The right to be left alone

LIKE others, your correspondent is not unduly paranoid about his privacy. He takes cybercrooks seriously, and practices all proper online precautions. But on retail websites, he cheerfully parts with credit-card and contact details, and accepts that his texts and e-mail messages may well be read by prying busybodies (whatever good that may do them). He resents the way mass-marketers build pictures of his buying habits, but finds their recommendations for further purchases mildly amusing, sometimes even useful. He quit using social networks, not through fear of identity theft, but when the return on investment (of time) became too low and the threshold of gibberish too high.

There are occasions, though, when he wants nothing more than to shut the entire world out, to focus on friends and family, and to enjoy the privacy of his home along with his god-given right to peace and quiet. Though the United States Constitution contains no mention of the individual’s explicit right to privacy, the Bill of Rights corrects that oversight. With the third, fourth and especially the ninth amendment, James Madison and his fellow drafters in the late 18th century made it abundantly clear that privacy was an essential ingredient of liberty. Without one, there could be nothing of the other.

So, what to make of this past week’s security pronouncements by the political leaders of America and Britain? Both governments have been trying to exploit the fallout from recent events (the Charlie Hebdo killings in France, and North Korea’s alleged hacking of Sony Pictures) in order to advance unpopular cybersecurity measures in the name of national security, despite their serious implications for privacy.

Following their recent two-day meeting in Washington, DC, Barack Obama, America's president, and David Cameron, Britain's prime minister, joined forces to express concern about the strong encryption techniques used by social media and internet applications. These, they claim, prevent their security services from tracking terrorists and other criminals online. The two leaders announced plans to expand the ongoing work between the National Security Agency (NSA) in America and the Government Communications Headquarters (GCHQ) in Britain.

So far, cooperation between the two intelligence agencies has focused mainly on defeating advanced encryption techniques. The NSA’s version of the technology is known as Bullrun, while its counterpart at GCHQ is called Edgehill. These are the names of early battles in, respectively, the American and the English civil wars—which suggests both that the agencies' cooperation on cybersecurity has been extensive and close, and that they expect the campaign to go on for a long time.

Such extended cooperation comes just as the White House is trying, yet again, to strengthen America’s cybersecurity laws. Each time President Obama has attempted to do so in the past, he has been thwarted by Congress on privacy grounds. However, with the recent spate of data breaches and cyberattacks, the time is now judged ripe for a renewed push. Proposals for new cybersecurity measures are expected to feature in the president’s State of the Union address on January 20th.

The British government has expressed similar frustrations over the lack of a clear legal mandate for intercepting internet communications. Last year, Parliament hurriedly passed emergency legislation that allowed the police and security services to continue accessing mobile phone and internet traffic, despite privacy objections from the European Court of Justice. If Mr Cameron’s party is returned to office following the general election in May, he intends to introduce a beefed up Communications Data Bill to replace the Data Retention and Investigatory Powers Act, which will expire later this year.

Referring to the inability of the security services to read end-to-end encrypted messages, an exasperated Mr Cameron asked: “Do we want to allow a means of communication [encrypted traffic] between people which, even in extremis, with a signed warrant from the home secretary personally, we cannot read?” Mr Cameron has pledged to ban all forms of digital communication that cannot be read by the intelligence services and the police if he is re-elected.

All of which sounds more like electioneering than practical policy. Banning encryption, for instance, would mean outlawing popular chat apps like FaceTime, WhatsApp, Snapchat, Hangout and iMessage. As if that were not difficult enough, Apple and Google would then be required to strip the strong encryption from their latest mobile operating systems.

That is not going to happen. There is no way that some of brightest stars in the Silicon Valley firmament would pull their products from the market to appease a foreign government.

Besides, a secret five-year forecast of the global threat to America’s information infrastructure—prepared in 2009 by the National Intelligence Council and made public by the whistle-blower Edward Snowden—surfaced last week, presumably in response to Mr Cameron’s remarks. The report makes it clear that banks and businesses could not function without strong encryption: it is the “best defence” they can adopt to protect their intellectual property, as well as their users' online privacy. All very embarrassing.

The National Intelligence Council’s report also warns that, given the scale of the hacking incidents detected to date, all organisations have to assume that any computer network which is connected to the internet has already been compromised. In other words, what business needs is not weaker, but stronger, encryption. As James Comey, director of the FBI, recently remarked: “There are two kinds of big companies in the United States. There are those that have been hacked ... and there are those that don’t know they’ve been hacked.”

In a recent interview with the Washington Post, Chris Doggett of Kaspersky Lab, a global cybersecurity firm based in Moscow, explained how his company was called in by a large financial-services firm to double-check its network security. Within minutes, a Kaspersky engineer had infiltrated the network via a file-transfer server that had not been set up properly. In turn, that provided access to a web server behind the company’s firewall. The web server's job was to exchange credit transfers with other major banks in New York. At that point, wire transfers could have been sent out “to the tune of several hundred million dollars” to anywhere in the world. The total time to hack the system? Just 15 minutes.

And that was for a large financial institution with adequate resources. What hope, then, can smaller organisations and individuals have when it comes to protecting their customers' or their own personal data from thieves, spooks or terrorists? Not much.

All of which has thrust the discussion about the trade-off between privacy and security back into the limelight. Some years ago, The Economist organised an online debate on the topic. The outcome, after weeks of commentary with much virtual ink being spilled, was that readers voted by a handsome margin for the defence of privacy. The majority viewed privacy as sacrosanct. Nothing in their concern over terrorism justified sacrificing privacy on the alter of pragmatism. Other media surveys since have broadly agreed, favouring privacy over security by, typically, two-to-one.

Yet reality suggests otherwise. Britons put up with ubiquitous closed-circuit TV cameras that track their every move in public as a way of reducing crime. Few Americans have been agitated by the way the NSA was authorised, in the aftermath of the terrorist attacks of September 11th 2001, to engage in warrantless wiretapping of the phone calls of fellow Americans on an unprecedented scale.

On the internet, people (your correspondent included) hand over their personal data freely. The fact is, information technologies make life richer, easier, more rewarding. They increase productivity, efficiency and economic growth. They help people relate to one another, create opportunities, realise dreams. All that these free internet services ask for in return is one's personal information—so they can sell it to advertisers to make a profit. Thus, both privacy and security are traded for convenience. And it all seems a reasonable bargain.

Once, not all that long ago, people considered their personal information to be just that—personal. But once they started sharing it over the internet, it ceased being truly private. “Our behaviour changed, but our expectations did not,” Eric Sterner, a fellow at the George C. Marshall Institute, a policy think-tank, wrote in the Washington Examiner last year. In Mr Sterner’s view, the privacy-versus-security debate is essentially over. “Privacy died with the information age.”

Yet, in a sense, the issue is not whether to accept some erosion of privacy, so governments may protect their people better from evil-doers. Rather, the issue is whether doing so will actually make their country safer. The question asked repeatedly since the intelligence agencies embarked on their wholesale wiretapping of private citizens is, "does profiling hundreds of millions of good guys help to unmask the few dozen bad guys in their midst?" There is scant evidence that it does.

Many would argue instead that granting the intelligence agencies yet further powers to intercept, collect, decrypt and store still more exabytes of personal data only exacerbates their problem of finding the terrorist needle in the public haystack. The answer, surely, is to rely more on tried and tested methods of criminal investigation and trade-craft. In short, to depend less on computer data and more on real human intelligence. Citizens might then not have to chose between privacy and security. They could, in a very real sense, have both.