top | item 6583969

How Much Surveillance Can Democracy Withstand?

208 points| broodbucket | 12 years ago |ieet.org | reply

69 comments

order
[+] cromwellian|12 years ago|reply
In the 80s, I got my first access to the internet after reading Steven Levy's book "Hackers". In the chapter on RMS, he mentioned that RMS didn't use passwords and didn't believe in security.

I found the dialup number to the MIT media lab, and tried logging in as 'RMS' and viola, no password, and I had my first shell account on an internet-connected Unix machine, although I was only a teenager, and didn't attend MIT.

RMS's act of charity benefited me greatly, I was relatively poor growing up in inner city Baltimore, and his account was a life line to a new world of the internet and away from the crackhouse infested streets.

I find it interesting that he has changed his standpoint from one of radical transparency to techno-privacy.

Remember, RMS is the guy who hacked LCS's computer lab password file, decrypted all the passwords, and emailed everyone suggesting they change their password to empty string. Now, I get that what he really wanted was to allow anyone to have access to LCS resources, and that would have been better served by just allowing anyone to create an account. But some early GNU accounts nevertheless did not have passwords, and I could read their email, shell histories, etc.

I think there is an interesting question is to the extremes of privacy and transparency in a democracy. If for example, it was not possible to discriminate against people, and if the government could not abuse any information gained on someone, then it might be the case that society would better off if there was very little privacy, because private distributed abuse amongst non-state actors would then be the biggest danger. If on the other hand, the state is far more abusive, then the fraud and violence perpetrated by small actors uncaught by surveillance is dwarfed by the damage done by the state having this information.

The question is, is it black and white, or is there some level of justifiable dragnet surveillance? Can democracy also tolerate Cryptoanarchy?

[+] Ygg2|12 years ago|reply
Power demands transparency. Lack of power should give you some privacy.

An individual has right to privacy and to waive said privacy when it considers appropriate. The case with Stallman you mention was waiving some of his rights to give his colleagues easier access.

Powerful organization should be forced to be transparent to maximum extent that is reasonable - you shouldn't be forced to give out your trade/state secrets, but classifying everything as such and hiding is a worse transgression. They don't have the right to waive their transparency when it suits them.

[+] yeukhon|12 years ago|reply
In the 70s, 80s, there are few computers and few people know what to do with computers and the Internet. It was fine. But today's hacking (or cracking) is driven primarily by the black market. So you can't just let anyone to log into your shell and do things. Back then you may be able to trace the person who logged into your account but today this is getting difficult (even for NSA this can be difficult in some situations).

Today hacking into anyone's /etc/passwd and decrypt all the password is a crime and your best friend will be more careful when handling secrets with you if you do that to him for "change your 123 to something more complicated".

[+] eksith|12 years ago|reply
One could argue he hasn't changed at all. On the contrary, it's the obligation of the actor to act transparently toward those acted upon.

In your case, you were the actor dropping in on RMS so the obligation was on you to be transparent about it. I'm guessing you weren't, since it wasn't very polite to peek at their email ;)

And therein lies the dilemma. Those with power will observe yet must be transparent about said observation. However they aren't transparent for fear of tipping their hand to what is essentially the proverbial "boogey man" that is terror.

[+] logn|12 years ago|reply
This is before my time, so take this with a grain of salt. But I don't think RMS has changed that much. He still advocates unlocked wifi networks ( http://stallman.org/#long-term -> https://openwireless.org/ ). My guess is that his crusade to use empty string passwords was actually just to let the common man have access to computing resources. These days, a password means much more and I'm guessing that RMS could explain why his fundamental view of security is the same still.
[+] ashutoshm|12 years ago|reply
excerpt from Steven Levy's book "Hackers" Appendix A. The Last of True Hackers

Stallman, who liked to be called by his initials, RMS, in tribute to the way he logged on to the computer, used the Hacker Ethic as a guiding principle for his best-known work, an editing program called EMACS which allowed users to limitlessly customize it—its wide-open architecture encouraged people to add to it, improve it endlessly. He distributed the program free to anyone who agreed to his one condition: “that they give back all extensions they made, so as to help EMACS improve. I called this arrangement ‘the EMACS commune,’” RMS wrote. “As I shared, it was their duty to share; to work with each other rather than against.”

EMACS became almost a standard text editor in university computer science departments. It was a shining example of what hacking could produce.

But as the seventies progressed, Richard Stallman began to see changes in his beloved preserve. The first incursion was when passwords were assigned to Officially Sanctioned Users, and unauthorized users were kept off the system. As a true hacker, RMS despised passwords and was proud of the fact that the computers he was paid to maintain did not use them. But the MIT computer science department (run by different people than the AI lab) decided to install security on its machine.

Stallman campaigned to eliminate the practice. He encouraged people to use the “Empty String” password—a carriage return instead of a word. So when the machine asked for your password, you would hit the RETURN key and be logged on. Stallman also broke the computer’s encryption code and was able to get to the protected file which held people’s passwords. He started sending people messages which would appear on screen when they logged onto the system:

I see you chose the password [such and such]. I suggest that you switch to the password “carriage return.” It’s much easier to type, and also it stands up to the principle that there should be no passwords.

“Eventually I got to a point where a fifth of all the users on the machine had the Empty String password,” RMS later boasted.

Then the computer science laboratory installed a more sophisticated password system on its other computer. This one was not so easy for Stallman to crack. But Stallman was able to study the encryption program, and, as he later said, “I discovered that changing one word in that program would cause it to print out your password on the system console as part of the message that you were logging in.” Since the “system console” was visible to anyone walking by, and its messages could easily be accessed by any terminal, or even printed out in hard copy, Stallman’s change allowed any password to be routinely disseminated by anyone who cared to know it. He thought the result “amusing.”

Still, the password juggernaut rolled on. The outside world, with its affection for security and bureaucracy, was closing in. The security mania even infected the holy AI computer. The Department of Defense was threatening to take the AI machine off the ARPAnet network—to separate the MIT people from the highly active electronic community of hackers, users, and plain old computer scientists around the country—all because the AI lab steadfastly refused to limit access to its computers. DOD bureaucrats were apoplectic: anyone could walk in off the street and use the AI machine, and connect to other locations in the Defense Department network! Stallman and others felt that was the way it should be. But he came to understand that the number of people who stood with him was dwindling. More and more of the hard-core hackers were leaving MIT, and many of the hackers who had formed the culture and given it a backbone by their behavior were long gone.

[+] pjc50|12 years ago|reply
We're used to thinking of places either as "free country", like the idealised America that appears in films, or "police state" where vast numbers of people are rounded up into gulags and dissent is impossible.

The current situation is neither of those. It's a large expensive system of state oppression .. that acts on remarkably few people(+). There is a gulag archipelago, Guantanamo, but it contains only 46 prisoners now. Outside it, hundreds of millions of people live pretty free lives in the western world. So there's little public appetite for doing anything about it. If you're not reading about it in the news you can ignore it entirely.

Perhaps the main output of the surveillance program is the targeting information for drone strikes. This results in thousands dead .. but they are a long way away, in a part of the world that has its own problems with violence.

Your actual chances of being victimised by the surveillance state for engaging in nonviolent leftwing politics are very small. But perhaps its worth noting that radical leftwing groups seem more likely to be investigated by law enforcement than radical rightwing groups that advocate all kinds of crazy things, including actual violence against the government (second amendment supporters).

(+) (note that I'm talking about just surveillance here, as distinct from the War on Drugs, the horrifyingly high American prison population, racism in the police, or heavy-handed public order policing)

(note 2: I'm from the UK, which has its own problems with official support for surveillance, occasional brutal policing, and particularly the state's role in violence in Northern Ireland has not been properly dealt with nor atoned for).

[+] angersock|12 years ago|reply
You've overlooked the hundreds of thousands incarcerated in some way due to, for example, the war on drugs--itself enabled by this electronic surveillance.

The problem is quite a bit worse, erring towards police state, when you take into account that.

[+] np422|12 years ago|reply
Nor the US or countries inside the EU can be considered police states as of today.

The problem is our direction ... We are heading towards a police state. Not there yet, but that's where we will end up if you don't stop ever increasing mass surveillance and more rights/power for the police and the police like authorities we recently created.

IMHO privacy is very important for a functional society and democracy - once you are aware that someone is listening you don't express yourself as freely any more, most people will begin to self censor .... and freedom of speech is lost to a certain degree.

A search warrant needs reasonable suspicion and a second opinion by a judge. I think it's fair that we protect our privacy by the same means.

After all, last time I checked the risk of getting killed by a terrorist was about the same as the chance of being killed by a meteor.

[+] wtracy|12 years ago|reply
There is a gulag archipelago, Guantanamo, but it contains only 46 prisoners now.

As an added bonus, most (all?) of those inmates are foreign nationals, who apparently don't count as people anymore in American politics.

[+] ohwp|12 years ago|reply
"Surveillance data will always be used for other purposes, even if this is prohibited."

This stood out for me in the article. And I think this applies to all forms of data.

[+] TeMPOraL|12 years ago|reply
It does, and it worries me that people seem to not understand how obvious and true this is.

There is only one real limit of what we can do - laws of physics. Anything not explicitly prohibited by them can be done. There is also one practical limit - economics, i.e. whether or not we have resources to do something. And that's it. Laws, customs, etc. are arbitrary limits we voluntarily impose on ourselves, and they can and will be broken whenever it's convenient.

So basically here's a rule of thumb: whatever can be done will be done. It also suggests the possible course of action. We can't fight laws of physics, so if we want something not to happen, we need to influence the softer, economic side. Make things we don't like prohibitively expensive. That's why I think any solution to surveillance problem will need to be technical in a big part.

[+] JanezStupar|12 years ago|reply
Does anyone remember the old days when Stallman was an over the top tin foil hat crackpot?
[+] Ygg2|12 years ago|reply
He wasn't a crackpot. We were just more gullible :P
[+] chatman|12 years ago|reply
That is extremely disrespectful towards a legend as RMS is.
[+] camus2|12 years ago|reply
Define Democracy first , this is not a state , this is an ideal to acheive, no country is fully democratic , but some are more than others. That's why one cannot call a country a democracy, but compared to North Korea , most countries are "democratic". Compared to Switzerland most are not.
[+] dreamdu5t|12 years ago|reply
While we're at it, let's define privacy.

It seems to me that these kinds of discussions tend to conflate forced government surveillence with voluntarily giving your information to other people (such as Facebook).

[+] rarw|12 years ago|reply
Articles like this pop up all the time. The problem is that they never address (1) the legitimate need for surveillance; (2) dangers of an internet (or other communications networks) which law enforcement or government cannot access at all; (3) the problems with arguing that government (or anyone for that matter) should be banned from collecting and reading data sent across the web.

I understand the concern. As someone who has advocated for stronger electronic privacy regulation, no one likes someone having the ability to look through their stuff. However, the answer is more likely a balance than a denunciation of all surveillance in any form. Surveillance with restriction is fine and probably a good thing. It helps prevent crime and can help catch criminals once crimes happen. Just as it's easy to argue that a government with information will misuse it, bad people with a closed communication network will use it to commit crime. Sure not everyone is going to plan a terrorist strike, or organize a gang online but some will. Is it worth enabling that kind of behavior?

Also what should and should not be private also has to do with where/when the information is collected. If the government were hacking into all of our computers and keeping back ups of our hard drives that's very different from collecting things that are sent on the internet. Legally there is currently a big debate about how to treat something that is taken from a stored medium - like a hard drive - vs one that is captured in transmission - like an email being sent. As it currently stands the government would have a hard time justifying accessing your computer remotely without a warrant but an easy time reading emails once they left your computer. Why? Because the sent email is akin to yelling something in a public place. Once it leaves your computer, it's not private while its being transmitted. If this sounds like a stupid distinction, that's because it is.

[+] tjr|12 years ago|reply
Articles like this pop up all the time. The problem is that they never address (1) the legitimate need for surveillance;

From the article:

For the state to find criminals, it needs to be able to investigate specific crimes, or specific suspected planned crimes, under a court order. With the Internet, the power to tap phone conversations would naturally extend to the power to tap Internet connections. This power is easy to abuse for political reasons, but it is also necessary.

[+] chatman|12 years ago|reply
Brilliant piece from Stallman! Written with a paranoid, skeptic mindset with firm dose of realism and full of practical advice.
[+] lucb1e|12 years ago|reply
> You have exceeded the allowed page load frequency.

Like, I just loaded the page. Is it down for other people, or does this trigger just for me?

Edit: Oh nevermind, this website thinks x-forwarded-for is my real IP-address. I set it to '"\ which occasionally triggers database errors on php or asp.net websites, highly amusing :P

Edit2: Also interesting is when hackernews crashes just after I re-enabled my header modifier and try to save the previous edit.

[+] lttlrck|12 years ago|reply
"If whistleblowers don't dare reveal crimes and lies, we lose the last shred of effective control over our government and institutions."

Isn't there something very wrong with this line of thinking? Are whistleblowers really the last bastions of democracy? Voters, protestors and guns be damned, when all is lost we can depend on the whistleblowers? Are you kidding me?

[+] dwaltrip|12 years ago|reply
Guns? Are you kidding me? You think it is more reasonanble forming militias to hold the government in line, if voting and protesting are ineffective?
[+] mlinksva|12 years ago|reply
That was precisely my reaction when reading the article as published in Wired recently. It has some good ideas for increasing privacy. Too bad they are made to turn on an extremely weak claim.
[+] nooneelse|12 years ago|reply
If information from the inside is never whistle-blown, how will the people know to be upset about something, and who/what to vote, protest, bear arms for/against?
[+] robotys|12 years ago|reply
I believe it is hard to change government. You can ask them anything (reduce surveilance) just expect them to do nothing.

Democracy is not even well understood by half of us, citizen of world.

what WE can do is follow the 'do nice to others' to the extreme. Outward thinking instead of inward thinking. Then collectively, the world will be better.

[+] coldcode|12 years ago|reply
About as we currently know about. But it depends on whether the surveillance is acted on. Having everything I do and say in a database is not the same as my vanishing one night into a police van never to be seen again.
[+] miguelrochefort|12 years ago|reply
Democracy is silly and won't withstand transparency.

That said, society can withstand 100% surveillance, total transparency. But that surveillance has to be done by the people and be publicly shared.

[+] Sagat|12 years ago|reply
You would want to be filmed at all times, and have that footage available to everyone? That's insane and I suggest reading Dave Egger's "The Circle".
[+] alan_cx|12 years ago|reply
Oh, way more that I wanted to type and a bit ranty. You're warned!!!!

Very sadly, he is completely wrong.

This is the beginning:

"How Much Surveillance Can Democracy Withstand?

The current level of general surveillance in society is incompatible with human rights. To recover our freedom and restore democracy, we must reduce surveillance to the point where it is possible for whistleblowers of all kinds to talk with journalists without being spotted. To do this reliably, we must reduce the surveillance capacity of the systems we use."

Not true. Not even slightly true. Its so tragic.

In principle, I could not agree with him more, but that does not appear to be a reality the vast majority can be bothered with.

Why? The vast majority simply do not care. Worse still a huge chunk of society, on a daily basis, give up more personal information than any government can possibly hope to ask for. We in the UK groan when the census comes up, every 10 years. But the average facebook profile contains more personal information than any census has ever asked for. And many many people up date FB daily. Imagine a government asked us to document our lives daily? I could go on, but that's the general thrust.

So, how much surveillance can society withstand? Loads more.

Is it incompatible with human rights? Well, humans don't seem over bothered, in fact they offer up more information that the government could ever ask for. Hence the NSA/GCHQ slurping.

Because the government will only ever use the data in a small targeted way, it will never ever negatively effect the vast majority of people. So they will never be inconvenienced by it. Only "those" people will be effected, and "they" are guilty evil doers. So, there will never be an uprising or revolt, because most people are unaffected.

See, even people most out raged by this agree that its good if they can round up terrorists, pedophiles or who ever the current bogyman is. Well, while we accept that, we accept the method, and there for that "evil" must exist. When it exists, it can be easily and silently abused. The expectations are the gaps through which evil seeps. This is why we are or try to be absolute about torture, chemical or biological weapons, racism, and so on. We know if we allow it in any way, mission creep will happen.

Of course, the real hypocrisy of people is that when something bad happens, we blame government for not having enough control over circumstances. We immediately say, "why didn't they do this that or the other. They failed." What if all this slurping of data could have prevented 9/11?

But in the end, from what I have seen, society can easily with stand a hell of a lot more surveillance. We allow it, government moderates it's use such that most never see the down side, government loves control, and we expect government to have that control.

Truth is, really, people want more surveillance so that they can live nice risk free lives. Frankly, I'm not sure people really want real freedom at all. They want a freedom, or their freedom, one that suits their daily lives. But are only too happy to deny freedom to others as long as their freedoms are preserved.

If this slurping is really that evil and unacceptable, incompatibly with human rights, why haven't millions of people descended on Washington and London, rioting in the streets, bringing down our respective governments?

Or are all these out raged people trusting democracy and the ballot box will sort it out?

Or, is it that really they don't care?

[+] userulluipeste|12 years ago|reply
"Frankly, I'm not sure people really want real freedom at all."

Someone answered that already, thousands of years ago: "Only a few prefer liberty, the majority seek nothing more than fair masters."

The vast majority doesn't want freedom, or at least they don't truly want it, as they can not use/value/appreciate it. I would say that the ones who do are the ones that induce the demand for freedom in the rest of the population. It just is the the easiest way of achieving such things. In this light, although the wish for freedom is touted as a noble goal, it isn't that different than some other personal quest in which a minority reaps the benefits of something that a majority fought for. Maybe our freedom (i.e. all the things that define it) is currently just tending to be reshaped to a more natural form, fitting better our average human nature?

[+] kubiiii|12 years ago|reply
The author asks how much surveillance can democraty withstand. Not society. Society can withstand loads more surveillance but the resulting regime cannot be called a democracy.
[+] np422|12 years ago|reply
There are two main difference between government surveillance and facebook. First of all, you get to decide what you want to share - it's not extracted from the email you sent to your doctor/lawyer/mistress in confidence like NSA/GCHQ does.

Second, if facebook makes a mistake you are probably served incorrect ads on a web page, if the government makes a mistake you can end up on the no fly list or in Guantanamo ...

But you are correct - most people don't value liberty or privacy.

[+] summerdown2|12 years ago|reply
I think I agree with you about the UK. Most people do seem ok with it. Of course, we'll never know if that might have been different had the reporting not been quashed by D notices.

I have to admit, I find surveillance extremely creepy, but then I translate it into my head into an Iain Banks novel. The great orbital in Look to Windward, is essentially governed by the AI Mind at its heart, which lets them all go freely about their business, yet saves them from peril. I like that world, and if I knew the ones who save me would never abuse it, I'd be happy.

Given the fact it's probably impossible to stop surveillance, I think the real question is how we make sure it's used for good. As it stands, the people in charge appear to believe public knowledge and debate is a bad thing.

So my question is less: "how much surveillance can democracy withstand?" and more, "how little oversight can a democracy withstand?"

[+] unknown|12 years ago|reply

[deleted]

[+] Sagat|12 years ago|reply
It's true that most people don't care about most things since they operate inside a small, simple world without being concerned with the things outside of their immediate experience. Not that it's necessarily a bad thing; many individuals have gone insane trying to solve the problems of the world. I myself only want a quiet life without hassle.

Societal and technological change are the result of the work of a small minority, which may very roughly correspond to the 20/80 Pareto principle. You can't expect everyone to be involved in complex conundrums. So it doesn't matter if the majority don't care about an issue. That doesn't mean we shouldn't do something about it.

[+] smky80|12 years ago|reply
> why haven't millions of people descended on Washington and London

Because humans essentially stopped evolving after developing agriculture, and most are only really capable of thinking one year/harvest ahead.

Like so many other things, the long term consequences are just outside of their horizon, so they are not able to effectively assess the trades they are making. Like a chess program looking X moves ahead and not seeing the punchline X+1 moves ahead.

[+] nvk|12 years ago|reply
Not this much.