Danielle Kehl
Fellow, Open Technology Institute
Tech Companies Compete on Privacy Post-Snowden
While surveillance reform efforts in Congress are on pause until lawmakers return from the campaign trail in November, the costs of the NSA鈥檚 bulk collection and monitoring programs continue to pile up. And now 鈥 to the chagrin of some law enforcement officials 鈥 companies are responding by to their products.
Last week, Senator Ron Wyden (D-OR) in Silicon Valley with the leaders of several major tech companies to discuss the 鈥淚mpact of U.S. Mass Surveillance on the Digital Economy.鈥 As Chairman of the Senate Finance Committee and a longtime advocate for surveillance reform, Wyden has been one of the leading voices in the Senate calling for an end to bulk collection and other mass surveillance practices. In assessing how the events of the past year have with Google CEO Eric Schmidt and executives from Microsoft, Dropbox, and Facebook, Wyden stated point-blank: 鈥淭his is going to cost jobs. Good-paying American jobs.鈥
The impact on the U.S. tech sector was one of several key themes that emerged during the discussion in Palo Alto, the heart of Silicon Valley. All of the panelists agreed that the loss of trust as a result of NSA surveillance is damaging U.S. business interests, both at home and abroad. One big concern is the risk of because of that have emerged in a number of foreign governments, including Germany, Brazil, and India. Schmidt that if these proposals move forward, 鈥渢he simplest outcome is we鈥檙e going to end up breaking the Internet.鈥 , increasing transparency around government requests for information, and promoting the use of encryption are immediate steps that can help mitigate the situation, but panelists emphasized that truly repairing the damage will take broader, long term reform efforts.
The statements of major tech leaders at the Wyden hearing are just the latest in a steady stream of evidence that the costs of NSA surveillance continue to increase. In July, we released a that assessed the economic and political fallout in the first year after Snowden, chronicling the existing and projected future losses for the U.S. cloud computing industry, the decline in technology sales overseas, and the potential impact of data localization and local storage proposals on American business interests. Practically every week, new information comes to light that adds weight to our case.
In August, the Wall Street Journal that foreign privacy startups are seeing a post-Snowden boom. 鈥淪ince news broke that former U.S. National Security Agency contractor Edward Snowden disclosed alleged U.S. government surveillance methods worldwide,鈥 the Journal wrote, 鈥渟ecure messaging and so-called 鈥楴SA-proof鈥 products and companies have sprouted across Germany and Switzerland, two countries who take their privacy laws very seriously.鈥 The rise of 鈥淪nowden marketing鈥 as a strategy to poach American business is serious 鈥 in the current environment, even the perception that a foreign company may offer users more security and protection from government overreach (regardless of whether their products are actually more secure) can be enough for customers to sever existing relationships with U.S. companies. In some cases, it鈥檚 individual customers who are , a small Norwegian provider offering secure email service that reported a significant jump in customers since June 2013. But we鈥檝e also seen governments pull major contracts, such as Germany鈥檚 that it intends to end its relationship with Verizon in 2015.
As another news story described last month, it increasingly seems like the government is putting Silicon Valley in a . On the one hand, the NSA compels companies to hand over troves of information on their users or face stiff fines, while at the same time preventing them from being transparent with their shareholders or users about the overall scope or cost of the surveillance. Several major Internet companies responded by suing the government in the secretive Foreign Surveillance Court, ultimately obtaining a in January with the Justice Department allowing them to publish some basic numbers about the national security requests they receive. And just last week, in federal court in California for the right to publish a more detailed transparency report than what the deal with the DOJ allows.
In addition to advocating for greater transparency and broader , many U.S. companies are also starting to respond by . Last month, both and announced that they鈥檙e moving toward full smartphone encryption by default, which means that all of the data on their phones will be protected from the prying eyes of the government, criminals, and the companies themselves (who could previously bypass most of a device鈥檚 security features when the government asked). The added protection is intended to appease not only to Americans who are concerned about NSA snooping, but also that have long been concerned about government-mandated security vulnerabilities in American products. As the Washington Post , 鈥淧rivacy is tech鈥檚 latest marketing strategy.鈥
Unfortunately, Apple鈥檚 attempts to close what cryptography expert Bruce Schneier 鈥渁 serious security vulnerability in the iPhone鈥 and hand some control back over to its customers has prompted a serious from the law enforcement community here in the United States. FBI Director James Comey has that the feature will 鈥渁llow people to place themselves beyond the law鈥 and that default encryption could seriously hinder criminal investigations, an argument that yesterday at . The Editorial Board of the Washington Post that perhaps Apple and Google should use their 鈥渨izardry鈥 to create a 鈥渟ecure golden key鈥 that would only be used to access information stored on a device once a warrant had been obtained.
The strong negative reaction from law enforcement and the Washington Post to these new improvements in smartphone encryption is off-base for several reasons. For starters, the claim that improved smartphone security could somehow make us less safe has been by who have explained how better encryption helps as well as threats. And suggesting that to enable law enforcement access simply does not make sense from both a security and an individual liberty perspective. We already , in the so called 鈥淐rypto Wars鈥 of the 1990s, when proposals to mandate that U.S. technology companies called the 鈥淐lipper Chip,鈥 giving the government the ability to decrypt private communications, were rebuffed after robust public debate on the issue. Twenty years ago, lawmakers, technologists and privacy advocates all ultimately concluded that such backdoors are not only bad for privacy, but also for our overall information security and America鈥檚 competitiveness in the information economy. That was true then, and it鈥檚 true today. The U.S. government should not compound the growing costs of the NSA programs with a misguided push for the weakening of smartphone security, but if it insists on sparking another round of Crypto Wars, we look forward to the fight.