PISA (police, intelligence and security agencies) want to know everything about your data and you: Bernard Keane explains why that’s not such a reasonable idea.
Clarifier: data retention – what it is and why it’s bad
By BERNARD KEANE Crikey politics editor
With Australian Security Intelligence Organisation chief David Irvine recently insisting to a Senate committee that data retention – under “active consideration” by the government – was crucial to intelligence-gathering and Australians had nothing to fear from it, it’s time for a clarifier on exactly what data retention is and the concerns it raises.
What is data retention?
The compulsory retention of information about a citizen’s telecommunications and online usage, either by telcos and internet service providers themselves, or by a government agency.
What sort of data?
Depends. The European Union scheme (now ruled illegal) was limited to telecommunications metadata – whom you called and when, duration of call, location, and the account linked to a particular IP address. However, some individual countries (like Denmark) went further and included web browsing history. Most Australian agencies officially only want metadata, not content data (like browsing history and email contents), but some agencies and police forces want the lot. Some things, like email subject lines, could arguably be either metadata or content data.
What would it cost?
In evidence to the Joint Committee on Intelligence and Security in 2012, iiNet said it might cost them $5 a month for every customer to store data. That, in effect, is a $60 a year surveillance tax on every household.
What happens now?
Traditionally, telcos have retained phone records because that was how they billed you. But there is decreasing need for specific call-based billing as consumers move to data-based plans. Moreover, companies have no need for metadata beyond the billing cycle, and given there’s a cost to storing such data, they are keeping less of it for the sort of periods agencies prefer – usually two years. Law enforcement and intelligence agencies call this “going dark” – losing access to phone information they’ve had for nearly a century.
So what’s the problem – isn’t this just maintaining the status quo?
No. Let’s just focus on phone data. Your mobile phone data includes your location as your phone interacts with nearby phone towers, so in effect it can be used as a tracking device. But more importantly, forget that “it’s just metadata” (or “just billing data” as the Prime Minister, Mr Abbott, said). A single phone call time and duration won’t tell anyone much about you. But in aggregate, metadata will reveal far more about you than content data. As Edward Snowden says: “You can’t trust what you’re hearing, but you can trust the metadata.”
With automated data-sifting software, agencies can accumulate a record of everyone you have called, everyone they have called, how long you spoke for, the order of the calls, and where you were when you made the call, to build a profile that says far more about you than any solitary overheard phone call or email. It can reveal not just straightforward details such as your friends and acquaintances, but also if you have medical issues, your financial interests, what you’re buying, if you’re having an affair or ended a relationship. Combined with other publicly available information, having a full set of metadata on an individual will tell you far more than much of their content data ever will.
The General Counsel for the United States National Security Agency has publicly stated, “metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content”. According to the former head of the NSA, Michael Hayden, the US kills people based on metadata (under their drone program).
OK, but we’ve already given away our privacy to Facebook etc, haven’t we? Why shouldn’t agencies that want to protect us get the same data?
This is an argument routinely used by data retention advocates, and by Irvine himself in his recent statements. But going on Facebook isn’t compulsory. Citizens choose to use social media or other online platforms and voluntarily engage in the swap of privacy for services that so many applications are built on. Maybe they don’t understand the full nature of what they’re losing in that transaction, but it’s still voluntary. There is nothing voluntary about data retention – not unless you want to withdraw from the 21st century and not use telecommunications and online services.
But agencies say they need it to help prevent and solve crimes.
Let’s look at what happened in Europe. A German parliament study concluded data retention in Germany had led to an increase in the crime clearance rate of 0.006%. (The German scheme was later ruled unconstitutional.) Danish police, who have a much wider metadata and content data retention scheme, said the sheer amount of information was too unwieldy to use.
But we can trust our agencies to do the right thing.
Australia’s agencies generally have a better record of behaviour than foreign agencies. For example, repeated abuses such as stalking women, sharing intimate photos and listening in to intimate conversations, have been revealed to have occurred in the NSA in the USA; the CIA recently spied on the Senate Intelligence Committee while it was preparing a report exposing the agency’s use of torture; MI6 in the UK abducted and rendered Libyan dissidents to the Gaddafi regime for torture in exchange for help in the War on Terror.
However, ASIO, the Australian Federal Police and the Australian Secret Intelligence Service are by no means perfect and serious questions remain, for example, about both ASIS’s bugging of the East Timorese cabinet in 2004 and ASIO’s efforts to intimidate and gag the whistleblower who revealed it late in 2013.
The problem is that unlike normal government bureaucracies, intelligence agencies have minimal public oversight or accountability, and can use national security as a justification to resist media scrutiny. The lack of oversight means incompetence, corruption, mission creep and criminal activity are far less likely to come to light than in normal government agencies. Public transparency is one of the key motivations for public servants to behave appropriately, and it doesn’t exist for agencies engaged in surveillance.
But if you’re not doing anything wrong, you have nothing to hide.
Wear clothes in warm weather and have blinds in your windows? So what are you hiding?
Are you happy for everyone to know where you are all the time, who your friends are, whom you’re having a relationship with, everyone you call, whether you have a medical or financial problem? It is not up to privacy advocates to “prove” the right to or importance of privacy. All governments acknowledge it is a fundamental right.
If you support breaching that right, it is up to you to make the case, not demand privacy advocates defend it.
But our intelligence and law enforcement agencies haven’t got the time or money to go on fishing expeditions.
People as diverse as whistleblowers, journalists, politicians, non-government groups and activists are subject to surveillance by law enforcement and intelligence agencies, despite not having “done anything” other than reveal wrongdoing by governments and companies and protest against it. Data retention thus indirectly threatens core processes of democracy like whistleblowing and political scrutiny.
And once information is collected, agencies will press for its permanent retention. Some already argue that information should be retained forever. That means all future governments will have access to it.
And law enforcement and intelligence agencies aren’t the only groups who have access to metadata. In Australia, bodies as diverse as local councils, the RSPCA and health bodies can obtain telephone metadata on citizens without a warrant.
But this is about stopping terrorism – the ends justify the means.
Terrorism is a wildly over-hyped threat. More Americans die from malnutrition, falls, swimming accidents and work accidents each year than the entire death toll from 9/11.
About three times more Australians have died falling out of bed since 2001 than have died at the hands of terrorists.
As a threat to the health and lives of western citizens, terrorism is negligible compared to deaths caused by poor infrastructure, bad health policies, unsafe workplaces or poverty. Doing things in the name of stopping terrorism relies on our emotional fear of attacks, rather than making the case for taking away our rights.
Bernard Keane is chief political correspondent at Parliament House Canberra for the online news journal Crikey This article appeared first in Crikey, and is reproduced with the permission of the author.
See also: http://www.theguardian.com/world/2014/jul/26/privacy-fears-australian-surveillance-laws-digital-era?
The Australian government is doing exactly what all governments do when trying to do something unpopular – it is deliberately muddying and confusing the issue, so that rather than allow public reaction to focus, logically, on key issues like whether the government actually has a mandate, whether the measures are constitutional, whether the measures are actually statistically justified, and so on, all sorts of feeble arguments and reassurances are put forward that lead us and the media down blind alleys. This gives it the time it needs to push through the changes, and by the time we realise what it has done, it is too late.
The CLA and other freedom-privacy groups need to get together very quickly and launch a high court challenge, on the grounds that this government has no mandate, and the proposed changes are unconstitutional. These are direct legal actions that can be taken right away, and if nothing else will slow things down and up the ante.
Abbott, Brandis and Turnbull need to understand that the public does not accept that there is legitimate justification for these deeply unpopular and freedom-limiting measures, and that they threaten the very fabric of our democracy (so-called) and society. They have to stand up to the pressures coming from the