Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/340 Thanks!
Well, the CCC has grown a bit, hasn't it?
I'm very pleased to be here and the first
thing I want to do is apologize for my
slides. I know there is far too much
information on my slides.
It breaks every rule of PowerPoint.
So don't look at the slides.
Maybe, but more.
Listen to what I'm saying, because
otherwise it won't make any sense, either
of us
to get through some
preliminaries.
For nine years, I was chief privacy
advisor at Microsoft and I have to
explain a bit about what that job
was.
I didn't have any responsibility for
legal compliance.
Thankfully, I didn't do
anything really in US
privacy. My job was to advise
40 national technology
officers around the world.
And a Microsoft national technology
officer is a guy with a very big
brain, often one or two PhDs able
to function essentially as Microsoft's
ambassador to governments
around the world at a very senior level,
normally citizens of their own country.
In a sense, you could boil down their
job to if Steve Ballmer then
wanted to get a prime minister on the
phone in half an hour, it was the
job to get that done.
So I didn't know about prison when
I was at Microsoft.
And what I'm about to tell you, I deduced
from open sources and by deciding to
read the American laws
and nobody asked me to do
this.
What happened to me after that was
I explained to a big Microsoft
internal strategy conference about cloud
computing with all of
the cloud management that all of my
national technology officers there, the
deputy general counsel at Microsoft,
what I discovered and I said to my
technology officer, look, you ought to
know this.
If you sell Microsoft cloud computing to
your own governments, then
this law means that
the NSA can conduct unlimited mass
surveillance on that data.
So the deputy general counsel of
Microsoft turned green.
I'd never seen anyone turn green before,
but she did.
There was dead silence in the room.
In the coffee break, I was threatened
with being fired.
And then two months later, they did find
me without course.
So since then, I really,
from 2011, went round trying
to tell as many people as I could
about what I discovered.
And I've given variants of the speech
now about 20 times, I suppose.
But I hope this brings things right
up to date as of about two weeks ago.
And also, I'm going to tell you some
things which I haven't told before.
So the first thing to say is this talk is
not about cloud as storage.
This is about parallel processing power
as a commodity.
And in fact, this photo is just
two photos crammed together.
The left is a modern data center.
And on the right,
there's a door,
a doorway. You probably can't see the
number, but the number is 641 a.
Now, how many people know what 640,
190 refers to?
Good.
OK,
so six forty one a came
from the story
of the first warrantless wiretapping
episode from about 2005
to 2007,
and I don't have time to tell that story.
But in fact, that doorway
contained a deep packet
inspection box installed round about 2002
in one of the main AT&T switching centers
in San Francisco.
So in a sense, you could boil
down my talk to
how likely is it legally or technically
that there's one of those on the right
in one of those on the left?
So what this talk is going to be mainly
about is the law underlying
what we now call PRISM,
and it is the 2008 Foreign
Intelligence Surveillance Act Amendment
Act, which,
when it was passed, have a different
numbering, which needn't bother us,
called 1881 a now everyone calls
it Section 702.
And what it's about is obtaining
foreign intelligence information.
It intentionally targets
only non Americans
outside the US.
When I say only, that is, of course, 95
percent of the world's population.
It's a blanket authorization for one
year.
There's a requirement to minimize access
on US persons after collection and to
a certain extent before collection.
And the provider
of these services has to provide
the government with all facilities and
information to accomplish this
acquisition in secret.
So the first point I want to emphasize,
which will make sense when you come to
the next slide, is this means
if you're not an American,
you cannot really trust.
Cryptographic services or in general,
software services provided
by US companies, because
even if that software or that
cryptography is sound to begin
with, you're going to receive software
updates.
And if you're not an American outside the
US, a software update could be pushed
to you, targeted at you,
which is going to hurt your security
if you don't comply with one of these
orders.
It's a contempt of the Foreign
Intelligence Surveillance Court.
If somebody's an American company, as
Marissa Mayer said last year, if
someone, an American company, were to
tell, say, a foreign data protection
authority, that's potentially an offense
under the Espionage Act, 20
years in jail or worse.
So the providers of these
services have complete immunity from
civil lawsuits
and all of this must be done in a manner
consistent with the US
Fourth Amendment.
And the analysis I'm giving you now is
the analysis that I was giving people
a year or 18 months before Snowden
verbatim.
These lights haven't been changed.
So what is foreign intelligence
information?
So we have to now go back
to the very first FISA Act,
the very first Foreign Intelligence
Surveillance Act in 1978.
And the definitions I'm showing you,
the significant part I'm showing you has
not changed since 1978.
It's been there that long.
And the extraordinary thing is that in
the legal literature, the policy
literature.
There is absolutely nothing written
about the part on the bottom
in bold, nothing at all from the
perspective of an non American.
So you, the prince, probably too small,
but in the definition of foreign
intelligence information, you can see the
sort of things that you'd expect, like
money laundering, sabotage, international
terrorism.
And then there's the section in bold.
And to actually get the text at the
bottom, you have to unwind two
levels of legal definition and substitute
them in.
But what you boil it down to foreign
intelligence information can mean
simply information
with respect to a foreign based political
organization or foreign territory
that relates to the conduct
of the foreign affairs of the United
States.
Nothing necessarily to do with national
security, nothing to do with terrorism,
nothing to do with crime,
simply if it relates
to the foreign policy of the US,
which is an incredibly broad definition.
You won't find a definition as broad as
that in any other law,
I believe.
So what is also
peculiar about this definition
is it's conditional on nationality,
if, again,
it's slightly too small to see, but if
you are a United States person,
that is to say, an American citizen
or permanent resident.
Where it says relates would
read necessary, necessary, a very
high and strict legal threshold.
But if you're a foreigner outside
the US, it's relates
a very, very low legal threshold,
trivial to pass.
So this is the only law, as far as I
know, where the very term of a
surveillance information to be obtained
is itself conditioned
by the nationality of the person.
Quite unique.
So what this law did in 2008
is it combined three elements for
the first time which had actually been
there in previous laws.
The first part that it only targets
non US persons located outside the US
had actually been there in a stop gap
precursor law called the Protect America
Act of 2007.
But that expired after one year
and then they had to do something
permanent, which was this.
But that idea of only targeting on U.S.
persons located location outside the US
began with this earlier law in 2007,
and this earlier law of 2007 was
essentially designed to clean up
the first warrantless wiretapping
episode, which had been raging in the US
press for a couple of years
before that.
The second thing that it did
is much more significant
in the Electronic Communication Privacy
Act of 1986.
It defined a term called Remote Computing
Services.
And when you look at that definition,
you'll see that the remote computing
services, even though it was defined in
1986, is a very good definition of
all forms of public cloud computing
that we would call today.
So this new term of remote computing
services was snuck in
to the FISA Amendment Act.
Nobody apparently
noticed it had been put in.
And the effect of this was that all
previous such laws had dealt with
telecommunication providers and Internet
service providers, providers of
communication services
by expanding the scope
of FISA 702 to include
remote computing services.
It effectively then embraced all of
these obligations on providers of cloud
computing.
And as extraordinary as it may be,
there was no commentary on this at the
time. There's nothing in the
Congressional Research Service.
There were no law papers commenting on
it. None of the civil society activism at
the time, no justice, no
reference whatsoever to the sedition.
The third new element, as we discussed,
is coming from Fyssas
1978.
It doesn't have to be about criminality,
even as we would understand it in Europe,
national security, the vital interest of
the state.
It can purely mean political surveillance
in the political and economic interests
of the US.
And surveillance over ordinary, lawful
democratic activities of people in their
own countries, exercising their
democratic rights and freedoms.
So this was designed for mass
surveillance of any cloud data relating
to US foreign policy, and it contains
this extraordinary double discrimination
by nationality.
Firstly, in the fact that in the
title of the statute, FISA said
no to only targets, not Americans
outside the US, but also
in that conditionality in the very
definition of foreign intelligence
information.
Again, that structure is quite unique
in the world.
So you remember
that all of that had to be done.
With regard to the Fourth Amendment and
although it may seem strange today,
back in 2012,
nobody actually knew
whether the Fourth Amendment applied
to non Americans outside
the US.
I would go to data protection conferences
year after year where a representative
from the US State Department would make
these great plans and
hymns of praise to the wonders
of the Fourth Amendment.
And since it was directed to an
international audience, I think it was
reasonable to suppose that
the implication was that somehow the
Fourth Amendment was protecting everybody
in that room.
Well, there was a bit of detective story
to find out that it didn't.
It starts with a 1990
Supreme Court case called the Digo
Akitas.
That isn't quite the perfect fit
for the cloud situation, but it's sort of
the best that we've got.
And then in 2008,
there was a foreign intelligence
surveillance court of review judgment
about the Protect America Act.
And this is the case that we now actually
know was about Yahoo!
It's called Imray REDACTED.
And of course, a lot of information has
now been declassified and come out.
But it was actually Yahoo!
Challenging.
The terms of this Protect America act
and the judgment came down
actually just after the
FISA 72 act had been passed,
so in the unredacted parts.
And this is very surprising because
almost all references to this sort of
thing are redacted, especially
in the newly declassified FISC stuff.
It said that there's no fourth protection
for foreign powers reasonably
believed to be located outside the US and
further.
Probable cause
as a term, meaning a 50 percent
likelihood that you're guilty of 50
percent likelihood that there's
sufficient evidence to show that you are
the person the police are looking for
in some criminal effect.
When I noticed this in 2010
and appeared on the US court service
website for about six months and then
disappeared, but fortunately being cashed
by the Federation of American Scientists,
there was there in black and white, again
in the unredacted parts, this
extraordinary idea that
if you are a foreigner outside the US,
probable cause doesn't become probable
cause of any criminality.
It just becomes probable cause that
you're foreign.
And that's the sufficient trigger to
begin surveillance.
So what I'm going to show you next is a
little short video clip.
It's a clip
primarily with Jameel Jaffer
of the American Civil Liberties Union, a
very fine privacy advocates
at the forefront of challenging
some parts of this from the point of view
of Americans over the past few years.
And he's talking in front of
a House Judiciary subcommittee hearing
in the middle of 2012 because
then FISA 72 was expiring.
It needed to be renewed.
And this is how the dialog went
through.
What does the Fourth Amendment
apply to foreign
targets in foreign lands?
I don't think that's the question.
That's my question.
So obviously it's the
right question because that's what
I told you.
I don't think that's what you said.
You don't think it does?
Well, in the circumstance of the statute,
I don't think it does.
Right.
I mean, we certainly have made the
argument that does the Fourth Amendment
of the statute, does the Fourth Amendment
apply to foreign nationals
and foreign does not
just the Second Amendment apply?
I don't know, first of all, but I think
no, I think it would depend
on the circumstance. Women's suffrage
does not apply.
Now, that's my point.
They don't. So we're not talking about
foreign. We're not talking about
surveillance of foreign nationals in
foreign lands. Right.
That's my second point.
So the significance of that is
that Jameel Jaffer, you know, doing the
best job he could as an advocate, was
really driven against back against the
wall to admit that there
is no constitutional protection for
foreigners in foreign lands, as
the charming Texas congressman put it,
and also that the US
Congress was laughing.
They were laughing at the idea that you
have privacy rights.
That is the climate of political debate
in the US, as anyone who's followed
the coverage will know.
So I had a bit of luck.
I was invited to join some academics
writing a report commissioned by the
European Parliament on fighting
cybercrime and protecting privacy in the
cloud. And probably the reason this
report was commissioned was to sort of
increase the sort of cyber drumbeat
of we must have more intensive
surveillance laws. But I explained all of
this to my academic colleagues and
they thought it was so important.
They let me write the middle section of
the report about all of this, pretty much
the analysis I've shown you more.
And this was published in
October, two
thousand and twelve.
The dates from the actual election, say,
January 2013.
And then, of course, nothing happened.
Nobody reads these European Parliament
reports. It just sort of sat there on the
website for two or three months.
And I was actually then watching the
renewal of the FISA legislation.
When did they decide to do that?
Congress? Well, between Christmas and New
Year, obviously.
So I was watching it on C-SPAN and I just
got fed up. So I started calling out all
the journalists that I remembered
from my old civil society days.
Not much luck.
Offer the story to The Guardian.
No interest to
other British newspapers, to The
Washington Post, The New York Times, no
interest.
And then Ron Galica, who, of course, is
now working on The Intercept with Glenn
Greenwald, wrote a very
tight 800 word summary,
which then created
a little bit of interest in the
blogosphere, about 1500 tweets in a week.
And then at least from Europe, you know,
the general reaction was, how can this
possibly be possible?
What on earth do we have data protection
law for?
If this is going on?
The US blog reaction was much less, but
typically, oh, those Europeans
are kind of upset that we can spy on
them. Who's going to stop us?
And that was from a self-described
American civil libertarian.
So how did all this happen?
How is it the case that thousands of
European policymakers
and data protection officials
all over Europe apparently didn't
understand this was happening?
Well, I think for almost everyone in this
room, what I'm
about to say next is going to be slightly
incredible. But
we as technologists understand
that if you want to encrypt data
yourself and you control the
algorithm, you control the implementation
of the software and you control the key
and then you put that data somewhere else
that's reasonably safe.
But if you want to compute with that data
the meaning of cloud computing, you want
to do useful work with that data in
somebody else's data center thousands of
miles away.
Well, there is no technical way to
protect that, because
even if the data is encrypted on disk
when it passes through the CPU,
it has to be in plain text to do useful
work before somebody mentions Hommel
morphic encryption.
The cryptographers I talked to tell me
that it's always going to be orders of
magnitude to slow
the general-purpose computing.
And amazingly, as far
as I can see, European policymakers did
not understand this.
They bought a whole lot of encryption,
blah, blah, blah, from the industry
that said, yes, of course we protect it.
So it's encrypted, isn't it?
And and, yes, we have very good security
measures and security policies.
Of course, it's impossible.
In fact, the cloud is more secure.
But apart from that,
the general structure of the lobbying
from the US government in particular was
that US law offers
very good protection to its citizens by
the Fourth Amendment as good
or better than many European countries,
which is true.
Therefore, don't worry about the US
clout.
But of course, you can see the fallacy
once the data in Europe goes
to US jurisdiction, it's totally
vulnerable to laws like Pfizer
said no to.
What was also happening from about 2009
is a whole slew
of what I call cloud
wash,
various documents from the US mission
to the EU and the proxies of
the State Department.
A law firm deeply dubious Hogan
Lovells produced a number of
frankly, deceptive quazi
legal analysis that were pure propaganda.
Respectable law firms like Linklaters and
even the European Data Protection
Supervisor was making speeches
at an event organized by one of
the main US lobbyists
talking about using new data
protection mechanisms to streamline data
into the cloud.
ENISA had a very inglorious
role in this, which I'll come back to,
and then various other
usual suspects.
None of those materials at all.
I've now got a collection of 13 before
Snowden.
Mentioned Pfizer at all,
not even the original Pfizer.
There was a lot of concern about the
Patriot Act, but
the Patriot Act turns out not to have
actually been the key point of
vulnerability for cloud computing.
So sort of restating what I just
said is cloud mass surveillance a real
risk?
Well, what we know from what's
been declassified by Snowden so far
is that so far the cloud companies have
not been asked
to, as it were, internalize the mass
surveillance. So far, it appears that
they have been presented with a
particular selector
and you will read enough about what those
can be. I won't leave with a point,
but what I want you to think about for
the future is this problem.
We agree, I think that you cannot
protect data in cloud computing
with encryption,
but the new forms of cloud
computing platform as a service, you
have an entire
way of writing software were,
as it were, under the hood.
If you write the algorithm once, then
the platform is supposed to take care of
scaling that in a few milliseconds
from one CPU perhaps to thousands of
CPUs.
And it's that elasticity of cloud
computing, which is probably
going to be one of the key competitive
advantages for cloud computing in future.
So imagine that you want to intercept
that.
Well, you have to intercept it at the
level where the data makes sense,
which could be, you know, somewhere in
quite a deep software stack.
So it's really not much use plugging in a
deep packet inspection box onto the
cables connecting the data center,
because you might have to have thousand
of those deep boxes on standby if
the capacity of the algorithm that
is actually running then scales onto
how many thousand CPUs, you're going to
need that much extra DPI capacity
to surveil it.
Unless you
use coercive powers to force the cloud
provider to basically build the
surveillance into the software
you build in surveillance subroutines at
the necessary levels of the stack.
So that however that application
scales, the surveillance capacity
is already there in software.
So I don't know.
And it appears we have no evidence that
this has been done already.
But it seems to me the writing is on the
wall, that if governments
are going to be wanting to surveil cloud
computing systematically, they're going
to have to exercise those
sorts of powers.
And I guess the point I'd like to make,
702 already provides these powers,
even if they have not been used to that
extent already.
So and I want to talk
more about the European side
of the affair and what's
been happening with European data
protection regulation,
as I think almost all of you will know,
there is a new data protection regulation
being hung up in in
European legislators for about
two years.
And, of course, discussions continued
after Snowden about what form that should
take.
And one whole part of that regulation
is concerned with the legal means
of exporting EU data
outside and particularly to the US.
So in the current data protection
directive,
there are basically these ways of doing
it, you can get somebody to consent,
you can rely on safe harbor,
you can form a contract with
specially approved clauses with the
person you want to export the data to.
And then there's also something new
called binding corporate rules.
Binding corporate rules essentially
allows a sort of corporation to make up
their own scouts on a charter.
We really will obey this and we'll
invent some sanctions on ourselves if
anybody breaks the rules.
And this is sanctified by
data protection authority.
And these were invented actually for
fairly reasonable purposes.
If if a global corporation wanted to do
all their human resources processing in
one center and therefore
collect data from all around the world to
do that.
This was sort of a template idea behind
a BCR.
But then I think very dangerously.
Data protection authorities in cahoots
with the big cloud providers
thought it would be a very good idea
to extend this idea of binding corporate
rules to so-called data processors,
data processors being entities which
supposedly have no
decision taking power over the data
they process. They're really just acting
on instructions from data controllers.
So somebody and I've got a shrewd idea
who it is, had the brilliant idea.
Well, let's adapt this old fashioned BCR
idea for a fairly tame purposes
to cloud computing.
And then we've got a template which can
basically be the primary vehicle for
legitimating cloud computing
in European terms.
So the rough idea is Microsoft, Google or
whoever gets the
BCOs certified
once they are certified and the new
regulation, the Data Protection Authority
must accept them. They wouldn't have any
discretion as they do today.
And then data can be transferred into
particularly US control clouds.
And then all questions of mass
surveillance just disappear into
what I call a puff of audit,
because Article
29 Working Party, the Committee of
European Data Protection authorities were
so naive that they imagined that
somehow a private security auditor,
if they were inspecting a data center and
they noticed room 641 A
and they said, oh, what's behind that?
Can I have a look in there?
And they've been told, no, of course you
can't. In fact, it's classified
information that you even notice that
if you tell anyone about that, you'll go
to jail for espionage.
Well, data protection authorities were so
naive that they thought somehow a private
security audit could detect
these risks of foreign mass surveillance.
So this diagram is supposed to show
the sort of risk matrix
of EU data sovereignty,
and on the left you've got
three kinds of information
criminal law enforcement, which probably
should include most terrorism cases,
sort of bona fide national security,
which in European terms we think of as
being the vital interests of the states
and then essentially foreign policy
and political spying for
national advantage.
And then in terms of the columns,
you have intra EU transfers and then
EU data in the US.
So the red zone is not covered
by the Fourth Amendment.
It's not covered by EU data protection.
It's not covered by Council of Europe
Convention on eight, certainly not
covered by the cybercrime treaty.
And of course, it's not covered by the
European Convention of Human Rights
because the US doesn't recognize that.
So all of this data for 15 or so years
has been completely unprotected.
Well, the story moves on, I'm going to
have to accelerate a bit.
In January, President
Obama made a flagship speech to try
and address these
concerns.
And, of course, he's in an impossible
position because on the one hand, he has
to assure the American people that
Fizer, 72 in particular, is no threat to
Americans because it's designed to spy on
foreigners.
But then at the same time, he has to find
some way of reassuring the rest of the
world.
So what's he
came up with was a very well written,
very well crafted speech.
But the meat beneath the speech was a new
presidential policy directive, PPD
28.
And basically,
there's a there's a real gotcha
of a footnote.
So footnote nine says
this directive is not intended to alter
the rules applicable to US persons in
executive order. Twelve three, three
three, which I have to mention
the Pfizer or other applicable law.
Just as a brief digression, executive
order twelve three three three was
created by Reagan.
And essentially it is a policy directive
which covers NSA
activities, spying entirely
outside the United States.
When you're basically just spying on
foreigners, there's no reason to believe
Americans involved.
You may have NSA agents infiltrating
data centers in some foreign country.
That's what EO twelve three fifty
is about. And it's policy.
It's not law.
And there's a reason for that.
We'll come back to you.
So in other words, in the small print,
in the footnote, all of the reassurances
in PPD twenty eight are basically
worthless from the point of view of
establishing any kind of equality of
rights. They're still going to be
discrimination by US nationality.
If you're a US person, then
a law enforcement authority would need a
particular justified FISC warrant
to that higher legal standard necessity.
And if you're not a US person, basically
the NSA just adds your selectors to a
list.
Then we had a report from the so-called
Privacy and Civil Liberties Oversight
Board, which essentially has no mandate
to look out for the interests of non
Americans at all.
Their analysis of the situation about
Americans occupied five pages out of 196.
And frankly, I think it's misleading
tautologies, credulous junk.
And there has been a vast amount of
declassification since, not
all of which I've analyzed, but
basically there is this tendency
that a lot of the stuff that is redacted,
you can tell from the context, the stuff
that's redacted is about the situation
of non Americans.
So who did I wore exactly?
Actually, I first got an opportunity to
try and get some interest from the Open
Society Foundation way back in January
11th, and I explained
to that committee not to saurus in person
what the school was made quite an impact
on them, but they didn't do anything.
They said they only fund existing NGOs
and they've done nothing.
In fact, Soros has done nothing about
surveillance issues in Western Europe in
the entire time Open Society
Foundation has been operating.
If anybody doubts that I saw a slut in
person in March at
a conference I attended and he didn't
deny it.
I also warned Privacy International in
June, they said they had no
resources and I tried again in October
and still no interest in Privacy
International.
And that pains me, particularly since
I've known the guys in private
international and worked with them for 15
years. And I'm genuinely baffled
by what's happened to Privacy
International recently.
I also in September, when
I actually left Microsoft,
warned Edry and
DG Justice at Cabinet level
the published Data Protection Authority,
who did nothing and basically
put one footnote of my slide.
I showed him in an academic article
he wrote.
He, of course, has now become the deputy
new European data protection supervisor.
The Greens were very helpful and I
have nothing but praise for particularly
Ralph Brandreth and Jan
Albrecht. And they are straight shooters
and I'm very grateful for the help they
give me.
In September
2012, I had an opportunity to make a
speech at the European Academy of Law
where Peter Hustings
was there.
His deputy, now EDPS
Jovani Bertarelli, representatives
from the EU Council,
the person in charge of the international
transfer section from the Conille and
therefore de facto Article 29.
And I basically explained all of this in
54 slides with a great deal more legal
analysis.
Again, stunned silence, but total
inaction.
At a different conference, I made Ainissa
aware of all this and then had some
correspondence with the head of NSA
who basically said they had no mandate
to act, that this is all excluded
from their mandate by national security
exemptions.
But then, of course, after Snowden,
it was deemed to be politically
impossible for NSA to say
that. So NSA concocted
really rather a bogus and
meretricious document, sort of implying
that they had factored in these sort of
risks to their pre Snowden cloud
analysis. And that's totally untrue.
I had an opportunity to make a speech to
the European Parliament's
Interparliamentary Forum for Civil
Liberties in October 2012
against on silence, the Portuguese DPA
put up their hand and said, Can we have
some details, please?
And then I tried to get in contact with
the podium with the Portuguese DPA,
no response.
And then back
in February 13.
That was when I made the presentation of
the European Parliament report that I
mentioned before in September.
And that did make an impact.
And immediately afterwards, the Labor
Committee asked me to draft some
amendments for the new data
protection regulation, but I'm afraid
they were mostly ignored or
diluted.
And then just before Snowden in May,
DG Connect in charge of climate policy.
I've been beating them up as well.
They finally organized a forum at
the offices of Digital Europe.
Digital Europe are essentially the trade
association for electronics
and software companies, largely dominated
by US and UK companies.
And basically DG Connect said, well,
CASPA, we're not going to think about
this. But look, if you can convince those
hard nosed bastards that digital Europe,
then we'll take you seriously.
And basically they laughed at me
just before Snowden.
So what has been the EU
Commission's cloud policy up to date?
It was run by Neelie Kroes out of DG
Connect and the
official EU policy document
published around 2012 essentially
rejected the idea of trying to make any
pan-European cloud,
which was sort of safe because
there was no enthusiasm from member
states. Basically, the member states
didn't really trust each other anymore
than the US, and that sort of collapsed
the idea to the extent it was ever
seriously considered.
There was a steering board composed
of industry bigwigs
and then various
bits of candyfloss about trusted cloud
Europe, yada, yada.
And then a new after Snowden
and a new group was
set up to try and streamline cloud
contracts and actually joined that for a
while until I realized that there was
no interest whatsoever in drafting
anything which would make surveillance
harder or build in sort of deterrents.
That just wasn't the agenda at all.
It was simply about making
essentially cloud less treacherous from a
contractual point of view, which is
useful work, but nothing to do with
stopping surveillance.
A particularly pernicious idea is if you
have a
cloud contract with a provider, then
that provider should be able to basically
subcontract what they've contracted with
you, sort of recursively so
you can glue on a sub provider and a
provider as a provider onto that, which
could, of course, be a different countries.
So you would have absolutely no idea
where the data was flowing.
And Article
29, the data protection authorities were
pushing this idea.
And I sharply criticized that.
And they said, look, Kasper, you don't
understand. Our job is not to stop
any kind of processing.
Our job is to find a legal basis
to allow it to happen.
And that is the mentality still
in the core part of
the European data protection authorities.
So really, there has been no substantive
change whatsoever
in EU policy since Snowden.
But when you listen to the speeches,
certainly before the new commission of
Neelie Kroes and Viviane Reding, you
would hear it is vital that we get a
strong new data protection regulation so
that we can deal with all of this
surveillance stuff, which
is completely false.
What did parliament do?
Well, after they
asked me for some amendments
when Snowden happened, the parliament
phoned me up and said, Kasper,
it's all true.
Would you like to write the briefing note
for the official European Parliament
inquiry, which I did.
And there's a reference to that on the
back of the slide deck. And if you want
to read one thing about all of this,
then I'd encourage you to read that
it's only 30 pages, but I think it's one
of the best pieces of work I've done.
So after Snowden, basically the Labor
Committee, the Civil Liberties Committee
went into a sort of purdah a lockdown.
There was one particular politician
who insisted on this, Baroness Ludford of
the Liberal Democrats, who marvelously
lost her seat at the last election.
So we don't have to worry about her
anymore, not
unfortunately, on these accounts, but
just the luck of the draw. And the
liberals are so unpopular.
But anyway, for for
reasons which are too politically
complicated going to now essentially
labor cut itself off from all advice,
any interchange, really, with
what they were cooking up, the sort of
compromise they're cooking up.
And so what emerged out of this purdah
was so-called Article 43
eight. And this is a restoration
of a clause which was lost from
a penultimate draft of a draft, was
actually published by the commission in
2012.
And what it said is that in the case
where you put some data in the cloud
and then the US, for example, law
enforcement wants to get direct access
from that cloud provider, well,
the cloud provider has got to tell
and get permission from the data
protection authority to do that.
So it sets up a deliberate conflict of
law because you remember,
if somebody had done that in
respect to the FISA law, they would have
been in contempt of the court and
possibly endangering themselves
under the Espionage Act.
So that's putting the companies in a
terrible, terrible squeeze, except,
well, think about it. On the one hand,
you've got contempt of the court,
very, very powerful court in the
US and potentially espionage charges.
On the other hand, you've got fines
and a very long, dubious process of
enforcement by very ponderous European
data protection authorities.
The fines might get quite big, but then
again, they might not.
So which are you going to choose?
So it's not a credible deterrent.
And that was a key part of the advice and
amendments that I drafted for the
parliament, but they wouldn't go for it.
One good thing the parliament did do is
they removed these because processes.
But it's likely the commission and the
council and Article 29, because it's
their sort of baby, will want them put
back.
Well, this is a bit outside the scope of
the talk, but I want to say that
there's a lot wrong apart from
this. With the new data protection
regulation, I've reluctantly come to the
view from having thought
and it was motherhood and apple pie
that this is going to be a curse on
personal freedom. This is going to be an
irreversible bureaucratization of
everyday life.
I probably will start going through all
the things which are wrong here except
just maybe the penultimate point
in the new regulation, which is
going on four times
as much text as the original directive.
There are 450 references to this term
of art processing.
Processing can mean computing with data
or storing the data.
But as we now know, but they didn't
know in 1981 when somebody had the bright
idea to manage these two ideas together.
We now know that you can protect store
data with encryption, but you can't
protect computer data with encryption.
So this entire regulation is built
on conceptual sand.
Each of these 450 references
is inherently ambiguous,
but it is conflating two completely
incommensurable information security
situations, one of which which is
tractable with technology and the other
which is not.
That's how messed up it is conceptually,
so to come right up to Deetz,
Article 29 Working Party came
out just this month with their
opinion, 51 page opinion on
the whole surveillance thing,
expanding from a shorter opinion they
published last year.
Um, it's a very muddy piece of
work.
It's really a long letter
of self exploitation by why
they couldn't reasonably be expected to
do anything about this to date.
But they do make some interesting,
definitive statements.
The exemption in the EU treaties offers
no possibility to invoke the national
security of a third country alone
in order to avoid the applicability of EU
law.
And this is a sort of rebuff to
the carve out in the EU treaties
for national security.
But of course, that is the national
security of member states, not of a third
country.
And DPAs may suspend
data flows on their existing
powers, particularly in Germany,
hint, hint that they haven't
done so so far.
And they're also awaiting the outcome of
the Max Schrems case, which we haven't
got time to talk about now.
But they also say that Article 43,
there's conflict of law.
The commission's idea now
put back by the parliament
after being lobbied away just before the
publication of the original regulation.
They don't like it. They say it may be a
step in the right direction, but it's not
going to be the solution to all problems.
But here's the bombshell
right at the bottom.
And it's not obvious,
they say, that if there
is any such Article 43, they don't want
the job.
Basically, it would be the interior
ministry of each country which would take
that decision whether to approve or deny
the transfer, not
the independent data protection
authority.
They don't want the job.
In other words, within the sort of
conclave, Article 29, they have failed to
reach any consensus that
this problem of foreign intelligence
surveillance is really anything that
should be done by them.
And they can maybe have a question or two
about that.
Article 29 also evades their
own responsibility for this mess.
Back in 2005, in one of
their working party documents dealing
with all of this, they said that
one of the reasons they were inventing
these BCR and contract structures
was so that transfers
they called repeated mass or structural,
which was their sort of code for this
sort of thing precisely because
of his importance, should somehow be
carried out within these legal frameworks
they were inventing.
But nine years later,
they say exactly the opposite.
They say that these instruments, which
they invented, should
not be the basis for these massive
structural or repetitive transfers.
So in other words, Article 29 in the
Folley, they got this whole ball rolling
in the mid 2000s as if these preposterous
legal mechanisms could possibly contain
these risks and now they contradict
themselves and walk away without
acknowledging that absurdity.
They also don't mention the
discrimination by nationality in US law,
which I stressed, and in fact, in 150
opinions since 9/11,
they never even mentioned the concept of
foreign intelligence at all.
The other bits, I don't probably have
time to explain right now.
But what they did do at a big conference
the beginning of the month
is publish a political statement,
sort of 15 points of political belief,
which sound very right on.
They don't they are, in fact, the sort of
thing that privacy activists
do say and espouse.
But really, this is a decoy.
This is a decoy to try and
distract attention from the fact that
they cannot achieve any solidarity among
themselves for deciding that they
actually have a responsibility to enforce
the existing law,
to shut down data flows, to
make the United States pay a price.
And the US is exceptionally expansionist.
If you look at references in surveillance
law to discrimination by citizenship
and nationality rather than the geography
of the communication path.
Well, there's about 40 in US law
counting up Pfizer and Hatriot and
Pfizer, the first and Fourth Amendment
special protections.
The U.K. has zero.
Surprisingly, Germany has
one, which is a profound embarrassment.
And I have got a question about that,
because in our
human rights are supposed to be equal.
But actually part of the German Jiten law
is very analogous to 702.
Canada has about to New Zealand, to
Australia, too.
And I haven't been able to discover any
others at all.
But the US has 40.
So what have NGOs done
in Brazil that Mondiale
in Istanbul IGF?
Nobody said one word
about discrimination by nationality.
I was tweeting like crazy kind of kicking
their shins.
The subject was never even raised
by anybody.
CTT, ACLU, EFF have done very little
on nonusers person rights.
I'm sure there are people here will
quarrel with you about that.
Access has done more than most,
Epic said not one word about
you.
In eight years of visiting the EU and
helping us with our privacy problems,
Edri has done nothing before or after
Snowden.
And I've mentioned Privacy International
already.
Is a real treaty with the US even
possible, supposing we got the sort of
guarantees that we would like to have the
criminalization of data protection
offenses? There is a serious fundamental
problem, which is that spying on
foreigners abroad
is an inherent presidential authority.
Congress cannot restrain that
presidential authority.
So, in other words, if Obama today
makes a promise and says we changed
policy, we're going to rewrite EO 23
pretty much more strongly than PD
28.
You can't trust that because a future
president or the same president could
tomorrow in secret renounce
that policy and just go back to business
as usual.
So it's not even clear that a legally
binding treaty is possible unless
you change the US Constitution.
And generally, what I've been
recommending for a couple of years now is
a three pronged strategy for any
response.
Firstly, you work out essentially
which data flows are more valuable to the
US than they are to Europe and
you begin shutting them down as in a
trade war.
Secondly, you need a long term EU
industrial policy to develop software
and cloud services.
And I think also critically, that
should include
a secure operating system for individuals
or much more secure operating system for
individuals.
You might have seen on the beginning of
the slides, and I know a policy advisor
to the Cuba project, and I
do think if you haven't heard of Cuba and
you worried about your security very
laptop, you should check it out.
That's all I'll say.
And thirdly, we need whistleblower
protection because
it's only through Edward Snowden's
courage that we know
at least that anyone is taking this
seriously now.
And we don't know that the next
whistleblower is going to be as
altruistic as Snowden.
So we need to actually give them
watertight asylum and probably
some incentives, probably some rewards.
I actually proposed to the parliament
that the whistleblowers should get
25 percent of any fines
subsequently exacted
on a controller. Now, that sounds an
enormous amount.
But you've got to remember, that person
is likely to be an American, either
somebody working for a corporation or
working for the NSA,
and they are going to need bodyguards and
protection from extraordinary rendition
and kidnaping back to sort of Guantanamo
for the rest of their lives.
So that's why the incentives have to be
enormous to provide a credible deterrent.
So the way that
I've tried to sort of summarize the
political situation now is welcome to the
matter Panopticon.
It is unfortunately true
that most people don't think they have
anything to hide from the government.
But people vote for politicians
and they have to have trust in public
officials. They have to trust the
public. Officials are acting impartially
in their national interest and in their
collective interest.
So how now are people going to know
that that is the case?
Because any politician or official in
Europe now knows that the NSA
and probably GHQ knows
every detail of their private life, every
indiscretion, everything rash, email
sent via email or any phone
call, information deducible through
traffic analysis.
Well, anyone with half a brain cell and a
position of power in the, you know, knows
their private life is up for grabs.
Their career could be ruined with one
tabloid news story
or the promotion ruined if they show
perhaps too much anti-American
bias.
And that comes to the attention of the US
and they sort of arrange for the other
guy to get promoted.
Well, how do we know that's not going to
happen? Because even if it doesn't
happen, we might reasonably suspect
that may happen.
So that is a profoundly corrosive idea
for democracy, but is something that we
now have to deal with it.
We cannot deal with it
by not thinking about it.
And as I put at the end my report,
the thoughts that Edward Snowden have
put in the minds of the public cannot
now be unthought.
Thank you very much.
OK, we can take about about
ten minutes for Q&A.
So if you have a question,
find a microphone, preferably
one of those.
Um, and also I have a signal
angel in the back.
And she is
she has a question.
Yes. Hello, Casper.
So we have a ton of questions
for you and the IOC.
And they were all really excited
about your talk.
And I mean, just start with one.
So can you name three
countries whose laws are equally
balanced and protecting
its citizens as well as foreigners?
So which countries could
we.
Yeah, take as an example
for laws in Europe or in
Germany?
So I think one important
distinction to make is the sport has been
going on in reality,
as we now know from Snowden.
And then there is what the law is in
theory.
So in every European country,
I believe, apart
from Germany,
the laws are equal.
There's nothing in European laws apart
from Germany that I discovered where it
says if you are a French citizen or if
you a Slovakian citizen or if you are a
Czech citizen, you get better protection
in respect to privacy and surveillance.
What almost every other country's laws
say is they differentiate between
purely domestic communications,
communications, starting and beginning in
one country and communications
which cross the border of that country.
So that is the way that most laws
make that distinction.
But he may say, well, does that make a
difference?
Yes, it does for cloud computing, because
the stark contrast is
if you have any American data
in Europe, then that data
is equally protected by European data
protection and human rights law.
And American could come over here and
start taking a case through European data
protection authorities or European courts
without any trouble at all
if they thought their privacy was being
unjustifiably infringed.
The converse is not true.
All EU data, as I hope I've demonstrated
in the US, you have no legal rights at
all, and that is the asymmetry
created by cloud computing
before cloud computing.
The rough assumption in the build up of
these international laws for 50 100
years was that territory was roughly
congruent with jurisdiction.
What cloud computing does is it just flex
those two apart and creates this vast
asymmetry.
Um, the mike over there.
OK, so thanks for the talk.
In Germany, the parliament finally
decided to open up an investigation
commission after the Snowden revelations.
And
so they got witnesses from the
German intelligence services,
but not much came out because
all the details are classified, which
would as prove.
And the government also protects them.
And it appears that somehow
the intelligence services operate in some
sort of room that is independent of the
law. Now, you pointed out how in the
US they would be and what they could
do within the boundaries of the law.
Now, my question is, do they
even care or more formally put
how likely would you
think that they that the US
agencies would feel bound by
the US laws at all?
So I think they do feel bound by the
US laws.
There was a great
John Oliver The Daily Show quip, which
is the amazing thing, Mr President, is
not nobody is saying that you broke the
law.
The amazing thing is that you didn't have
to.
And I do think that when you read the
texture of what NSA lawyers
have said and the texture the club
reports and so forth, they they are, in
a sense, legal overload.
We're now getting kind of bombed with
thousands and thousands of pages of
American legalese. But the trouble is,
none of it has any relevance for us.
It is all about because that
is the only rights which exist.
It is all about protecting the rights of
Americans and there simply is no rights
defined for anybody else.
Thank you. The microphone over there,
please.
Hi.
Hi. I have a question about the role
of jurisdiction in the area of cloud
computing.
And as I'm sure you know, Microsoft
is challenging a ruling in the states
about access to data held
in the EU.
And I'm just wondering what your views
are on that. Is it sort of snake oil or
is there something like a positive role
that US companies can do in sort
of challenging this global surveillance?
So, as I say, I'm very glad you asked me
that. As you can imagine, getting fired
from by Microsoft for trying to warn them
about 702.
I do find it kind of amusing that
now Microsoft is painting itself
as the champion of privacy.
And I'm afraid this case is not
about protecting the sovereignty of
European data.
This is about protecting the sovereignty
of Microsoft.
But the short answer.
There is the substance of that case is
only about the Stored Communications Act,
a part of 1996.
In other words, it only deals with
criminal law enforcement.
So even if Microsoft won that case, I'm
actually hoping they won't because then
that'll kind of shore up this rotten
system that we have today.
But even if they won that case, it would
do nothing to prevent surveillance under
EO twelve fifty three or five.
So it's completely orthogonal to that.
We'll take another question from the
Internet.
So hello.
OK, so two questions
and the same direction.
The question is that,
I mean, the the
US are quite powerful in comparison
to Europe.
So one of your examples
was to not give
them any data anymore, that they really,
really want to have something to
trade off.
So how do you think that will work?
Is there any possibility that
this will be the case?
So when I first started recommending
this policy a couple of years ago,
basically everyone said it was crazy and
they said there is no capacity for this
in Europe.
We don't have enough
software houses.
We don't have enough people who could
build and invest in data centers.
It's completely crazy.
But what I heard from the commission just
two weeks ago is that what they're
hearing now is actually European
providers, particularly telcos, are
queuing up to now
provide European based data
centers. And of course, another
consequence of what I said is people
should not be using open source software
for security
because this problem of actually pushing
software updates and through a software
update, any security infrastructure
you've got, being able to be toast
because you just don't know what's in the
update. Of course, open source is no
panacea, but tools
like static analysis for getting the bugs
out of open source are much more
effective than when we last had this
debate 12, 13 years ago.
So from all points of view, there is just
a massive advantage now in everybody,
particularly governments switching to
open source cloud computing
indigenously hosted in the EU.
If you do that, of course, the NSA can
still try and break in.
But if the NSA is trying
to break in, you can at least defend by
conventional means.
And you're in essentially a totally
different situation.
And if you've handled all of that data
over on a plate for the inspection of 72,
I think we've got time for two more
questions,
I think, to the switch.
Your claim is that
Article 43 does not work because of
the asymmetrical nature of the
crime and punishment.
The punishment for
for for it for spying is 20 years
imprisonment, etc.
But it does not apply to European
citizens operating in Europe.
So could
Article 43 not be shored up by saying
anyone who provides cloud
services in Europe has to have a non
European, not an American citizen
working in the role of getting
the information about
this on the back and forth
as required by Article 43?
And then the asymmetries asymmetrically
does not exist anymore, if that's a word.
So it's a nice idea, but a couple of
problems. I mean, one is that it's by no
means clear that the Espionage Act can
only be used against American citizens.
Ask Julian Assange.
And the second point is that
there is the scope of American law
extends not just to US based companies,
but to any company that does
business with the US.
So theoretically have no to order could
be put onto Deutsche Telekom or France
Telecom or whoever.
But from my experience, working
in a very big corporation and now
having my my judgment is
the US would not serve a 72
on a European company because the whole
purpose would be secrecy.
And I think that may
be naive, but a European corporation
staff from the European lawyers, they
would not put up with that.
They would ensure that essentially
they would cry for help from their own
government, from from
data protection authorities.
So I think in practical terms, there's
very substantially less risk for a
European company, even if it is doing
business in the US to be subject to this
law. But I'm afraid putting
responsibility, just American citizen,
won't necessarily do it.
And the last question,
do you think over here,
do you think there's any way an
American company can set
up a cloud offering
that really
legally protects their
customers data from,
let's say, the US legally spying on them?
Sure, yeah.
I mean, just use a European company
running free software physically
located in the territory of Europe, and
you protect that as well as you can,
but not for an American company.
No, there is.
Way out for an American company,
something about which I'm terribly,
terribly sad.
Thank you so much, Caspar.
I hope that there will be a result that
is bigger than stunned silence.