellor Angela Merkel. U.S. Director of National Intelligence James Clapper called the inquiry “more dangerous than the Snowden revelations.” Those revelations were apparently so dangerous that Clapper could lie to Congress about them, denying the practice of metadata collection on millions of Americans under Section 215 of the PATRIOT Act—and keep his job.

Scandal over and interference in the Parliamentary inquiry’s process have been rampant. Committee members have suffered apparent phone tampering. In April, German foreign intelligence service (BND, for Bundesnachrichtendienst) head Gerhard Schindler was forced to resign two years ahead of schedule amid the ongoing scandal, after claiming he had not known about domestic spying—and that dependence on the NSA left his agency unable to refuse their demands for information. In a recently leaked report dated March 2016, Federal Data Protection Commissioner Andrea Vosshoff wrote that the BND has massively violated the German Constitution, and “illegally and massively restricted [her] supervision authority on several occasions. A comprehensive and efficient control was not possible […] these are grave legal infringements.” Two American spies have been caught engaging in espionage relating to the inquiry.

The German Bundesverfassungsgericht (federal Constitutional court) announced this week that the government’s national security interests in cooperating with the U.S. may trump the Parliament’s powers. The German government required the Parliament to withdraw its questions about the NSA’s selector lists, or lists of search terms given to the BND (German security agency)—which the BND supposedly implemented without question despite the lists targeting German and German-allied politicians and interests. So the only legislative body in the world that was attempting to check illegal U.S. mass surveillance has been effectively blocked by its own government from doing so.

This development was unsurprising. In private conversations, the U.S. has reportedly repeatedly threatened allied governments like Germany’s that they will stop sharing intelligence relevant to preventing terror attacks if the other country stops doing the U.S.’s bidding. “Nice country you have there; pity if something should happen to it.” So despite mass surveillance increasing its vulnerability to industrial espionage, countries like Germany can’t advance their national interests by opting out of the global American surveillance state. Militarily, the U.S. maintains asymmetric advantages that give it an unequal lead against potential opponents in areas including space—where its military satellite system is the best in the world.

Pressure has been building behind closed doors for closer collaboration—perhaps even at the level of adding Germany to the Five Eyes Intelligence Alliance (currently comprised of the Anglophone U.K., U.S., Canada, Australia, and New Zealand). The German government is at odds with its own intelligence services over where to go from here: To cut ties, obey the German Constitution, and tell the public that the terror attacks that follow would have happened anyway? Or to deepen these contested partnerships, bowing to the realities of the unipolar world in which the global superpower has become a global surveillance state?

The Five Eyes countries have already made their choice about what sort of a political world they want to live in. Now it’s Germany’s turn. The Parliamentarians at the NSA inquiry laughed when a witness pitched the Six Eyes partnership in the middle of the hearing. But a secret BND 300 million Euro budget reveals they took the Snowden revelations about the Five-Eyes’ mass surveillance programs as a wish-list. And last week’s German high court ruling against Parliamentary oversight power creates precedent for the government to override the legislature in the interests of national security. So the best effort globally to resist mass surveillance politically appears to be going down in flames.

It’s not Germany’s fault. Political resistance to mass surveillance at the isolated country-level seems as unlikely to work as it is to be embraced. If there was a club your competitors were all in that let them get inside information on everyone, you’d want to be in that club too. It’s an irresistible logic of competitive advantage—even though the fire hose of inside information from mass surveillance doesn’t help security agencies enhance security any more than the fire hydrant of expert information helps experts make better predictions than non-experts. (It doesn’t: experts just think they make better predictions than non-experts.)

So at the political level, it seems possible that only the dominant power in a unipolar world—the U.S. government itself—can break mass surveillance. And at the practical level, it can only be broken technologically, by making it prohibitively difficult and expensive—not by outlawing it. In other words, only the surveillance state can defeat the surveillance state—and only with the tools of surveillance themselves. This would effectively require a coup within the U.S. Government to reinstate privacy rights. And since when has a military coup ever resulted in fewer instead of more civil liberties?

If that sounds bad, it’s worse. We need federal security agencies like the CIA, FBI, and NSA to support strong computer security. Instead, they support weak cryptography and pressure companies for backdoored hardware and software by request. This, as Senator Frank Church warned during the Watergate hearings, is the abyss from which there is no return. Just because there is no return does not mean there is no resistance.

Conclusion

There are lots of ways to resist mass surveillance, but they’re all futile. None of them will work in the sense of ending it. At best, most of them will buy you time. As long as it’s possible to cheaply surveil entire nations, governments will do it. Making mass surveillance prohibitively expensive by normalizing strong encryption and more secure endpoints along with diversifying communication methods is the most effective way for most people to resist. Resisting in groups works better than resisting alone, so helping your professional organization, institution, or social/religious group adopt better information security practices is a civic duty for people who care about liberty and security alike. But technological resistance will only get you so far as long as you (or your group) are one of the only ones using encryption and relatively secure endpoints. And whoever you are, you remain vulnerable to state-level attackers. It is only by changing technological norms at a societal level that we can make mass surveillance and other forms of mass cyber-attack prohibitively expensive.

Further Resources

Surveillance Self-Defense Against the Trump Administration, by Micah Lee.

Information Security for Journalists, by Silkie Carlo and Arjen Kamphuis.

Surveillance Self-Defense, by the Electronic Frontier Foundation.

Digital Security Tips for Protestors, by EFF.

Security-in-a-box, by Tactical Tech.

Edward Snowden Explains How to Reclaim Your Privacy, by Micah Lee.

Best Practices for Conducting Risky Research and Protecting Yourself from Online Harassment, by Alice E. Marwick, Lindsay Blackwell, and Katherine Lo.

How to Disappear in a Fog of Data (and Why), by D.J. Pangburn.

Tech companies: you have 63 days to make these 5 changes to protect your users before Trump is sworn in, by Cory Doctorow [also relevant to academic institutions and others with large databases—VW]

France Goes China: How to Enhance Your Information Security Anyway, by Vera Wilde.

Obligatory Revolution Playlist

 

– archive / textbook