PAPER SERIES: NO. 8 — MARCH 2015 Understanding Digital Intelligence and the Norms That Might Govern It David Omand UNDERSTANDING DIGITAL INTELLIGENCE AND THE NORMS THAT MIGHT GOVERN IT David Omand Copyright © 2015 by David Omand Published by the Centre for International Governance Innovation and Chatham House. The opinions expressed in this publication are those of the author and do not necessarily reflect the views of the Centre for International Governance Innovation or its Board of Directors. This work is licensed under a Creative Commons Attribution — Non-commercial — No Derivatives License. To view this license, visit (www.creativecommons.org/licenses/by-nc- nd/3.0/). For re-use or distribution, please include this copyright notice. 67 Erb Street West 10 St James’s Square Waterloo, Ontario N2L 6C2 London, England SW1Y 4LE Canada United Kingdom tel +1 519 885 2444 fax +1 519 885 5450 tel +44 (0)20 7957 5700 fax +44 (0)20 7957 5710 www.cigionline.org www.chathamhouse.org TABLE OF CONTENTS vi About the Global Commission on Internet Governance vi About the Author 1 Acronyms 1 Executive Summary 1 Introduction 2 Origins of Digital Intelligence 2 Supply-side Considerations 4 Demand-side Considerations 5 The Resulting Digital Intelligence Environment 8 Legal and Societal Constraints 11 A Three-layer Model of Security and Intelligence Activity on the Internet 17 Conclusion 18 Works Cited 22 About CIGI 22 About Chatham House 22 CIGI Masthead GLOBAL COMMISSION ON INTERNET GOVERNANCE PAPER SERIES: NO. 8 — MARCH 2015 ABOUT THE GLOBAL ABOUT THE AUTHOR COMMISSION ON INTERNET Sir David Omand was the first UK security and GOVERNANCE intelligence coordinator from 2002 to 2005 as permanent secretary in the Cabinet Office. Previously, he was The Global Commission on Internet Governance was permanent secretary of the UK Home Office and director established in January 2014 to articulate and advance a of Government Communications Headquarters (the UK strategic vision for the future of Internet governance. The signals intelligence and cyber-security agency). He has two-year project conducts and supports independent a degree in mathematics and theoretical physics and a research on Internet-related dimensions of global public master’s in economics. He is a fellow of Corpus Christi policy, culminating in an official commission report that College Cambridge and is senior independent director will articulate concrete policy recommendations for the of Babcock International Group PLC. His book Securing future of Internet governance. These recommendations the State is published by Hurst (United Kingdom) and will address concerns about the stability, interoperability, Oxford University Press (United States). security and resilience of the Internet ecosystem. Launched by two independent global think tanks, the Centre for International Governance Innovation (CIGI) and Chatham House, the Global Commission on Internet Governance will help educate the wider public on the most effective ways to promote Internet access, while simultaneously championing the principles of freedom of expression and the free flow of ideas over the Internet. The Global Commission on Internet Governance will focus on four key themes: • enhancing governance legitimacy — including regulatory approaches and standards; • stimulating economic innovation and growth — including critical Internet resources, infrastructure and competition policy; • ensuring human rights online — including establishing the principle of technological neutrality for human rights, privacy and free expression; and • avoiding systemic risk — including establishing norms regarding state conduct, cybercrime cooperation and non-proliferation, confidence- building measures and disarmament issues. The goal of the Global Commission on Internet Governance is two-fold. First, it will encourage globally inclusive public discussions on the future of Internet governance. Second, through its comprehensive policy- oriented report, and the subsequent promotion of this final report, the Global Commission on Internet Governance will communicate its findings with senior stakeholders at key Internet governance events. www.ourinternet.org VI • CENTRE FOR INTERNATIONAL GOVERNANCE INNOVATION • CHATHAM HOUSE UNDerstanDING Digital INTELLIGENCE AND THE NORMS THat MIGHT GOVERN IT ACRONYMS and intelligence sharing have become major international political issues. This paper looks at the dynamic interaction DGSE Direction générale de la security extérieure between demands from government and law enforcement DPI deep packet inspection for digital intelligence, and at the new possibilities that digital technology has opened up for meeting such ECHR European Convention on Human Rights demands. Inevitably, the paper has an “Anglo-Saxon” ECtHR European Court of Human Rights bias, given that American influence on the Internet so FBI Federal Bureau of Investigation far has been so great, an understandable situation given GCHQ Government Communications Headquarters the origins of the Internet and the sources of investment and innovation that have driven it thus far. The Snowden IP Internet Protocol allegations have highlighted what many nations see as NATO North Atlantic Treaty Organization this US “home field” advantage in economic terms, as well NSA National Security Agency as in the scale and reach of modern digital intelligence giving the United States a “hard power” advantage. The SIGINT signals intelligence alleged range of targets of US intelligence included the UNSC United Nations Security Council chancellor of Germany and the president of Brazil and set WMD weapons of mass destruction off firestorms of diplomatic protests led by those nations. The disclosures also put the long-standing “Five Eyes“ (the EXECUTIVE SUMMARY United States, the United Kingdom, Canada, Australia and New Zealand) partnership in signals intelligence (SIGINT) This paper1 describes the nature of digital intelligence and under unparalleled scrutiny and became an issue in the provides context for the material published as a result of New Zealand general election. The debate in the European the actions of National Security Agency (NSA) contractor Union over personal privacy in a data-rich world in which Edward Snowden. Digital intelligence is presented as the private sector harvests significant amounts of personal enabled by the opportunities of global communications information was already complex,2 but the Snowden and private sector innovation and as growing in response allegations have made this and other international debates to changing demands from government and law intense and at times toxic.3 That, in turn, has led to some enforcement, in part mediated through legal, parliamentary nations exploiting the issues for protectionist purposes to and executive regulation. A common set of organizational benefit their domestic industry in terms of data localization and ethical norms based on human rights considerations and procurement restrictions from US suppliers. Overall, are suggested to govern such modern intelligence activity the adequacy of the previous regimes of legal powers (both domestic and external) using a three-layer model and governance arrangements is seriously challenged of security activity on the Internet: securing the use of just at a time when the objective need for intelligence on the Internet for everyday economic and social life; the the serious threats facing civil society is apparent. This activity of law enforcement — both nationally and through paper suggests areas where it might be possible to derive international agreements — attempting to manage international norms, regarded as promoting standards of criminal threats exploiting the Internet; and the work of accepted behaviour that might gain widespread, if not secret intelligence and security agencies using the Internet universal, international acceptance, for the safe practice of to gain information on their targets, including in support digital intelligence. of law enforcement. INTRODUCTION The Snowden material has exposed — to unprecedented and uncomfortable international gaze — the world of digital intelligence and the technical success of US agencies and those of its close intelligence allies in adapting their processes to the opportunities the Internet provides. The protection of personal information from unlawful exploitation, and the legality, proportionality and adequacy of regulation of digital intelligence access 2 Discussion of a controversial new draft European Union Regulation on Data Protection and a specific new Data Protection Directive for law enforcement continues. See http://ec.europa.eu/justice/data- protection/. 1 The contents of this paper and opinions given in it are the sole responsibility of the author in his capacity as visiting professor at King’s 3 The European Parliament, for example, has called for suspension of College London. They should not be taken as an expression of the views the “safe harbour” arrangements for sharing data on European citizens of the British government, which continues neither to confirm nor deny with the United States and the suspension of the US/EU Terrorist Finance allegations made in the media about the operational activity of British Tracking Programme that had generated significant intelligence, helping intelligence in the light of the material leaked by Edward Snowden. to detect terrorist plots and trace their authors. DaviD OMANd • 1 GLOBAL COMMISSION ON INTERNET GOVERNANCE PAPER SERIES: NO. 8 — MARCH 2015 ORIGINS OF DIGITAL