'Cybersecurity' begins with integrity, not surveillance

If you've been following the surveillance debate, you may have noticed that it is actually two debates: first, it is a debate about whether mass surveillance works; and second, it is a debate about whether mass surveillance is a good idea, whether or not it works.

I've made arguments in both of these debates. On the question of whether it works, I'm among those who point out that the spies who have spent billions putting whole populations under surveillance can't point to any dividends from that massive investment. Since the debate over mass spying began in 2006 (with the whistleblower Mark Klein's disclosure that the NSA had gotten access to AT&T's main fibre-optic trunks), American spies have made a lot of grandiose claims about the plots they've foiled through mass surveillance. But when pressed, even their top officials admit that the entire mass-spying regime has caught exactly one "bad guy" – and that was an American who was thinking of wiring some money to al-Shabaab in Somalia.

So the argument that mass spying isn't worth it because it just doesn't work very well is an attractive one. When the official National Commission on Terrorist Attacks Upon the United States tabled its report on the 9/11 attacks, it was clear on the relationship of surveillance to the 9/11 attacks. Specifically, the 9/11 commission concluded that the problem wasn't a shortage of intelligence, but rather a lack of coherence and coordination among spy agencies, so that the warning signs were missed. In other words, the comparatively minuscule surveillance regime pre-9/11 was more than sufficient to catch the 9/11 plotters, and the drops of useful intel were lost in the the pre-9/11 trickle. What hope do we have of finding the next drops, now that the trickle is a neverending flood?

Even if surveillance worked…

But the more I think about this, the more I realise it's not the argument I want to make. The longer the surveillance debate goes on, the more I realise that even if mass, total, continuous surveillance worked to catch terrorists, I would still oppose it.

The Washington Post journalist Barton Gellman and I presented an introductory session at SXSW before Edward Snowden's appearance, and he made a thought-provoking comparison between surveillance and torture. Some of the opponents of torture argue against it on the ground that torture produces low-quality intelligence. If you torture someone long enough, you can probably get him to admit to anything, but that's exactly why evidence from torture isn't useful.

But Gellman pointed out that there are circumstances in which torture almost certainly would work. If you have a locked safe – or a locked phone – and you want to get the combination out of someone, all you need is some wire-cutters, a branding iron, some pliers, and a howling void where your conscience should be.

The "instrumental" argument against torture – that it doesn't work – invites the conclusion that on those occasions where torture would work, there's nothing wrong with using it. But the primary reason not to torture isn't its efficacy or lack thereof: it's that torture is barbaric. It is immoral. It is wrong. It rots societies from the inside out.

And so it is with mass surveillance. As the exiled WikiLeaks volunteer Jacob Appelbaum said to me this week in Berlin, "Surveillance makes you say 'yes' when your conscience says 'no.'"

The space to think things through

That is, when you are continuously surveilled, when your every word – even your private conversations, even your personal journals – are subject to continuous monitoring, you never have the space in which to think things through. If you doubt a piece of popular wisdom and want to hash it out, your ability to carry on that discussion is limited the knowledge that your testing of the day's received ideas is on the record forever and may be held against you.

One thing that parenting has taught me is that surveillance and experimentation are hard to reconcile. My daughter is learning, and learning often consists of making mistakes constructively. There are times when she is working right at the limits of her abilities – drawing or dancing or writing or singing or building – and she catches me watching her and gets this look of mingled embarrassment and exasperation, and then she changes back to some task where she has more mastery. No one – not even a small child – likes to look foolish in front of other people.

Putting whole populations – the whole human species – under continuous, total surveillance is a profoundly immoral act, no matter whether it works or not. There no longer is a meaningful distinction between the digital world and the physical world. Your public transit rides, your love notes, your working notes and your letters home from your journeys are now part of the global mesh of electronic communications. The inability to live and love, to experiment and err, without oversight, is wrong because it's wrong, not because it doesn't catch bad guys.

Everyone from Orwell to Trotsky recognised that control over information means control over society. On the eve of the November Revolution, Trotsky ordered the Red Guard to seize control over the post and telegraph offices. I mentioned this to Jacob Appelbaum, who also works on many spy-resistant information security tools, like Tor (The Onion Router, a privacy and anonymity tool for browsing the web), and he said, "A revolutionary act today is making sure that no one can ever seize control over the network."

If the NSA and GCHQ want to effect "cybersecurity", then let them help us with the project of building a network that allows us to maintain the integrity of our private lives. Cybersecurity should be about securing the people of the United Kingdom, not making the state secure from us.