Privacy, security and public opinion

[Brian Gladman]

From: "Owen Lewis" <oml@eloka.demon.co.uk>
To: "ukcrypto" <ukcrypto@maillist.ox.ac.uk>
Sent: Sunday, June 04, 2000 7:52 PM
Subject: Re: Privacy, security and public opinion

> ----- Original Message -----
> From: "Peter Mitchell" <pete@dmed.demon.co.uk>
> To: <ukcrypto@maillist.ox.ac.uk>
> Sent: 31 May 2000 09:43
> Subject: Re: Privacy, security and public opinion
>
> > Owen Lewis wrote:
>
> > Essentially the authorities are saying, "We need these powers. But we
> > can't tell you why we need them, even though we may use them against
> > you, citizen, at some time. You must just trust us to use them in a way
> > of which you would approve."
> >
> > That attitude is not appropriate in a supposedly democratic society.
>
> You may say so. Now come up with an alternative.

A key issue here is that very often the statement 'we need these powers but
we cannot tell you why because doing so would undermine their value' is
simply untrue. Very often this is a smoke screen that is being used to
obscure a policy line which would never survive open scrutiny.

In the US, when the pressure was on for relaxation of crypto export
controls, the US Law Enforcement/Intelligence community used just this sort
of excuse in their arguments for continued controls. The response of the US
legislature was not to accept this line as an 'act of faith' but rather to
force the conduct and publication of an independent study by senior security
cleared academics under the auspices of the US National Science Foundation.
Among other things the resulting report (which is well worth reading)
indicated that it IS possible to have an effective open debate about the
issues involved without seriously compromising operational objectives.

Over the last five years of repeated failures in UK crypto policy
formulation, I have made several requests for such a study in the UK but
this has never been taken up. In my view this is because the preservation of
power in Whitehall requires that UK citizens should not be able to
scrutinise policy development in this area.  50 years ago there ***might***
have been some good reasons for this but they are most certainly well beyond
their 'sell by' date now.

So a key step we need to take is to remove the culture of secrecy in
Whitehall and to do this we need a Freedom of Information Act that errs on
the side of being more open than is really desirable because a 'weak' act
will be largely ignored.  Needless to say we are getting the useless
version.

> I'd be among the first to say that it is not perfect but I'm darned if I
can
> suggest more that marginal improvements. If we had some ruling class, self
> perpetuating and hermetically sealed off from the rest of us, then yes
there
> would be a real danger.

In my experience this situation does exist to a significant extent. I would
agree that it is slowly being broken down but anyone who thinks this is now
entirely in the past is badly mistaken.


> However, I believe that any real danger is very
> largely nullified by the fact that anyone who is bright enough, determined
> enough and does not have a serious criminal record, can get themselve into
a
> position where they either know what does go on or else even get to direct
> what does go on. In short, there should be nothing to hide in a system
which
> is open to operation and management by the people in some ever
> changing set of combinations.

I don't agree - there is plenty to hide and plenty that is hidden without
justification.

> If by 'democratic society' you mean a society in which every person should
> be informed of every detail in regard to their governance, I point out
that
> to evaluate meaningfully information in many different areas may take
years
> of training and some experience. What is the value of an opinion based on
> ignorance? I don't know how a refuse collection, recycling and disposal
> facility works. I therefore would not wish to push any opinion of mine in

But there are people in society that do know about these things and they can
only bring their expertise to bear if the government allows them to by being
more open.  If my next door neighbour is an expert on refuse collection and
I am not, why should I deny his involvement simply because I don't have the
expertise to make an input?

The fact that 99.9% of the population is disinterested in an issue is not,
in my view, an acceptable excuse for not involving the other 0.1% since very
often the expertise of this group will outstrip all of the expertise
available in Whitehall by a very large margin.  Provided that the
relationship between Whitehall and this small group is an open one that is
subject to wider public scrutiny, I see this as a beneficial process.

This list is a good example - in my view it has had an impact on the
formulation of UK cryptogrphy policy even though it is comprised of no more
than 0.001% of the UK population.

> regard to whether such facilities should operate in this that or the other
> way. If you like, I place a limited trust in those who should know more
> about
> it to make those decisions for me, the limits of the trust being
reasonably
> assured by an unfettered right to elect and un-elect, and at not
infrequent
> intervals, those who do make the decisions.

It is your right to decide that you are content to trust the process as it
is but I do not - I see plenty of evidence to suggest that it does not
always work in a way that protects my interests.

I see the BSE crisis as partly the result of a situation in which a
government body has worked in a culture of secrecy while trying to represent
the interests of both food producers and food consumers. The result has been
that both groups have been let down.  With a more open approach I believe
that the conflict of interest would have been evident much earlier and might
well have been acted on earlier as well.

This is just one of several examples I could quote where the culture of
excessive secrecy has played a part in undermining the true interests of UK
citizens    Closer to home for ukcrypto, we have one body - GCHQ - that is
trying to represent the interests of those who want to exploit information
and those who want to protect it.  Hence it is only a matter of time before
we see a 'BSE crisis in cyberspace' but I don't see the UK government doing
anything about this until after the event (if then).

You may feel content with the very course choice that you are given at
elections but I am not. The idea that, by voting for a particular party, I
am giving this party a mandate to implement all of their proposed actions is
simply not correct. This is the mandate they are taking but it is not the
one I am giving them - all I am doing is making a very course judgement that
they are likely to do less damage than the other lot.  In any event,
pre-election policy commitments are often meaningless since they will be
changed once in power - as we saw with the complete reversal of Labour Party
encryption policy after the last election.

And there ARE countries that offer their citzens policy choices at a more
detailed level than 'all or nothing' party manifestos. I lived in California
for several years and citizens there can organise to have individual
decisions put on their ballot papers.  If I recall correctly excessive taxes
on property owners were prevented by such action several years ago
(Californians on the list will, I hope, correct me if I am wrong here).

> >If they do not explain to us exactly why they want these powers, then
they
> > cannot obtain our informed consent, and so they have no right to ask for
> > them.
>
> Then how do you propose that the informed consent of the populace entire
> shall be given to each and every matter affecting their governance? It
never
> has been so in any modern nation on this Earth and I do not see a way of
> making it happen in future.

The technology to obtain a much wider public involvement in government
decisions is now in our hands but I rather doubt that it will be used in the
UK to give more power to the people.  In any event, we can make big
improvements without going to this extreme by being much more open during
policy formulation processes and doing this well before polices are actually
set (ie. stopping the sham 'after the event' consulatations that are so
popular in the UK). This does not require that everyone is involved in every
decision but rather that people should be able to become more involved if
they so choose.  Sometimes media and public pressure is able to force this
on an unwilling government (e.g GM food) but in many areas that do not
command widespread interest this does not happen.

The nature of more open decision making processes will most often be better
decisions and the RIP legislation is a pretty good example here. In my view
six months of open discussion on 'ukcrypto' ***prior*** to its publication
would have led to proposals that would have been infinitely better than
those which we now have.

> >Particularly since we know that the authorities have so often
> > abused the trust we put in them.
>
> I'd put the boot on the other foot. What is remarkable is not that some
> abuse
> occurs from time to time but that so little abuse occurs overall. There is
> an analogy between the British body politic and the public services with
> that of a teenager, bursting with health and hormones and who get the
> occasional zit. One may be right to point out the zits but don't make the
> mistake of claiming that they are a sign of some deep corruption and
> possibly terminal ill health.

The problem is not so much one of deep corruption but rather 'ill health'
caused by deeply inbred resistance to change.

In large measure the Whitehall viewpoint is still one of 'we know what is
best for you' rather than 'here are the possibilities, which do you think
best meets your needs?'  Those in power are living in the first half of the
20th century while the rest of us are trying to cope with the 21st.

Of course, all of this is not really an issue for 'ukcrypto' but it is a
desperately important issue - does anyone know of a UK based list where this
is a sensible discussion topic?  - if not, should we have a 'ukdemocracy'
list?

     Brian