We cannot afford to be indifferent to internet spying

http://www.theguardian.com/technology/2013/dec/09/internet-surveillance-spying

Version 0 of 1.

We've seen less than 1% of the NSA documents Edward Snowden took with him from his employer, Booz Allen. The whistleblower had been employed to consolidate training documents used to brief NSA agents and contractors on the full range of NSA programmes and sources, which gave him access to the intimate (and sometimes boastful) details of the NSA's capabilities.

The disclosures will keep coming, and they will be worse. The journalists handling the Snowden trove have taken extraordinary care to redact them in order to preserve the legitimate law-enforcement capabilities of western spy agencies, and there are certainly programmes of even grander sweep and more sensitive details that will take more time-consuming verification and caution before they can be disclosed.

In the meantime, two themes keep running through the disclosures: first, that the world's spies have converged on a consensus theory of spying: that the way to find the needles is to make the haystacks as big as possible. Call it the Greater Manure Pile Theory of Intelligence: the bigger the pile of crap, the greater the likelihood that there is a pony beneath it. Somewhere.

The second theme is a simpler one: gathering up mountains of data on everyday people is an attractive nuisance and an invitation to abuse. Whether it's the news that NSA spooks use their anti-terror apparatus to stalk women they fancy – a practice so widespread it got its own creepy-cutesy name, LOVEINT – or that they collaborate with GCHQ and the Canadian spies at CSEC to spy on leaders of friendly nations at G20 summits; or that they use it to gather details of the pornography-viewing habits of non-criminals whose ideas they dislike in order to blackmail and discredit them.

It's safe to assume that the future of the Snowden trove is many more such revelations: more mountains of sensitive data about everyday, innocent people; repeated, egregious, criminal abuse of that data.

Far-reaching consequences

For decades, I've had privacy conversations with people who've assured me that they have nothing to hide and therefore nothing to fear. I'm having a lot fewer of those discussions these days. When you discover that a paraplegic Canadian woman was denied entry to the USA after a border-guard accessed a database that revealed she'd once been suicidally depressed, it's easy to see how you – or someone you love – might suffer far-reaching consequences even from accurate data used for the purpose it for which it was intended.

This week's news that the NSA has a "planetary scale" programme of gathering location data on "hundreds of millions" of mobile devices, for the purpose of establishing guilt-by-association for people who are physically proximate to terror suspects only heightens the sense that your life might be permanently compromised by data gathered by the habitual liars at spy agencies such as the NSA and GCHQ, who consistently misled their paymasters in government about their activities.

Still, it's hard to believe that spies will stop spying, or spy less. We are nowhere near peak surveillance. The Met will not be satisfied until London has 14 CCTVs per red blood cell.

Peak indifference

However, I believe that we have turned a corner: we have finally attained Peak Indifference to Surveillance. We have reached the moment after which the number of people who give a damn about their privacy will only increase. The number of people who are so unaware of their privilege or blind to their risk that they think "nothing to hide/nothing to fear" is a viable way to run a civilisation will only decline from here on in.

And that is the beginning of a significant change.

Like all security, privacy is hard. It requires subtle thinking, and the conjunction of law, markets, technology and norms to get right. All four of those factors have been sorely lacking.

The default posture of our devices and software has been to haemorrhage our most sensitive data for anyone who cared to eavesdrop upon them. The default posture of law – fuelled by an unholy confluence of Big Data business models and Greater Manure Pile surveillance – has been to allow for nearly unfettered collection by spies, companies, and companies that provide data to spies. The privacy norm has been all over the place, but mostly dominated by nothing-to-hide. And thanks to the norm, the market for privacy technology has been nearly nonexistent – people with "nothing to fear" won't pay a penny extra for privacy technology.

Limits of technical literacy

In September, the Pew Research Centre released Anonymity, Privacy, and Security Online, a study of American Internet users' attitudes towards privacy. Broadly, they found that Americans had recently taken extensive, affirmative steps to improve their privacy, but had, generally speaking, failed. Their technology and their technical literacy were insufficient to accomplish such a difficult end. They evinced a widespread view that privacy rules were too loose. They reported many instances of bad consequences arising from breaches of their privacy or the privacy of people close to them.

Not long after this report, Cassidy Wolf, this year's Miss Teen USA, made headlines after it was revealed that her computer had been taken over by a creep who took covert nude photos of her using its webcam, captured her social media passwords, and demanded live sex shows or he would post the compromising photos to her online accounts. Wolf went to the FBI, and they ran the creep to ground, only to discover that he had dozens of other victims, including minor children.

The Internet Engineering Task Force is promising to encrypt the entire internet by default. Internet companies like Google and Yahoo are stepping up the encryption within their networks. They're rethinking their collusion with spy agencies – having discovered that these agencies not only demanded the right to their spy-boxes in the data-centre, they also secretly tapped the fibre leading in and out of it.

More of us are increasingly aware of the risks of the privacy risks from technology. From here on in, the market for privacy-preserving technology will only grow. From here on in, the public pressure to rein in spy agencies and preserve privacy in law will only mount. From here on in, the chorus of voices correcting the nothing-to-hides will only swell. From here on in, the privacy-preserving design decisions in technology will only rise in importance.

The spies will keep spying. They will spy more. They will spy harder. They have proven themselves to be without any scruple and without any adult supervision. But their job gets a lot harder from here on out. There is a moment out there for privacy activists to seize upon, a moment that privacy entrepreneurs can capitalise upon, a moment that privacy-oriented lawmakers can make political hay from. It's up to us to make the most of it.

• Surveillance debate: we're asking for an end to bulk data collection

Our editors' picks for the day's top news and commentary delivered to your inbox each morning.