Privacy

Introduction The flow of data across international borders creates jurisdictional challenges, as the data itself and the person generating it may be subject to different countries’ laws. International tensions result when law enforcement seeks evidence stored on a foreign server during a domestic criminal investigation or when individuals expect domestic privacy protections for data hosted abroad. Increasingly, countries have responded by imposing new requirements to store data locally, threatening cross-border data flows, which generate approximately $2.8 trillion of global gross domestic product each year. The United States should explore new avenues to prevent these restrictions on the free flow of data. Given that the majority of the world’s largest Internet companies are headquartered in the United States, tensions erupt most frequently when foreign citizens’ data is held by U.S. companies or stored on U.S. soil. The United States can both raise international data privacy standards and promote the norm of the free flow of information. It can do so by building on several recent diplomatic successes, including the Privacy Shield agreement between the European Union (EU) and the United States, as well as ongoing U.S.-UK negotiations to streamline access to data in criminal cases. The United States should act with great care to ensure its efforts raise overall privacy protections rather than subverting them. It can do so in three ways. First, the U.S. government should promote a common approach to data protection that is gaining traction through regional agreements such as the Privacy Shield and the Asia-Pacific Economic Cooperation’s (APEC) privacy framework in order to lessen growing privacy concerns. Second, the United States should finally update the mutual legal assistance treaty (MLAT) system, increasing the legitimacy of legal methods for obtaining cross-border access to evidence in criminal investigations. Third, the United States should leverage its willingness to take these actions in diplomatic negotiations to seek international endorsement of the norm of the free flow of information. The time to do this is now, when increasing numbers of countries are imposing requirements that data be stored locally, also known as “forced localization,” and when digital issues are on the agenda of the Group of Twenty (G20). This framework would reduce tensions between national sovereignty and the borderless Internet, on which the U.S. economy relies heavily, while strengthening respect for human rights, privacy protections, and the rule of law online. Background The jurisdictional conflicts arising from cross-border data flows usually involve foreigners’ data on servers belonging to U.S. companies. U.S. communication privacy law prohibits electronic communications companies from disclosing communications content except in certain situations—such as when compelled to do so in response to a U.S. warrant, court order, or subpoena—even when it is sought by a foreign country investigating a crime committed on its soil by a non-U.S. citizen. As a result, the principal recourse for foreign law enforcement is the system of MLATs, which protects the due process rights of the individual. However, U.S. procedures for complying with a request are opaque and take an average of ten months to complete. Edward Snowden’s disclosure of the extent of National Security Agency (NSA) surveillance has fueled privacy concerns from individuals whose data winds up on U.S. companies’ servers. The fifteen-year-old EU-U.S. Safe Harbor agreement, under which U.S. companies transferred personal data across the Atlantic by certifying that their privacy procedures complied with EU data protection laws, was struck down by the Court of Justice of the European Union in October 2015. The court acted in response to an Austrian student’s complaint, based in part on incorrect press accounts, that personal data he provided to Facebook was readily accessible to the NSA, in violation of European privacy laws. Fortunately, the United States has taken steps to ease these frictions. In February 2016, the European Union and United States agreed to replace Safe Harbor with Privacy Shield, which provides the European Union with assurances that data on its citizens that is transferred to the United States will be handled in accordance with EU privacy norms. In March 2016, the U.S. attorney general revealed that the United Kingdom and the United States are negotiating a deal to allow UK law enforcement agencies expedited access to data held in the United States. The United States can attempt to build on these efforts to further ease international concern about privacy and law enforcement access to data when it travels to the United States. The United States can also build on the Trans-Pacific Partnership provisions designed to protect the movement of data. This focus of the G20 this year on digital issues is an opportunity to gain acceptance of the norm of the free flow of information. A statement in favor of such a norm would not obligate countries to remove data localization requirements, and therefore might be achievable coupled with good faith efforts on the part of the United States to ease tensions.  Challenges to a New Framework Despite these modest successes, there are considerable challenges to resolving the tension between national sovereignty and international data flows. Privacy law scholars Peter Swire and Justin D. Hemmings argue that the increased use of encryption on consumer devices leads foreign law enforcement agencies to seek access to the same data in unencrypted form, which in some cases is hosted on a server in the United States. When confronted with the dysfunction of the MLAT system, countries may attempt to compel U.S. companies to hand over data in violation of U.S. law, require that data be stored locally, or mandate backdoors to unlock encrypted devices. Therefore, increasing foreign law enforcement’s access to data held by U.S. companies, if accomplished with the appropriate safeguards, could have the counterintuitive effect of strengthening protections. However, care should be taken not to grant access too broadly to the wrong regimes and thereby risk weakening human rights protections. Gaining a statement of support in the G20 for the norm of the free flow of information will be challenging, despite the benefits of cross-border data flows to international collaboration and economies of scale and despite good will gestures by the United States. Concerns from individual users and foreign governments regarding the treatment of data held by U.S. companies are behind some countries’ requirements that companies store personal data domestically. However, several G20 countries, notably Russia and China, have other interests in restricting data flows. Through multilateral diplomacy, the United States can explore whether it can garner enough support from countries eager for the United States to address their privacy and law enforcement concerns that a few remaining countries would be reluctant to oppose a broadly supported agreement. Recommendations In order to preserve the openness and global reach of the Internet, the United States should encourage the adoption of an international framework for increasing privacy and human rights protections while safeguarding the free flow of information. First, the United States should, to the extent practicable, encourage countries to adopt an approach to data protection that raises privacy protections when data crosses international borders to approximate international norms or the individual’s domestic laws. Successive agreements and reports, such as the revised privacy guidelines of the Organization for Economic Cooperation and Development (OECD), the Asia-Pacific Economic Cooperation privacy framework, and the new Privacy Shield, have endorsed this approach, referred to as “interoperability.” The United States should encourage broader adoption of these agreements. In addition, the U.S. Judicial Redress Act, part of Privacy Shield, grants EU citizens standing to sue the U.S. government concerning its collection of EU data. The U.S. government should add additional partners to the list of countries whose citizens can make similar claims, under the new law’s provision allowing the U.S. attorney general (with the agreement of the secretaries of State, Treasury, and Homeland Security) to do so. Second, the United States should undertake two separate reforms to address foreign law enforcement’s frustration with the MLAT process, thereby discouraging attempts to circumvent the system and its due process protections. The U.S. government should expedite and simplify the MLAT process through a variety of measures such as increased funding for the Department of Justice’s Office of International Affairs and the introduction of standardized, online requests, as recommended in the 2013 report by the President’s Review Group on Intelligence and Communications Technologies. This would make the current system more legitimate and user-friendly without weakening its protections. In addition, the United States could allow countries with high human rights standards to join the eventual U.S.-UK agreement. Such a partnership would provide a reward for nations that respect due process and human rights. The system would safeguard against abuse by operating with stringent criteria, including those proposed by legal scholars Jennifer Daskal and Andrew K. Woods (such as the submission of targeted, particularized requests subject to robust minimization procedures and authorized by an independent adjudicator, and committing to transparency reports). Digital privacy expert Greg Nojeim has outlined additional restrictions that should also be considered, including that the crime be wholly committed in the requesting country, that the only connection to the United States should be the headquarters of the company holding the data, and that the U.S. company would not be required to release the information but would be required to notify the Department of Justice, which would ensure the information is not sought to restrict speech or undermine human rights. Third, the United States should work to obtain G20 leaders’ endorsement for the OECD’s Internet policymaking principles, which include allowing cross-border information flows and respecting human rights, as well as endorsement of interoperable privacy protection, such as the OECD privacy guidelines, APEC’s privacy framework, and the EU-U.S. Privacy Shield. Gaining Chinese and Russian support will be difficult, but digital issues are on this year’s G20 agenda and China, as its host, is seeking deliverables, which provides the United States with some diplomatic leverage. Russia’s stated ambition to join the OECD, which would require acceding to the principles, may provide additional leverage. Recent, modest successes provide the United States with an opportunity to help resolve conflicts over privacy protections and law enforcement access to data through interoperable agreements. Forging these agreements would take flexibility on the part of the United States, but offers the opportunity to promote U.S. norms in support of an open, global, and secure Internet.

Protecting the privacy of user data from unauthorized access is essential for business executives, policymakers, and users themselves. The pace of targeted attacks and massive data breaches is only increasing. Each new incident hurts organizations' bottom lines, undermines users' trust in the products they use every day, and can have dire consequences for public safety. The problem is multifaceted. Technologists are rushing to fix software vulnerabilities. Regulators are trying to keep pace with the realities of a complex ecosystem. Market-based approaches, such as cybersecurity insurance, remain immature. In addition, consumers are still learning what options they have, and what options they should be asking for. Currently, end users can use software that provides strong privacy protection with a high degree of certainty. Unfortunately, adoption rates for such software are low, largely because of how hard it is for nonexperts to use. This does not have to be the case. Software developers in the open-source community—who are generally the first to build encryption and privacy tools—need to improve the design of their tools to make them more user-friendly and useful. In turn, corporate and government purchasers should begin promoting the value of open-source software, particularly as it offers best-in-class security. These steps would go a long way toward improving privacy online. Background: Cryptography and User Experience Tools that provide strong privacy guarantees have historically been niche products, requiring a special understanding of the underlying security mechanisms in order to operate them. However, many of the basic concepts are straightforward. For example, encryption allows the contents of a message to be scrambled so that third parties cannot read it. Users apply an encryption key—similar to a long, complex password—to scramble data, and a decryption key to unscramble it. If the encryption of messages passing between users Alice and Bob occurs on their respective computers, and the decryption keys are under their sole control, it is called end-to-end encryption. This form of encryption is the gold standard in privacy preservation, because it prevents would-be eavesdroppers from intercepting the conversation. Software tools for end-to-end encryption have been available to users since the early 1990s, when Phil Zimmerman created a program called Pretty Good Privacy (PGP) and released it to the public free of charge. However, nonexpert users have faced a number of challenges with these tools from the beginning. In a 1998 paper, "Why Johnny Can't Encrypt," Alma Whitten and J. D. Tygar documented problems facing users of PGP. The authors found that participants had difficulty performing even basic tasks like encrypting and decrypting messages. Further studies have replicated these results with a variety of software programs. The integration of software into daily life—from workplace desks to phones tucked in pockets—has led to tremendous professionalization of user-experience (UX) design. From big firms to small app developers, many software companies live and die on the quality of their UX and employ a host of designers and researchers to improve it. Not surprisingly, end-to-end encryption tools are derided when they are hard to use, whether these tools are for playing games or talking confidentially about sensitive material. Given this industry focus on UX design, it may seem odd that privacy tools still have a reputation for being hard to understand and use. Several factors contribute to these apparent shortcomings, which limit the development and adoption of user-friendly privacy tools. Challenges One fundamental challenge to both the usability and adoption of privacy-preserving tools is that privacy is considered a secondary task, as demonstrated through user-experience research. A secondary task is always subservient in users' minds to the primary task, which is whatever core activity the software is meant to enable: sending emails in an email client, exchanging instant messages in a chat program, or collaborating on documents in a file-sharing application. Many security features have this second-class status: users describe talking to their friend not as "secure messaging" but simply "messaging," with the need for security as an ancillary requirement. This is problematic for software designers because users will readily abandon success on the secondary task if it becomes too onerous, or if they perceive it to be in conflict with the primary task. Privacy-preserving tools seeking mass appeal face another significant challenge: nonexpert users have a hard time distinguishing strong security properties from their snake-oil alternatives. It is easy to call a tool "secure," but it is hard to communicate the nuances without going into overwhelming details in an app-store listing. There have been efforts over the years to create a third-party seal of approval for secure tools, but these attempts have either foundered in obscurity or lacked credibility by allowing developers to purchase approval after a cursory self-evaluation.  Creating well-designed privacy-preserving tools with mass appeal also faces a variety of ecosystem hurdles. First, most tools in this space are developed as open-source products, which means that the authors publish the source code for anyone to read. This is good for security because the transparency of the open-source development model makes it possible to conduct independent reviews of the software (reducing the probability of critical vulnerabilities). It is bad for sustainability because few open-source projects are profitable, and many derive their funding from unsteady sources of income such as donations or grants. Second, the majority of nonexpert users are unlikely to transfer their digital lives to niche security tools, and prefer to prioritize their primary tasks by choosing the convenience of popular cloud platforms. End-to-end encryption is in direct conflict with the business model most platforms have adopted, because it prevents the data mining and ad targeting that these services have monetized. A service provider such as Google cannot serve targeted ads if it cannot read the contents of an email. Finally, a recent resurgence of a decades-old debate around the propriety of encryption technologies—particularly as they relate to law-enforcement efforts to thwart terrorism or investigate crimes—is creating tremendous uncertainty for software developers. Apple and Google have both made upgrades to support user-controlled encryption by default in strategic products (iMessage's encrypted chat, Android's encrypted file system). However, these nascent investments are unlikely to be followed by large-scale integration of privacy-preserving technologies, given that a multitude of conflicting requirements around cryptography loom on the horizon in different jurisdictions. For the United States, it is especially unfortunate that this debate emerges at a time when confidence in technology companies' ability to protect user data is still suffering from the fallout of the Edward Snowden revelations. Recommendations First and most urgent, the current debate over the use of encryption undermines the promotion of privacy tools. The U.S. government proposed a technological backdoor with the Clipper Chip in the early 1990s, using the same arguments heard today. It failed spectacularly. Although technology has evolved since, the fundamentals of encryption have not. Policymakers in the United States and other countries should recognize that anything less than intact cryptography puts all users at risk. Developers cannot build software that allows law enforcement to access encrypted communications but prevents malicious actors from exploiting that access. Cryptography cannot distinguish good people from bad, so a backdoor for one is a backdoor for all. Undermining the encryption used by U.S. companies would place the average consumer at risk of attack by malicious third parties, and merely motivate criminals and terrorists to use one of many alternative options. Powerful cryptography tools can easily be built outside the United States; as the self-declared Islamic State's use of German messaging service Telegram demonstrates, software rarely respects borders. In addition, technology decision-makers, including chief information security officers and others with purchasing power, need to promote the value of open-source tools throughout their organizations. This can be done by authorizing in-house engineers to contribute to open-source projects during work hours and explicitly seeking technology consultants experienced in the open-source world. Open-source development can span geopolitical barriers to create technologies that offer best-in-class security, but all too often such projects are viewed as half-baked or risky by decision-makers. The volunteer authorship of many projects contributes to this reputation, but the lack of polish in the user experience design does greater damage. Changing a company's culture from one of client ("software is an expense, what do I get for my money?") to one of community ("software is an investment, how can we contribute strategically for long-term benefit?") can help organizations and projects find innovative, secure, and affordable solutions. Open-source developers, in turn, need to prioritize user-experience research and design, as well as to optimize their tools for large organizations. The focus of too many projects has long been on users who resemble the developers themselves. It is time to professionalize the practice of open-source development, recruit designers and usability researchers to the cause, and take a human-centered approach to software design. In particular, project leaders should make the development process more accessible to new participants by including explicit instructions to user-experience experts in their documentation. Although this change in focus will require a cultural shift within the open-source community, it will allow projects to attract more users and more donations, and ultimately result in more useful tools. To support these efforts, technology-focused foundations and software companies' research and development wings should shift funding priorities toward more applied research on crafting and communicating about security-related features. Much of the work in this area examines the reasons a tool is hard to use—not ways to improve it—or focuses on toy refinements (e.g., "this custom interface is better than the standard"). As an example of such research, WhatsApp recently incorporated end-to-end encryption into its mobile messaging platform, without changing the user experience of its product. However, it accomplished this by hiding all privacy-specific features and tasks from its users, which in turn introduces vulnerability to certain kinds of attacks. Instead, researchers should work to identify factors that make privacy features successful across tools, and examine how such features might be added to popular products without harming user satisfaction. Taken together, these recommendations would both incentivize and facilitate organizations and individuals in their efforts to adopt stronger protections of user data from unauthorized access. Easier-to-use privacy tools and greater consumer confidence, in turn, will support continued growth, innovation, and financial stability in the digital era.