From Unique Earthworm, 11 Years ago, written in Plain Text.
Embed
  1. Distributed citizen groups and nimble hackers once had the edge. Now
  2. governments and corporations are catching up. Who will dominate in the
  3. decades ahead?
  4.  
  5. BRUCE SCHNEIER OCT 24 2013, 7:07 AM ET
  6.  
  7. Vivek Prakash/Reuters
  8.  
  9. We’re in the middle of an epic battle for power in cyberspace. On one side
  10. are the traditional, organized, institutional powers such as governments and
  11. large multinational corporations. On the other are the distributed and
  12. nimble: grassroots movements, dissident groups, hackers, and criminals.
  13. Initially, the Internet empowered the second side. It gave them a place to
  14. coordinate and communicate efficiently, and made them seem unbeatable. But
  15. now, the more traditional institutional powers are winning, and winning big.
  16. How these two side fare in the long term, and the fate of the rest of us who
  17. don’t fall into either group, is an open question—and one vitally important
  18. to the future of the Internet.
  19.  
  20. In the Internet’s early days, there was a lot of talk about its “natural
  21. laws”—how it would upend traditional power blocks, empower the masses, and
  22. spread freedom throughout the world. The international nature of the Internet
  23. bypassed circumvented national laws. Anonymity was easy. Censorship was
  24. impossible. Police were clueless about cybercrime. And bigger changes seemed
  25. inevitable. Digital cash would undermine national sovereignty. Citizen
  26. journalism would topple traditional media, corporate PR, and political
  27. parties. Easy digital copying would destroy the traditional movie and music
  28. industries. Web marketing would allow even the smallest companies to compete
  29. against corporate giants. It really would be a new world order.
  30.  
  31. This was a utopian vision, but some of it did come to pass. Internet
  32. marketing has transformed commerce. The entertainment industries have been
  33. transformed by things like MySpace and YouTube, and are now more open to
  34. outsiders. Mass media has changed dramatically, and some of the most
  35. influential people in the media have come from the blogging world. There are
  36. new ways to organize politically and run elections. Crowdfunding has made
  37. tens of thousands of projects possible to finance, and crowdsourcing made
  38. more types of projects possible. Facebook and Twitter really did help topple
  39. governments.
  40.  
  41. But that is just one side of the Internet’s disruptive character. The
  42. Internet has emboldened traditional power as well.
  43.  
  44. On the corporate side, power is consolidating, a result of two current trends
  45. in computing. First, the rise of cloud computing means that we no longer have
  46. control of our data. Our e-mail, photos, calendars, address books, messages,
  47. and documents are on servers belonging to Google, Apple, Microsoft, Facebook,
  48. and so on. And second, we are increasingly accessing our data using devices
  49. that we have much less control over: iPhones, iPads, Android phones, Kindles,
  50. ChromeBooks, and so on. Unlike traditional operating systems, those devices
  51. are controlled much more tightly by the vendors, who limit what software can
  52. run, what they can do, how they’re updated, and so on. Even Windows 8 and
  53. Apple’s Mountain Lion operating system are heading in the direction of more
  54. vendor control.
  55.  
  56. I have previously characterized this model of computing as “feudal.” Users
  57. pledge their allegiance to more powerful companies who, in turn, promise to
  58. protect them from both sysadmin duties and security threats. It’s a metaphor
  59. that’s rich in history and in fiction, and a model that’s increasingly
  60. permeating computing today.
  61.  
  62. Medieval feudalism was a hierarchical political system, with obligations in
  63. both directions. Lords offered protection, and vassals offered service. The
  64. lord-peasant relationship was similar, with a much greater power
  65. differential. It was a response to a dangerous world.
  66.  
  67. Feudal security consolidates power in the hands of the few. Internet
  68. companies, like lords before them, act in their own self-interest. They use
  69. their relationship with us to increase their profits, sometimes at our
  70. expense. They act arbitrarily. They make mistakes. They’re deliberately—and
  71. incidentally—changing social norms. Medieval feudalism gave the lords vast
  72. powers over the landless peasants; we’re seeing the same thing on the
  73. Internet.
  74.  
  75. It’s not all bad, of course. We, especially those of us who are not
  76. technical, like the convenience, redundancy, portability, automation, and
  77. shareability of vendor-managed devices. We like cloud backup. We like
  78. automatic updates. We like not having to deal with security ourselves. We
  79. like that Facebook just works—from any device, anywhere.
  80.  
  81. Government power is also increasing on the Internet. There is more government
  82. surveillance than ever before. There is more government censorship than ever
  83. before. There is more government propaganda, and an increasing number of
  84. governments are controlling what their users can and cannot do on the
  85. Internet. Totalitarian governments are embracing a growing “cyber
  86. sovereignty” movement to further consolidate their power. And the cyberwar
  87. arms race is on, pumping an enormous amount of money into cyber-weapons and
  88. consolidated cyber-defenses, further increasing government power.
  89.  
  90. Technology magnifies power in general, but rates of adoption are different.
  91.  
  92. In many cases, the interests of corporate and government powers are aligning.
  93. Both corporations and governments benefit from ubiquitous surveillance, and
  94. the NSA is using Google, Facebook, Verizon, and others to get access to data
  95. it couldn’t otherwise. The entertainment industry is looking to governments
  96. to enforce its antiquated business models. Commercial security equipment from
  97. companies like BlueCoat and Sophos is being used by oppressive governments to
  98. surveil and censor their citizens. The same facial recognition technology
  99. that Disney uses in its theme parks can also identify protesters in China and
  100. Occupy Wall Street activists in New York. Think of it as a public/private
  101. surveillance partnership.
  102.  
  103. What happened? How, in those early Internet years, did we get the future so
  104. wrong?
  105.  
  106. The truth is that technology magnifies power in general, but rates of
  107. adoption are different. The unorganized, the distributed, the marginal, the
  108. dissidents, the powerless, the criminal: They can make use of new
  109. technologies very quickly. And when those groups discovered the Internet,
  110. suddenly they had power. But later, when the already-powerful big
  111. institutions finally figured out how to harness the Internet, they had more
  112. power to magnify. That’s the difference: The distributed were more nimble and
  113. were faster to make use of their new power, while the institutional were
  114. slower but were able to use their power more effectively.
  115.  
  116. So while the Syrian dissidents used Facebook to organize, the Syrian
  117. government used Facebook to identify dissidents to arrest.
  118.  
  119. All isn’t lost for distributed power, though. For institutional power, the
  120. Internet is a change in degree, but for distributed power it’s a qualitative
  121. one. The Internet gives decentralized groups—for the first time—the ability
  122. to coordinate. This can have incredible ramifications, as we saw in the
  123. SOPA/PIPA debate, Gezi, Brazil, and the rising use of crowdfunding. It can
  124. invert power dynamics, even in the presence of surveillance censorship and
  125. use control. But aside from political coordination, the Internet allows for
  126. social coordination as well to unite, for example, ethnic diasporas, gender
  127. minorities, sufferers of rare diseases, and people with obscure interests.
  128.  
  129. This isn’t static: Technological advances continue to provide advantage to
  130. the nimble. I discussed this trend in my book Liars and Outliers. If you
  131. think of security as an arms race between attackers and defenders, any
  132. technological advance gives one side or the other a temporary advantage. But
  133. most of the time, a new technology benefits the nimble first. They are not
  134. hindered by bureaucracy—and sometimes not by laws or ethics either. They can
  135. evolve faster.
  136.  
  137. We saw it with the Internet. As soon as the Internet started being used for
  138. commerce, a new breed of cybercriminal emerged, immediately able to take
  139. advantage of the new technology. It took police a decade to catch up. And we
  140. saw it on social media, as political dissidents made use of its
  141. organizational powers before totalitarian regimes did.
  142.  
  143. Which type of power dominates in the coming decades?
  144.  
  145. Right now, it looks like traditional power.
  146.  
  147. This delay is what I call a “security gap.” It’s greater when there’s more
  148. technology, and in times of rapid technological change. Basically, if there
  149. are more innovations to exploit, there will be more damage resulting from
  150. society's inability to keep up with exploiters of all of them. And since our
  151. world is one in which there’s more technology than ever before, and a faster
  152. rate of technological change than ever before, we should expect to see a
  153. greater security gap than ever before. In other words, there will be an
  154. increasing time period during which nimble distributed powers can make use of
  155. new technologies before slow institutional powers can make better use of
  156. those technologies.
  157.  
  158. This is the battle: quick vs. strong. To return to medieval metaphors, you
  159. can think of a nimble distributed power—whether marginal, dissident, or
  160. criminal—as Robin Hood; and ponderous institutional powers—both government
  161. and corporate—as the feudal lords.
  162.  
  163. So who wins? Which type of power dominates in the coming decades?
  164.  
  165. Right now, it looks like traditional power. Ubiquitous surveillance means
  166. that it’s easier for the government to identify dissidents than it is for the
  167. dissidents to remain anonymous. Data monitoring means easier for the Great
  168. Firewall of China to block data than it is for people to circumvent it. The
  169. way we all use the Internet makes it much easier for the NSA to spy on
  170. everyone than it is for anyone to maintain privacy. And even though it is
  171. easy to circumvent digital copy protection, most users still can’t do it.
  172.  
  173. The problem is that leveraging Internet power requires technical expertise.
  174. Those with sufficient ability will be able to stay ahead of institutional
  175. powers. Whether it’s setting up your own e-mail server, effectively using
  176. encryption and anonymity tools, or breaking copy protection, there will
  177. always be technologies that can evade institutional powers. This is why
  178. cybercrime is still pervasive, even as police savvy increases; why
  179. technically capable whistleblowers can do so much damage; and why
  180. organizations like Anonymous are still a viable social and political force.
  181. Assuming technology continues to advance—and there’s no reason to believe it
  182. won’t—there will always be a security gap in which technically advanced Robin
  183. Hoods can operate.
  184.  
  185. Most people, though, are stuck in the middle. These are people who have don’t
  186. have the technical ability to evade either the large governments and
  187. corporations, avoid the criminal and hacker groups who prey on us, or join
  188. any resistance or dissident movements. These are the people who accept
  189. default configuration options, arbitrary terms of service, NSA-installed back
  190. doors, and the occasional complete loss of their data. These are the people
  191. who get increasingly isolated as government and corporate power align. In the
  192. feudal world, these are the hapless peasants. And it’s even worse when the
  193. feudal lords—or any powers—fight each other. As anyone watching Game of
  194. Thrones knows, peasants get trampled when powers fight: when Facebook,
  195. Google, Apple, and Amazon fight it out in the market; when the U.S., EU,
  196. China, and Russia fight it out in geopolitics; or when it’s the U.S. vs. “the
  197. terrorists” or China vs. its dissidents.
  198.  
  199. The abuse will only get worse as technology continues to advance. In the
  200. battle between institutional power and distributed power, more technology
  201. means more damage. We’ve already seen this: Cybercriminals can rob more
  202. people more quickly than criminals who have to physically visit everyone they
  203. rob. Digital pirates can make more copies of more things much more quickly
  204. than their analog forebears. And we’ll see it in the future: 3D printers mean
  205. that the computer restriction debate will soon involves guns, not movies. Big
  206. data will mean that more companies will be able to identify and track you
  207. more easily. It’s the same problem as the “weapons of mass destruction” fear:
  208. terrorists with nuclear or biological weapons can do a lot more damage than
  209. terrorists with conventional explosives. And by the same token, terrorists
  210. with large-scale cyberweapons can potentially do more damage than terrorists
  211. with those same bombs.
  212.  
  213. The more destabilizing the technologies, the greater the rhetoric of fear,
  214. and the stronger institutional powers will get.  It’s a numbers game. Very
  215. broadly, because of the way humans behave as a species and as a society,
  216. every society is going to have a certain amount of crime. And there’s a
  217. particular crime rate society is willing to tolerate. With historically
  218. inefficient criminals, we were willing to live with some percentage of
  219. criminals in our society. As technology makes each individual criminal more
  220. powerful, the percentage we can tolerate decreases. Again, remember the
  221. “weapons of mass destruction” debate: As the amount of damage each individual
  222. terrorist can do increases, we need to do increasingly more to prevent even a
  223. single terrorist from succeeding.
  224.  
  225. The more destabilizing the technologies, the greater the rhetoric of fear,
  226. and the stronger institutional powers will get. This means increasingly
  227. repressive security measures, even if the security gap means that such
  228. measures become increasingly ineffective. And it will squeeze the peasants in
  229. the middle even more.
  230.  
  231. Without the protection of his own feudal lord, the peasant was subject to
  232. abuse both by criminals and other feudal lords. But both corporations and the
  233. government—and often the two in cahoots—are using their power to their own
  234. advantage, trampling on our rights in the process. And without the technical
  235. savvy to become Robin Hoods ourselves, we have no recourse but to submit to
  236. whatever the ruling institutional power wants.
  237.  
  238. So what happens as technology increases? Is a police state the only effective
  239. way to control distributed power and keep our society safe? Or do the fringe
  240. elements inevitably destroy society as technology increases their power?
  241. Probably neither doomsday scenario will come to pass, but figuring out a
  242. stable middle ground is hard. These questions are complicated, and dependent
  243. on future technological advances that we cannot predict. But they are
  244. primarily political questions, and any solutions will be political.
  245.  
  246. In the short term, we need more transparency and oversight. The more we know
  247. of what institutional powers are doing, the more we can trust that they are
  248. not abusing their authority. We have long known this to be true in
  249. government, but we have increasingly ignored it in our fear of terrorism and
  250. other modern threats. This is also true for corporate power. Unfortunately,
  251. market dynamics will not necessarily force corporations to be transparent; we
  252. need laws to do that. The same is true for decentralized power; transparency
  253. is how we’ll differentiate political dissidents from criminal organizations.
  254.  
  255. Oversight is also critically important, and is another long-understood
  256. mechanism for checking power. This can be a combination of things: courts
  257. that act as third-party advocates for the rule of law rather than
  258. rubber-stamp organizations, legislatures that understand the technologies and
  259. how they affect power balances, and vibrant public-sector press and watchdog
  260. groups that analyze and debate the actions of those wielding power.
  261.  
  262. Transparency and oversight give us the confidence to trust institutional
  263. powers to fight the bad side of distributed power, while still allowing the
  264. good side to flourish. For if we’re going to entrust our security to
  265. institutional powers, we need to know they will act in our interests and not
  266. abuse that power. Otherwise, democracy fails.
  267.  
  268. In the longer term, we need to work to reduce power differences. The key to
  269. all of this is access to data. On the Internet, data is power. To the extent
  270. the powerless have access to it, they gain in power. To the extent that the
  271. already powerful have access to it, they further consolidate their power. As
  272. we look to reducing power imbalances, we have to look at data: data privacy
  273. for individuals, mandatory disclosure laws for corporations, and open
  274. government laws.
  275.  
  276. Medieval feudalism evolved into a more balanced relationship in which lords
  277. had responsibilities as well as rights. Today’s Internet feudalism is both
  278. ad-hoc and one-sided. Those in power have a lot of rights, but increasingly
  279. few responsibilities or limits. We need to rebalance this relationship. In
  280. medieval Europe, the rise of the centralized state and the rule of law
  281. provided the stability that feudalism lacked. The Magna Carta first forced
  282. responsibilities on governments and put humans on the long road toward
  283. government by the people and for the people. In addition to re-reigning in
  284. government power, we need similar restrictions on corporate power: a new
  285. Magna Carta focused on the institutions that abuse power in the 21st century.
  286.  
  287. Today’s Internet is a fortuitous accident: a combination of an initial lack
  288. of commercial interests, government benign neglect, military requirements for
  289. survivability and resilience, and computer engineers building open systems
  290. that worked simply and easily. Corporations have turned the Internet into an
  291. enormous revenue generator, and they’re not going to back down easily.
  292. Neither will governments, which have harnessed the Internet for political
  293. control.
  294.  
  295. We’re at the beginning of some critical debates about the future of the
  296. Internet: the proper role of law enforcement, the character of ubiquitous
  297. surveillance, the collection and retention of our entire life’s history, how
  298. automatic algorithms should judge us, government control over the Internet,
  299. cyberwar rules of engagement, national sovereignty on the Internet,
  300. limitations on the power of corporations over our data, the ramifications of
  301. information consumerism, and so on.
  302.  
  303. Data is the pollution problem of the information age. All computer processes
  304. produce it. It stays around. How we deal with it—how we reuse and recycle it,
  305. who has access to it, how we dispose of it, and what laws regulate it—is
  306. central to how the information age functions. And I believe that just as we
  307. look back at the early decades of the industrial age and wonder how society
  308. could ignore pollution in their rush to build an industrial world, our
  309. grandchildren will look back at us during these early decades of the
  310. information age and judge us on how we dealt with the rebalancing of power
  311. resulting from all this new data.
  312.  
  313. This won’t be an easy period for us as we try to work these issues out.
  314. Historically, no shift in power has ever been easy. Corporations have turned
  315. our personal data into an enormous revenue generator, and they’re not going
  316. to back down. Neither will governments, who have harnessed that same data for
  317. their own purposes. But we have a duty to tackle this problem.
  318.  
  319. I can’t tell you what the result will be. These are all complicated issues,
  320. and require meaningful debate, international cooperation, and innovative
  321. solutions. We need to decide on the proper balance between institutional and
  322. decentralized power, and how to build tools that amplify what is good in each
  323. while suppressing the bad.