The Guardian view on surveillance: Australia is giving too much power to the state
The Australian government has just hustled into law a wide-ranging bill which attempts to give its intelligence services powers against encrypted communications. Whatever the government may wish, there are of course limits set to these powers by the mathematics that underpin strong encryption. If it is properly implemented, strong encryption is quite literally unbreakable for the foreseeable future. That is why it has become an essential part of the modern world, sustaining, among other things, the whole of our banking system. No government could really wish it to be weakened, because that would unleash international anarchy. But no government can be entirely happy with it either, for it does make safer a great deal of criminal and terrorist activity. Last week’s law is the latest in a series of more or less unhappy compromises between the demands of security, privacy and human rights.
At one extreme there is the Chinese policy, which abolishes privacy and human rights entirely in the interests of state power. A mesh of digital surveillance holds every citizen a virtual prisoner and strips them of privacy. This is most highly developed in the repression that has clamped down on the western province of Xinjiang, but ultimately it is clear that everyone in China will be judged by their “social credit” score, derived from all of their actions, online and off, which have ever been digitised. Any company that does business in China, as Apple does, Google plans to do, and Facebook yearns to, will find that it cooperates with the state.
At the other extreme is the – largely American – libertarian dream of a world and an economy where the state has no power at all, but is kept out by a shield of encryption. This comes closest to existence in the markets of the dark web, whether these are for drugs, human traffic, or software, and in some of the wilder cryptocurrency schemes.
The difficulty for democrats who care about human rights is to find some way to limit or balance the powers that encryption might make available to criminals while maintaining the protection it gives to ordinary citizens. This isn’t a technological problem any more than gun control is. In both cases, what’s required are political, legal and cultural constraints on power. The Australian law does not appear to provide enough of these. Part of it copies the powers already granted to Britain’s GCHQ to hack into phones and other computing devices, and to demand communications companies help it to do so. There is also one clause, sinister in principle and in practice difficult to invoke, demanding that communications providers strip encryption from their products if asked. How oppressive this all turns out to be in reality depends entirely on the diligence and quality of the oversight that gives it democratic legitimacy.
It is also crucial that access to the data thus obtained is not widely shared. The greatest authoritarian loophole in these regimes is the wide dissemination of data within government agencies in ways that are entirely unjustified by the purposes for which it was originally collected. This is part of a problem much wider than the technologies of strong encryption. The great danger to freedom and privacy is not so much that the data is collected, but in the ways it is later shared and refined.