Engineering our Way out of Fascism

The following is a transcript of my keynote lecture at FSCONS 2013. Releasing it now because my last post referenced it, and at SIF 2014 today, Carl Bildt essentially proved pretty much all the points I made here.

{% youtube 0N55BLw0Z-E %}

It is good to be here, it is always good to be here at FSCONS. More so than any other event I attend, to come here is to come home. Yet to come upon this stage is always a reminder that we have work to do, and this year, more than any previous year, we have work to do. In part that is perhaps because in previous years we were too lighthearted about the work we need to do, or too blasé or too busy doing other things. Of that I am as guilty as any of you. But we need to talk about this seriously now.

The work that needs to be done now exists for reasons that need no introduction. I’m going to try and talk about that work, and about about knowing, and about acting. I’m going to try and talk about fascism, though not in the sense we normally use the word. And I’m going to talk about the distinction between technology and politics, and how we allowed ourselves to be convinced by the fascists that such a distinction existed, and even those of us who are very much aware of the political implications of technology are often blind to the implications of those politics. And of course, I’m going to talk about what all of this has to do with Free Software.

This year has been a good year for knowing. We now know many things that we were not supposed to know, that those who intended us not to know were very serious about keeping from us. We also know that there is much more that we will know soon, and those who do not want us to know these things are struggling to figure out how to keep this knowledge from us. Their goal is ultimately to determine in which way they can cut off free speech without seeming to do so.

In England where I now reside there are discussions of how to prosecute those who know things that we should know, how to cause David Miranda to be rendered permanently persona non grata for the sole crime of having passed through an airport’s transit lounge. All is not as it should be. It would be ludicrous to claim that England were a democracy, but as many still make such claims it’s worth noting that these are not the actions of a democracy.

In light of Edward Snowden’s exposures of massive surveillance conducted by the United States Government, a lot of commentators from political, technical, social and mathematical angles have debated heavily the question famously framed by one from the country where Snowden sought refuge as Что делать? What is to be done?

In order to answer the question, the question must be asked. Unfortunately a lot of the public debate around the response to the revelations has avoided defining the actual problem and has fallen short in terms of defining concrete solutions.

Understanding the Problem

The problem created by the existence of ubiquitous surveillance conducted by a state in consortium with private actors falls into a few broad categories. There are issues which arise internally within the state in question, issues which arise externally in the international realm, then there are existential issues, and there are more general issues with the political trend.

I have recently spoken in other venues about the existential problem of ubiquitous surveillance, so I will not go deeply into that topic except to say that in the time since I did those speeches and wrote those essays, their harshness has not only been repeatedly justified but shown to be severely understated.

The existence of these systems is a fundamental threat to society.

The best way I have found to think of this is to think of nuclear weapons. Nuclear weapons have been used to murder around 260.000 people over the course of human history. The people who committed that crime have never been held to account, but having narrowly averted a mass extinction event, in part through actions taken in Berlin exactly 24 years and one day ago today, we now have roughly ten thousand of these devices in existence today. We don’t know where all of them are, but we know that they exist in a scarcity economy, they are countable, and they can be dismantled.

Surveillance technology does not have this feature. Software, being not subject to the same structures of scarcity as nuclear weapons are, can exist in uncountable copies throughout the Internet. We don’t know where Prism is, nor do we know on how many computers Boundless Informant runs. And we might never know. This means that for all intents and purposes, we must assume that the cold war of surveillance is one that can never actually end – not through the felling of any Iron Curtains.

The Digital Curtain is impervious to all the world’s Berliners.

The people who built these tools have not directly through them killed anybody, although indirectly these tools have doubtless facilitated state murder. However, the fundamental rights of at least 2.5 billion people have been violated through the creation of these tools, and within a narrow margin of possibility that we have not yet explored, the creators will never be held to account.

The Internal Problem

Internally within countries such as the United States and the United Kingdom, the problem of ubiquitous surveillance is one where the distinction between the inside and the outside is lost. In an episode of Battlestar Galactica from 2004, the protagonist Commander William Adama states that “There’s a reason you separate military and the police. One fights the enemies of the state, the other serves and protects the people. When the military becomes both, then the enemies of the state tend to become the people.” Here he echoes a sentiment more concisely expressed by Boroughs when he quipped that “a functioning police state needs no police.”

More recently, and less fictitiously, Eben Moglen stated in Westward the Course of Empire that: “Military control ensured absolute command deference with respect to the fundamental principle which made it all ‘all right,’ which was: ‘No Listening Here.’ The boundary between home and away was the boundary between absolutely permissible and absolutely impermissible—between the world in which those whose job it is to kill people and break things instead stole signals and broke codes, and the constitutional system of ordered liberty.”

The internal problem of ubiquitous surveillance is that it amounts to a refutation of the individual’s ability to defend actions against government scrutiny. It does not, oddly, eliminate the presumption of innocence - formalized as ei incumbit probatio qui dicit,non qui negat, that the burden of proof lies with the accuser and not the accused - but rather allows the accuser to see all the cards, always. While some will argue that a just government should have the ability to be able to see all the cards at all times in the name of prevention of crime, such argumentation does not address the flawed logic of presuming that the government is just.

Once one makes such an assumption, as various commentators including former editor of The Independent, Chris Blackhurst, have done quite publicly of late, then any criticism of existing authority is automatically considered invalid, and any actions taken by existing authority are considered valid. Blackhurst argued that “If the security services insist something is contrary to the public interest, and might harm their operations, who am I to disbelieve them?”

In Robert Altemeyer’s The Authoritarians, he set up three criteria for a person being considered to have the psychological profile of a Right-Wing Authoritarian follower:

1. a high degree of submission to the established, legitimate authorities in their society;

2. high levels of aggression in the name of their authorities; and

3. a high level of conventionalism.

He further argues that “most people seem spring-loaded to become more right-wing authoritarian during crises.” All of these behavioral characteristics are demonstrated in spades by those journalists and pundits who have been most rabid in justifying government secrecy and denouncing those who would expose it, as a crisis of confidence is unraveling public trust of the presiding authorities.

In short, the internal problem of ubiquitous surveillance comes down to a question of legitimacy. In previous times, any government operating a highly efficient analogue of the Stasi would be deemed illegitimate and undemocratic, a government that imprisoned those who exposed wrongdoing would be considered to be rogue, and a government bent on preventing public discourse by sending thugs over to media outlets offices to drill holes in hard drives and set fire to computers would be considered despotic at the very least. A government has no legitimacy when it spies on its citizens and lies about it perjuriously, covers up systematic war crimes and throws those who exposed them in prison for 35 years, and holds people without trial for investigating leaked evidence of criminal wrongdoing. The crisis of modern western democracy is a crisis of legitimacy.

The External Problem

Externally, there is a diplomatic problem. The crisis created by Edward Snowden’s revelations are pushing diplomatic boundaries in ways that even Chelsea Manning’s revelations didn’t, with Obama refusing to visit Putin, Rousseff refusing to visit Obama, and Morales being forced to visit Fischer by Portuguese, French, Spanish and Italian airspace authorities. If you had been cryogenically frozen during the Cold War, then thawed out in 2013 and had this situation explained to you, you wouldn’t believe any of it.

In particular, you’d have trouble grocking the fact that a post-dictatorial South America appears to be the most vigilant in upholding the spirit of the Universal Declaration of Human Rights, while Western European and American authorities are vigorously defending the exact same kind of activities that they previously used so as to define the USSR as the enemy.

Since nation states came into existence, there has been a general understanding that every government spies on every other government to the extent they can, without being overly aggressive, overt or unsubtle. This diplomatic allowance has nevertheless not been assumed to extend to the general public or to industry, although at various times various governments have overstepped those bounds and been given a stern talking to. However, since the time when Henry L. Stimson proclaimed that “Gentlemen do not read each other’s mail,” in his closing of the Black Chamber - an artifact of US military imperialism that Stimson, in 1929, considered to be outdate and inappropriate - there has been a growing anxiety relating to government interception of cross-border telecommunications, to no small degree fueled by the globalization of trade and the concentration of the world’s communications onto a few hundred undersea fiber optic channels.

The external problem, then, becomes one of trust. The gentleman’s agreement to conduct only the minimum amount of spying necessary to protect national interests, and only on public officials of the governments in question, which is very subtly semi-formalized in the Vienna convention, is there to make sure that allies can trust each other, enemies can still conduct trade, and everybody could more-or-less get along. Indeed: during World War I, the UK and Germany, while being at war with each other, were the world’s single most active pair of trade partners. When that trust is broken, it presents a threat to international diplomacy, it upsets international trade, and it makes the founding of any new diplomatic alliances way more complicated than it already was.

The fallout of this is becoming clear: Brazil is going to run its own fiber optics to Europe and finance the creation of alternative systems for e-mail to contend with American commerical offerings, while various other countries are considering measures as far apart as trade sanctions against the US, self-balkanization from the Internet á-la China, or overhauls of internal government communication standards. Very few governments are entirely blasé about this, and none should be.

The larger trend problem

Underlying all of this is a worrying trend. Over the last decade, the pendulum of cultural liberalism has swung back in many ways, with wars on terrorism, drugs, etc becoming all the more central to discussions globally. Inequality has grown and authoritarianism on the rise.

This authoritarianism is not the crude, forceful authoritarianism of previous centuries, where brutal measures were taken against all that opposed the regime, but a softer, more subtle form of authoritarianism, derived from the right wing branch of nationalism known as fascism. In order to prevent people from rising up against them, the people must be subdued and convinced that the life they lead is not too bad and that it could be worse. When I was a child, my grandmother used to say “think of the children in Africa.” Without meaning to say that my grandmother was a fascist, I recognize that this form of discourse is a subtle part of the cultural fascism that we have become accustomed to.

Fascism has become the dominant political system of the world, under the traditional definition of fascism rather than the more modern catch-all if-shoe-fits definition, but various aspects of how it came to prominence - through ­­agreements, diplomacy and skirting of poorly enforced or unenforced rules. both explicit and implicit - have led to it not being noticed by most people. The fact that this is the case has led us to a point where the likes of NSA are an inevitability, but so are the likes of Monsanto, Northrup-Grumman, JP Morgan, Microsoft, and so on.

Fascism: The perfect union of state and business.

Let’s not lose track of what we’re talking about. Fascism in this form is also known as a “mixed economy”. You might have noticed how Nordic social democracy is all about the promotion of mixed economies, but in practice, this means that the governments support certain large companies directly or indirectly with monopoly rights, procurements, grants and so on, while leaving what Venkatesh Rao called the “Jeffersonian middle class” in the gutter.

Sweden is proof that Fascism can be pleasant.

Last month, US Senator Dianne Feinstein suggested that “if you want to find a needle in a haystack, you first must have a haystack,” as a justification for the creation of massive databases detailing nigh every aspect of every individual’s life. In response, ex-FBI agent Coleen Rowley wrote that “Of course self-righteous builders of massive haystacks are not inclined to point out that it’s inherently easier to find a needle if it isn’t covered with hay,” pointing out the logical fallacy behind the argument but not deepening our understanding of the internal logic of a governance structure where such statements are considered reasonable. A “Feinstein’s Haystack” can be defined as a problem that has been created for the purpose of creating the impression that it is being solved. In order to retain authority, legitimacy is required. The most efficient way to gain legitimacy is to impress on ones followers that the role of the authority is justified and the holder of the authority is necessarily the best suited for the job. Through the creation of this institutionalized make-work, authoritiaran leaders retain legitimacy - even when the justifications are illogical.

One sees similar logic deployed globally to justify direct – if subtle – atrocities committed against humanity. Not so much a victimless crime as a crime that the victims won’t notice until it’s too late.

A Cost Estimation

Let’s run some numbers on this.

About 2.5 billion people are affected by NSA’s surveillance activities. This is an estimation of the number of people using the Internet in the world, a number that can be expected to grow quite substantially over the next several years. To break this number down a bit, current estimates put the number of users of e-mail globally at 1.9 billion individuals as a conservative estimate, with 2.3 billion being a more likely reality. Facebook has 1.15 billion users, Skype has around 600 million users, Twitter is of similar size. Dropbox has 175 million users.

Over a billion Android smartphones and tablets are in circulation, and over 250 million Apple iPhones and iPads. Amongst e-mail users, roughly 435 million people use GMail, 325 million use Outlook.com (formerly Hotmail), and 298 million using Yahoo! Mail. The top ten e-mail providers in aggregate host between 70-90% of all (legitimate) e-mail accounts, with the top fifty providers accounting for close to an estimated 99% of the e-mail market.

Further: During a single day last year, the NSA’s Special Source Operations branch collected 444,743 e-mail address books from Yahoo, 105,068 from Hotmail, 82,857 from Facebook, 33,697 from Gmail and 22,881 from unspecified other providers. This gives some idea of the relative internal security capacities of these core vendors. It has long been known that Yahoo’s operational security is quite bad as far as user privacy is concerned.

The DNI (Director of National Intelligence) budget is about 52 billion dollars per year. That covers NSA, CIA and some other things, but it does not include US Cyber Command, ONI (Office of Naval Intelligence), any US Airforce surveillance activities, research done at the National Defense University and other similar organizations, nor does it include surveillance conducted by other five eyes partners. Adding those other aspects, it’s not a stretch to guess that the total budget is $120 billion/year.

$120 billion over 2.5 billion people over 365 days a year gives us a cost estimation of this catch all surveillance of about $0.13 per person per day. Let’s call that PPV: Price Per day of Violation. This is incredibly cost effective for the surveillance states. Of course, a lot of the $120bn are going to various tasks which are not directly related to spying on the general public – everything from keeping the floors clean at Fort Meade down to conducting drone strikes on people in Pakistan.

But since we don’t know the exact division and all of these things factor into the same system of systematic human rights violations, let’s just use the total figure. Actually, this is also better for the following analysis because it assumes their capacity to be greater than it actually is, which is to say that the biased assumption that pervasive ubiquitous surveillance is bad leads us to want to overestimate rather than underestimate the total surveillance capacity. Of course, if it were possible, we would prefer to be accurate, but the asymmetric clandestine nature of the surveillance measures makes accuracy hard.

Raising the Stakes

A lot of people have been asking “how do we reclaim our privacy”? The answer to that is an economic one. The total global surveillance budget is finite and subject to a lot of real world restrictions. It cannot grow indefinitely. However, we can raise the cost of each privacy violation substantially.

This requires a three pronged attack: technological development, policy advocacy, and litigation. The technology side is likely to be the biggest individual contributor, but we should not discount the benefits of influencing policy makers and dragging offenders through the legal system.

The goal of those interested in protecting human rights should be to raise the average cost of surveillance to $10.000 per person per day within the next five years. This reduces the effective surveillance capacity to about 32.000 people, assuming no budget changes, which strictly promotes targeted surveillance and careful planned target acquisition. In reality, this will be a lower number simply due to the expected increase of Internet users over the next five years and the associated scaling costs with low level traffic analysis.

How to get to $10k PPV?

First, let’s talk about litigation options. The fine people at Privacy International (support their work!) are currently working on taking the seven largest telecoms providers in the world to court over fiber optics surveillance, based on violations of article 8 of the European Convention on Human Rights. The Electronic Frontier Foundation (support them too!) is involved in multi-district litigation against the NSA and various other parties. These two organizations are doing remarkable and amazing work, but they do have limitations on how much they can accomplish, and there is a lot of stuff that they can’t reasonably cover. If they get more money, they can do more things. This is kind of obvious, but seriously consider contributing.

Amongst the many untapped legal options is directly suing various providers, such as Verizon, AT&T, T-Mobile, Apple, Yahoo!, Google, Microsoft, Amazon, SWIFT, Barclays, ABN AMRO, Deutsche Bank, UBS. Why so many banks? Because it isn’t just the Internet that is being monitored.

On top of this, it might be worth considering lawsuits against governments directly. This will be harder to do, but if won, these would have a substantial effect on the situation.

The reason this will be effective in raising the bar is that it will make the various private entities involved feel a direct bottom line impact on their businesses resulting from their collusion with state actors, which will lead them to push back to a much more significant degree than they have so far.

Litigation however will only get us so far. A large amount of policy work is needed in order to fix the current situation. Specifically, numerous international agreements need to be reconsidered and renegotiated. Cross-border data protection agreements should be looked at, and similarly the Wassenaar agreement needs anything touching on cryptography taken out of it. Laws within countries can be improved, in particular data protection laws and laws regarding cryptography. Countries that require key escrowing for instance need to stop doing that.

The Tax Issue

If you happen to be living in one of the Five Eyes countries, the numbers game gets a bit more complicated by sheer virtue of taxes. You see, unless you are dodging taxes, you’re actually funding the adversary. That means that if you start a company around the issue of protecting privacy, base it in a Five Eyes country, and you don’t pull a double-Irish or some other trickery to get out of paying taxes, you’re going to be funding both sides of the battle. In a sense, this fact makes tax-avoiding companies like Google and Facebook somewhat better, in that at least they aren’t funding the surveillance state.

Technical Solutions to Political Problems

Then there’s technology. Although policy and litigation approaches are useful, they will not do anywhere near as much to raise the PPV as improvements to technology. Here, technologists like many of us must first admit a few things to themselves, and then devise a strategy that is likely to succeed.

In the late eighties and early nineties, we could be forgiven for caring about technology. We were busy building an operating system, we were exploring the reality that is afforded to us when we can control every part of our computers, from bootloaders, keyboards and disk I/O up through graphics adapters, graphical user interfaces, networks and even Perl. We were a nascent breed who could do anything, and the technology was exciting.

Now, we’re a bit further down that particular road and we have to stop taking the political consequences of Free Software for granted – as many of us unfortunately do. Even those of us who are the most politically aware sometimes subtly mistake arbitrary decisions about the protocol we use, the cryptosystem we employ, or whether we zero index our arrays, as being purely technical decisions. And while I’ve not yet fully comprehended the political implications of using a red-black tree rather than a binary tree, it is a well documented fact that choosing ASN1 over C-strings can have far reaching political implications.

On top of that – sorry guys – but we suck at design. We suck so much at design that many of us still think a command line is a great user interface, and many of you will defend that stance strongly. Don’t get me wrong, I love the command line, but the command line is a language for people who care about technology. Good user experiences should not require a user to care about technology. In one sense, that comes down to the crux of the problem: Many of us in the free software movement care more about technology than we care about people. Software over wetware. That’s a political stance too.

That brings us to what is to be done – Что делать.

After I had prepared this talk, I found time to watch the intervention Bruce Schneier made at the IETF conference in Vancouver last week, and found that almost everything I had to say had been rendered redundant. Nevertheless, let me give you the outline – and please then go and listen to Bruce.

Moving everything we control from centralized to decentralized infrastructures is the first step. This is one many of us have cared about for years, but it’s a step that the numbers I previously mentioned show that we have been failing in.

Technology is always political, and how even small design decisions made by software developers can have a drastic effect on the political outcomes over long or short periods of time. I’d like to suggest that software developers generally need to start developing like they give a damn about the society they live in - which may be true of the free software movement to a certain but absolutely insufficient degree, and is entirely untrue of those software developers who have not thrown in their lot with the free software movement.

Specifically, I want to rabidly attack the notion that usability and functionality are at odds with each other, and the idea that presenting users with a half baked system where they need to break out the command line whenever things don’t operate within some arbitrary parameters of normalcy is in some way acceptable. Most people don’t care about technology, they care about doing the things that are meaningful to them. They don’t want to spend all day fiddling with GnuPG’s parameters or figuring out whether their XMPP session is being transferred over SSL. They don’t want to know about IPSec or AES.

No. They want to be farmers, or merchants, or dentists or doctors. They want to teach our children languages and mathematics. They want to build houses or spaceships or plumbing or bridges or roads. They don’t have time to work with bad technology that we made badly because we didn’t care about them.

What’s worse: when companies that don’t care about those people either give them highly usable software that doesn’t respect their fundamental rights, most people will go for it because despite its failings, it at least gets the job done. If what we offer them as an alternative is not at least as good in terms of getting the job done – from the perspective of a nontechnical user, it does not matter at all how ideologically pure our offering is.

Software that helps 100 people do something wonderful is absolutely meaningless if it’s unusable by the next five billion people.

Bottom line: If you’re developing software and you aren’t developing that software for the benefit of all humanity, you are helping the fascists.

What needs to happen now is pretty simple: We need to migrate the next billion people off centralized infrastructures and give them strong crypto, and we need to do that over the course of the next five years, at maximum. We must not fail this task. Over a longer timeframe, we must expand this to everybody.

Decentralizing everything, encrypting everything, and hardening all of the endpoints, will not get us out of the fascism we have found ourselves in. Engineering our way out of fascism is a necessary step, but not a sufficient step. We need to fundamentally restructure our societal governance models, but we’ll get to that. That’s later. This is now. We are technologists. Let’s make what tech we can.