The story so far

2. The story so far • It’s hard to keep up with the details of the mass surveillance revelations, but at present we know about • Mass surveillance including storage of totality of comms data (Tempora) as well as metadata • Agreements to store and ‘unmask’ data of British citizens by NSA in US • "pattern of life" or "contact-chaining" analyses, under which the agency can look up to three "hops" away from a target of interest – examining the communications of a friend of a friend of a friend. • This largely seems to happen without public outcry or overwhelming resistance

3. Consequences: Chilling effects • PEN American Center’s report this week, “Chilling Effects” shows that growing surveillance has driven some American writers to censor their work. The findings from the survey of over 500 PEN writers, conducted in October 2013, demonstrate that writers are increasingly worried about surveillance. As a result, some are already engaging in self-censorship and altering their research methods.

4. Consequences: The splinternet (Grossman) • threats by Brazil and Germany (chiefly, but not solely) to pass national laws requiring data pertaining to their citizens to be stored locally instead of shipped around the Internet into the purview of the NSA. • attempts to regulate content at national borders. These would either turn the Internet into a patchwork of unpredictably unreliable access to information or a lowest-common-denominator medium hosting only the most universally acceptable (ie, blandest) content. • Uneasiness outside the US about ICANN’s remaining ties to the US Department of Commerce. The upshot is much more interest in other, more international governance efforts such as the Internet Governance Forum than there was six months ago. • Fears about blockage of content that is inconvenient or not profitable for operators to transmit (ie the subject of net neutrality) • Structural censorship

5. Consequences: security broken ‘for everyone’ • Bruce Schneier: ‘in its haste to "weaponize" the Internet, the NSA has broken its mechanisms of security. And those breaks—including the backdoors that the NSA convinced or coerced software developers to put into the implementations of their encryption and other security products, are so severe that it is now just a matter of time before others with less-noble causes than fighting terrorism will be able to exploit the holes the NSA has created.’ (arstechnica, Nov 18) • Raises the question about whether these actions have so severely compromised the internet’s system that it will be difficult to re-establish it as a secure network • View from the IETF technical standards setters: ‘At the end of the day this is a policy problem not a technology problem’ • Technical solutions: encryption, certificate security, https, httpBIS

6. Solutions • Technical – • IPv6 • Security features as discussed at IETF • Regulatory – • pass some laws • Enforce or encourage self regulation • Normative – • protest a lot – how successful is this? • Try to be represented at high level meetings besides technical ones Under what circumstances would we wish to pursue each of these solutions? How would we seek to combine them?