>> Good afternoon again
and welcome to GW.
My name is David Dolling and
I'm the Dean of the School
of Engineering and
Applied Science here
at the George Washington
University.
I don't think it would
be news to anybody
that there's been a lot of
documents out there recently
with respect to cyber security.
We've seen the White
House's executive order aimed
at protecting our
critical infrastructure.
We've seen a report from the
Security Company Mandiant
that exposed a Chinese
military hacking group.
And very much in the news
now although it's faded
after the press conference
yesterday afternoon have been
documents related
to NSA's prison
and telephone surveillance
programs.
Well today, we are
very fortunate
that have several
experts with us
to discuss their various
view points on surveillance
on cyber security and the
future of the internet.
As we try to be secure
while protecting privacy,
we do need to be guided by
knowledge from many disciplines
and in fact, this was stated
quite explicitly last December
at the launch of the GW
Cyber Security Initiative.
The initiative's chairman,
former DHS Secretary Michael
Chertoff spoke of the need
for university's
like ours and others
to give students an
understanding of the triad
of technology, business
policy and how they interact
to create difficult cyber
security challenges.
While I'm on the podium here,
I'd like to just take advantage
of a captive audience because I
know you all too polite to cheer
or get up and move out to say
a few things about the School
of Engineering and
Applied Science here at GW
which is a very thriving
and growing enterprise.
Our Department of
Computer Science
in fact anticipated
Secretary Chertoff's remarks
by launching last fall
the Master of Science
in Cyber security in our
Computer Science Department.
It's the first program
in Washington DC designed
specifically to respond
to the large and
fast growing need
for technical cyber
security experts locally,
nationally, and internationally.
Underscoring our commitment
here to cyber security education
and public service, our NSF
and DHS sponsored CyberCorps
scholarship programs.
These programs fund students who
are going to be future leaders
in the federal government
on cyber security
and indeed some of
them already are.
Each week, the CyberCorps
students meet in class often
with current or former
federal employees as well
as industry experts to learn
about the major cyber security
issues so they're prepared
to meet the challenges that
will certainly great them
after they graduate
here and take jobs.
This course which was
previously only available
to CyberCorps students is now
available to all GW students
as a hybrid cause
conducted mostly online
with the short intensive
in person learning
experience or the beginning.
Starting next year,
some doctor or students
in the graduate school
of education
and human development
here at GW on human
and organizational learning
will also be taking this class a
required part of their
cyber security focus.
Well, let me say that
today's event which looks
to be very well populated
and looks like it's going
to be very interesting
is sponsored
by the cyber security policy
in research institute.
We abbreviate that around
here to CSPRI of the School
of Engineering and
Applied Science.
In addition to overseeing
the CyberCorps program,
it facilitates and execute
into disciplinary research
in education in cyber
security across GW.
One example of this is its
work with the graduate school
of education in human
development supporting the
national cyber watch
center in a joint project
to develop the nation
cyber security workforce.
More information on that program
on CSPRI Cyber Security
Scholarships and School
of Engineering and Applied
Science can be found
in the material available
the registration desk.
We're happy to have
as a cosponsor
of this event today the internet
society and it's my pleasure
to now introduced Paul
Brigner, Regional Director
of the North American Bureau at
the Internet Society to come up
and tell you a few
words about it
and its role and
in today's event.
So, on behalf of GW, the
School of Engineering
and Applied Science,
CSPRI and the Department
Of Computer Science,
welcome to GW
and I hope you have
a great afternoon.
Thank you.
[ Applause ]
[ Pause ]
>> Thank you Dr.
Dolling and thank you
to the George Washington
Cyber Security Policy
And Research Institute
for partnering
with us on this event today.
And thanks to all of
you for joining us
and that means not everyone here
in the room but also to those
who are at a remote
hub in New York City.
That remote hub is
being sponsored
by the internet societies
New York chapter.
I know we don't have
a good view of them
with the camera right
now but what's going
to happen is they
will walk up to
that camera and ask questions.
And by the way, they've
been meeting
on this topic already
this morning.
They've had their
own meetings today,
so maybe that gives you an idea
of how passionate that group
of individual is about
the topics we will be
discussing though.
So, thank you to the New York
chapter for getting together
to join us as remote hub.
And definitely, thank you
to all those on live stream.
We have a very good crowd
already gathering on live stream
to watch us from
all over the world.
My first order of business today
is makes sure that you're aware
of the internet society.
If this is the first time you're
joining from one of our events,
we are a global nonprofit
cost driven organization
with a very straight
forward vision.
That is the internet
is for everyone.
We work to achieve that vision
by promoting the open
development evolution and use
of the internet for the benefit
of tall people throughout
the world.
Some of our key functions
involve facilitating the open
development of standards,
protocols, administration
and a technical infrastructure
of the internet.
Supporting internet education
in developing countries.
Promoting professional
development in community meeting
to faster greater
participation and leadership
in areas important to the
evolution of the internet
and fostering an environment
for international cooperation,
community and a culture
that enables internet
self governance.
Well, I saw staff lead specific
projects on these topics.
Much of our work is achieved
through the work of our members
and chapters around the world.
And speaking of chapters,
I would like to give
special recognition
to the local DC chapter.
I am very fortunate that our
headquarters is just not far
away in western Virginia so
I'm able to interact personally
with our DC chapter
on a regular basis.
And I can attest to the fact
that they are really a
first class group of people
that regularly hold very
interesting meetings related
to the internet societies
mission.
So, if you're a local
and you're not involve,
you're really missing out, I
do hope you will get involved.
And if the leaders who are here
from the internet society DC
chapter would stand briefly,
I just want to make sure
that you're recognized.
So, great.
So, you know who they are.
Please make a special
effort to talk
to them today during
this event if you'd
like to get involve
with the chapter.
[ Pause ]
One of my key functions
at the internet society is
to work closely with our
chapters in the region not only
to plan iNET events like this
but to assist with their events
and to have an open
dialogue on policy issues.
That dialogue in turn
helps me and my colleagues
at the internet society to form
our policy positions and help
to set the agenda for
our regional meetings
like the one we are
attending today
and that brings me
to today's agenda.
The topic of this iNET
has really been driven
by the interest of our members
in the North American
region and around the world.
It so happens today that one of
our panelist is the President
and Chief Executive Officer
of the internet society
that's Lynn St. Amour.
So, she will have
the opportunity
to address the concerns
of our constituency today.
Now, without further delay,
I would like to introduce
Professors Lance Hoffman.
He is the Director of the Cyber
Security Research and Policy--
I'm sorry, the Cyber
Security Policy
and Research Institute here at
George Washington University.
I first met Professor Hoffman
when he sponsored a debate
on PIPA and SOPA and
I knew that he was,
based on that experience, I
knew that he was game to talk
about some very controversial
topics.
So, I guessed right, he
was interested in talking
about this one as well and
it's been really a pleasure
to partner with him
on this event.
So, I want to sincerely
thank you for that.
It's really been a
great experience.
I'd also like to thank all
of our fantastic panelist
who have agreed to
speak here today.
We really have an all
star group of people
who have taken their time out
to share their views with you.
I'd like them all to come up
and take their sits on stage now
if they would and I
will turn this event
over to Professor Hoffman.
One thing I forgot to mention
is that if you want to Twitter
or tweet about this event,
please use the hashtag
iNET DC, iNET DC.
Thank you all over much.
[ Applause ]
[ Noise ]
[ Inaudible Discussion ]
>> Good afternoon everybody.
Let me add my welcome to that of
Dean Dolling and to Paul Brigner
and let me also thank the
internet society, our cosponsor
for this event for
their programmatic
and financial assistance
in making it possible.
I also want to thank from
CSPRI, my Associate Director,
Dr. Costis Toregas and our
intern and research assistance
who have worked on this and are
helping here today tray hair
[phonetic] Dustin
Benanberg [assumed spelling],
Jaime Moore [assumed spelling],
and Greg Ziegler
[assumed spelling].
My role today is to set the
stage for our excellent panel
and into moderate that panel
discussion on cyber security
in the future of the internet
given the recent revelations
about prism and other
surveillance programs.
The panelist of each degree
to summarize their thoughts
in a four minute statements
so we could have lots of time
for questions from the
audience including the audience
in cyber space.
After the audience question and
answer session in a short break,
participants will return for
a very interesting session
around table discussion where
we will see their world views
on this, where there
world views agree,
and where there are tensions and
talk about this in a round table
which will be informed by
their previous statements
and the audience
questions before hand.
I'm delighted that
for this event,
we will have an experience
moderator Professor Steve
Roberts leading the
round table discussion.
Many of the students and
faculty here may recognize Steve
as the superior professor
of media
and public affairs here at GW.
But others including
those viewing on this
on the internet maybe
more familiar with him
from his appearances
as a commentator
on many Washington
based television shows,
as a political analyst
on the ABC radio network,
and as a substitute host
on NPR Diane Rehm Show.
Another rule where he-- this
is material from experts
and clarifies it to facilitate
informed public discussion.
But before the round table,
let me identify the
participants on stage.
We will not have lengthy
introductions here
since their bio sketches have
been made available to you
in the brochure which you
have gotten or can get
at the registration desk.
But anyway, let me
introduce very briefly
and you see their name
tags in front of you,
Danny Weitzner is the
Director and Cofounder
of the MIT Computer Science
and Artificial Intelligence
Laboratory.
>> Not the whole lab.
>> Not the whole lab?
>> I'll explain.
>> OK. Lynn St. Amour
is the President and CEO
of the Internet Society.
Let's see, who's next.
Laura, Laura DeNardis
is professor of School
of Communication at
American University.
Melissa Hathaway is President of
the Hathaway Global Strategies.
Let's see.
Who's down there?
I don't have you on my list.
>> Oh no.
>> I apologize.
>> That would me.
>> Oh Randy, of course.
Randy from-- I don't have here.
I mean, OK.
Randy-- where are you from?
I'll let you introduce yourself.
I'm sorry.
[Inaudible Remark]
>> I'm the University
IT Security Officer
at Virginia Tech.
>> I didn't want
it to get it wrong
and say something
wrong-- wrong university.
Sorry Randy.
OK, let's see.
Leslie Harris is from Center
for Democracy and Technology.
And last but not the least,
John Curran, President and CEO
of American Registry
for Internet Numbers.
OK, so without further ado, I am
going to suggest to be each go
down the-- I have to
decide, I'm going to leave it
to I guess either Danny or
John on who wants to go first.
>> No, no, no.
Go ahead.
>> John?
>> OK.
>> OK?
>> OK John, go on.
Four minutes please.
>> Well, thank you.
I'm happy to be here and I
want to thank the opportunity
to present at this panel.
Keeping my remark short,
I will say that we're
in an interesting period of
time with respect to the future
of the internet and
how it's governed.
People may not realize
it but the fact is,
there is a coordination
function that's existed
since the earliest days of the
internet which is necessary
so that we can actually
use the internet
so that it actually functions.
For example, computers
on the internet have
unique identifiers.
Several, actually, one of
them is the IP addresses
which is part of what
Aaron [assumed spelling] is
involved in.
We can't have computers
using the same IP addresses.
Every computer needs
its own IP address.
Likewise, there's coordination
of things like domain names
to make sure that a
domain name is a sign
to one organization,
et cetera, et cetera.
This is called technical
coordination
and it's been a function of the
internet, necessary function
for the protocols
to work as designed
since the very beginning.
People may not realize that
this use to all be done
by one gentlemen, Dr. Jon Postel
who we no longer have with us
but was an amazing individual.
And in the late '90s, we
actually went about setting
up infrastructure to enable
this technical coordination
so that IP addresses and
domain names could be available
to everyone globally for
their use on the internet
but coordinated so that
they actually interoperated
so that they work as expected.
This structure involves
a lot of organizations.
Aaron is one, there're five
regional registries throughout
the globe.
Aaron is the one that handles
North America, so with Canada,
the United States and about
half of the Caribbean.
Though there are four
other regional registries
and then there is the DNS
coordination that goes
on through organizations
such as ICANN.
The international
coo-- [laughs].
Sorry. International--
[Noise] --
Organization for assigned
Names and Numbers.
So, the fact is that these
bodies all work doing technical
coordination is very important.
But, they've been doing it based
on a historical trajectory.
A trajectory that originated
with projects and programs
out of the US government
which have
since been increasingly
moved out to independence
but were not quite there yet.
In fact, some of you maybe aware
that these organizations were
under supervision somewhat
indirect but still supervision
of program such as NTIA in
the department of commerce.
And so, one of the things that
we now find ourselves facing is
that there is a unique
role in the US government
with respect to the internet.
And this unique role is one that
is based on-- it's experienced.
It's a steady hand,
behind the scenes,
helping the internet
mature and grow.
Recently however, we've now
seen that there's another hand
that maybe busy doing
other things
such as surveillance
in cyber security.
And so, the question that comes
up is how do we reconcile those?
How do we reconcile an open
global transparent internet run
for everyone with
the possibility
that there is also surveillance
going on and other things
that may not meet
the expectations
of global internet users.
And so, this is the
challenge in front of us.
It's particularly
highlighted because of the fact
that the US governments
unique oversight role in this
and it's brought
to the forefront
by the recent discussions where
we now say that it is not simply
for the benefit of
all the internet,
but there's also some
national priorities
and national initiatives that
the US government also pursues
over the same infrastructure.
I think that's the challenge
that we will now face more
so than ever in light
of the revelations
for the last few months and
the net result would be a lot
of the discussion in
forum such as this.
Thank you.
>> Thank you and I'll try
to make this iPhone
behave a little better--
>> OK.
>> Although--
>> I thought I was over on time.
>> Yes.
>> You were right on
time, you were great.
>> OK.
>> Leslie?
>> It's time, I guess.
So, I also want to get us out
of the DC bubble and the focus
on the rights of people
in the United States.
I've been talking about
that for the last six weeks.
And congresses about to
considering an amendment that's
going to reign in
the NSAs ability
to collect our metadata
from phones.
I want to pivot away from that
'cause I think there're three
other things that we ought
to be considering at least.
What-- and the reactions of
governments and internet users
around the world and what this
means with the architecture,
not just the governance, the
architecture of the internet
and also for the
protection of human rights
of global internet
users and that turns
out to be a very
thorny question.
Certainly for governments,
I think this entire kerfuffle
is reinforced the concerns
that the global internet has
undermined their sovereignty
in control over their citizens.
And it's further
illuminated this sort
of privileged position
of the United States.
Certainly, with respect
to ICANN and some
of the other critical resources,
we continue to have a
disproportionate share
of internet traffic, all
that's declining and obviously,
we have a dominance in our
global internet companies.
For some, and the EUs, I
think I have a good example,
this illuminates
left an inability
to protect the human
rights of their own citizens
and we have a major fight coming
up in the data directive there
about whether they're
going to allow data to come
to the United States at all.
At the same time, it's an
extraordinary opportunity
for authoritarian governments
to exert more control
over the people in data in their
own boarders and it's, you know,
rushes now dusting of a
legislation that has to do
with national servers.
You're going to see
that elsewhere as well
and I think it's fair to worry
whether this carefully honed
narrative as US narrative of the
why is trusted neutral stored
of the internet can
really hold and it's fair
to ask whether we're moving
towards the balkanization
of the internet as
government sees these moment
to impost local server
requirements or worse
and we saw some of these
proposals last year.
I know we're supposed to be
acronym free at the wicked.
I'll explain-- routing
requirements
to either avoid the
United States of literally
to direct the routing of traffic
and the worst outcome
being literally ring fans
to national or regional
networks.
If I were in Latin America and
notice that there was 80 percent
of my traffic still coming
from the United States,
I may start to wonder why
we're still relying on Miami
to reach most of the world.
Some of that might be
a weird salutary effect
that we finally get internet
exchange points in some places
that have not had them.
But I think governments becoming
involved directly in the rooting
of internet data would
opposed a profound challenge
to the open end-to-end internet
and I think all these things
are going to be on the table.
I think you are also kind of
expect to see a reexamination
of the world's relationships
with our cloud providers,
already seeing that.
You know, there's a Netherlands
provider and no prism,
no surveillance, no
government backdoors.
And finally, I think we may have
lost some of the rapprochement
that happened in the governance
wars in the last year.
There are number of important
forums and discussions coming
up about various treaties
and how much various treaty
buddies ought to be able
to impose their--
post themselves into internet
debates, I think we're going
to lose some ground there
and it could be I
think quite troubling.
Last point, global
internet users are furious.
They believe their human
rights have been violated
and I think they
don't yet realize
that it's not entirely clear
whether they have any recourse
for that.
There's a lot of ambiguity
in human rights law.
Human rights law are
pretty much applies,
if countries make commitments
to protect the human rights
of people within their
boarders or their control,
I don't think we began to
understand or have any clarity
on how-- who's responsible
for human rights
where there's non-physical
action
such as electronic surveillance.
And they're not going to be
happy when they understand
that FISA and all
the conversations
in the United States about
safeguards and minimization are
to protect our rights but
have absolutely nothing
to do with them.
I don't think congress
is going to care.
But I think there's a
massive laws to respect
and when we're talking about
five zeta [inaudible] whatever
that is, a non-US
person data going
into a new Utah data center, I
think that the irony at the end
of the day will be that one
of the FISA permissible
activities is collecting
intelligence for foreign
affairs and foreign policy.
And I think at the end of
the day, we may see people
of the world uniting with
their governments around kinds
of restrictions and ring fencing
of the internet that will come
to both underlying rights
and undermine the
openness of the internet.
So, that is my anxious
persons guide to the--
to what's been happening.
>> Thank you Leslie.
Randy?
>> How many of you noticed
accounted how many surveillance
devices you've past
to get to this room?
Yeah. I just walked in from the
restaurant a couple blocks away.
I counted 22 surveillance style
devices just in the walk outside
of this building and there's
at least in this room right now
that not counting your
smart phones and all that.
I hope you all can find the six
because they're pretty
obvious as to what they are.
My point on all of this
is that as a practitioner,
I'm the Sisa for Virginia Tech.
My office is responsible for
monitoring and responding
to any attacks against
our network infrastructure
at Virginia Tech.
We have our main campus down
the Blacksburg, Virginia.
It's about four and a
half hours from here.
We have a Northern
Virginia campus right
across the river in Boylston.
And so my charge,
my office is charged
to monitor any attacks
from there.
Anybody who has ever managed
an internet infrastructure has
known since the very beginning
that the internet has never
been anonymous in the sense
of tracking a machine.
From day 1, we've
always been able to track
where our machine was.
We were not able to track
who is at the machine
with any reasonable
amount of accuracy
but we've always been able
to track where machines are.
The big thing was of course
data, storage capabilities.
We didn't have enough
data storage capabilities,
disk drives.
In 1992, when I've
got involved--
first involved with the computer
security stuff, you know,
we had a one gigabyte drive and
we thought that was, you know,
the entire disc storage
in the entire free world.
And, you know, nowadays, with
the huge disk forms that are
out there, that is allowing
this collection of data.
So, from our standpoint,
that's always been the case.
So, my challenge is,
you all let this happen.
You all let knew that this was
happening and you let it go on.
There is nothing new about the
prism stuff and all of these.
It's kind of ironic for people
in my world 'cause we all
sit back and we go, you know,
in 2010, the Washington
Posts, Dana Priest
and William Arkin wrote an
excellent series called Top
Secret America where
they're talking about all
of the built way companies
that are building the
surveillance technologies
that the federal government
and other entities are using.
All out there was an excellent
series on the newspaper
that I read it back then.
Newsweek came out in
2008 where they talked
about a whistle blower
who mentioned
about NSA's warrantless
wiretapping so to speak.
It was all out there.
If you go back and you look
through the press things,
there was always something
there and nobody reacted to it.
So, it's ironic from
my viewpoint
that everybody is having
this big flop about it now
because it's been there
and you let it happen.
So, my charge to you is don't
let it happen again, OK?
When you do read
about these things,
you need to influence your
legislatures about what's going
on 'cause they do not
understand the technology.
One quick example, in Virginia,
there's data bridge
notification laws
of social security is disclosed.
You know, somebody
gets a spreadsheet
and it explodes out there.
Yet I can go to a county
courthouse website and look
up public records deeds,
divorce decrees, whatever,
and what's on those documents.
Yet the kind of clerks can't
redact that information
because until recently,
the law forbid it, OK?
Everybody was in a rush for
eGovernment but never thought
about what's in those
documents that going there.
So, we need to be
able to influence
and educate the legislatures
who are--
who are building the policy.
So, this is the whole thing.
I'm a technologist and everybody
in here, the computer scientists
and all that, you all
learned in here with me.
We help build this
infrastructure.
We may have had a
misgiving where we thought
that as builders we could
control the people who use it.
But as, you know,
previous history shown
with the atom bomb development
and all these other things,
that's not always the case.
Builders do not control
the controllers.
That's my first point.
The second point is that, again,
you all have smart phones.
Actually I don't.
I have kind of a dumb phone
and people always laugh.
They go, "You know,
you're a technologist,"
and I just have a little,
you know, Samsung Integrity
with the nice little
flippy thing.
And I said, "Because the
guys in my lab have busted
into the smart phones
and tracked everybody
all over the place."
But actually the reason
why I don't this is
because the battery life is not
long enough for my taste, OK?
But a great quote, Lyn Paramore
[assumed spelling] wrote a great
article and in there quoted
things that are supposed
to make our lives easier.
"Smartphones, Gmails,
Skype, GPS, Facebook,
they have become
tools to track us.
And we've been happily
shopping for the bars
to our own prison one prison at
a time, one product at a time."
So, we're in the-- we're
to blame for all of this.
We are allowing that to happen.
The last thing I want to talk
about is this Federal
word play thing.
Whenever I confront a student
or a professor whose been
violating a university policy,
you let something
go out on the net.
And I go. "Why did you do that?"
And it's kind of like watching,
you know, a six-year-old.
"I don't know, you know, it
wasn't my fault," you know.
That type of stuff.
And you get this
word play, you know.
Richard Pryor, a long time
ago had an excellent thing
when his son broke something
and he asked his son happened.
And all the word play that his
son came out with, you know,
"Some invisible man came
out and broke the thing."
That's what we're seeing now.
We're seeing this when they
say we're not collecting data
on you.
Well, OK, your not collecting it
technically but you're buying it
from people who are
collecting it from us.
So, that's-- that's
one thing there.
The network companies that say,
you know, the data providers,
the Verizons, the Googles,
they say, "Hey, you know,
we're not willingly giving it
to the federal government."
Well, of course not.
You're being subpoenaed
for the document.
You're not giving it
willingly to the-- to there.
You know, Zack Holman
wrote a great little tweet.
It says, "We don't give
direct database access
to government agencies."
That quote has become the
new "I didn't inhale," OK?
And so the key word is direct.
Marketers are being collecting
information on us all the time.
And, in fact, that was
one of the big things
that helped us with 9/11.
On a positive side,
that did help us
in 9/11 identify the hijackers
when the marketing companies
and the credit card companies
realized that they could help
because they had that data.
So, we need to be sure that
things are done correctly.
Everybody says we're
doing it legally.
And that's correct.
The laws stated they can do it.
It's the creation of
that law that's the flaw.
And that's my surveillance guide
telling me it's time to quit.
Those are my points.
>> Thanks, Randy.
Melissa?
>> Thank you.
Well, I think it's
important to look
to our past to inform
our future.
And I'm going to take a
little bit different direction
than my colleagues.
The very first transmission of
the internet was October 29th,
1969 and it was an e-mail
between two universities.
And today we have more than 204
e-mails are sent per minute.
More than 1,300 new mobile
users are added per minute
to the internet, 47,000
applications are downloaded,
100,000 tweets, 1.3 million
videos are uploaded to YouTube,
two million searches to Google,
and six million Facebook views.
The internet is part of
every part of our life
and over the last
45 almost years,
we have embedded the internet
in every part of our society.
And it is the backbone of our
core infrastructure of every--
every country's core
infrastructure.
It represents e-government,
e-banking, e-health, e-learning,
the next generation of
air traffic control,
the next generation
of power grids
and every other essential
service has been concentrated
onto one infrastructure,
the internet.
And that is putting
our businesses
and our national
security at risk.
And I-- when I speak about
our, I'm really speaking
in as a global citizen.
If I were in France I would be
speaking about it in France.
If I were Iran or
Israel, it's the same way.
And so I think that
that has really began
to change the conversation
that we can't have any one
single point of failure,
economic failure and/or national
security failure to any one
of our-- of our core
businesses or infrastructures.
And so when we're talking about
cyber security and we're talking
about different government
actions and we wrap it all
into one conversation, I ask
you to start to think about it
as multiple conversations.
And it's not helpful
to bundle into one term
of cyber security
and/or surveillance.
So, I'd you to-- I'd like
you to think about it
in six different ways
of why our governments
and why our industry are
talking past each other.
The first is is when we're
talking about cyber security,
we're sometimes talking
about political activism.
Those who would like to bring
transparency to policies
and to our initiatives
that they don't agree with.
In the United States, one could
say that that was WikiLeaks
that brought about a great
amount of transparency
to US policies as they
leaked our information
into the internet.
All right, one could argue
that that was also Snowden.
But in other countries
political activism is being used
by Twitter, using Twitter and/or
Facebook to organize people
in these squares like Taksim
and/or in Turkey or Egypt
to express political
discontent with their government
with the intent to
overthrow the government.
Political instability.
And so when our governments
are starting to talk
about surveillance on the
internet and/or filtering
of the internet, some believe in
political democracy and freedom
of that speech on the
internet and others do not.
And it has different
mechanisms of how they're using
that surveillance
or the technology
around political activism.
Now that should not be
confused with organized crime
on the internet, the real modern
day bank robber who's stealing
ones and zeros which
is real dollars
out of your credit accounts
or out of your real banks,
and as being passed on as
a cost for our citizens.
We have many of our
governments who are talking
about the importance
of organized crime.
When I was just in Europe
just a few weeks ago,
it was 30 million dollars stolen
out of 45 different
cities in 30 minutes.
That's a real problem
for our banks.
It's a real problem
for our credit cards.
And we're having to deal
with that organized crime
and real theft of
ones and zeroes.
Now that should not be confused
with intellectual property theft
and industrial espionage.
That's very different.
And many of our government
leaders in the United States
and many government leaders
in Europe are talking
about the unprecedented theft
of intellectual property.
Thefts, meaning,
illegally copying the plans,
processes and/or next
generation technologies
out of our corporations
for the economic advance
of their companies
and/or countries.
And so the intellectual property
theft is then not the same
as espionage.
And there are governments
that are conducting espionage.
Most governments do to steal
the plans and intentions
of other governments and
know their capabilities.
In the United States, we
sort of bundled the two,
IP theft and espionage.
When were talking about it, in
fact, we're talking about it
as Pearl Harbor and other
very exaggerated terms.
If we are going to bundle
intellectual property theft
with espionage then we have
to be willing to put espionage
that we would walk from
it as a government.
And I don't see any
government willing
to walk away from espionage.
So, why don't we talk about
what's really the problem
and that's intellectual property
theft and/or the protection
of intellectual property
and patents, et cetera.
There are two other areas that
are becoming more concerning
for most companies and
countries that are--
the first is disruption
of service.
And this is the distributed
denial-of-services actually
degrading real services
in your e-banking
and your e-infrastructures
that are preventing our banks
from allowing you to actually
access those infrastructures
and/or capabilities.
And we just had a--
and a significant,
in the United States,
we're having a distributed
denial-of-service
against our financial
institutions
and so are many others
in Asia and Europe.
And then finally the
destruction of property.
There was just recently a
malware that was released
against Saudi ARamCo
which destroyed 30,000
of their computers.
And when we start to actually
think about destruction
of property and how one
might recover from that
that is a different set of
capabilities than you would deal
with from organized crime
and/or political activism.
So, as we talk about this
on our panel over the course
of the next hour, I ask
you to start to think
about which problem
are you talking
about because we're not
talking about the same thing
in each of our conversations.
I'd like to wrap up and that
over 100 countries have
these capabilities,
and they are using these
capabilities to deal
with these different problems
whether it's political activism
to overthrow government
or its political activism
to bring transparency
to policies they don't
like is different
than organized crime
or intellectual property theft.
And there are three strategic
things that are happening
in the global order of things.
First, some are using disruptive
technology like a Stuxnet
or a Shamoon to bring
down core infrastructures
or core businesses
around the world
or some are implementing
surveillance tools to bring
about transparency or to
show the vulnerabilities
for those infrastructures
to be brought down.
So, disruptive technologies
are being used.
Second, strategic alliances
are also being wielded
to actually gather that power
and control over the internet.
And that's playing out in
the UN and the ITU and NATO
and ACION [assumed spelling]
and other of the forum
where countries can
align against each other
for particular motives.
And then finally there
are strategic properties.
And I mean that in the
very sense of it is.
There are 25 internet
service providers
that control 90 percent
of information flow
on the internet.
There are internet
exchange points
that actually control the
flow of technology and/or ones
and zeroes from continent to
continent or within a continent.
And there are data aggregators
who have actually more
information on us like a Google
or a Facebook than any
foreign intelligence service
of any other country.
So, you have to think
about where are the
strategic properties
and how they're being used
by all governments not
just by one government.
Thank you.
>> Thank you, Melissa.
Laura?
>> Good afternoon everyone.
I'm very delighted to be here.
And I wish to thank the Internet
Society for the invitation
and for GW for hosting
it as well.
I view PRISM as an
opportunity to draw attention
to the implications of broader
global internet governance
conflicts that have
implications for economic
and expressive liberty.
I recently-- recently the
last two or three years spent
that time researching
and writing a new book
called the Global War
for Internet Governance.
And it's going to be
published later this year
by Yale University Press.
Now in this book, there are
approximately four pages
at the end of acronyms.
So, what I've done is I've
challenged myself today
to not use any acronyms.
So, what I would like to ask you
to do is to pound on the table
if I use an internet governance
acronyms, so pay attention
to that, and I know some
of you will do that.
But what I tried to do
in the book is describe
the various layers
of how the internet is
already governed and what some
of the current debates are that
I expect to shape the future
of freedom and innovation
in the coming years.
Now what is internet governance?
This panel has already
described it.
If I had to give one definition,
I would say internet governance
is the design and administration
of the technologies
that are necessary
to keep the internet operational
and then the enactment
of substantive policy
around those technologies.
But there is no single system
of internet governance.
John said it best when he was
describing the various roles,
names and numbers,
administration,
standard setting, private
interconnection, arrangements
between telecommunication
companies, the privacy policies
that are enacted by social
media, by search engines
and other information
intermediaries.
And, of course, cyber security
governance not necessarily
enacted by governments
but by entities
such as certificate
authorities that are handing
out digital signatures
and things like that.
So, those are just
a few examples.
So, we need to take this
conversation outside
of discussions about
just governance.
However, one of themes that
I do take up in the book
and in my work in general is
that internet governance
conflicts are the new spaces
where political and economic
power is working itself
out in the 21st century.
We see this with PRISM,
we see this with Stuxnet,
we see this with the
turn to intellectual--
to infrastructure
for intellectual property
rights enforcement,
with governments cutting off
access during political turmoil.
And as Mellissa said,
we had denial-of-service
attacks often used
to suppress human
rights and expression.
So, internet governance points
of control are really not just
about keeping the internet
operational although
that is absolutely vital.
But there are also a proxy
for broader political
and economic conflicts.
So, the fact that PRISM
draws attention to some
of these broader global
internet governance issues is
an opportunity.
But keep in mind that government
surveillance ad censorship
for that matter which is in my
opinion an even greater problem
around the world
is not something
that happens in a vacuum.
So, it's delegated and
it is made possible
by certain arrangements
of technical architecture
and by private ordering.
So, infrastructure governance
just to give you a few examples,
infrastructure governance is
directly tied to privacy issues.
So, I have an information
engineering background.
I am also a social scientist
who studies the politics
of technical architecture.
And I can say that, you
know, you probably could say
to use a Harry Potter analogy.
There are some dark arts
of internet governance
that have a good intention but
they can be used for other uses.
So, one of these, for example,
is the deep packet inspection.
I didn't use the acronym
so no pounding on the table
which is a capability that
allows network providers
to inspect the actual
content of packets sent
over the internet rather
than just the packet headers.
So, this can be used
for a variety
of very important function
such as network management,
detecting viruses and worms.
It could also be used for
customized advertising,
now getting outside of
the operational role,
or for surveillances
or for throttling
and blocking of traffic.
So, this is a very significant
development made possible only
by advances and processing
power and storage.
And we need transparency
and accountability
in issues like this as well.
So, another area of
infrastructure related
to privacy is the hidden
identity infrastructure
that makes possible business
models that are based
on online advertising.
So, this is a good thing
for freedom of expression
because there are free products
that we are able to use,
but we are almost at the
point where the prospect
for anonymous speech considering
this identity infrastructure is
almost impossible.
We have technical identifiers
at the level of hardware
like Ethernet cards at the level
of virtual identifiers
locationally via cellphone
location, wireless fidelity
AKA wifi, it's my one acronym
or global positioning
system and through things
like platform mediation and real
identification requirements.
So, if you put this all
together, this is at the heart
of business models that
we need at the heart
of online advertising, at the
heart of having free software.
But it also is the
technical capability
that can enable new
form, even newer forms
of surveillance in the future.
So, these are new
opportunities for surveillance.
Two other infrastructure issues
I'll mention I'll mention
quickly include a current
rethinking and redesign of the
"who is" protocol
which keeps track
of who is registering a
domain name and, of course,
also the issue as has
already been mentioned
of internet exchange points.
How these are governed and
how they are distributed
around the world is something
that is very related
to civil liberties.
The Internet Society and we'll
hear from next has really been
at the forefront of
this area which--
having more internet
exchange points,
looking at the criticality
of them for human rights
for infrastructure development
and as concentrated points
of information flows.
So, the truth is that global
internet choke points,
of course, exist.
And the internet is governed
not by any one entity
but multi-stakeholder governance
which I'm sure we will take
up in the roundtable later.
But that this governance
is not fixed anymore
than architecture is fixed.
So, the architecture
is constantly changing
and the governance is
constantly changing as well.
The basic theoretical
or conceptual framework
of my own work is
that arrangements
of technical architecture are
also arrangements of power.
So, it's critical for the public
to be engaged in these debates
because the future of
internet architecture
and governance is
directly related
to the future of
internet freedom.
So, I appreciate the opportunity
to discuss that here today.
Thank you very much
for listening.
>> Thank you, Laura.
Lynn?
>> Good afternoon.
This has been a very
comprehensive set
of speaking points, I
have to say to date.
So, the Internet Society is
a cause-based organization.
We advocate for an
open global internet.
In the recent revelations
about the mass scale
interceptions not only
by the US, the UK, but
many, many other countries
around the world have
serious implications
for the open global internet.
ISOC is an international
organization.
We have members, org
members and chapters
in virtually every country
of the world perhaps even
every country of the world.
We have headquarters in
just outside of D.C. here
in Western Virginia and
Geneva, Switzerland.
And we have a very senior policy
and technical staff in little
over 20 countries of
the world often times
in the same individual
which is more
and more the future in any case.
I spent 27 years in
Europe, just moved back
to the US a little
over a year ago.
And the one thing I'd really
like to do is to make sure
that here in D.C., in
this country's capital
that we recognize that this
is not just about US citizens
and it's not just
about the foreigners
that the US is surveilling.
This affects every
individual in the world.
It affects some of
them very directly
but it will affect the
internet we all have access
to going forward to tomorrow
and to generations to come.
If we are not careful, we will
actually rob both individuals
today, tomorrow and future
generations of all the freedom
and the benefit and
the innovation
that the internet has brought.
The Internet Society actually
deals an awful lot in principles
and the principles that make the
internet what the internet is.
First and foremost,
it's a platform.
It allows everybody to go out
and develop what they choose to,
to access what they choose to,
to innovate on material that's
out there and make
that available.
If we're not careful,
we'll loose all of that.
So, the-- in particular
recently,
the unwarded collection
storage and the ease
of correlation amongst all
the data that's collected.
And I actually don't
differentiate a lot
between metadata and content.
You can get so much
information from metadata
that we shouldn't kid
ourselves by saying,
"It's just metadata we're
collecting, it's OK."
That-- though the collection
that will undermine many
of the key principles
and relationships.
And in particular some of those
natural conclusions will start
to impact the physical
infrastructure
of the internet itself whether
it's using some of the IXPs
as choke points or
whether it's using some
of the technical
capabilities that exist
to help with surveillance.
Those are all things
we want to I think--
think through very,
very carefully.
One of the principles we argue
for is multistakeholder
dialogue.
And it's because so much of what
we're all facing whether it's
in a policy or a technical
or a social environment
has never been done
in the world before.
We're breaking barriers
every single day and we need
to bring everybody to the
table for a discussion
and move forward
thoughtfully and carefully.
That is even more so when we
look to governments particularly
in their role in
protecting citizens.
We believe that the internet
must be a channel for secure,
reliable, private communication
between entities
and individuals.
And surveillance without due
process is simply unacceptable.
And as some other articles
have said recently, frankly,
it's very creepy as well.
And if that makes it more
personal, this is good
because we need everybody to
care about what's happening now.
We also challenge the
view that policies
to ensure security
must always come
at the cost of user's rights.
I'd also argue with the fact
that we all know it was coming
so what are we concerned about?
Due process wasn't followed.
That's what were
concerned about.
Did most people that
pay attention
to this field understand that
you could do all these sorts
of things with the data?
Yes. Did we believe our
governments were doing it
without due process
and certainly
without an adequate
level of transparency?
I might answer yes
but hopefully--
hopefully we didn't
and [inaudible]
to happen as Frank said.
One of the things we'd actually
like to do is really
get everybody to focus
on the multistakeholder.
A lot of the principles
that have given us the internet
find new forms, structures
and processes to address that.
Don't revert back to we
need a new institution.
I don't think that is the answer
in almost every situation.
Some of the recent proposals
that have been put forward
to address some of these
aspects would call for treaties.
Treaties are largely
intergovernmental.
They don't allow for
the private sector.
They don't allow
for civil society.
And honestly I don't
know how you get some
of those private
sector companies
to sign on to a treaty.
So, I don't think treaties
are the answer either.
We're going to need to create
new processes and new forums
and certainly at the
core of all that ought
to be thoughtful
informed dialogue.
So, I think, you
know, it's our hope
that as these discussions
continue across the world
that we recognize and
come to agree again
on some other high
level principles.
Some of the ones I'd throw
out for further debate,
is it unwanted surveillance
even in the furtherance
of national security
is not acceptable.
Unwarranted surveillance
is not acceptable.
The disproportionate
surveillance is also
not acceptable.
That surveillance
without accountability is
not acceptable.
And further, turning
to something a little
more positive,
that there should be
transparency with respect
to policy and its
implementation,
that we should be harnessing the
expertise of all stakeholders
to discover better ways
to protect citizens
in a global community.
And most importantly,
encore to everything we do
that we uphold human rights.
And so I look forward to
the discussion for the rest
of the day, and thank you.
>> Thank you, Lynn.
Danny?
>> Thanks, Lance.
So, thanks to the Internet
Society and GW, Lynn and Lance,
for getting-- Paul for
getting us together.
And at the end of the
panel, I'm always reminded
of this very distinguished
member of Congress said
at the near the end of a very
excruciatingly long hearing,
everything's been said but
not every one has said it.
So, I subscribe to much
of what has been said
by many of my fellow panels.
I want to just make three points
about what I think we've
been experiencing as a result
of this surveillance
debate over the last month.
I think fundamentally what
we've had is a certain degree
of a crisis in confidence
and a crisis in trust
about the internet environment.
The question is, should
you trust it or not?
And as Mellissa noted,
it's, I think, useful to try
to breakdown to some extent
our current sources of trust
in the internet in particular,
in society in general.
I want to just make three
points about the institutional,
legal and political levels of
trust that we tend to look to.
To start with the
institutional, you heard from--
you heard from John and
from Lynn about some
of the institutions that
make the internet work.
You know, I think
it's interesting
when you look purely
technically at the internet.
People pretty much trust that
the pack is going to arrive more
or less in the right order.
And enough of them
will get there
that you could get your
message through it.
You can watch video.
We don't-- we don't have a
lot of debates about that.
I will note just as a kind of
a observation of the sociology
in a certain way of people
in the internet technical
community.
There is a sense in some
ways as Lynn suggested
that if any third party
can get in the middle
of a communication stream
between two parties,
but that is in a sort of
very idealized sense a
technical failure.
It's the internet
not working properly.
Now that's a narrow
technical view
of the internet environment.
We, of course, have a
broader legal and social
and political view of our
societies, and we do recognize
that that surveillance
and espionage will happen.
But part of the challenge, I
think, in closing the trust gap
that we have is to articulate
better what those sorts
of expectations are.
We do have administrative
institutions
like that run the
domain name service
and IP address assignment.
Thanks to people like John.
They just kind of worked--
people grumble about
I can't [phonetic].
But so far, you know, people
are getting new domain names.
They are being maintained.
Nothing has completely
fallen apart at that point.
What I think is more complicated
on the institutional trust
front is that in many cases,
we're used to looking
to government
to establish trustworthiness
in society.
And certainly governments
believe their job is
to establish trustworthiness
in society.
But as you've heard, many
of our sources of trust
in the internet are
actually not governmental.
They are working perfectly well
largely without governments.
And I'll come back
and talk about that.
But again because of that
somewhat unusual circumstance
that Lynn alluded to, these
multistakeholder processes,
we probably have to understand
that a little bit better
so that people can trust
those environments.
You know, on the-- when we
look at legal institutions,
we rely a lot on our
legal institutions
to establish trust in society.
We hope that our legal
institutions make it
so that most people and most
institutions mostly do the right
thing most of the time.
We don't expect perfection
but we do expect our legal
institutions to set standards
and that there are consequences
when they're not followed.
I think when we look at
the privacy issues raised
by the current surveillance
practices
that had been revealed, the
problem that we have, I believe,
is that every one would like
there to be a sense of privacy
in our communications
environment.
But I think we have a real--
a lot of confusion about
just what that ought to mean.
We tend to think about
privacy particularly
in the computer network
environment as being able
to keep things secret.
Well, I think we all understand
now that we don't have a lot
of secrets, and we rely
on lots of third parties
to maintain our information.
So, we don't keep secrets as
well as we may be used to.
And my own view is that that
means we have to start thinking
about privacy more as a question
of whether information is used
properly whether it's misused,
whether it's used
to discriminate unfairly
against people.
But that's going to require
certain amount of discussion.
Lots of people have
mentioned accountability.
We're going to need better
accountability mechanisms
for these more complex
privacy rules.
When privacy is not
a binary phenomenon
that is either it's secret or
it's not, we need mechanisms
to assure trust in the way
personal information is handled.
I think there's a very
simple analogy actually
that we can draw from
the financial world.
Huge parts of our economy,
huge parts of the
world's economy run based
on a pretty well understand
set of accounting rules.
We're used to looking at
balance sheets for corporations
and having some sense of trust
that those balance sheets
reflect what's actually going
on in the financial life
of the corporations.
We don't expect to see
all the transactions
in the general ledger in order
to look and get a picture
of whether the corporation is
profitable, not profitable,
paying its taxes
correctly, not, et cetera.
Now there are-- this doesn't
always work perfectly,
but I the analogy particularly
to the NSA surveillance
situation is quite strong.
We do as citizens of the
United States want to be able
to have a sense of confidence
that our intelligence agencies
are following the rules
that they say they're following.
My guess is they probably do
about 90 percent of the time.
But we want to know that
there's some accountability
to those rules.
I think we understand that
we're not going to be able
to send auditors, independent
auditors inside classified
environments and can have
them come back and report
on everything they found.
But if we follow this balance
sheet model, if we follow
to a methodology of assessing
how information is used,
we can get that sense
of trust back.
And finally, as a
matter of political trust
and by political,
I don't mean kind
of small P Washington politics.
I really mean politics
in the sense
of how we organize
ourselves as a society.
As people on this
panel have noted,
our sources of political
trust are complicated
in the internet environment
and unusual.
We are used to the
idea of states
of government's exercising
authority directly
on institutions often
on intermediaries,
but in the internet
world and we're--
and if you considered
the analogy
between telephone
networks in the past
and internet service providers
today, telephone networks,
broadcast networks were
really creatures of the state.
They were authorized by
the actions of legislatures
and therefore controlled in that
way at the local state federal
and even international
legal level.
The internet doesn't--
has not happened that way,
it was not a creature of the
state ever, it was really
in many ways a creature of
individual and voluntary action
by some people on this panel,
by others all around the world
who participate in making this
internet institutions work.
But now when we're
nervous about how they work
and how the state work
we have rethink some
of these relationships.
So, we're going to have
to get use to the fact
that governments-- I
would submit cannot reach
into these internet institutions
like the internet engineering
test force like I can--
like the worldwide
web consortium
and achieve exactly
the result they want.
But of course at the same time
governments will make laws
and rules about how individuals
and corporations act whether
for intellectual
property protection
or privacy protection
or anything else.
So, I think that what this--
the whole surveillance
experience has revealed is
that the rules and expectations
that we have are quite
a bit more nuanced
than the very binary
technical behavior
of the internet environment.
And I think our challenge
is now to do a better job
of articulating just
what we expected,
all these different
institutions at all these levels
and how we're going
to find accountability
to those expectations.
Thanks.
>> Thank you Danny and thank
you everybody on the panel.
I think what we'll do now,
I'm going to open up first
to the panelist for
five or 10 minutes
so they can ask questions
of their fellow panelists,
make further, you know,
comments, go some back and forth
that way for five or 10 minutes.
In the meantime if
you in the audience,
if you have a question would
you please if you're physically
in the audience here
at GW step up to one
of these two microphones in
either of the isles, form a line
and when your turn comes please
state your name and affiliation
and then ask your question.
If you are in the internet
world, if you're off
in the clouds somewhere and
want to communicate send it in,
Paul any other directions
on that
or you have some
questions already?
While you're waiting, I want to
give the panelist a chance first
but any other protocol?
>> So, they type the
questions into live stream
and I'll be reading them
here at one of these mics.
So, that's for the
live stream panelists.
In New York they can just line
up at their microphone there.
>> In New York they can
line up their microphone
and we'll see them
live up there?
>> We'll see them,
yes, that's right.
>> OK.
>> Very good.
>> All right.
This will be interesting.
OK, but first let's get to the--
give the panelists a chance
to ask questions, Leslie?
>> So, I want to ask a question
of Danny because talking
about the concern or persuading
people that, you know,
winning people of off
government is sort
of the governance structure
for the internet and trying
to educate them that it's
not really government,
it's all of these other
institutions and we do them
in a multi-stakeholder
way and many people
up here have spent
considerable time trying
to move people to that model.
It just seems to
me that the rest
of the world right now is going
to think we've been involved
in a slight of hand
that basically we're
saying governments stay out,
governments don't get
too involved here.
All these other into multi
stakeholder institutions are
really the core of
the internet and then
at the same time
building an environment
where the United States
uses historically--
historical dominance
to basically trump all
of those governance.
So, I hear what you're saying
but it was a hard argument
to make to the rest of
the world beforehand.
I'm just curious
whether you're continuing
to say it with a straight face.
But I'm having trouble.
>> It's a habit.
I guess what I would say
is the ability to make
that argument really
depends on--
as several people
have said the layer
at which you're making
the argument.
I don't believe that the NSA
surveillance changes one bit the
question of who should be
setting standards for TCPIP
or who should be determining
how domain names get assigned.
I do believe that as you
said Leslie that the question
of government espionage
activities whether it's the NSA
or GCHQ or MI5 or, you know,
the German Intelligence Agency,
the French Intelligence
Agency, anyone of them,
all of which you're doing
exactly the same thing.
I do believe that we now have
to have a more public discussion
about what our expectations are
for surveillance
including espionage
in the internet environment.
But that shouldn't get confused
with the question of whether all
of a sudden we need
a treaty about how
to set internet technical
standards.
And I believe that, you know,
I'm highly uncomfortable talking
about the rest of the world.
But I think that what we saw in
the internet governance debate
at the United Nations at the--
in Dubai where the proposition
from Democratic countries like
Iran and China and Russia was
to exert greater control
over the internet environment
was rejected not just
by the usual suspects, that
is the 34 OACD countries
who you could somewhat
expect to do that.
But by another 20 countries,
from Africa and South Asia
and different parts of
the world, that I think
at Brazil have recognized that
while we could always do better
with the current internet
governors arrangements
that they're working and
messing with them has a cause
for all those countries.
So, I think as long as we
keep these issues distinct
and don't confuse them
I think there's a way
to have both discussions
in a coherent way.
>> Well, so I agree with you.
>> I know you do.
[laughs]
>> But it seems to me
the opportunity here
for many countries to
combine them together
to not make them distinct.
The opportunity to
reclaim control
by basically bringing
this together.
>> Sure. So, what
did Russia say?
What did Russia say this-- you
know, Russia said in response
to the NSA we need more
government control--
>> Right.
>> -- of both the
internet infrastructure
and the internet companies.
It's a-- I mean, I think the
question is how does anyone say
that with a straight face
when the concern was undo
government intrusion?
But, yeah, I mean it--
people who want to make those
arguments will find ways
to make them.
>> I worry that many of those
in between are suddenly going
to become more persuadable
because of the outrage.
>> So, I have a question
for my fellow panelists.
And it's sort of following
what Danny just raised.
In December we had an
interesting conference,
the World Conference
on International
Telecommunications.
I'll use the acronym
WCIT not 'cause I want
to have the table bounded.
I explain the acronym first.
>> You did.
>> But you hear the
term WCIT so I want
to pronounce it as
you might hear it.
But the World Conference
on International
Telecommunications was look
at some treaty arrangements.
So, some tariffs.
Regarding interconnection
and there were number
of very interesting proposals
that shut up in Dubai.
And I'm struck by the
timing because that happened
and now we now have a lot of
events regarding surveillance
and then I say and
so on and so forth.
And I guess with my panelists
I'd ask the question,
does anyone care to speculate
if water had been reversed?
What the outcome
would have been?
Because I've had a
few people suggest
that that's an interesting
exercise.
I am not sure whether or not
the outcome that we had in Dubai
in December is what
we would be seeing
if in fact it was being
done instead next month.
>> Hold on, that was my concern.
That's my concern.
Well, I think that if you
look at the World Conference
on International
Telecommunications,
it was an important treaty
negotiation, renegotiation
that hadn't been renegotiated
since 1988, is that right?
'88. And as Americans we look
at these negotiations as one--
as a one negotiation and I think
that that's a poor perspective
because the WCIT was really
about how does one monetize
the internet and to pay
for court infrastructure.
And it is one of a multi-series
of negotiations, the world--
there's another
telecommunications conference
on policy, WTPF, it
just happened in Geneva
and they'll be the world
summit on information society
that will be culminating
in 2014 I think, right?
2014, '15.
>> So on, yup.
>> And there will be 24
negotiations to go between now
and then that will ultimately
be where things will land.
And then from-- the world summit
on information society
will be the strategy
by which will be executed
in the WTPF for policy.
The WCIT for regulation and
in the internet standards--
in the international
standards organization
for the overall technology.
So, I think if you are a
person in the corporate world
and you're worried about these
things you shouldn't just look
at one of these forums
as one off.
And if you're worried about it
from a government perspective
it's not just the policy forum
where the regulatory forum,
it's all of this forum
and they're all interconnected.
So, I would say that yes, I
think you actually suggested
that it was a positive outcome
at WCIT in Dubai and I think
that the United States lost
in that negotiation but--
and I think that the United
States and many are going
to continue to lose and it's
going to be a quick erosion
of our stance not a slower
version of our stance.
>> I'll take one more
question from the panel.
Any other panelist has
a question before we go
out to the audience?
Going once?
OK.
>> Mike Nelson with
Bloomberg Government
and with Georgetown University.
I want to commend the internet
society for great panel,
we got the lawyers,
we've got the techies,
we've got the scholars,
we've got the activists,
and that's great but we
tend here in Washington
to talk about the policy.
And Danny I tweeted your--
a [inaudible] of your talk
which I thought was exceptional.
And that was--
>> You got it to 142 characters?
>> Less than that.
But you basically said, data
will flow, we can't really focus
as we used to on
controlling that flow,
we have to control the
misuse of that data.
Policy makers are starting
to understand that.
But I think we also
have to figure out a way
that techies can start
implementing systems
that reflect that.
And the first way to
do that is to make sure
that systems are more
transparent so that we can see
where data is being misused.
And I guess I'd challenge the
audience to think about privacy,
not to tell the audience
and the panel to think
about transparency by design.
We've heard about privacy by
design but has anybody thought
of examples of where we're
building in the transparencies
so its in the technology
and other places
where we could do that better?
Just an open question.
>> Laura?
>> OK. I think that's a really
great question and a good point.
I'll give one example of where
I think the transparency is
excellent and then
a couple of examples
where I think we need
more transparency.
What is one of the oldest and
most vulnerable institutions
of internet governance?
The internet engineering
taskforce jumps to mind.
So, this is the-- one
of the standard setting
organizations for the internet.
There are many others
but they have set many
of the core standards so they
have a tradition of being open
in three different ways.
They're open in the
development of a standard
and that anyone can participate.
Now, granted there are a lot
of barriers to participation,
it requires a lot of
technical knowledge,
it requires in many
cases money to go to some
of the events in time.
But it is basically
open to anyone.
They are also open
and transparent
in that the actual
specification.
So, a standard is
not really software
or hardware specifications
that are written down
and people can go
online and view them.
So, I would differ with some
of the panelists and say that,
"Oh the technology
is-- it is political."
So, the technology designers
make political decisions
in the design whether they
like to call it that or not.
So, sometimes privacy
is designed in.
Think about encryption
standards for example.
Think about unique identifiers
and the privacy implications.
Yet the specification is
open so there are some degree
of accountability where
people can view it.
It's also open in
the implementation
because it results in
multiple competing products
that are based on that standard.
So, that's an example.
In other cases we don't have a
lot of transparency and I agree
with you that we need more.
So, here is an example, how do
we look at interconnections?
So, this is an area where
I'm worried because of all
of the calls for greater
government regulation
of interconnection in an area
that has worked fairly
well up until now.
Well, part of the reason
we're seeing this calls
for a regulation is that we
can't really see what the
agreements are between
these private companies.
So, I think it would be more
helpful to have transparency
in an area such as that as well
as other infrastructure areas.
>> So, I want to go
back to Danny's premise
which you apparently
support which seems to be--
data will flow, everybody
will collect it
and we should only
focus on the uses.
And that's certainly a
discussion we've had on sort
of the consumer side
of the ledger?
You know, Google will
collect it and where we have
to focus our attention
is how they're using it.
I have to submit the government
is collecting information
and certainly the US government
collecting information really
to-- is subject to-- I mean in
our own country it's subject
to this little thing called
the Fourth Amendment and I know
of no case and I stand-- I'm
willing to stand corrected
that says, you can go in--
I mean, this is essentially
what the governments is arguing
in NSA collection.
And they're calling it
acquisition and not collection
that acquiring the
information is not collection.
And that any rights that
might attach don't happen
until you open and
look at the packets.
I don't know, you know, I've
never heard anybody come
into somebody's house, walk
away with their desk drawer
and say, "We're acquiring."
To let you know if we ever
get around to looking at it.
And so-- Danny and I have
some disagreement although I'm
getting persuaded
more and more by his--
by the question of use
in the commercial side
of this big data world.
But, I'm not willing to go
there in terms of governments.
And I think it's a really
dangerous thing to do.
>> So I-- just to
clarify, my observation
that data will flow is not
meant as a moral conclusion.
And I think the extension
which we choose to put limits
on how much data government
can acquire from those
who have already
collected it, right.
Because that's what
we're talking about here,
it's very important and I think
that historically we have relied
on technical barriers to large
scale information collection
as a way to limit how much
power the government has
and we don't have those anymore.
So, we're going to have
to get very explicit
about what limits we think
government should have
on both the collection
and the use front.
My only observation kind of
back to your point Mike is
that we are much
better technically
at managing collection
limitation
than we are managing
use limitation.
Just as a pure matter
of the kinds
of computer science techniques
that we have available
and I would submit
that's because, you know,
the computer security community
cryptographers have taught us a
huge amount about how
to keep data secret
and control access to data.
There's a whole other set
of disciplines developing
in computer science that try to
characterize information usage,
track information usage,
but it is a different--
but there is less progress
on that because I think
that that's not a
view of privacy
that computer sciences
have previously focused on.
So, I think you're
exactly right to point
out that we need
more work there.
>> I'd actually hear
from the techies.
Because I wasn't thinking
so much about transparency
at the institution
level at layer eight.
I was thinking more
the lower levels.
Well, like--
>> Oh, I'll give the--
let me give the--
>> -- like route to tracing,
you know, when we send an e-mail
to each other you can find out
where it balanced along the way.
>> Let me give the techies
about two minutes before we move
on to another question
because we will have a chance
to circle back in
the round table again
so we can take another
bite at the apple here.
>> Yeah.
>> Go ahead.
>> I just want to--
just very quickly.
Stealing is stealing.
It doesn't matter whether
it's in the physical world
or in the cyber world.
So, whatever the techniques you
have to collect data of a theft,
in the physical world you
can apply the same techniques
in the cyber world.
The difference is speed.
I mean it takes me
physically a long time to go in
and steal a laptop from
the gentleman's tester
but I can steal all the
information on his laptop
in a second, probably as long
as it took me to do it as long
as I can connect
it over the net.
So, the comment about
the government, you know,
and the search warrant in
the constitution, you should,
you know, that's why it's there.
That's why we have
the constitution is
to follow those laws.
And you can still achieve
the same goals and stay
within the constitutional
limits.
It's been done.
It's just that what's happened
is we got a bunch of people
at the policy level that
didn't understand what the
implications are.
And that's where-- everything
that they've done
has been legal.
It-- the law is the problem.
Not what whether
they're doing it or that.
>> I would question that.
>> But--
>> OK. I'm going to move
this along because I want
to give Joanne a chance and
I'm sure Steve is getting a lot
of farther for the round table
to come back to just later on.
>> So, I don't want
to pick up on thing
which is the internet has
a tradition or convention,
I wouldn't say tradition,
convention of protocols
which behave in an open manner.
And so, this is for
example, your--
when you're looking at how
packets flow, there are commands
like traceroute that let you see
how they go through the internet
and you can map them through an
exchange point most of the time.
When you look at mail headers,
you can look at e-mail headers
and you can actually see,
wow that's not my e-mail,
it got from point A to
point B and it's visible
and you can see those
most of the time.
When you look at a packet that
you've received you can look
at the source address and
say, "Oh, where is that from?"
And you can look it up and
find it most of the time.
Now, there is no
obligations that any
of this information is accurate.
It's all sufficiently accurate
to keep the internet
running or at least so far.
And we hope it will
just keep it running,
but there's no actual
obligations and you need
to be careful because while
there would be some benefit
to having an attribute that says
there's an actual obligation
to make this accurate, then
I see people emerging saying,
"Well, wait a second, now I'm
worried about my anonymity
because now you can trace my
IP, or you can trace my e-mail."
So, we have just a
convention of transparency
which has been enough to
keep the internet running.
There is a question on
whether or not that's going
to actually work long term.
The point that was made by
Randy which is that the rate
at which you can attack
something digitally is a lot
faster than physically.
And this means that the ability
to have an accountable internet
where we can actually figure
out who sent the bomb threat
or figure out who sent the
e-mail which cause the problem
at the school is
potentially a very large duty
and it may require us making
a tradeoff between anonymity
and curated anonymity in
order to have accountability.
Right now it's not
clear that one
or the other is the
right answer.
>> So, we may-- we'll circle
back to this in the round table.
Let me move on to the
next question over here.
>> All right, I'm [inaudible]
cofounder of Codex for Africa.
This is more to as
the techie side too
but at the same time
from a global view.
We represent thousand
of developers in Africa,
in the upcoming years it's going
to be more software
developers who're are going
to be creating thousands of
applications on mobile and web.
And one of the things is what
are the strategies there,
when you have emerging countries
or emerging economy jumping
on a bag of bandwagon of using
the internet to do transaction
with the US or the
western world.
What do you think what would
happen because I could be
in a country like Synagogue,
you know, do some hacking,
I can do anything I can because
you don't have access to the--
maybe the continent
level network.
But as well as the
western world,
what are your strategies
and all that?
>> Well, this is where
the law comes into play.
What we hear on the
techie side for instance is
of course there is laws
in hacking in the US,
but there is no laws
in hacking in China,
as we would understand it.
So, each country gets to define,
you know, what a hacking is.
Some may take it as an
assault against the government
if you are hacking, you know,
some might just say it's
a plain and simple theft.
So, you're going to have to-- I
would think you'd have to look
at each individual
country's definition
of what they considered to
be hacking in that case.
Now, on the other side, again,
if you're writing an application
for someone like that then
you're going to do logging,
you're going to do all of this
type of stuff because you want
to provide an auditor
if you will
if it's a financial
application with some record
of whatever transactions
your software handles.
So, there's always going to be
a record of something that you--
either your app did or
where your app went.
Whether it's accurate or
not that's another question
but there's always
going to be a record.
And again, metadata
analysis I can use that
and make some inferences
as to what you did even
though I can't see what you--
what's in your individual
packets if you encrypted them.
>> John?
>> So, that's an amazing
wake up call here.
So, we have this internet
that's remarkable.
It allows people to interact,
people in different countries
with different expectations
to interact.
And yet, the conventions
by which governments work
haven't evolved fast enough.
The idea that citizen in country
A is interacting with citizen
in country B and it might be
illegal in one country and not
in another is a whole
new concept
that governments are going
to take some time to try
to figure out how to deal with.
So, we have a problem.
We literally have an
internet that has capabilities
that governments haven't
come to grip on how
to handle their duties
and responsibilities.
I know governments
have feel very strongly
about protecting their
citizens against pornography
or against certain
types of content.
I know governments
in other countries
that feel very strongly that
that's up to each citizen.
But the reality is that that
intersection has now happened
because of the internet.
Two governments can have
very different views
on what their responsibilities
of their citizens are.
So, to answer your
question in a general case,
the internets move
faster than governments.
Governments literally do
not know how to interact
with the situation you describe.
On a practical matter, if
you end up doing something
of significance, something
that causes a lot of harm
or actually there's a very
nice list of types of attacks,
distraction of property, theft
of intellectual property.
There's different types
of extortion or DDoS,
if you actually do something of
a major magnitude you'll find
out that law enforcement does
cooperate between countries
and it works very well.
It's just not set up for
the scale of the internet.
And it's in the age
of the cooperation
between law enforcement
and various computer
response teams is one step
above fax machines ringing
and going back and forth.
We have the mechanism to
handle the really bad events
fairly slowly.
We don't have anything
to handle the scale
of automatic attacks
happening 24 hours a day
around the entire
globe which don't--
>> Let me move to Danny.
He wanted to say something
and then I'm going to move
on to the next question.
By the way, I can't
really talk to anybody
in New York once
I ask a question.
So, what they do I guess
they'll stand up or something
or else go through Paul.
Danny, go ahead.
>> I just want to make one
observation about the challenge
of international law
enforcement cooperation.
Most people in this room
are probably familiar
with the SOPA debate that was
proposed in United States.
In a certain sense we only
have that debate with all
of its cataclysm because of the
failure of current mechanisms
in international law
enforcement cooperation.
We have that debate, the
Congress was considering
that law blocking access
to websites outside
the United States
that might have infringing
content because people
in Congress were concerned
that US Law Enforcement didn't
have an effective way of working
with law enforcement
authorities from the countries
where the infringement
was actually happening.
I think that we have to get a
lot better as John is suggesting
at add enforcement cooperation.
There are realms where that
works reasonably well but it's--
the problem is it's mostly
cooperation in the form of how
to make a criminal conviction
against someone to stick.
Law enforcement cooperation
mechanisms are good
at exchanging evidence,
it make sure
that you have the information
you need to, you know,
bring someone to
trial but not good
at actually stopping
the behavior
that maybe harmful
as it's happening.
So, I think it's a
very big challenge.
>> All right, go to Paul for a--
>> I actually did see that
David Salmon [assumed spelling]
of the New York Society's
chapter president would
like to have a question.
So, why don't we go
to him if he will--
I think they have a
little bit of a delay.
So, he might just be
hearing this in a second.
>> OK David.
[ Inaudible Remark ]
>> OK, that's your cue David.
>> OK. I'll speak to the
camera then or-- yeah.
OK, so.
[ Inaudible Remark ]
OK, we have some delay here.
My question is what sort
of scenarios do our
panelists envision
and what would be some
alternative solutions
if our government specifically
Congress is unwilling or unable
to rain in agencies such as the
NSA in terms of surveillance?
If they can't do
it or choose not
to what would be
the consequences?
Are there technical solutions
or are there possible solutions
that could be implemented
without US government?
>> OK. The panelists are being--
the panelists are being asked,
is there a work around congress?
>> I would just to
speak to it just
as an individual not
as a panel member.
But if congress can't rain
in the government agency we
have a lot more serious problems
than what's going
on in the internet.
>> When was the last time
we passed a federal budget?
>> I mean, they are
government agency.
Congress has to do that.
Now, again, there is
classified information
and all this other stuff that
can influence how law is passed.
But quite frankly if congress
didn't have that power
to do it then we wouldn't see
General Alexander making a run
up to talk to members, I
think was it today or--
>> No, it's tomorrow.
>> Yeah, the vote is tomorrow.
So, you know, doing that,
so certainly I would think
congress has the ability to do
and should have the ability or
else we don't have a democracy.
>> OK, any other
panelist winging on that?
Lynn?
>> Well--
>> You can just say quicker
than I'm-- oh, I'm sorry.
>> No please.
>> That, you know, there
are ways for people
to manage their traffic.
I know I'm certainly certain
that would be even more ways
for people to manage their
traffic and choose the routing.
We actually are quite
concerned about that
because it will make the global
internet much less resilient.
It will-- putting something
in a box doesn't mean it's--
it maybe protecting it from
one country actually examine it
but it doesn't protect
the other country.
And so, I'm not quite sure
what David's question was but,
you know, if it's about
routing and the ability to route
around what you see as a
problem, I think we need
to be very, very
careful about what some
of those potential solutions are
and because I don't think
it will address the question
you're-- the problem you're
trying to route around.
And in fact it will overtime
make the global internet much
less resilient.
>> Paul?
>> OK, I have a question
from live stream.
It's from Garth Gram
[assumed spelling].
He asks, is the real
issue autonomy
and self determined
choice rather than privacy?
And if so, what is
the role of identity
in addressing the
issue of trust?
>> Well, I'll take
one step at that.
I think that in the
discussions of privacy
over the last 10 years or
so, maybe longer I think
that we've gotten a little
bit distracted by the promise
of individual choice as
somehow the key to privacy.
I think that a lot of
the privacy values--
and what I mean by that
is the dialogue box is
that everyone sees in, you
know, one website or another
where you have to click here
to accept the privacy policy
or swat away a dialogue
box to proceed.
And I think certainly in-- it's
actually a remarkable point
of convergence between the
United States and Europe
in the last couple years
both the White House
and the Federal Trade Commission
issued major privacy policy
statements that noted
the limitations of this
so called noticing choice or
individual determination model.
The European certainly have
pointed that out as well.
A lot of the things
that we value associated
with privacy are
collected values.
We want to make sure
people can associate freely,
can engage in politics,
can engage in commerce,
can seek medical
care, et cetera.
And I think that giving
people the choices to opt
out of those things or
somehow control their identity
when they are trying to
speak to their doctor or make
up public political
statement really seems
to be exactly the opposite of
some of our core privacy value.
So, I think that
there are situations
in which individual
autonomy is quite important
but a little bit also to the
last question about the NSA.
I don't think we get ourselves
out of these privacy problems
by just giving people, you
know, 20K long encryption keys
to wield against everyone else.
>> Laura?
>> That's a really
interesting question and I want
to tie it back to something
that I think Danny said
before about data will flow.
And, you know, while
I agree with that,
that's also not necessarily
the case.
We have interconnection disputes
that have resulted in outages,
we've had countries
that have cut off access
for their citizens.
We have areas of the world
that have infrastructures
of complete censorship.
We have digital divide
issues, we have trends away
from interoperability where
we're going in the cloud
to more proprietary
protocols for example.
So, it's-- so data will
not necessarily flow.
But one of the things
that is required for it
to flow is this issue of trust
that the questioner brought up.
So, I think I can mention just
a couple of areas or maybe three
that are very important.
So, the trust has always excited
between network providers
to exchange information about
IP addresses that are either
in their control or that they
can reach on the internet.
But we have seen
examples that's done
by through a boarder
gateway protocol.
There have been examples
where false routes have been
advertised whether intentionally
or not and outages
have occurred.
So, there is-- our effort
is underway now to secure
that which are very necessary.
So, we have to build
trust into the network.
It's not something that
we can just assume.
It has to be designed in,
it has to be build in.
The same thing with how the
domain name system works.
We have servers located around
the world that resolve queries
of domain names like maybe I'm
up here looking at cnn.com,
I'm not but the domain
name server would resolve
that into its IP address
and route the information.
Well, that can be gamed also
and that there can be a
false return of a query.
So, having things like domain
name system security extensions
has to be continued
to be implemented.
You know, these are just
a few of the examples,
an answer to the question
that it has to be designed in,
same thing with website
authentication.
If I'm saying that correctly the
role of certificate authorities
and how they verify
through a digital signatures
that a website is who
the website says it is.
So, again, this is an
example of the politics
of the architecture, it's
no just about agreements
between people but about
designing this trust
and identity into
the infrastructure.
>> I'm going to move on
to the next question just
because I want to get the
audience as much opportunity
as I can because the
panelists are going to be able
to circle back on this
later on over here.
>> So, I'm Luke Wadman [assumed
spelling], I'm a student working
as a policy analyst intern,
analysis intern for
IEEE this summer.
I'm working on internet
governance issues.
And does the panel
think there is any--
would it be a good way to
frame the debate on privacy
and internet governance and
et cetera in economic terms
because if I've learned
anything in my time in DC it's
that catching the ear
of our congressional
representatives is easy
if you start talking about
jobs and job creation
and we've already talked a
little bit about the impact
of things like prism on US-based
IT companies like Google
and Facebook, particularly
in the EU
but also around the world.
One case is that Google isn't
really competitive in China
and that's probably going to
continue in that direction.
So, would that be a good way to
frame this whole conversation
and actually encourage some sort
of positive congressional
action?
>> So, I would never say
that I have any idea how
to encourage positive
congressional action.
I just want to put
that on the table.
I think it is true
that everything that's
happened this sort
of last six weeks inside this
sort of NSA bubble has happened
without any reference
as to what it might--
the impact that it might
have on US industry.
And I think it is possible
that the impact at least
in the short run maybe severe.
On the other hand a
lot of people may carry
on about being unhappy
about discovering
that the NSA is sucking
up their data.
Historically, when
the big comp--
if you look at the SOPA fight
which I think was
probably the first time
that US internet industry sort
of held hands with activists
and technologist, it does
get congresses attention.
I will say though that
National Security is different.
It is just always
different and the arc
of National Security has been
more, more, more since 9/11
and the question is whether
these revelations have sort
of pushed us beyond the
more and more place.
>> OK. Let's move over here.
>> Hi, I'm Susan Aaronson
with GW, I'm a professor here
and I work with the
Worldwide Web Foundation
on measuring internet openness.
And I want to ask you a
question that relates to trust,
the trust of policy makers.
So, in the last couple of
days we've seen [inaudible]
and Angle a Miracle [assumed
spelling] make these delightful
comments about sever locations
and threats in terms of privacy.
And again, I wonder
if there are--
so, they're basically saying
if the server can't be located
where we can control, where our
privacy rules dominate we might
not accept for example some
of the things the
United States wants
in the trade agreement or--
and we see similar things with
the Trans-Pacific Partnership
and I just wonder if you
could talk a little bit
about this now.
You know, you can always, for
national security reasons,
you can always say you have
a particular policy in place
and it's not protectionist.
But this is opposite
of that, right?
They're saying that
for privacy reasons,
they want to essentially
protect their citizens
from their information
being traded
by having the server
location in the United Stated.
If I may add one other
thing which is Frank La Rue,
who works for the-- who is
the UN Special Representative
on Freedom of Expression,
he has said basically
that the US' failure to protect
the privacy is a violation
of its human rights' obligation
because that is a
basic human right
under the Universal
Declaration, blah, blah, blah.
So I want to hear your comments.
>> Sure. I'll do this.
Pull it out there.
I'll-- the Trans-Pacific
Partnership
and the US Free Trade Agreement
is and always will have had
to address the data
privacy laws.
The Safe Harbor that
we had in place
in 2001 will actually
expire with the agreement.
And the United States, as you
know, has no national umbrella
for data breach and
data privacy.
We have 47 individual states
with their individual programs
and no national umbrella.
And so, if we're recalling
for congressional action
that had an economic, you
know, significant impact,
there are 52 pieces of
legislation currently
in 113th Congress
around cyber security,
about 10 of which
around data breach.
It would be wonderful
if we could get
to some bipartisan
agreement on that
so we could enable the
overall Free Trade Agreement
to move forward between
the two continents.
More specifically though, noting
the 47 different state laws
and noting the difference
between the Europe
and the United States,
cloud computing
and where the data is
stored follows the geography
and will always follow
the geography.
So if there's a data breach
here in the state of Virginia,
it follows a different
set of rules
than Massachusetts
and in California.
And a company, whoever the
company might be, actually has
to know all sets of laws
for that particular state
in this case in order to follow
the regulatory compliance,
et cetera.
That also is the same
for if it's stored
in the United Kingdom,
it follows the United Kingdom's
laws, and the Netherlands,
and Brazil, and you
pick the place.
And so when the EU and
the leaders of Germany
and elsewhere are talking
about the data protection
and data privacy, and they are
looking at the United States
and worried about how our data--
we're protecting
data and the privacy,
then it would be also important
understand how the European
companies are mirroring data
in other countries like Brazil
or South Africa or
Egypt or China or India,
et cetera because the data
always follows the law
of the geography
that it sits in.
>> I'll just add to that
that one of the things to--
I mean, obviously, the
NSA revelations have sort
of strengthened the EU's
hand in a discussion
that was going long before.
We have a particular view
of what privacy means.
It doesn't match up, going back
to this question earlier about,
you know, what economic kind of
motivation might move Congress.
One would think the US
companies would move forward
on a comprehensive
data protection regime
in the United States that
might be more flexible
and perhaps reflect the internet
more than the European one,
but I haven't seen them
step forward on that.
I think it would be interesting
for somebody to ask the question
about the various EU countries
in their surveillance regimes
because as much as I say
some very unpleasant things
about ours, I think you
would find that it--
with the exception
of our capacity
for the just incredible
scale of collection,
that the actual legal
protections are no better
at best and probably
a lot worse.
>> Just one comment on
the trade discussions.
Suzanne, I think
it's a very good,
it's a very important question.
I certainly think that,
you know, as you well know,
better than probably anyone
in this room, you know,
trade agreements have always
made exceptions for things
like national security,
public morals,
sometimes consumer
protections, things like that.
I think what we see now is
that simply pushing them off,
those issues off into the
exception category is not going
to work so we need
some kind of mechanism
that on the one hand
respects the fact
that governments do
have a legitimate
and important interest in
protecting their citizens
against unsafe products,
against human rights violations
if that's the way they do
privacy, against, you know,
security breaches,
what have you.
But tying that to the
location of data is, I think,
just an overly simplistic way
of accomplishing that purpose,
and I think, you know,
you can make fancy--
well, you can make fancy trade
arguments about why that's not,
you know, most favored
nation treatment.
But I think the bottom line is,
we used to have trade agreements
that were fundamentally about
tariffs and we've mostly dealt
with those issues, and now we
are going to trade agreements
that are fundamentally about
the non-tariff barriers
that exist between economies.
So we're going to have
to deal with that either.
I think that in the, you
know-- for some period of time,
I think the surveillance issues
will cloud those discussions
but we'll come back
to them at some point
and they will be
the same issues.
So-- and I-- the only thing I--
the only final thing I
would say, I think that one
of the big challenges
we're going to have
in the trade context on
internet issues is the challenge
that we found with ACTA,
that the ACTA was making--
[Inaudible Remark] Sorry, oh,
sorry, oh God, Steve is going
to throw that look at me.
So there was a trade agreement
involving intellectual property
enforcement whose
acronym is ACTA
and was very strenuously opposed
by civil society groups all
over the world because they
didn't know what it was,
they didn't know what was in
the agreement and they argued,
I think-- I thought,
quite legitimately
that if there are
going to be rules made
about intellectual property
rights that affect individuals,
there should be some
public discussion
of what those rules are.
Trade people believe they
somehow can't negotiate
in public.
And that's a sort of an article
of faith in the trade world.
They're going to have to learn
to be a little bit more public
if they're going to get anything
done on these issues is my deal.
>> Lynn, you got the last
word before the break.
>> Just quickly.
Not only-- it wasn't that they
wouldn't negotiate in public,
they would not authorize
a release
of the documents
post-negotiation.
They were not available
publicly.
>> So this sounds
like a thread going--
circling back to NSA and FISA
and all that, but I am sorry
that we have hit the point
where we promised we were going
to take a very brief five-minute
break that you're going
to have a chance to stretch
your legs, then we're going
to come back and people on the
panel will mix it up some more,
even better I suspect,
moderated by Steve Roberts.
But let's take a quick
five-minute break.
There will be one other
opportunity for you all to meet
and greet at least
most of the panelists
and there's a reception that
starts at 5:15 afterwards.
But for now, five-minute break,
we'll convene at 4 o'clock.
Thank you very much.
[ Inaudible Discussions ]
Well, thanks for
sticking around.
I know it's been
a long afternoon.
As Lance said, I'm
Steve Roberts.
I'm a professor here at
GW in the School of Media
and Public Affairs,
right across the street.
And my job is to try to
crystallize some of the issues
that we've been discussing
and [inaudible] some
conversation among
the panelists.
And I want to start by quoting
a couple of things I heard.
Lynn, for instance, said that
"unwanted surveillance
is not acceptable."
Leslie talked a lot
about human rights.
But there was a phrase
that I did not hear the entire
first hour and a half except
in passing, and that word
was "national security."
And so I want to pose this
question to the panel.
Isn't national security
a human right?
Isn't safety a human right?
Isn't the unwanted surveillance,
one person's unwanted
surveillance is another person's
protection from danger
and from terrorism?
So, I want to ask everybody,
what's the tradeoff here?
The whole idea in the first half
of this panel was the importance
of the freedoms in the internet.
But what are the limits,
and what are the
legitimate tradeoffs,
and how do we balance
legitimate human rights
against legitimate
rights to be safe
from terrorism and
other threats?
Who wants to start?
Go ahead, John.
>> So I'm going to almost answer
the question, but not quite.
It is true that the
governments have certain roles
and responsibilities.
And one of those roles is
there's a certain protection,
a certain defensive role
that a government feels
it has to provide.
And the question is how do
governments do what they see
as their obligations,
their actual responsibilities
given the internet.
The internet has not been
very good at this, OK?
So, --
>> Would you excuse me.
It's not just an obligation,
it's not just something
that they passing, this
is the first obligation
of government, is to protect--
>> Right.
>> -- people.
Isn't it the first obligation?
>> Ideal. One of the things that
[inaudible] does, of course,
is we're responsible for
maintaining a registry
of IP addresses and that
registry is often used
because someone does
something in cyberspace
and the first thing
law enforcement would
like to know is, where is
that in the real world?
Because real world has the
people in organizations
and the cyberspace has to do
with domain names
and IP addresses.
And so, governments
feel they have
to enforce laws for example.
And yet the internet wasn't
built with an interface
for government is saying, "If
you're trying to do your duty,
here's how you go about
finding that person.
Here's how you go about doing
what you see as an obligation."
So, I know a lot of
people look at this
and they go this entire area of
governments and what they want
to do with the internet and
they want to take control
and they want to
do surveillance.
If you turn it around
and look at it,
remember that from the
government's perspective,
in many cases, these governments
feel they have an obligation
and the internet is
actively preventing them
from doing something
they're required
by their citizens to do.
So, we need to not omit the fact
that the internet doesn't
provide a friendly interface
to government.
So, me people would see that
as a feature but it's a fact
that shouldn't be
overlooked in the discussion.
>> Tradeoff.
What's the tradeoff?
Leslie?
>> So, I want to back this up.
This is not a new question
and it doesn't have
to do with the internet.
I mean, we have a--
an international
human rights framework
that explicitly makes national
security an exception for--
exception for-- in
human rights treaties.
It is an obligation of
the countries themselves
to protect our national
security.
But we also have an entire
developed jurisprudence
about publicly enacted
transparent law,
proportionate law, fair
process, remedy and oversight.
And, you know, I think
we just throw this
into the internet context, we're
just missing, there's a bit--
you know, there's a basic--
there's bodies of law and norms.
And the question here is not
whether there's a tradeoff,
it's whether you
reach a balance.
And I think when you have
most of this process secret,
the judicial process
secret, the oversight secret,
the interpretation
of the law secret,
then you cannot achieve
that balance.
The question at the
end of day is balance.
I certainly would take
issue with the idea
that the internet has been
unfriendly to law enforcement
and it's always this, you
know, we're going dark
and we can't see anything.
I think if we learned anything
over the last couple of months,
it's that law enforcement
really has access
to much more information
and that there is
therefore a temptation
to use what technology
has created
to go beyond what a balanced
human rights frame would allow.
And I think that's
what our problem is,
not that they're not
supposed to be [inaudible].
It is a first order of
business for government.
They are supposed to
protect their citizens.
But Steve, if you look at this
framework that's been created,
it was framework that was
created on a battlefield in Iraq
to make sure that you had every
less possible bid of information
to make sure you would
know about the IED.
And this whole haystack
and needle analogy assumes
that collecting a
haystack is proportionate,
and I don't think it is.
>> But the President
has said this program
of surveillance is
essential, the Director
of national security said that
it's essential, the Chairman
of the Senate Intelligence
Committee,
a liberal former mayor
of San Francisco had
said it's essential,
what's your quarrel with this?
And how do you rebut their
argument of everybody
who has had access to the
secret, say this is justifiable.
I'd like other people
to deal with this.
>> Please.
>> Yeah. [Multiple Speakers]
>> OK. So, it's-- there's
so many portrayals
of this as a binary.
And, you know, I think
the issue is more one
of degrees [phonetic] and
a more granular issue.
But there are some
binaries here, right?
We either have a
constitution or we don't.
We either have a fourth
amendment or we don't.
But if you start looking
at the actual practices
and I don't think we have a full
picture of exactly what's going
on but based on some of the
things that we've heard,
there are ways to enact the
necessary national security
without crossing the lines
that would be unacceptable
to the majority of the people.
So, having low level-- so
layers of control and layers
of accountability in the
processes of surveillance,
right, so not just having any
low level analyst being able
to take a fire hose of
information and download
that unto their computer just
to exaggerate the point, right?
So, there's the granularity,
there's getting the
information that's necessary,
there's the process
of accountability,
there's the issue
of judicial review.
So, I think that there are ways
to enact the necessary
national security now
that our public's
fear is online and now
that we have the privatization
of that public's fear
without going to the extremes
of basically having
the fire hose analogy
and just downloading
whatever data about anybody.
>> Anybody else on the panel
who want to pick on this?
Please, go ahead.
>> So, you want us to talk about
tradeoffs but I actually want
to suggest that I think a more
accountable clear system is
better for national security.
I think what's happening
now where you have very,
very broad authorities that
are unclear is almost the worst
of all possible worlds
for both civil liberties
and national security
because you have--
you have policy officials,
other governments, activists,
et cetera, poking
around in the business
of the intelligence community,
and that's not a very good thing
for them frankly, they want
to able to do what they do
of quietly and-- but in
order for us to do that,
in order for that to happen,
there has to be a clear sense
of what the rules are.
One sense I which-- I
largely agree with Leslie
but the one sense in which
I think this is an internet
problem is it's really
kind of a 9/11 problem,
and then I think a lot of
what's going on is going
on under the kind of exceptional
basis that we've handled a lot
of national security
issues post 9/11.
And to quote the President
again, ironically enough,
just a few weeks before this
whole surveillance story broke,
the President went to the
National Defense Universities,
you know, and gave a
speech saying, number one,
it is bad for a country
to be perpetually at war,
and number two, that
the threat level
from Al Qaeda was basically
below the level that it was
at 9/11, and that we should--
and that we should start
treating that threat,
that national security threat
as part of the norm not
as an exception that
we have to respond
to with these kinds
of exceptions.
This whole surveillance
program was created
as the President's
surveillance programs, you know,
as an exception, and
that's its problem.
If the problem is not--
>> Although continued by
a democratic president--
>> Yes, that will-- that's
right but I think that it needs
to be continued on a more
clear accountable basis.
And so I don't tend to accept
that the issue gets solved
by saying more surveillance,
less surveillance.
I think that the issue
is surveillance according
to what rules and with
what accountability.
>> Lynn I quoted [phonetic]
you-- please, your turn.
>> Yeah. I mean, I'll come
to my point [inaudible]
but just [inaudible] said
unwarranted surveillance.
I recognize the difficulty
in unwanted thief
in the perspective
of the individual.
So, it's very much
an unwarranted.
>> Thank you.
>> But-- And I just
really wanted
to echo the three comments
that have been made here
very, very, very strongly.
When-- In a system
like the internet
which is breaking all barriers
where we're so interconnected
and so interdependent, we
have to change our paradigm
of looking at this and move
it to one of managing risk.
We can talk about in the context
of tradeoffs if you like.
But we really do
have to look at--
>> Wasn't that the only context?
Or isn't tradeoff is the only
legitimate way to talk about it?
Because we-- isn't that
what we do everyday?
>> I think tradeoff
is legitimate way
but I'm not sure we're
making the right tradeoffs
and I think we continue to
focus on national security
and quite often run
by flagrant abuses
than we're conflating the issue
or we're not pulling it apart.
It's not about national security
and what is the best way
to protect national security.
From my perspective, you know,
what our members
are actually upset
about is the flagrant
abuses and the lack
of transparency and the secrecy.
>> Yes, please.
>> And I think part of
the problem that I have
with hearing what they've said
for giving the reasons is
we haven't heard the reason
that makes sense.
It's-- why are you
collecting the data,
it's like the equivalent
of your mom
and dad saying well,
because I said so.
You have to give it something
behind that, you know, to--
is there a credible threat
at whatever level there is.
I think Danny is right.
I think the threat level from
what we've read in previous,
you know, speeches
by the President is
that the threat level is a
lot less than it was at 9/11.
Well, if it's a lot less
than it wasn't 9/11,
why do we need to expand this?
Give us something to look at.
But I think when I hear
them talk about these things
and give these reasons as
somebody who does this type
of metadata analysis
and, you know,
just as for my own
infrastructure was certainly
in my own infrastructure I
can do a lot of that analysis.
But there's an uplink to me.
And those people that
control that infrastructure,
my infrastructure,
your infrastructure,
they can do the same
type of analysis
and it trees all the way up.
It's-- So, why?
You have to give us
a credible reason.
>> But was running through a lot
of your comments is a basic
mistrust of government.
I mean you've been told--
public has been told by
the Intelligence committees
which have in brief that this
is a very valuable tool PRISM
and other surveillance are
very valuable to the President.
Duly elected democratic liberal
president had said it's a very
valuable tool, the
liberal chairman
of the Senate Intelligence
Committee has said it's a very
valuable tool and everyone
of you is doubting it.
So, what is the source of your
suspicions and your mistrust
of what you're being told?
>> So, I actually
don't, you know, when--
there's no way for us to
know if it's a valuable tool
or not a valuable tool.
So, you could take them at face
value that it's a valuable tool.
Collection of data
is a valuable thing.
It's just not the only analysis
in a democratic society.
And I think-- so, I mean, I--
and that's I think
the problem here,
we live in a democratic
society where we're supposed
to have proportional laws
that more than a small number
of people are able to know
about to assess that balance
between liberty and security.
We really don't have that.
I mean, if this was a discussion
that they were tasking
these companies
with specific request
based on articulable facts
about specific individuals
or even several hundred
individuals,
we might be having a different
discussion about the balance
between liberty and security.
But we're having a
discussion about the value
of basically collecting
the data potentially
on everybody in the world.
I mean, we don't know the set.
So, it's not about trust
of government or not.
You know, I think you could
probably come, you know,
device a program where you
know everything about everybody
in the world and claim
it makes you safer,
maybe it makes you safer.
But we no longer are
following either the values,
the constitution
or the norms of it.
>> Well, we see you're not
following the constitution.
These laws were passed by
democratically-elected Congress.
>> Well, having been there.
Yeah.
>> Yeah, right.
>> Having been there,
they didn't know what
they were passing
and they didn't know
what [inaudible].
>> So, [inaudible] to that, you
just said the issue wasn't trust
and you now you just say, well,
they didn't know what
they were passing.
>> They didn't know--
they didn't know--
>> If you believe well-- well,
let me ask you the question.
If you believe in a democratic
system, now you're saying,
I don't believe
in the democratic process
that's passed these laws.
>> No.
>> That they were
misinformed and we know better?
>> No. The laws have been
after the fact, stretched
and manipulated in ways
the Congress didn't intend.
And that's where-- and that's
where we've gone off the rails.
Nobody who is in Congress
at that time, Section 215,
the metadata law
that we're talking
about which is aimed
specifically US citizens.
In making the changes they
were making, nobody believed
that relevant data meant
everybody in the United States.
>> Let me ask you--
>> So, you know, this is--
so this is ultimately--
yes, it's a question
of trust in so far
as the people implementing the
law have made it as elastic
as possible without it
completely exploding
and it might not be exploding.
>> John.
>> I've expressed no view
on whether it's desirable
or undesirable or whether
it's illegal or legal.
Neither of those questions
are really interesting to me.
When it comes to
the internet though,
the question is there's
a set of events going
on regarding surveillance,
and the internet is
global in nature.
We have allies and
trading partners
and organizations globally,
other governments who want
to understand what's going
on because they may
have the same desire.
There may be another government
that wishes for its reasons
to engage in surveillance of
communication in its country.
And it wants to understand
what is the framework
by which this is occurring
and how does it happen
in the internet, how was it's
supported, how does it go
on because they have their
own national interests
and they may pass laws in their
region that are perfectly fine
and acceptable according
to their processes.
So, we now have this
framework that says,
there are circumstances during
which surveillance is
apparently an accepted part
of the architecture.
What we don't have
is a transparency
about where that's occurring and
how that occurs and what happens
if another 130 countries
also do it.
I believe that if we're to have
equitable internet governance,
it's necessary to have
a fully articulated
and transparent framework.
I do not know whether
or not everyone is going
to like what their country
chooses for what it does
with surveillance or not.
That's a different question.
That's a question of laws
and governance structure.
But if this is going to go
on, we need to understand
where it occurs and how
it occurs and the fact
that it could be occurring
in a lot of places.
And that should be understood
and documented as part
of a clearly transparent
recognition
that this is part
of the internet.
>> Let me ask you
all this question.
You said you're not
interested in legality.
But one of the key debates
here is the legal framework
for PRISM and the FISA law.
And there's not much
debate about whether
or what's been taking places
legal or not under the law,
but there's a big debate about
whether the law is the right law
and whether the framework
should be altered.
If you all were to testify
before an intelligence
committees and others
on the Hill and asked,
how should this law be change
to advance the values
your talking about?
What would be some
of your suggestions?
Go ahead.
>> I think we have to start
by walking out the changes
that we made in the
records law because we took
out all the words that
make it proportionate
and make it targeted
and transformed it
into a broad collection statute.
And I, you know, I think
the ways to walk it back
that allows substantial
collection of targets
and information related to
that targets and backs it
out of this broad relevancy
standard that allows it--
if one to be collected
on anybody but also not--
it just takes out the whole
national security purpose.
Basically, you no longer
have to be collecting data
because of a particular
terrorist
or particular intelligence
activity.
You only have to be
collecting in order
to be protecting
the United States.
And that is simply to fraud
and to likely to abuse.
It is harder for me to
note what have changed 702
because we still don't
understand what they're doing.
>> And [inaudible] going
to thought about these--
>> Except for the transparence--
except for greater transparency.
>> 'Cause this is-- this
is going to be debated
in the weeks and months ahead.
It's a very important question.
>> But the traditional method
of before the haystack
love [phonetic],
if you allow me to call it that.
Before that was placed,
the traditional methods
of law enforcement
worked, and they would work
with whatever the
internet had to provide.
You needed to identify somebody.
You usually identify them
through a non-technical aspect.
You had an informant
somebody tell you, "Hey,
I think that you were doing
something illegal," and that--
that puts the focus on you.
From there, you would use
your traditional tools whether
they're on the net or
not to find, you know,
to find out what's going on.
Collecting data when there's
no evidence of a crime is kind
of counter intuitive and
kind of productive in a way
because it's sitting there.
So, if it were me and I was an
adversary of the United States,
I would find where those--
that database was being stored
and I would go after it to
collect all that information
because I can do the same
type of metadata analysis
that could be done that way.
The third thing is--
the reason why we--
you've mentioned earlier that
maybe we've mistrusted is
because we know what can be
done with that data and we know
when somebody-- we know
when somebody has given
us a [inaudible] answer.
Because I know that if I
control my infrastructure,
I know the power that I
have doing in my office,
I have to act responsibly
and within, you know,
the laws and all that.
But I know what can be done
if there's no oversight
on my position.
And that's why I
think you hear--
>> But there is oversight.
It is, you know, I mean they--
>> It would be if you were-- if
you were the oversight committee
for what I would do technically,
do you have the technical skills
to know what I'm doing?
[Inaudible Remark]
>> So I'm going to
leave the legal--
so the legal policy
questions, I largely agree
with what has been said.
I don't think that we
have adequate oversight.
And if I were-- I was talking
to Congress about what to do
to increase the trust
in this environment,
I would say that that Congress
and the FISA court
needs a more effective
accountability mechanism.
There is no way that the FISA
court judges or the members
of the Intelligence
community are looking
at every single query--
>> Right.
>> -- that NSA analysts
are performing
on these enormous
amounts of data.
It is technically possible to do
that to Mike Nelson's [assumed
spelling] earlier point
to actually evaluate whether
when Bob led the general counsel
of ODNI says, "Yeah, we have
the whole state haystack
but we only ask questions
based on certain predicates."
I know Bob and I more
or less trust him
but I think it's outrageous
for the government to say
to its citizens,
"Don't worry, trust us."
We give the government
considerable authority
but we need mechanisms
to make sure it's being
used responsibly.
And none of the oversight
mechanisms that exist
that you've mentioned are
able to provide that kind
of accountability
other than to call
up a responsible
person like, you know,
Mr. Ledin [assumed
spelling] say,
"Are you following the rules?"
And he says, "Yes, we're
following the rules."
He doesn't even know what
every single analyst does
in the agencies that's
responsible for it.
>> Let me ask you about one of
the proposals that has been made
and why they debated
in Washington.
And so, a lot of people
pointed out one of the flaws,
critics had pointed
out one of the flaws
in the FISA process is there's
no adversarial mechanism
within the FISA system that the
government comes in and asks
for permission and there
is no counter voice.
There is no adversarial
proceeding.
And in most legal systems, there
is a mechanism for challenging.
So, a number of legislative
proposals have been advanced
in one form or another.
Is this one of the mechanism set
that Congress should be looking
at to try to reorder
this balance that many
of you think is out way?
>> Yeah. I actually think
this question of some kind
of a public advocate and
I think it's probably--
we figured it out how to give
private lawyers the ability
to look at classified
information
and criminal procedures.
We ought to be able to come up
with this table of those people
who litigate the
national security state,
who can stand in for the public.
And, you know, I think it's one
of many potential points of sort
of strengthening oversight here.
I think it's-- I think
it's critically important.
I think different levels of sort
of reporting back
to the FISA court.
I think part of the
problem and the reason
that people are responding
is, I mean,
it's interesting FISA was
a civil liberties measure
when it was adopted in 1978.
And, you know, it's basically
my mentors were the civil
libertarians who
proposed this crazy idea.
And the world is really
different from the ones in 1978.
And being in contact with
a foreign person, I mean,
you know, there was
an iron curtain.
If you were-- if they
could actually figure
out you were communicating
with a foreign person,
it probably had some
significance.
We now live in this
world where 20 percent
of us are first generation,
where our corporations
are global,
where we travel all the
time, and where we--
people don't identify
themselves in that the same kind
of we-them way and
yet we have a law
and a designation
of foreign persons.
That really is a Cold
War era and almost has
to be reconsidered
all by itself.
And the law can't
be working very well
because it's not
supposed to sweep
up American's communications.
And all you have to do is read
the minimization guidelines
to understand how much of our
communications [inaudible].
>> Hal Berghel wrote
an interesting article
that just came out in
IEEE Computer magazine.
It's called "Through
the PRISM Darkly".
And there's a quote
in there that says,
"The Foreign Intelligence
Surveillance Court has an
approval rate of 99.93 percent
of all surveillance requests.
While this might not meet
the strict definition
of a kangaroo court,
it seems to fall
within the marsupial family."
So--
[ Laughter ]
The point of it is is that there
are, you know, there are two
and he calls them cyber urban
myths that deal with this.
One is that you do need
to all of this, you know,
information to do it
and that there's not--
there's sufficient oversight.
And I think we all agree,
there's not sufficient
oversight.
You wouldn't ask me to be on
a medical oversight committee
to review surgical procedures
because I'm not a
doctor, I'm not a surgeon.
I don't have that
expertise in that area.
And so, I think that's the--
I think that's the thing
that bothers the technology
people is we know it is a small
community of the actual people
that know the nuts and bolts
about technology security
from that standpoint.
And if we don't know
each other by--
personally, we know each other
by reputation and whatever.
And so when you look and
you query your other peers
and they have the same
misgivings that you do,
then it makes you
wonder what's going on.
>> I just want to make one
other point about the people
who are being swept up in
this-- in this surveillance.
I think one of the reasons
that more fine-grained
accountability is really
critical is we don't know
but I think it's a safe
assumption that, you know,
somewhere north of 90 percent
of the people who are on any
of these terrorism watch list
who were the targets of any
of this surveillance
are Arab-Americans
who have some connection
to the Middle East,
many of whom are
probably Muslims.
In this country, we don't
have a great history
of treating minorities
perfectly fairly.
And part of the reason we
have oversight mechanisms,
part of reason we have open
courts, part of reason we try
to have due process with public
visibility is to make sure
that we actually do
our job and really--
and really treating people
fairly and not discriminating.
And again, I don't--
I don't think--
I think it's really interesting,
you hear this panel,
you hear the public discussion.
I don't think through
that many people saying,
"Stop the Surveillance."
People are not saying that I was
in Boston during the
marathon bombings.
People are clamoring for the
instillation of more cameras.
You know, the question
I really believe is not
about whether law enforcement
should have these tools.
It's about whether
we can feel confident
that they're using
them responsibly.
>> One of you made
the point that--
actually, this is
not a new issue--
that just a few years ago,
Washington posted an expose,
a very lengthy one, Diana Press
[assumed spelling] and others.
And there was not anything
like the same kind of reaction
that there's been lately.
And I'm wondering why you
think what's the difference,
why has there been such--
why are we having this panel
and not three years ago.
Why is there so much
conversation now
about this issue
when, in fact, when--
at least some of this
was made known through--
to post another mechanisms
some years ago?
>> Smartphones.
>> We didn't have the numbers,
we didn't have the numbers.
I mean, from the Verizon
order, we now know.
It's-- I don't remember
how many millions
of people's records were--
tens of millions of people's
records were collected.
We had-- we have
general outlines
from the post reporting,
from, you know, from all kinds
of things but we did-- it was
not dramatized with numbers.
And I think and now we know
it's basically everyone's data.
We never actually knew
that was happening.
>> Right. I think that's right.
I also think there was an uproar
when the warrantless
wiretapping was first revealed.
We had a very big
battle in Congress.
People were really
worried about it.
People who were not
following it closely
and they passed an amendment
might have actually thought
that what we wound
up with was some kind
of additional procedural
protections.
Instead, we wound up-- what we
wound up with was a ratification
of that program, immunity
for the providers,
and not much more.
And so I, you know, I
think a lot of us knew some
of this was going on but
I think we didn't know.
One of my colleagues, Jim
Dempsey who's on the Privacy
and Civil Liberties Oversight
Board wrote an article saying,
"Did they just approve
a vacuum cleaner?"
And lots of people then
responded with, "Oh,
you know, that's ridiculous."
Well, no, in fact, they
approved a vacuum cleaner
and we didn't know it.
>> Laura? Laura.
>> I agree with those points.
I think it is a matter
of scale in this case.
But I think there are
few other points, too,
that are a little
bit more subtle.
So, one issue is that this came
after Hillary Clinton's
internet freedom speech
and this entire mean
[phonetic] that has been created
and I think rightly
replicated around the world
about internet freedom.
So, this is a very important
issue and what this does is it--
it's providing an opportunity
for people to challenge
that notion of the internet
freedom and to point
out what they're
calling hypocrisy.
So, that to me is a problem.
It can also be an opportunity
if it's addressed appropriately.
Another issue is that individual
citizens are living their life
online to a much greater extent
than they did five
years ago even.
It's really amazing
if you think.
I mean, I'll just give you
an example I was talking
about today.
So, five years ago, I was--
I would read the paper
in the morning and now,
I'm completely connected to
my smartphone all the time
and I am posting information,
I'm communicating in it.
So, the public sphere
is what's at stake here.
The public sphere is online.
And I think that
that is much greater
than during these last
instances a few years ago
that were mentioned.
So, scale, the issue of
people being more cognizant
about how their internal
private life is lived
out in the digital
realm and also the mean
that has been fairly successful
about internet freedom
has ensued
in these intervening years.
>> I think those were
grilling [phonetic] points.
>> Yeah. [Multiple Speakers]
>> I was just going
to say quickly
that technology makes lots of
things possible and it was clear
at the time of those articles.
It's clear today.
It doesn't mean that
it's eminently minable
but that's done outside
of due process.
And I think those are the things
that are getting
people excitable.
It's not technology and it's
not what's technically possible
or even what's technically
feasible.
It's actually ultimately
the full mining
and then the lack
of public scrutiny.
>> What about the argument
that you hear from some people
that not only are we three
years farther away from 9/11?
Several of you made
the point that a lot
of these original
processes were passed almost
in a battlefield mentality,
one of you used that phrase.
And that there were extreme
circumstances with the value
of national security
in protecting the
homeland very much
in the forefront
of a public debate.
So you got three years later
but some people would argue--
there's almost a
contradiction here.
Certainly the intelligence
community would say, "Well,
actually people are more
relaxed now and less concerned
about the threat because
our systems have worked
and that you shouldn't
be dismantling systems
which have actually made
people more secure."
How would you answer that?
>> Let's concentrate to what
the President has said though.
I mean, what the
President has told us--
>> Although he has said
he's in favor of the system.
>> Yes. And he said that
the capability is necessary.
He's in no way precluded
additional oversight.
I think he's actually
welcomed the discussion of--
>> Sure.
>> -- of what kind
of oversight we need.
But he said we're living
it in a lower threat level
and that we need to make
changes as a society
and as government
in response to that.
So, not the other way around.
>> Edward Snowden, to some
people he's a traitor.
To some people, he's a hero.
What do you think?
>> Everybody, on your clearance
you signed a document that says,
"If you disclose secrecy,
there's a penalty."
So, from that standpoint,
you clearly violated
that document and, you know,
I don't have a problem with--
with being prosecuted
because of that.
On the oversight--
>> Because it this contractual--
>> Because it is contractual.
I mean, it states, "Anybody
who has a clearance."
You have that-- it's in
your-- in the agreement,
and it says clearly that you,
you know, 25 years in prison
or whatever it is that--
>> You actually read that?
>> No, it's-- yeah.
It happens when you come from
a family of lawyers, you know.
>> It's privacy policy.
>> No. I mean, you look-- yeah,
I mean, if I'm going to go
to jail, I want to know
what I have to say, right?
And, so I think-- I think
from that standpoint, yes.
I think the rest of the
community is still trying
to divide it as to whether
or not the information
that is disclosed is a problem.
And some people go back kind
of like what I was saying
is there have been articles
about this for, you
know, a long time.
You know, you can go
back into the '70s
when NSA had the ECHELON
program, in the mid-'90s
with Omnivore and
Carnivore, you know,
all of those type of things.
You've had this type
of electronic surveillance
for quite sometime.
So, we're not quite sure what
it is and not having seen all
that is disclosed but we're
not quite sure of what it is
that he's telling the world
that we don't know already.
And so from that stand point,
I think part of my community,
we're not sure about
the content.
But certainly he violated an
agreement and he, you know,
that's what they're going
to go after him for.
>> So I have mixed views
about Snowden because I think
that whistleblowing in a
free society and a right
to know is critically important.
And if you go back
to Pentagon Papers
and terrible things did not
happen with the publishing
of the Pentagon Papers.
[ Pause ]
So-- so, part of--
>> I'll cover the
Pentagon Papers story and--
>> I'm sure--
>> -- cover Daniel
Ellsberg's trial.
So, I'm--
>> And Ellsberg's trial.
>> Yes.
>> And Ellsberg is very,
very out there right
now about Snowden.
I was kind of right with him
until he started keeping away
the US cyber security strategy
with respect to China
while he was in Hong Kong.
And then I started to wonder
exactly what he's motivations
were, you know.
And so, I do feel like
there's a level or recklessness
that worries me and although
it's hard for me to really know
if there's damage to national
security because I've set
in some of these meetings
with national security people
who I've held up the
minimization guidelines
and said, "Is there anything
in here that's really
secret or should be?"
And they said, "No."
The existence of
these programs sort
of have been broad-brushed
some people knew.
So, if at the end of the day,
it's that the public
finally knows
that it's happening
'cause I'm not sure
if any thing's been revealed
that will allow people
to somehow evade all of this,
that, I think, you know,
society has to make
room for whistleblowers.
I just wish we had
whistleblowers
who were a little less reckless.
>> Well, you know,
as a whistleblower,
he appears to have
delusions of grandeur.
>> Well, right.
>> I mean, the first
couple of days, he had--
he'd made statements
such as saying--
such as that he could order
a wiretap of the President
and he could, you know,
had all the locations
of all the NSA stations.
Pretty unlikely, that said,
I guess the, you know,
I think that his disclosures
have done a public service.
I think he's a whistleblower
in that sense.
I actually agree.
It seems like he
just broken the law
and doesn't seem
very complicated.
What I find confusing and--
is that somehow the
traditional notion
of civil disobedience seems
to have been lost track
of in what he's doing.
I mean, I wish-- I mean, look,
he's obviously has put his
life at total risk and--
>> Although traditional
idea is you pay the penalty
for having broken the law.
>> You pay the penalty and
you [inaudible] having a trial
and you expose-- you expose the
things that you're concerned
about and you expose
them, further look at me.
He's a civilian.
He wouldn't be tried in a
court martial the way Bradley
Manning is.
>> Right.
>> He could've staged
a public trial
and a big public discussion that
he chose not to and I, you know,
again, it's not for me
to say how people should put
their lives at risk as he'd has
but I think it's a-- I think
it's an incomplete active
civil disobedience.
>> Anybody else want
it, got a view on that?
Let me ask you another question.
One of the things that
Dan said that the--
are the very interesting
analysis when he talked
about the internet not being
a creature of the state,
how earlier forms
of communication whether
it's telephones and telegraph
and so many of them grew up.
Television spectrums,
I mean, they were sold
by the government,
right, and still are.
So, there was an inherent
regulatory legal organic
connection between earlier
forms of communication
and government regulation which,
as you point out is missing
in a large part in this
particular system we've all been
talking about.
>> But it's more than a legal
question it seems to me,
it's also a cultural question,
that a lot of you being soaked
in this culture and committed
to this culture have evinced
skepticism of government
and of regulation and yet at
the same time, you're grappling
with the notion of how do you
bring some order to a system
that continues to cry out
for some kind of regulation.
I'm interested for you
to use a little bit
about the contradiction between
sort of the historic origins
and the culture of this
system and the need
to bring some order
and regulation to it.
It seems to me there's an
inherent conflict that's worth
talking about.
Start.
>> I'll kick off the
discussion about that.
I think sometimes when
you go to a workshop
that discusses internet
governance,
it descends into a question
such as who should grab the keys
of internet governance, right?
So, the question of--
so if question were asked
such as should the United
Nations control the internet
or should the United
States control it
or should Google control it?
Like those kinds of
questions don't make any sense
in their first instance.
And part of that is because
there is no monolithic system
of internet governance.
It's highly granular,
it's multi layered.
There are-- there are
so many different levels
of internet governance.
I mean, I-- my book is very long
and I only get into
some of them.
But the issue here is
multistakeholder governance
and what that means.
So, internet governance is very
interesting because it is not
about governments necessarily
but that doesn't mean
that there's not a
role for government
in many different areas.
So, if I have identity theft,
I'd like the government
to step in and help me.
I expect antitrust enforcement.
I expect laws about--
some laws about privacy.
I expect some laws
about intellectual
property rights enforcement.
I expect certain national
statute on any variety
of things related to
trade, child protection.
So, there are many places
for the government to be
in internet regulation
and governance.
But most functions
that are related
to the operational
stability and security
of the internet have
not been the purview
of traditional governments
but they have been enacted
by private industry.
And I think that that's
a very important point.
Now, tying this back
to the PRISM issue,
one concern that I have is
that the one separate area
of how the internet is
being used in the data
that can be collected
and gathered will bleed
into this other area of
the operational stability
and security of the internet.
So, we can expect to see
this issue used as a proxy
for governments that are
interested in gaining control
in certain operational
areas of the internet.
I guarantee that
that will happen.
So, we'll see that in some--
once he calls for
international treaties.
Again, that leave
out private industry.
That leave out civil society.
We'll see it in additional
calls for bringing
in a more multilateral control
of some critical
internet resources.
So, I think one bleeds
into another.
But that it's really not
about private industry
versus governments
or civil society
versus private industry,
for example.
It's about the more
contextual question
of what governance is
necessary for what--
which particular area.
So, in certain cases, it's
completely appropriate
for only the private
sector to be involved.
In other cases, it's the
purview of government.
So, it has to be asked
in a contextual area,
and that's what multistakeholder
governance is.
It's not everybody in charge
of every-- it's granular area.
That's not it.
It's about what's
the appropriate form
of governance in
a particular area.
>> John?
>> So the one thing
we do know is
that the internet
evolves very quickly.
I was involved 25 years of
it and it changes rapidly.
What was dial-up
modems and just Telnet
and FTP quickly became
circuits and high speed fiber.
Yeah, OK, sorry.
[Inaudible] And the web--
>> My work here is done, yeah.
>> The fact is that that
evolution doesn't work well
with government regulation.
Having been involved in
the telecommunication side
of the industry as opposed the
internet side, I also dealt
with a lot of [inaudible]
regulations.
And generally, we're dealing
with regulations that were three
to ten years behind the
time trying to drag them
into current circumstance,
and it was inevitable.
The process of regulation
doesn't work well
with a forward-looking
rapidly evolving internet.
So, when we start
thinking about--
about the non-governmental
nature of the internet,
as the internet grows up, we
find ourselves in a conundrum
because the internet
is no longer optional.
The internet is intwined
in everyone's life.
Governments are looking at
their economies and going,
"Some percentage of my
economy is tied to this?"
You can say I have a choices
to whether or not I'm going
to participate but I don't.
I have to be involved.
So, governments are now
realizing they have no choice,
they need to be involved.
They look at their duties,
their responsibilities.
And they go, "How do I
affect what I'm required
to do in this new media?"
And it's a big challenge,
folks, because the protocols
and the operational conventions
that hold the internet
together have to be global.
They have to interoperate
on global basis.
But governments are
used to acting
on a national basis
occasionally regional,
occasionally bilateral,
multilateral, but generally,
they act on a national basis
and you can easily break
the internet by attempting
to regulate it without the
idea of a global context
in which it operates in.
This is really what's
been opened
up in the last five years.
In the last five years,
governments are realizing
they do need to get involved,
they don't understand
the framework
by which they can do so safely.
In general, this has resulted
to not much regulation
but that's not necessarily going
to be the case going forward.
And it's-- the internet
community and I say
that being the operators,
the various entities
that operate pieces
of the infrastructure
aren't exactly forthcoming
to government saying, "Here,
this is how to safely
regulate the internet.
That guide book has
not been written."
And so, without a meeting
of the minds on this topic,
we run the risk that governments
are going to make regulations
that make no sense or break
portions of the internet.
Until this an understood
common framework
for this, we're all at risk.
>> Lynn, do you wanted to talk?
>> Yeah, very good comments
both from Laura and John,
and I just want to make sure
that we're left with a myth here
that much of the internet
committee believes
that there's no rule
for governments.
We've been engaging
with governments
and certainly we could have
done it better over the years.
But, you know, for many,
many years when ISOC had a very
small staff of seven people,
I was going to [inaudible]
and spending weeks
because you don't go to United
Nations meeting for two days,
you'd go for two
and three weeks.
That's a significant investment,
and we went because
we wanted people
to understand how the
internets actually worked.
And I-- it's like a slight
disagreement with John
and nobody has the answer
but how we regulate for a lot
of this new environments.
It's not because we think
there should be no regulations
because we can't
figure out what sort
of regulation there should be.
And to John's other point,
it is because of the pace
with which the internet changes.
And it is to the fact
that it has broken
so many global boundaries.
You can do it within
any single context.
So, it is a very,
very complex world.
And we continue to advocate for
dialogue discussion, thoughtful,
let it take the time it needs.
We need to pull apart lots
of different complexities
and let the right thing emerge.
That is not the same
as saying no rule
for governments but
it often gets--
>> And another dimension of
this is not all governments are
the same.
Because you can talk about China
being a pretty malign force
in terms of internet freedom
to say nothing of Iran
which uses the internet to roll
up all networks of descent,
where in Tahrir Square,
the internet is a
mechanism for expression.
So, part of it, you can--
part of the problem
is government even
as a concept is subject to
many different definitions.
Yeah.
>> It is Steve but that's
probably why the western
governments that operate
in democracies with legal
and constitutional frameworks
that it's particularly
important.
And one of the reasons people
are particularly unhappy
about this particular
surveillance is if we're trying
to come up with this
nuanced role
about where government belongs,
we haven't exactly
sent the right message
to the rest of the world.
And I think that's part
of the problem here.
>> I just want to offer a
kind of a friendly amendment,
I hope to John's view, you know.
I think John correctly
points out that attempting
to regulate the internet
infrastructure whether it's the
institutions that
operate and design it
or the actual operators
is very [inaudible]
because it changes
very quickly and it has
to work on a global basis.
That was the experience of the--
of SOPA, the Stop
Online Privacy Act,
was that policymakers
thought they could reach in--
>> Piracy.
>> -- sorry, Piracy Act.
>> [Inaudible] is the stop--
>> That's right.
Thank you, thank you, thank you.
Right, you know, governments
thought they could reach
in to the internet
infrastructure
to solve a problem
that is really
about human behavior
and violating laws.
However, at the same time
there are plenty of legal rules
that actually work incredibly
well on the internet.
You know, the FTC is still using
the Fair Credit Reporting Act
from 1970 which was one
of our first piracy laws
in United States to stop very
advanced sophisticated online
services from harming people.
That's not causing
John any problems.
He's not-- he [inaudible]
even think about it.
And so I think there's-- I think
that it's when governments try
to do this sort of
shortcuts that they were used
to doing is you were suggesting
with the broadcasters, you know,
say, "You guys have to behave
this way in order for us
to achieve a broader
policy goal."
That's where we really
have problems
in the internet environment.
>> You know, number of you have
used the word privacy as a value
and as a very curious
[phonetic] value.
But I want you to
play with the idea
that perhaps we're
actually really ambivalent
about the question of privacy
because in fact in many ways,
the wide availability of data is
actually an enormous convenient.
Every time you go to
a website and you put
in your e-mail address
and up comes your password
and all your credit
card information
and at one stop shopping
at Amazon, right?
We all love it but isn't that--
>> But we've made a decision
to share that with them, so.
>> Well--
>> Wait just a minute.
I want a-- I want a--
I understand that.
But I want to pose a question
about whether at some point,
aren't we really ambivalent
about this question
that we actually like people
to have information about us
when it serves our purposes of
convenience and accessibility.
And that there was a certain--
I understand your
point about voluntary.
But this will mark [phonetic]
a point here as well.
>> I think part of
the problem is--
is the public is
realizing that the people
that are storing the
information that we give
to them aren't doing a good
a job in protecting it.
I could go to my local bank--
I grew up in Falls Church.
I used to go to the local
First Virginia Bank right there
in Falls Church.
I gave them all my
information when I opened
up my first account
when I was a teenager.
And I had a reasonable
expectation
that the only way they
were going to get that--
anybody else is going to
get that information was
if they actually went in and
rob the bank and stole the file,
you know, the file
cabinet or whatever.
>> Or if anyone in the
government wanted it?
>> Or if anyone in the
government want it?
I mean that-- I mean
that, you know, that--
that's a reasonable thing.
But nowadays when we find
out that you have all these
massive data leaks, you know,
and when you examine
the root cause of what--
what the leak was from
a tactical standpoint,
I should have been
fixed 15 years ago.
You know, some of these attacks,
I do a talk now if they ask me,
you know, I guess it's because
I had gray hair and I've been
in the security business
for 20 years.
I think I noticed something
but I do [inaudible]
that the contract--
>> It's because of the ponytail.
>> I think it is.
You know, it's the-- it's the
same attack methods that we saw
in the early '90s are
still effective in 2013.
And so my question to the
technical community was,
what have we been doing
this last 20 years?
I mean, you know, I in the SANS
Institute that I was a part of,
we drew up a top
ten threats in 2001.
I pulled it out and today
in 2013, every single one
of those top ten threats from
2001 is still affecting today.
So, what have we been
doing to protect ourselves?
And I think it's that type
of thing that's causing this
rumble about, you know, well,
private industry isn't
doing anything about it,
individuals aren't
doing anything about it.
So, that only leaves
a government
to do something about
it, you know.
And so I think that's why
we're seeing that pushing
that direction, 'cause
historically when you look
at it, the same things
are still affecting us,
it's just that what's
happening now is back in 2001,
the scope of a data breach
was much less than the scope
of the data breach now.
>> Sure, sure.
>> And just one last
aside [phonetic].
The iPhone, I think,
I looked it up,
is five years old
today-- this year.
So, to answer your question
about why the difference from--
>> Hold on just a second.
John and Leslie, you want a-- is
there a point you wanted to make
about the voluntary
submission of data.
>> I don't think so.
I think every point has been
made by everybody quite well.
>> OK. John?
>> You thought-- say that maybe
people don't value privacy
over convenience, and that
that we give up privacy
and there's no outrage
about that.
Why is there an outrage
in some cases?
And I guess the question
that comes up is,
a lot of people voluntarily
give up privacy
because we want the convenience.
We want to click the button
and get the order done.
We want the website
to know who we are.
We want to fill out
all the information
on the airline profile because
it just makes traveling a little
easier and anything
that makes it easier--
>> And who can not remember all
those damn passwords anyway,
right?
>> So there are times
we do that.
But the reality is that there's
also times when you consent
to losing your privacy
in situations that aren't
for your convenience but
you're going to anyway.
Next time you're
going to your doctor,
pick up that HIPAA form
and look at it, OK?
It says, "We're going to
share your data with the CDC
because if there's an
outbreak of something,
we're going to do that, OK?"
It's not for my convenience,
hopefully, I'm not relevant,
but the fact is they're
going to do what--
and we consent with because
well, we knew about it.
We understand--
>> And there's a public
interest involved because--
>> There's a public
interest but also as annoying
as that form is, they
took the time to tell us.
I do think that's a
different question
when there's surveillance
is going on
and you don't know
about it at all.
And I think that might be the
angst behind a lot of this.
>> Leslie?
>> Well, I also think
that there's difference
between surveillance
by the government
and surveillance by companies.
I mean I think they've
become more joined together
because they are now the
source of all the information
that the government
is collecting.
But I think at least in
the constitutional system,
not in Europe where they're
making a distinction.
Having that government who has
the capacity to impose penalties
on people and make choices about
who is going to be prosecuted,
et cetera, is entirely different
matter than whether I like
or disliked it, you know,
Google Profiles keep
sending me the same crib
for my pregnant daughter
over and over again.
I'm annoyed, I'm
extremely annoyed.
But I also think--
>> They knew she was
pregnant before she did, yes?
>> Yes.
>> Well, they probably
did, but they knew
that I did this thing once
and it's following the--
it's literally following
me around the world.
I mean it's became
kind of a joke.
But I find that annoying and
I'm somebody who knows how
to set my privacy settings.
So, you know, in one-- in
one circumstance it's a loss
of some measure of control,
we ought to have more control,
it's one of the reasons we
ought to have a baseline build
to give us some fair
information practices.
In the other, you know, the
government has the capacity
to make very important
decisions about us.
And we have a constitution that
says they have to follow rules.
And so we do react differently
to the crib and to the NSA.
>> Yeah.
>> The one thing I would
say about our tension
between convenience and
privacy is-- I just think that--
I think privacy has always been
a kind of a contested concept.
I mean, it's not an absolute.
I don't think there's
anyone hardly in the world
who thinks it's-- it's
an absolute condition.
But we know, as Leslie
is saying,
we have different
privacy expectations.
We want different privacy
results at different times.
And some of the-- some
of the privacy promise
that we have [inaudible]
like seeing the same
crib too many times.
Others have real consequence
like if you're credit
report is wrong
and you can't get a mortgage,
you're really, you know,
it really-- or you don't
get a job, you know,
it really makes a difference.
And I think that-- I think
in a way the phrase--
I think categorizing privacy
as a single right is what
makes the conversation a little
confused because it-- the
reality is it's a number
of concerns wrapped up into one.
>> But in this day and age,
isn't it a little naive to say,
I'm going to give my
information to Amazon?
Or I'm going to give my
information to Google
for my own purposes because I
choose to, and somehow I'm going
to be able to control--
>> Oh, yes.
>> -- all the use
of that information.
>> Yeah, that's not--
that's not doable,
and I don't think any
privacy law we would pass
in this country would
change that.
>> It is naive but I think--
I think the problem is I don't
mind giving you any information
you ask about me if you tell me
ahead of time what you're going
to do with that information.
So, what John was talking
about in the HIPAA thing
when they say, "We're going
to give it out to the CDC,"
and you tell me ahead of
time before I give you
that information, that's much--
that's a much different
environment than giving it here
and then buried in [inaudible]
fine print is a little click
thing that says,
"Oh, by the way,
we're going to just give
this to anybody we want."
>> We only have few
minutes, and I want to--
you've mentioned out, a number
of you, the fact that we're--
we're dealing with a very
complex system as Laura said
with a lot of stakeholders here.
And one of the stakeholders are
these providers whether it's
Google, whether it's Yahoo,
who take that information.
They don't warn you in some
ways that they're going
to give it away because they're
not voluntarily giving it away.
They're being subpoenaed,
they're being ordered
to by the government.
And they are caught.
We have-- this institution,
these huge institutions
are private institutions,
but as we've learned
through PRISM
and all the revelation
subject to government orders
and government warrants.
And many of them are fighting
this at least fighting
to be able to be more
transparent because they have--
they're stakeholders, too.
And-- and they are worried
that their brands are going
to be tarnished by
being swept up in this.
And to talk a little bit
about the special role
of this institution, these
intermediary institutions,
the Apples, the Microsofts,
the Googles who are
on one hand are getting
pulled by the government
to release information.
On the other hand, they're being
pressured to keep it private.
>> Yeah.
>> Yeah, that's a really
important question.
And if you look at-- Let me
just back it up to before PRISM.
If you look at even just the
Google transparency reports
which probably don't have
everything and I think
and even Google says that
national security isn't--
not everything is reflected
in the transparency reports.
But when you do look
at something like that,
you can see that there
is a very big disconnect
between what governments
are asking information
intermediaries to do and
what they actually do.
So, you can see that--
just to give an example.
Maybe they disclosed data about
an individual in 37 percent,
37 percent of the time in--
to the Brazilian government
or 47 percent of the time
to another government.
Do you see what I'm saying?
There is a disconnect in that
differential between the request
to turn over user data
and the actual instances
of turning over the data.
That's where they have this
special governance role.
And that's an important
point the make.
But they also bear a burden
in carrying out a request
such as the more
recent revelations
because there is a
public relations hit.
There is the cost of hiring
numerous attorneys to deal
with the fallout from this.
And there's the possible
economic impact
of having trouble doing business
in other parts of the world
that might be suspicious
towards those companies.
>> Yeah, you might be thanking--
they might be thanking Snowden
for the revelations
because and, of course,
by the national security
letters.
They're not allowed to--
to let anyone know that
they collected the data.
So, now on the other
hand, you have the--
the Snowden revelations
which were saying, "Hey,
these guys had to
give out the data".
So, you know, and
now that's come out.
What they should have
said is instead of trying
to back [inaudible]
been saying, "You know,
trying to save their
reputation."
We said, "Look, you
got subpoenaed,
we know you got subpoenaed,
you gave up the data
because it's a law."
But I think that that
piece of it is the secrecy,
not being able to say why
something was collected,
you know, and not being able
to even say anything about it.
Lesley?
>> Well, the question raised
is this bigger question
when we talk about players
in the internet echo system.
The intermediaries
are a critical part.
And we have-- under our law, we
sort of provide them with a lot
of special protections
because they can't be liable
for everything that's going
on in their platforms.
And yet there under
enormous pressure,
this national security
revelation is one small piece
of this very complex
environment where when you ask
about governments and government
is trying to regulate,
the first place that governments
go in trying to solve anything,
a social problem is to
try to figure out how
to get the intermediaries to
take on that responsibility.
So, this has been sort of
a tension that's existed
since we actually had any
kind of powerful intermediary.
So, that's one side, and the
other side is the amounts
of power they have as
a governance entity
to set the rules of
[inaudible] for the internet.
And so--
>> And one of the
interesting variables here is,
I noticed just recently that
several of the big players,
Microsoft, Google, Yahoo,
I think three have
all filed suit--
>> Right.
>> -- in an attempt to be
able to be more transparent
about the role and the-- and
the requirements they're under.
I think in part because of
the point Laura was raising
that they themselves, given the
culture that they're part of
and the stakeholders they have,
they are taking a big public
relations in branding hit
for this kind of cooperation.
>> And they also have
real leverage here
which they have exercised
on occasion, you know.
Many of the big intermediaries
Google, Twitter,
others have at times gone to
court to challenge subpoenas
and other kinds of court
orders they receive saying
that they're too broad.
I mean, Google had been--
had been under order to
turnover large volumes
of search log data, this
was just a criminal case,
it's not [inaudible] cases.
>> Right.
>> And they've challenged
those and they, you know,
so the intermediaries have
a really important role
because at least until
there's a change in the law,
they are often the only ones
who can actually bring any kind
of challenge to the
scope of the--
of the authority that the
government is claiming.
>> This is nothing new
because in World War II,
the federal government used to
look at the telegraphs at RCA
and look at the phone system
for records and stuff like that.
I mean what's changed
is the number of players
because back then it was
just those two, I suppose,
plus maybe some minors.
Now you have you know multi--
multinational groups
all over the place.
But the technique, I mean,
the tactic of government going
to a provider and getting the
information they need, it's--
it's [inaudible] been there.
>> I would assume the
Egyptian government did
that when the communications
were chiseled, you know,
letters chiseled
on stone tablets.
>> I'm going to-- We
have five minutes left.
I'm going to give each
you one minute to--
we've had a long day,
very attentive audience,
lot of issues.
But I want to give each of you
a chance to make a final point
after this conversation.
You started with
your initial remarks.
But what do you want the
audience to be left with?
What-- in each of your mind
is something significant we've
talked about today, an issue
that you want to reinforce?
I want to give each you
a chance to do that,
and since we've started
with you earlier,
I'll start with you this
way and we'll go down.
>> So as contentious
this processes is,
I think it's incredibly
important,
the dialogue that's happening
in the United States.
Hopefully, we can do more than
just, you know, have battles
in the newspapers and on panels
like this and really look
at our legal system and make
sure that it has the kind
of accountability
that we needed.
Laura said, you know,
the problem here is scale
and I really agree with that.
Courts have been good
at supervising electronic
surveillance [inaudible] one
wiretap on one phone number
or a handful of phone numbers.
The scale of intrusion here is
such that we can only manage it
and have it a proper oversight
with using exactly the same kind
of computational tools
and analytic tools
that are being used by the
intelligence agencies to try
to mind this data to begin with.
And the one other thing I
would just say is, this is--
as several people said,
this is a global discussion.
The US is obviously an important
part of the internet environment
but we are not the only
country on the internet
and we do not control the whole
internet and I think that just
as we are examining the behavior
of our intelligence agencies,
I think it's very important
that other countries
that have democratic values
that believe in transparency
and due process really look
very hard at their intelligence
and surveillance
practices as well.
>> Thanks, Dan.
Lynn.
>> I guess I'd start with saying
that everybody's voice is
extraordinarily important,
not only here in the US
but every individual
around the world.
And we need attention
and we need voice
to every issue whether it's
this particular set of issues
or it's United Nation's
expressed interest
in some portions of
the internet ecosystem.
And I think specific
to this issue,
the only thing I would say is--
[inaudible] we're all
very interconnected
and very interdependent.
And when we think about
things such as security
or managing risk or trying
to manage those tradeoffs,
we actually need
to do that in a--
with both sides of the dialogue.
One actually looking at what
we can actually do to protect
and ensure things that
support economic prosperity
and social development
while trading off
against preventing
any perceived harm.
I think we're far too much to
[inaudible] over in the side
of preventing perceived harm,
and that we don't quite
have the balanced rate yet.
>> Laura.
>> I think it's important not to
take the stability and success
and the security of the
internet for granted.
So, we're used to it working for
the most part because of efforts
like John's organization and
others and it is working,
but we also have examples
of problems with denial
of service attacks, examples
of government is
cutting off access,
examples of interconnection
problems.
We have trends away
from interoperability
which I think is a
really big problem.
We have trends away
from anonymity
which changes the nature of
the technical infrastructure.
So, point one is that we
cannot take the stability
and security for granted.
It has required a
tremendous amount of effort
on the parts of many,
many people.
And it's something that concerns
me everyday when I see some
of the trends away from
interoperability and security
and interconnection
security, basically.
So, that's point number one.
The second point
is if we believe
that we have the public sphere
in the online environment,
if we believe that there's
a technical mediation
of the public sphere,
then we have to think
about what that means.
What does the democracy look
like when the public
sphere is now digital?
So, we know historically that
possibility is for anonymity
or at least traceable anonymity
have been closely linked
to democracy.
So, I think it's important
to just ask the question
of what does democracy look
like when we have this technical
mediation of the public sphere
and the privatization of
conditions of civil liberties
where private companies are
getting a request delegated
from governments or carrying
out their own governance
of these infrastructures.
So, don't take the
internet security
and instability for granted.
Remember that we have
the technical mediation
of the public sphere
and the privatization
of conditions of
civil liberties.
And the final point is that
internet governance is something
that is-- that the
public can be engaged in.
We've seen examples of
civil society action
of private action, civil
liberties advocates involved
in decisions about
internet governance.
There are many avenues
to do that.
That the-- I do have an
engineering background
but the technology
is not that hard
that people can learn the
technology, learn the issues
and get engaged in these
debates which are very important
because as goes internet
governance,
so goes internet freedom.
>> Randy?
>> All of you here that are
attending this panel discussion,
you all have stake in what
we've been talking about.
And so I would challenge you
guys to not only make sure
that your peers understand
what some of the pressures are
and what some of the
pitfalls and what are some
of the disadvantages are of
working with the internet.
But also, you guys are
probably going to be on a track
where you're going to be
working with legislators
and policy makers
and things like that.
And make sure that they
understand the implications
of whatever it is that they're
trying to write up or implement,
both on the legal side
and on the policy side.
That's to me what I see your
contribution to the whole thing.
It's going to be
very incremental.
It's going to take a long time.
You know if some people talk
about the fact that it's
like when the automobile was
first introduced at the turn
of the century and it took us
25 years to come up with the set
of laws and procedures
to make things work
when we didn't do that.
But you guys are the ones that
are going to be talking to
and down the road
influencing policy and laws.
And so, you know,
take the challenge,
do it and influence
what you can.
>> Leslie.
>> So I'm just going
to make one point.
And that's that those of us
who are Americans or people
in the United States have
a voice in this debate
that we need to exercise.
But we need to exercise
it with more
than our own rights in mind.
If-- the interesting thing
about the internet and the lack
of a government control is the--
it's also very unclear
about who's responsible
for the human rights of people
in the online environment.
And we-- I think the NSA example
that we have data flowing all
over the world, states
have obligations to people
within their borders, and
a few other kinds of places
that the law has developed.
We're not sure who has the
obligation for the rights
of internet users in
this kind of environment.
And it's a conversation
that really needs to happen
because the-- our lives,
some significant part
of who we are is now online
and flowing through these wires
and who ultimately is
responsible to make sure
that basic privacy and free
expression rights are honored
has become increasingly complex.
So, people need to
take that on as well.
>> Last word, John.
>> It's a global internet.
There needs to be an
equally global discussion
about the principles
by which we operate it.
And part of what's occurred
over the last few months will
help encourage one aspect
of that discussion.
So, it's a probably
a good thing.
>> I want to thank all
of you for being here.
I want to thank the
Internet Society.
I want to thank the GW
Engineering Department
and their [inaudible]
Lance Hoffman's Institute.
Long afternoon, thanks
for your patience.
I hope you learned something.
Come back again.
Thanks a lot.
[Applause]
