Silicon Valley Privacy Push Sets Up Arms Race With World’s Spies

By With assistance from Cornelius Rahn

Photographer: Chip Somodevilla/Getty Images

James Comey, U.S. Federal Bureau of Investigation Director, addresses the Intelligence... Read More

By Amy Thomson and Adam Satariano

Nov. 5 (Bloomberg) –- U.S. technology companies are facing escalating pressure to let police and spies tap into smartphone data and e-mails in the name of fighting terrorism. Silicon Valley so far shows no sign it plans to give in.
Robert Hannigan, head of the U.K.’s surveillance agency GCHQ, said yesterday that Twitter Inc. (TWTR) and Facebook Inc. (FB) are being abused by terrorists and urged more cooperation from the industry. U.S. Federal Bureau of Investigation Director James Comey similarly criticized technology companies in September for adding new safeguards that
prevent law enforcement from gaining access to information stored on mobile devices.
Law enforcement and intelligence agencies, hindered by the encryption technology, may lobby for legislation requiring companies to give them access, said Daniel Castro, senior analyst with the Information Technology & Innovation Foundation. That would be similar to how telecommunications companies are required to work with the government on phone taps.
Yesterday, Facebook said it recorded a 24 percent increase in requests, to 35,000, for data from governments around the world, compared with a similar period last year. Facebook supports an effort in the U.S. Senate to require a warrant to compel companies to disclose stored contents of an account, according to Chris Sonderby, Facebook’s deputy general counsel.
“ISIS is really freaking people out, with all those people being recruited via social media,” said Victor Asal, director of the center for policy research at the University of Albany, referring to the terror group Islamic State. “It’s really raising concerns to a much higher level than we’ve seen.”

Corporate Quandary

The pleas from government agencies leave companies in a quandary. If they comply, technology companies risk being viewed by customers as incapable of protecting privacy. Resistance leaves them susceptible to continued allegations of abetting criminals.
“What a number of big companies have started to do is anchor their brands on privacy,” said Brian Nussbaum, a University of Albany professor. “Law enforcement has a hunch that this will become more of a trend as sophisticated encryption becomes more widely available and wants to prevent that door from closing.”
The latest round in the debate was sparked by an editorial page article published yesterday in the Financial Times by Hannigan. Services that encrypt messages or help users hide their identities online, he wrote, have become “the command-and-control networks of choice for terrorists and criminals.”

Secure Software

Apple Inc. (AAPL) and Google Inc. (GOOGL) have announced encryption tools for smartphones in recent months that are so tough to crack that law enforcement agencies aren’t able to get information stored on the mobile devices, including photos, text messages, contacts and Web browsing histories. The software is so secure that the companies themselves aren’t able to unlock the devices even if they receive requests from government agencies. The two companies make the software that runs on more than 90 percent of the world’s smartphones.
Hannigan’s missive was the latest warning shot from European officials concerned about the Internet’s role in luring an estimated 3,000 young Europeans to join Islamist militants in Syria and Iraq. Technology now allows militants to encrypt messages, a practice once the preserve of “the most sophisticated criminals or nation states,” Hannigan said.

Customers, Governments

The pressure puts tech companies in a bind between customers and law enforcement, said Castro. They have implemented tougher encryption to help reassure customers worried about governments snooping on their private lives, as seen in the Edward Snowden leaks from the National Security Agency, he said.
“Citizens right now don’t trust what the government is doing in terms of surveillance, and they don’t want the companies they are handing their information over to handing it over to government agencies,” Castro said.
The advances in encryption have left phone companies and Internet providers outside the U.S. stuck in the middle. Until now, police in many countries could ask companies like Vodafone Group Plc and Deutsche Telekom AG to decode traffic when they sensed a threat. With U.S. tech companies holding the encryption keys, carriers can no longer do that.
“It’s an international problem because the companies are operating across borders and law enforcement authorities are operating within borders,” said Stephen Deadman, Vodafone’s chief attorney for privacy issues. “It requires a diplomatic solution.”

Security or Commerce

Some analysts said it was ironic that companies such as Google mine the data of customers for commercial gain while restricting the government from doing the same to track down potential threats.
“You have security on one side and economics on the other,” said James Lewis, senior fellow and director of the strategic technologies program at the Center for Strategic and International Studies in Washington.
Yet others said that view was wrongheaded. Customers give over their information in exchange for using the service, not with the expectation it will be used by the government, Castro said.