- Distributed citizen groups and nimble hackers once had the edge. Now
 - governments and corporations are catching up. Who will dominate in the
 - decades ahead?
 - BRUCE SCHNEIER OCT 24 2013, 7:07 AM ET
 - Vivek Prakash/Reuters
 - We’re in the middle of an epic battle for power in cyberspace. On one side
 - are the traditional, organized, institutional powers such as governments and
 - large multinational corporations. On the other are the distributed and
 - nimble: grassroots movements, dissident groups, hackers, and criminals.
 - Initially, the Internet empowered the second side. It gave them a place to
 - coordinate and communicate efficiently, and made them seem unbeatable. But
 - now, the more traditional institutional powers are winning, and winning big.
 - How these two side fare in the long term, and the fate of the rest of us who
 - don’t fall into either group, is an open question—and one vitally important
 - to the future of the Internet.
 - In the Internet’s early days, there was a lot of talk about its “natural
 - laws”—how it would upend traditional power blocks, empower the masses, and
 - spread freedom throughout the world. The international nature of the Internet
 - bypassed circumvented national laws. Anonymity was easy. Censorship was
 - impossible. Police were clueless about cybercrime. And bigger changes seemed
 - inevitable. Digital cash would undermine national sovereignty. Citizen
 - journalism would topple traditional media, corporate PR, and political
 - parties. Easy digital copying would destroy the traditional movie and music
 - industries. Web marketing would allow even the smallest companies to compete
 - against corporate giants. It really would be a new world order.
 - This was a utopian vision, but some of it did come to pass. Internet
 - marketing has transformed commerce. The entertainment industries have been
 - transformed by things like MySpace and YouTube, and are now more open to
 - outsiders. Mass media has changed dramatically, and some of the most
 - influential people in the media have come from the blogging world. There are
 - new ways to organize politically and run elections. Crowdfunding has made
 - tens of thousands of projects possible to finance, and crowdsourcing made
 - more types of projects possible. Facebook and Twitter really did help topple
 - governments.
 - But that is just one side of the Internet’s disruptive character. The
 - Internet has emboldened traditional power as well.
 - On the corporate side, power is consolidating, a result of two current trends
 - in computing. First, the rise of cloud computing means that we no longer have
 - control of our data. Our e-mail, photos, calendars, address books, messages,
 - and documents are on servers belonging to Google, Apple, Microsoft, Facebook,
 - and so on. And second, we are increasingly accessing our data using devices
 - that we have much less control over: iPhones, iPads, Android phones, Kindles,
 - ChromeBooks, and so on. Unlike traditional operating systems, those devices
 - are controlled much more tightly by the vendors, who limit what software can
 - run, what they can do, how they’re updated, and so on. Even Windows 8 and
 - Apple’s Mountain Lion operating system are heading in the direction of more
 - vendor control.
 - I have previously characterized this model of computing as “feudal.” Users
 - pledge their allegiance to more powerful companies who, in turn, promise to
 - protect them from both sysadmin duties and security threats. It’s a metaphor
 - that’s rich in history and in fiction, and a model that’s increasingly
 - permeating computing today.
 - Medieval feudalism was a hierarchical political system, with obligations in
 - both directions. Lords offered protection, and vassals offered service. The
 - lord-peasant relationship was similar, with a much greater power
 - differential. It was a response to a dangerous world.
 - Feudal security consolidates power in the hands of the few. Internet
 - companies, like lords before them, act in their own self-interest. They use
 - their relationship with us to increase their profits, sometimes at our
 - expense. They act arbitrarily. They make mistakes. They’re deliberately—and
 - incidentally—changing social norms. Medieval feudalism gave the lords vast
 - powers over the landless peasants; we’re seeing the same thing on the
 - Internet.
 - It’s not all bad, of course. We, especially those of us who are not
 - technical, like the convenience, redundancy, portability, automation, and
 - shareability of vendor-managed devices. We like cloud backup. We like
 - automatic updates. We like not having to deal with security ourselves. We
 - like that Facebook just works—from any device, anywhere.
 - Government power is also increasing on the Internet. There is more government
 - surveillance than ever before. There is more government censorship than ever
 - before. There is more government propaganda, and an increasing number of
 - governments are controlling what their users can and cannot do on the
 - Internet. Totalitarian governments are embracing a growing “cyber
 - sovereignty” movement to further consolidate their power. And the cyberwar
 - arms race is on, pumping an enormous amount of money into cyber-weapons and
 - consolidated cyber-defenses, further increasing government power.
 - Technology magnifies power in general, but rates of adoption are different.
 - In many cases, the interests of corporate and government powers are aligning.
 - Both corporations and governments benefit from ubiquitous surveillance, and
 - the NSA is using Google, Facebook, Verizon, and others to get access to data
 - it couldn’t otherwise. The entertainment industry is looking to governments
 - to enforce its antiquated business models. Commercial security equipment from
 - companies like BlueCoat and Sophos is being used by oppressive governments to
 - surveil and censor their citizens. The same facial recognition technology
 - that Disney uses in its theme parks can also identify protesters in China and
 - Occupy Wall Street activists in New York. Think of it as a public/private
 - surveillance partnership.
 - What happened? How, in those early Internet years, did we get the future so
 - wrong?
 - The truth is that technology magnifies power in general, but rates of
 - adoption are different. The unorganized, the distributed, the marginal, the
 - dissidents, the powerless, the criminal: They can make use of new
 - technologies very quickly. And when those groups discovered the Internet,
 - suddenly they had power. But later, when the already-powerful big
 - institutions finally figured out how to harness the Internet, they had more
 - power to magnify. That’s the difference: The distributed were more nimble and
 - were faster to make use of their new power, while the institutional were
 - slower but were able to use their power more effectively.
 - So while the Syrian dissidents used Facebook to organize, the Syrian
 - government used Facebook to identify dissidents to arrest.
 - All isn’t lost for distributed power, though. For institutional power, the
 - Internet is a change in degree, but for distributed power it’s a qualitative
 - one. The Internet gives decentralized groups—for the first time—the ability
 - to coordinate. This can have incredible ramifications, as we saw in the
 - SOPA/PIPA debate, Gezi, Brazil, and the rising use of crowdfunding. It can
 - invert power dynamics, even in the presence of surveillance censorship and
 - use control. But aside from political coordination, the Internet allows for
 - social coordination as well to unite, for example, ethnic diasporas, gender
 - minorities, sufferers of rare diseases, and people with obscure interests.
 - This isn’t static: Technological advances continue to provide advantage to
 - the nimble. I discussed this trend in my book Liars and Outliers. If you
 - think of security as an arms race between attackers and defenders, any
 - technological advance gives one side or the other a temporary advantage. But
 - most of the time, a new technology benefits the nimble first. They are not
 - hindered by bureaucracy—and sometimes not by laws or ethics either. They can
 - evolve faster.
 - We saw it with the Internet. As soon as the Internet started being used for
 - commerce, a new breed of cybercriminal emerged, immediately able to take
 - advantage of the new technology. It took police a decade to catch up. And we
 - saw it on social media, as political dissidents made use of its
 - organizational powers before totalitarian regimes did.
 - Which type of power dominates in the coming decades?
 - Right now, it looks like traditional power.
 - This delay is what I call a “security gap.” It’s greater when there’s more
 - technology, and in times of rapid technological change. Basically, if there
 - are more innovations to exploit, there will be more damage resulting from
 - society's inability to keep up with exploiters of all of them. And since our
 - world is one in which there’s more technology than ever before, and a faster
 - rate of technological change than ever before, we should expect to see a
 - greater security gap than ever before. In other words, there will be an
 - increasing time period during which nimble distributed powers can make use of
 - new technologies before slow institutional powers can make better use of
 - those technologies.
 - This is the battle: quick vs. strong. To return to medieval metaphors, you
 - can think of a nimble distributed power—whether marginal, dissident, or
 - criminal—as Robin Hood; and ponderous institutional powers—both government
 - and corporate—as the feudal lords.
 - So who wins? Which type of power dominates in the coming decades?
 - Right now, it looks like traditional power. Ubiquitous surveillance means
 - that it’s easier for the government to identify dissidents than it is for the
 - dissidents to remain anonymous. Data monitoring means easier for the Great
 - Firewall of China to block data than it is for people to circumvent it. The
 - way we all use the Internet makes it much easier for the NSA to spy on
 - everyone than it is for anyone to maintain privacy. And even though it is
 - easy to circumvent digital copy protection, most users still can’t do it.
 - The problem is that leveraging Internet power requires technical expertise.
 - Those with sufficient ability will be able to stay ahead of institutional
 - powers. Whether it’s setting up your own e-mail server, effectively using
 - encryption and anonymity tools, or breaking copy protection, there will
 - always be technologies that can evade institutional powers. This is why
 - cybercrime is still pervasive, even as police savvy increases; why
 - technically capable whistleblowers can do so much damage; and why
 - organizations like Anonymous are still a viable social and political force.
 - Assuming technology continues to advance—and there’s no reason to believe it
 - won’t—there will always be a security gap in which technically advanced Robin
 - Hoods can operate.
 - Most people, though, are stuck in the middle. These are people who have don’t
 - have the technical ability to evade either the large governments and
 - corporations, avoid the criminal and hacker groups who prey on us, or join
 - any resistance or dissident movements. These are the people who accept
 - default configuration options, arbitrary terms of service, NSA-installed back
 - doors, and the occasional complete loss of their data. These are the people
 - who get increasingly isolated as government and corporate power align. In the
 - feudal world, these are the hapless peasants. And it’s even worse when the
 - feudal lords—or any powers—fight each other. As anyone watching Game of
 - Thrones knows, peasants get trampled when powers fight: when Facebook,
 - Google, Apple, and Amazon fight it out in the market; when the U.S., EU,
 - China, and Russia fight it out in geopolitics; or when it’s the U.S. vs. “the
 - terrorists” or China vs. its dissidents.
 - The abuse will only get worse as technology continues to advance. In the
 - battle between institutional power and distributed power, more technology
 - means more damage. We’ve already seen this: Cybercriminals can rob more
 - people more quickly than criminals who have to physically visit everyone they
 - rob. Digital pirates can make more copies of more things much more quickly
 - than their analog forebears. And we’ll see it in the future: 3D printers mean
 - that the computer restriction debate will soon involves guns, not movies. Big
 - data will mean that more companies will be able to identify and track you
 - more easily. It’s the same problem as the “weapons of mass destruction” fear:
 - terrorists with nuclear or biological weapons can do a lot more damage than
 - terrorists with conventional explosives. And by the same token, terrorists
 - with large-scale cyberweapons can potentially do more damage than terrorists
 - with those same bombs.
 - The more destabilizing the technologies, the greater the rhetoric of fear,
 - and the stronger institutional powers will get. It’s a numbers game. Very
 - broadly, because of the way humans behave as a species and as a society,
 - every society is going to have a certain amount of crime. And there’s a
 - particular crime rate society is willing to tolerate. With historically
 - inefficient criminals, we were willing to live with some percentage of
 - criminals in our society. As technology makes each individual criminal more
 - powerful, the percentage we can tolerate decreases. Again, remember the
 - “weapons of mass destruction” debate: As the amount of damage each individual
 - terrorist can do increases, we need to do increasingly more to prevent even a
 - single terrorist from succeeding.
 - The more destabilizing the technologies, the greater the rhetoric of fear,
 - and the stronger institutional powers will get. This means increasingly
 - repressive security measures, even if the security gap means that such
 - measures become increasingly ineffective. And it will squeeze the peasants in
 - the middle even more.
 - Without the protection of his own feudal lord, the peasant was subject to
 - abuse both by criminals and other feudal lords. But both corporations and the
 - government—and often the two in cahoots—are using their power to their own
 - advantage, trampling on our rights in the process. And without the technical
 - savvy to become Robin Hoods ourselves, we have no recourse but to submit to
 - whatever the ruling institutional power wants.
 - So what happens as technology increases? Is a police state the only effective
 - way to control distributed power and keep our society safe? Or do the fringe
 - elements inevitably destroy society as technology increases their power?
 - Probably neither doomsday scenario will come to pass, but figuring out a
 - stable middle ground is hard. These questions are complicated, and dependent
 - on future technological advances that we cannot predict. But they are
 - primarily political questions, and any solutions will be political.
 - In the short term, we need more transparency and oversight. The more we know
 - of what institutional powers are doing, the more we can trust that they are
 - not abusing their authority. We have long known this to be true in
 - government, but we have increasingly ignored it in our fear of terrorism and
 - other modern threats. This is also true for corporate power. Unfortunately,
 - market dynamics will not necessarily force corporations to be transparent; we
 - need laws to do that. The same is true for decentralized power; transparency
 - is how we’ll differentiate political dissidents from criminal organizations.
 - Oversight is also critically important, and is another long-understood
 - mechanism for checking power. This can be a combination of things: courts
 - that act as third-party advocates for the rule of law rather than
 - rubber-stamp organizations, legislatures that understand the technologies and
 - how they affect power balances, and vibrant public-sector press and watchdog
 - groups that analyze and debate the actions of those wielding power.
 - Transparency and oversight give us the confidence to trust institutional
 - powers to fight the bad side of distributed power, while still allowing the
 - good side to flourish. For if we’re going to entrust our security to
 - institutional powers, we need to know they will act in our interests and not
 - abuse that power. Otherwise, democracy fails.
 - In the longer term, we need to work to reduce power differences. The key to
 - all of this is access to data. On the Internet, data is power. To the extent
 - the powerless have access to it, they gain in power. To the extent that the
 - already powerful have access to it, they further consolidate their power. As
 - we look to reducing power imbalances, we have to look at data: data privacy
 - for individuals, mandatory disclosure laws for corporations, and open
 - government laws.
 - Medieval feudalism evolved into a more balanced relationship in which lords
 - had responsibilities as well as rights. Today’s Internet feudalism is both
 - ad-hoc and one-sided. Those in power have a lot of rights, but increasingly
 - few responsibilities or limits. We need to rebalance this relationship. In
 - medieval Europe, the rise of the centralized state and the rule of law
 - provided the stability that feudalism lacked. The Magna Carta first forced
 - responsibilities on governments and put humans on the long road toward
 - government by the people and for the people. In addition to re-reigning in
 - government power, we need similar restrictions on corporate power: a new
 - Magna Carta focused on the institutions that abuse power in the 21st century.
 - Today’s Internet is a fortuitous accident: a combination of an initial lack
 - of commercial interests, government benign neglect, military requirements for
 - survivability and resilience, and computer engineers building open systems
 - that worked simply and easily. Corporations have turned the Internet into an
 - enormous revenue generator, and they’re not going to back down easily.
 - Neither will governments, which have harnessed the Internet for political
 - control.
 - We’re at the beginning of some critical debates about the future of the
 - Internet: the proper role of law enforcement, the character of ubiquitous
 - surveillance, the collection and retention of our entire life’s history, how
 - automatic algorithms should judge us, government control over the Internet,
 - cyberwar rules of engagement, national sovereignty on the Internet,
 - limitations on the power of corporations over our data, the ramifications of
 - information consumerism, and so on.
 - Data is the pollution problem of the information age. All computer processes
 - produce it. It stays around. How we deal with it—how we reuse and recycle it,
 - who has access to it, how we dispose of it, and what laws regulate it—is
 - central to how the information age functions. And I believe that just as we
 - look back at the early decades of the industrial age and wonder how society
 - could ignore pollution in their rush to build an industrial world, our
 - grandchildren will look back at us during these early decades of the
 - information age and judge us on how we dealt with the rebalancing of power
 - resulting from all this new data.
 - This won’t be an easy period for us as we try to work these issues out.
 - Historically, no shift in power has ever been easy. Corporations have turned
 - our personal data into an enormous revenue generator, and they’re not going
 - to back down. Neither will governments, who have harnessed that same data for
 - their own purposes. But we have a duty to tackle this problem.
 - I can’t tell you what the result will be. These are all complicated issues,
 - and require meaningful debate, international cooperation, and innovative
 - solutions. We need to decide on the proper balance between institutional and
 - decentralized power, and how to build tools that amplify what is good in each
 - while suppressing the bad.
 
Stikked
