RConversation

The Great Firewall of America

Last month the U.S. Trade Representative Ron Kirk sent a letter to the Chinese government requesting information about its censorship practices. The middle kingdom’s response: a polite middle finger. Foreign ministry spokeswoman Jiang Yu declared that Chinese censorship follows “international practice.”

Her response is specious given that China operates the world’s most elaborate and opaque system of Internet censorship, as I describe in Chapter 3 of my forthcoming book. Yet Congress has been hard at work to bolster its legitimacy, however inadvertently. The reality is that the PROTECT IP Act now in the Senate, and a new House version called Stop Online Piracy Act (SOPA), would bring key features of China’s Great Firewall to America. Read my opinion piece in the New York Times for more details on how these bills would implement technical and legal solutions that would have the unfortunate result of making the Internet everywhere more like the Chinese Internet.

The House Judiciary Committee will hold a hearing on SOPA at 10am on Wednesday morning (a few hours from now). It will be webcast live on the committee website. The video should also be archived there after the event.

Opposition to SOPA is widespread, bipartisan, and international. The Center for Democracy and Technology is collecting links to blog posts, articles, as well as letters of opposition from human rights groups, Internet engineers, law professors, Internet companies, public interest advocates, consumer rights groups, among others. Allan Friedman at the Brookings Institution has an excellent paper explaining how SOPA and PROTECT IP will make the Internet less secure, sabotaging engineers' long-running efforts to increase the level of security in the global domain name system.

The New America Foundation (where I am a senior fellow) has signed an open letter to the House Judiciary Committee, along with a list of human rights, civil liberties and public interest groups. It argues:

We do not dispute that there are hubs of online infringement. But the definitions of the sites that would be subject to SOPA’s remedies are so broad that they would encompass far more than those bad actors profiting from infringement. By including all sites that may – even inadvertently – “facilitate” infringement, the bill raises serious concerns about overbreadth. Under section 102 of the bill, a nondomestic startup video-sharing site with thousands of innocent users sharing their own noninfringing videos, but a small minority who use the site to criminally infringe, could find its domain blocked by U.S. DNS operators. Countless non-infringing videos from the likes of aspiring artists, proud parents, citizen journalists, and human rights activists would be unduly swept up by such an action. Furthermore, overreach resulting from bill is more likely to impact the operators of smaller websites and services that do not have the legal capacity to fight false claims of infringement.

In Chapter 7 I describe my experience testifying at a March 2010 House Foreign Relations Committee hearing chaired by Rep. Howard Berman (D-CA). Berman happens to be one of SOPA’s key sponsors. While the hearing’s stated purpose was to discuss Google’s decision to halt censorship in China and how the United States can support global Internet freedom, committee members devoted considerable time to chastising a Google executive for failing to sufficiently police uploads to YouTube for infringing content. By their standards, YouTube and other similar user-driven sites clearly fall short of SOPA’s requirements. As I point out in the book, The cognitive dissonance on display at that hearing highlighted an inconvenient reality: politicians throughout the democratic world are pushing for stronger censorship and surveillance by Internet companies to stop the theft of intellectual property. They are doing so in response to aggressive lobbying by powerful corporate constituents without adequate consideration of the consequences for civil liberties, and for democracy more broadly.

The public interest letter details some of those consequences:

Relying on an even broader definition of “site dedicated to theft of US property,” section 103 of SOPA creates a private right of action of breathtaking scope. Any rightsholder could cut off the financial lifeblood of services such as search engines, user-generated content platforms, social media, and cloud-based storage unless those services actively monitor and police user activity to the rightsholder’s satisfaction.

In my op-ed I conclude:

The potential for abuse of power through digital networks — upon which we as citizens now depend for nearly everything, including our politics — is one of the most insidious threats to democracy in the Internet age. We live in a time of tremendous political polarization. Public trust in both government and corporations is low, and deservedly so. This is no time for politicians and industry lobbyists in Washington to be devising new Internet censorship mechanisms, adding new opportunities for abuse of corporate and government power over online speech. While American intellectual property deserves protection, that protection must be won and defended in a manner that does not stifle innovation, erode due process under the law, and weaken the protection of political and civil rights on the Internet.

I am not against copyright or intellectual property protection - I'm about to publish a copyrighted book. I hope that people will buy it. Its quality owes a great deal to the editors and other professionals whose job it was to help me shape and refine my argument, and to improve my prose. But I don't believe that the defense of my copyright should come at the expense of civil liberties. It is a moral imperative for democracies to find new and innovative ways to protect copyright in the Internet age without stifling the ability of citizens around the world to exercise their right to freedom of speech and assembly on the Internet.

Surveillance and Censorship in India

Chapter 9 of my forthcoming book opens with quotes from an infamous April 2011 BBC interview with RIM's co-CEO Mike Lazaridis, in which he ends the interview abruptly after the BBC's Rory Cellan-Jones presses him to answer questions about RIM's “arguments with the Indian government and various other governments in the Middle East" over those governments' desire to gain access to Blackberry messages and e-mails. In August 2010, the United Arab Emirates and Saudi Arabia threatened to ban BlackBerry services until RIM agreed to allow a satisfactory level of government access to communications sent through RIM devices within the country. India soon followed suit with its own demands for access. Late last month, the Wall Street Journal reported that RIM has set up a facility in Mumbai "to help the Indian government carry out lawful surveillance of its BlackBerry services." The report further quotes a RIM statement which says that "we believe the government of India is now applying its security policy in a consistent manner to all handset makers and service providers in India, which means that RIM should not be singled out any more than any other provider."

There is a larger problem, however. When it comes to censorship in India, the hardworking folks at the Centre for Internet and Society in Bangalore recently concluded that the Indian government is violating not only Indian laws but also the Indian Constitution in the way it handles censorship demands to companies. What are the chances, then, that the Indian government is not violating its citizens' rights in similar ways when it comes to demands for user information to RIM and other mobile service providers? CIS's Pranesh Prakash compared Google's most recent Transparency Report, which reveals the number of content removal and user data requests made between January and June 2011 by the Indian government, and compared that information with an official response to CIS queries on content removal and blocking by the Ministry of Communications & Information Department of Information Technology. Prakash's conclusion:

...it would seem that law enforcement agencies are operating outside the bounds set up under the Indian Penal Code, the Code of Criminal Procedure, as also the Information Technology Act, when they send requests for removal of content to companies like Google. While a company might comply with it because it appears to them to violate their own terms of service (which generally include a wide clause about content being in accordance with all local laws), community guidelines, etc., it would appear that it is not required under the law to do so if the order itself is not legal. However, anecdotal evidence has it that most companies comply with such 'requests' even when they are not under any legal obligation to do so. This way the intention of Parliament in enacting s.69A of the IT Act—to regulate government censorship of the Internet and bring it within the bounds laid down in the Constitution—is defeated.

As I reported in the book, in April 2011, the Ministry of Communications and Information Technology issued new rules under which Internet companies are expected to remove within thirty-six hours any content regulators designated as “grossly harmful,” “harassing,” or “ethnically objectionable.” Indian free speech advocates have vowed to challenge the rules’ constitutionality. Google publicly protested the rules in a statement warning that “if Internet platforms are held liable for third party content, it would lead to self-censorship and reduce the free flow of information.” As Prakash put it then, “The Indian Constitution limits how much the government can regulate citizens’ fundamental right to freedom of speech and expression. Any measure afoul of the constitution is invalid.”

More details about surveillance and censorship in India can be found in the India-focused chapter of a new book, Access Contested: Security, Identity, and Resistance in Asian Cyberspace, produced by the Open Net Initiative, coming out in December from MIT Press. The India chapter is not currently available online but I discuss India's issues in a related chapter titled "Corporate Accountability in Networked Asia" (The Citizenlab, one of ONI's partners, has made that chapter, along with all of Part I of the book, available online here.) I wrote it late last year and it went into production before the new April 2011 rules came out (academic presses take a long time), but I think the larger point remains very relevant. I compare the role played by companies in facilitating government censorship and surveillance in China to the role of companies in two Asian democracies: South Korea and India. I argue that "efforts to hold companies accountable for free speech and privacy in authoritarian countries like China will face an uphill battle unless companies in Asia’s democracies are pushed by domestic civil society actors to defend and protect user rights in a more robust manner than is currently the case."

The first step is for companies to follow Google's lead in being more transparent about how they respond to government demands. Then civil society organizations in democracies, like India's CIS, will be equipped and empowered with the information they need to push their governments to stop using companies as an opaque and unaccountable extension of state power. RIM can and must recognize that by being evasive with the public it is standing firmly on the wrong side of history.

Here is the video of Lazaridis' interview:

Surveillance technologies and "apolitical" corporations

There has been a steady stream of headlines recently about the use of Western surveillance technology by repressive regimes. After the hacktivist group Telecomix exposed the use by Syria of filtering and surveillance devices manufactured by the California-based company Blue Coat last month, the company has finally acknowledged that at least thirteen of its devices are being used by Syria.

Today, The Guardian has an amazing article titled "Governments turn to hacking techniques for surveillance of citizens." It describes the annual Intelligence Support Systems (ISS) World Americas  conference, at which surveillance firms share tips on the latest "lawful interception" techniques used to spy on citizens. The companies showed little concern for how this technology can be and is being abused around the world. An excerpt:

Jerry Lucas, the president of the company behind ISS World, TeleStrategies, does not deny surveillance developers that attend his conference supply to repressive regimes. In fact, he is adamant that the manufacturers of surveillance technology, such as Gamma International, SS8 and Hacking Team, should be allowed to sell to whoever they want.

"The surveillance that we display in our conferences, and discuss how to use, is available to any country in the world," he said. "Do some countries use this technology to suppress political statements? Yes, I would say that's probably fair to say. But who are the vendors to say that the technology is not being used for good as well as for what you would consider not so good?"

Would he be comfortable in the knowledge that regimes in Zimbabwe and North Korea were purchasing this technology from western companies? "That's just not my job to determine who's a bad country and who's a good country. That's not our business, we're not politicians … we're a for-profit company. Our business is bringing governments together who want to buy this technology."

The EFF has proposed a two-part "know your customer" framework for surveillance equipment:

1. Companies selling surveillance technologies to governments need to affirmatively investigate and "know your customer" before and during a sale.  We suggest something for human rights similar to what most of these companies are already required to do under the Foreign Corrupt Practices Act and the export regulations for other purposes, and
2. Companies need to refrain from participating in transactions where their "know your customer" investigations reveal either objective evidence or credible concerns that the technologies provided by the company will be used to facilitate human rights violations.

Click here for further details. One of the broader problems, of course, is that the market for ever-more sophisticated surveillance equipment feeds unaccountable abuses of power not only by authoritarian regimes but also by democratic governments.

As long as engineers and companies claim to have no responsibility for the political context in which their inventions and products are used, the problem is going to grow worse. This problem has been exacerbated in the Internet age, but it has been around a lot longer. In a talk I gave last week at the Silicon Valley Human Rights Conference, I played a video clip from Tom Lehrer's early 1960's song about ex-Nazi rocket scientist Wernher von Braun:

The lyrics :

Gather round while I sing you of Wernher von Braun,
A man whose allegiance
Is ruled by expedience.
Call him a Nazi, he won't even frown.
"Ha, Nazi Schmazi," says Wernher von Braun.

Don't say that he's hypocritical,
Say rather that he's apolitical.

"Once the rockets are up, who cares where they come down?
That's not my department," says Wernher von Braun.

Some have harsh words for this man of renown,
But some think our attitude
Should be one of gratitude,
Like the widows and cripples in old London town
Who owe their large pensions to Wernher von Braun.

You too may be a big hero,
Once you've learned to count backwards to zero.
"In German oder English I know how to count down,
Und I'm learning Chinese," says Wernher von Braun