Jared Cohen - The New Digital Age

In democratic countries, corruption, crime and personal scandals will be more difficult to get away with in an age of comprehensive citizen engagement. The amount of information about people that enters the public domain—tax records, flight itineraries, phone geo-location sites (global-positioning-system data collected by a user’s mobile phone) and so much more, including what is revealed through hacking—will undoubtedly provide countless suspicious citizens with more than enough to go on. Activists, watchdog groups and private individuals will work hand in hand to hold their leaders to account, and they’ll have the tools necessary to determine whether what their government tells them is the truth. Public trust may initially fall, but it will emerge stronger as the next generation of leaders takes these developments into consideration.

When the scope of such changes becomes fully realized, large portions of the population will demand government action to protect personal privacy, at a much louder volume than anything we hear today. Laws will not change the permanence of digital information, but sensible regulations can install checks that will ensure some modicum of privacy for citizens who seek it. Today’s government officials, with a few exceptions, don’t understand the Internet—not its architecture or its manifold uses. This will change. In ten years, more politicians will understand how communication technologies work and how they empower citizens and other nongovernmental actors. The result will be public figures in government who can lead more informed debates on issues of privacy, security and user protection.

In democracies in the developing world, where both democratic institutions and technology are newer, government regulation around privacy will be more random. In each country, a particular incident will initially raise the issues at stake in dramatic fashion and drive public demand, similar to what has happened in the United States. A federal statute was passed in 1994 prohibiting state departments of motor vehicles from sharing personal information after a series of high-profile abuses of that information, including the murder of a prominent actress by a stalker. In 1988, following the leak of the late Judge Robert Bork’s video-rental information during the Supreme Court nomination process, Congress passed the Video Privacy Protection Act, criminalizing disclosure of personally identifiable rental information without customer consent. 6

While all of this digital chaos will be a nuisance to democratic societies, it will not destroy the democratic system. Institutions and polities will be left intact, if slightly battered. And once democracies determine the appropriate laws to regulate and control new trends, the result may even be an improvement, with a strengthened social contract and greater efficiency and transparency in society. But this will take time, because norms are not quick to change, and each democracy will move at its own pace.

Without question, the increased access to people’s lives that the data revolution brings will give some repressive autocracies a dangerous advantage in targeting their citizens.

While this is a bad outcome and one we hope will be mitigated by developments discussed elsewhere in the book, we must understand that citizens living in autocracies will have to fight even harder for their privacy and security. Rest assured, demand for tools and software to help safeguard citizens living under digital repression will give rise to a growing and aggressive industry. And that is the power of this new information revolution: For every negative, there will be a counterresponse that has the potential to be a substantial positive. More people will fight for privacy and security than look to restrict it, even in the most repressive parts of the world.

But authoritarian regimes will put up a vicious fight. They will leverage the permanence of information and their control over mobile and Internet service providers to create an environment of heightened vulnerability for their citizens. What little privacy existed before will be long gone, because the handsets that citizens have with them at all times will double as the surveillance bugs regimes have long wished they could put in people’s homes. Technological solutions will protect only a distinct technically savvy minority, and only temporarily.

Regimes will compromise devices before they are sold, giving them access to what everybody says, types and shares in public and in private. Citizens will be oblivious to how they might be vulnerable to giving up their own secrets. They will accidentally provide usable intelligence on themselves—particularly if they have an active online social life—and the state will use that to draw damning conclusions about who they are and what they might be up to. State-initiated malware and human error will give regimes more intelligence on their citizens than they could ever gather through non-digital means. Networks of citizens, offered desirable incentives by the state, will inform on their fellows. And the technology already exists for regimes to commandeer the cameras on laptops, virtually invade a dissident’s home without his or her knowledge, and both listen to and watch everything that is said and done there.

Repressive governments will be able to determine who has censorship-circumvention applications on their handsets or in their homes, so even the non-dissident just trying to illegally download The Sopranos will come under increased scrutiny. States will be able to set up random checkpoints or raids to search people’s devices for encryption and proxy software, the presence of which could earn them fines, jail time or a spot on a government database of offenders. Everyone who is known to have downloaded a circumvention measure will suddenly find life more difficult—they will not be able to get a loan, rent a car or make an online purchase without some form of harassment. Government agents could go classroom to classroom at every school and university in the country, expelling all students whose mobile-phone activity indicates that they’ve downloaded such software. Penalties could extend to these students’ networks of family and friends, further discouraging that behavior for the wider population.

And, in the slightly less totalitarian autocracies, if the governments haven’t already mandated “official” government-verified profiles, they’ll certainly try to influence and control existing online identities with laws and monitoring techniques. They could pass laws that require social-networking profiles to contain certain personal information, like home address and mobile number, so that users are easier to monitor. They might build sophisticated computer algorithms that allow them to roam citizens’ public profiles looking for omissions of mandated information or the presence of inappropriate content.

States are already engaging in this type of behavior, if somewhat covertly. As the Syrian uprising dragged on into 2013, a number of Syrian opposition members and foreign aid workers reported that their laptops were infected with computer viruses. (Many hadn’t realized it until their online passwords suddenly stopped working.) Information technology (IT) specialists outside of Syria checked the discs and confirmed the presence of malware, in this case different types of Trojan horse viruses (programs that appear legitimate but are in fact malicious) that stole information and passwords, recorded keystrokes, took screenshots, downloaded new programs and remotely turned on webcams and microphones, and then sent all of that information back to an IP address which, according to the IT analysts, belonged to the state-owned telecom, Syrian Telecommunications Establishment. In this case, the spyware arrived through executable files (the user had to independently open a file to download the virus), but that doesn’t mean the targeted individuals had been careless. One aid worker had downloaded a file, which appeared to be a dead link (meaning it no longer worked), in an online conversation with a person she thought was a verified opposition activist about the humanitarian need in the country. Only after the conversation did she learn to her chagrin that she had probably spoken with a government impersonator who possessed stolen or coerced passwords; the real activist was in prison.