Ross Anderson 

Work and surveillance in a post-Snowden world

How does spying affect us all? Security expert Ross Anderson puts on different hats and imagines what it's like to work in this new world
  
  

Illustration of an advertiser and a charity worker
'All your thoughts are sitting on my server, so I can mine them and figure out how to sell you stuff.' Illustrations: Laurent Cilluffo Photograph: Laurent Cilluffo/Guardian

The advertiser

It takes only four Facebook likes to tell whether you're straight or gay. Most people have no clue how much this is going to change the world. The Cambridge psychologist Michael Kosinski has found that it's easy to tell someone's race, intelligence and sexual orientation from what they "like" on Facebook. Whereas in the past you could choose, say, whether or not to wear an Out and Proud T-shirt, these days there's no closet to hide in any more. Online, no one has any idea what you're wearing, although mostly, you're wearing your true colours. Now, there's a new predator in town, who can see through your camouflage. That predator is me.

Just you wait till we get Google Glass. Then I'll know everything you ever look at. Technology gets more like telepathy with every year that passes. And all your thoughts are sitting on my server, so I can mine them and figure out how to sell you stuff. Hey, the police will want a copy too, but that's not my problem. If they turn up with a warrant, I don't want to go to jail. But I hope they'll learn to keep quiet about it and not spoil the party.

The police officer

Why can't I get all this technology too? When I do a wiretap it takes ages getting a warrant from a minister and then we wait weeks for the National Technical Assistance Centre to do anything. Yet they're at GCHQ, and now we know from Snowden that they've got all the information already. Why can't I just serve a Ripa notice on them, at least for the traffic data?

Tony Blair promised us an Intercept Modernisation Programme to produce a communications database; David Cameron promised a communications data bill, until Nick Clegg said no. Now MPs learn that the communications database existed all along, and these bills were just a cover to give us what we want.

So what are they dragging their feet for? GCHQ says it needs the capability to deal with terrorism, serious crime and paedophilia. We detectives agree. So does HMRC and the other agencies, too. The Regulation of Investigatory Powers Act gives me the power to demand evidence if you've got it. Why can't I just serve a Ripa notice on them, at least for the traffic data? I can already serve notices on Google and Facebook. Why not GCHQ?

The lawyer

Professional people have to keep confidences. You never know when a client will turn out to be of interest to the state. Three times in the past few years one of my clients has turned out to be entangled with spooks of some kind or other; so far one's gone to jail, one's been acquitted and one case is pending. The spooks and special branch don't have a monopoly on wisdom; sometimes they just don't understand the evidence. That's why you need defence lawyers.

Last month I started a telephone conversation with instructing solicitors by reminding them that everything we said could be taken down and reported to the other side. "We know," they said. "We've learned that it comes with the territory if you handle cases like these." Yet the right to a fair trial is absolute, and how can a suspect have a fair trial if the prosecutor can read the emails between the defendant, his legal team, and their experts?

Maybe human rights lawyers need to get more devious. They tend to be young, idealistic and very badly paid. At the other end of all of these scales are partners in the big city firms. So what happens when they advise on an international deal in which a government has an interest? "Well, we just anticipated that our hotel rooms would be bugged," one retired partner told me. "You learn to deal with it. You say that X is your absolute bottom line, when it's actually your target. Then they haggle you right down to it, and they're all smiles when you finally cave in. It's hugely satisfying."

The civil servant

So now everyone knows why GCHQ has long refused to allow government departments to store information classified at "restricted" or above in US cloud computing services. There have even been stories of Indian diplomats going back to using typewriters for "top secret" stuff. Research by the University of Pennsylvania's Bridget Nolan (pdf) reveals one of the big open secrets in Whitehall – that the protection bureaucracy often stops even the intelligence community getting anything useful done. And thanks to Snowden it's about to get worse.

The threat of wiretapping and computer intrusion by the Russians, the Chinese, the Israelis and even our American allies (though please keep quiet about that) has led us in Whitehall to build a byzantine structure of security clearances and classifications. Information can be marked "protect", "restricted", "confidential", "secret", or "top secret". Snowden has told the world that above that it gets even more complicated, with various levels of "strap". He was only cleared to "strap 1" but the files he liberated contained lots of "strap 2" and even "strap 3" information. Yet the bureaucracy that's been created to keep track of all this has so got in the way of government business that last week Francis Maude, the Cabinet Office minister responsible for it, announced that the lower levels of "protect", "restricted" and "confidential" will in future be replaced by a single level, "official". This will cause mayhem.

American files marked "for official use only" will be translated to "official" when they cross the Atlantic to us, and then become "confidential" when they go back again – as a file can only be automatically copied to an equal or higher level. Meanwhile, the director of the NSA has promised to fire most of his system administrators, because Snowden was a system administrator. So there will be nobody capable to deal with the ensuing chaos.

The doctor

Your health records are progressively being "shared", as it's called, without much thought for privacy. And the police have had access to some central systems since 1996, when they got access to all NHS prescriptions. Once NHS England uploads all the records from our GP surgery into the new Care.data system, they will have even more.

So what about the 5 million people in England with some form of psychiatric diagnosis in their record? Will they find themselves suddenly more likely to be treated as suspects rather than witnesses, or as unreliable witnesses? Will the psychiatric history of all witnesses start being disclosed to the defence in a criminal trial as a matter of course? If the police have it, the defence must have it too. Will a woman who's been raped find she can't get justice if she was ever treated for depression? Will she come to the surgery and blame me for writing down the diagnosis in her record, and say I should have advised her to opt out? We have the opt-out leaflets in the waiting room, but we don't have the time or money to do more than that.

Snowden is making patients more sensitive about privacy, and when trust in medical confidentiality goes down, patients die. People seek treatment late, or not at all; and it's not just the obvious problems such as HIV, but also cancer and even depression.

The banker

The banking industry's Edward Snowden was Hervé Falciani, who in 2008 defected from HSBC in Geneva with five CDs of data on thousands of private-banking account holders. He traded the stolen data for political asylum in France. In one country after another, our wealthy clients have been prosecuted for tax evasion.

Falciani's revelations, like Snowden's, have whetted officials' appetites. The NSA has access to far more than he ever did; it gets copies of international money transfers sent via Swift (which is most of them). I'm pretty sure they're also hoovering up all the card payment transactions off the backbone; they'd only have to serve warrants on Visa and MasterCard, and we'd never be the wiser.

So far, the NSA has focused on terrorists and the private fortunes of foreign leaders. But the CIA gets a copy of the NSA feeds (pdf), and they do economic intel, which gets a bit close to the bone for our corporate clients. The DEA is starting to get some help, and the world's tax inspectors will surely be next. Snowden will make their case harder for ministers to resist. Why should George Osborne give billions to GCHQ if they won't help him catch tax cheats?

Transparency will create winners, but losers too. A lot of bank profits come from places such as Jersey, Gibraltar, Bermuda, the Caymans, and the British Virgin Islands, and without bank secrecy these countries' economies will be in trouble. And then there's the City of London, which is the biggest tax haven of all. Ask any of our non-dom private banking clients.

Ross Anderson is professor in security engineering at the University of Cambridge, and chairs the Foundation for Information Policy Research

 

Leave a Comment

Required fields are marked *

*

*