I was at the IETF meeting in Berlin. Some subset of the security area had a guest presentation on privacy, talking about recent NSA spying. We focused on how to improve the security of the Internet against passive attack and what we as protocol engineers can do to improve privacy in our protocols. As an example, it seems like ephemeral keys generated with some key agreement such as ECDH are more clearly desirable than they've ever been before.
My last night in town, I had a long conversation and then dinner with one of the presenters. I don't think he's a terrorist; I'd be surprised if he were violent. He's certainly done things the US dislikes including working on software to promote Internet anonymity, supporting people using that sort of software for things like Wikileaks, and file suit against the US government when his privacy and liberty was threatened by the US. If there are crimes he's committed, they should be addressed in a court of law, not with murder and covert operations.
We talked a bit about his legal cases and about how he's been harassed by the US government. Mostly, though, we talked about peoples' reactions to recent revelations about spying and US activity. I talked about how at one level I'm not surprised to find that the US spies on people. At another level, though, knowing not just that people can observe the Internet, but that the whole thing is recorded on an ongoing basis changes how I evaluate risks. I knew that they could; now I know that I can count on passive attacks against everything I do. That changes how I feel; that changes how I approach risk. I talked about feelings of fear and powerlessness because I'm not able to meet my need for privacy in my thoughts and personal affects. Then we talked about forms of coersion that are employed to force people to spy on others or to take other actions demanded by the US government.
One of the most frightening things is that I realized for years, I've been under-estimating the impact. When I first read 1984 I thought about it as an artifact of past fears of totalitarianism. When I saw depictions of a government turning to torture in 90's science fiction, I viewed it as brutish and unrealistic. Even if someone were that evil, they'd never resort to such ineffective mechanisms. then we were confronted of pictures of our soldiers sexually assulting and torturing prisoners. That could never happen here in the US. It kept on. But even when I read Little Brother, I thought it was a bit over the top. It isn't though; I have high confidence that all that happens here, in the US, targeted at American citizens. Perhaps not yet at our kids. Sadly the responses proposed in the book would not be nearly as effective in real life. What will be next? What will I consider too unlikely to happen until I am confronted with it in my daily life?
Somewhere in the dinner, I realized that there are actions I can take--actions I must take to be true to myself. I can live with intent, working with my actions and thoughts and words to create the world in which I choose to live. For me that means I will not allow my conduct to be chilled by what I think possible. I will not bow to threats of greater scrutiny or bullying for being the person I choose to be, for thinking what I choose to think and for speaking my mind.
I don't think it's likely that I'll ever interact with the government or be the recipient of their special attention. I don't collect information on people. The software I write is good security software, but by its nature it's easier for the government to approach the operators of my software to collect information than to coerce me to include a back door. However, if I'm wrong on that and I receive a legal instrument, I'll comply. However I'll draw the line. I will not have my behavior coerced by threats to myself or threats to those I care about. I can do more to protect myself and people I care about by being the kind of person who it is pointless to threaten than I can by being pressured and hoping those pressuring me will play nice and not exert ever-increasing pressure. That said, I realize everyone can be broken both psychologically and physically and I'm no exception. Part of me still feels silly thinking this way: the government doesn't pressure law-abiding citizens; I have nothing to fear. Another part of me realizes that I've been so wrong about the scope of all this in the past and that I do know people for whom these decisions are not at all theoretical. I might as well be prepared.
Somewhere in all this, I came to the realization that it's not a huge step from what my dinner companion has already faced to violence and assassination. Later in the conversation he mentioned that he's received advice to become sufficiently famous for his murder to be unprofitable. Based on the source, I think the advice is delivered with reasonable knowledge of the US's practices and have no evidence the source tends to hyperbole. My dinner companion is someone that several people in the privacy community I know and value have spoken of with respect. Someone who works on software, someone works to try and change peoples' minds through persuasive argument and facts. Someone who for a few accidents and a slightly more conservative political outlook I could have been. having realized all this, I can no longer say I don't know; I'm unaware of what my government is doing. As an American, I must take on my share of responsibility for what's going on here.
to be clear, I am not radical; I believe in the rule of law and reasoned discourse. I'm not even proposing that I significantly change how I live my life. I simply believe I should be mindful of what is going on with privacy, and to help others form their opinions. Someday perhaps I'll have a pro-privacy anti-torture candidate to vote for. Wouldn't that be a desirable change!
I wrote this on the plane back to the US after IETF. It's several days later and I'm pondering posting it. My gut clenches; I'm afraid when I think about posting because I don't have confidence that I can speak my mind without fear of negative consequences. I've decided that I will post this. As someone who has chosen to live a life of intent and to promote love and connection, I want to act as if I live in the world in which I would choose to live. In that world I should say this.