Confronting the Internet Counter-Reaction

Keen: Thank you all for coming. The subject today—and I don’t think you can have a counter-reaction. A reaction is counter by definition. So anyway, that’s—so maybe we’ll have to cancel that. But we’re still going to do this. And I thought we would start—we’ll try to keep it as informal as we possibly can, keep everybody awake for an hour. I wanted to start, and you can read the bios and all the rest of it if you want in the program, so I’m not going to do any of that. But I wanted to start with Constantijn—I’m not even going to try and pronounce his last name. He can do it himself if he wants.

Van Oranje-Nassau: Constantijn’s the difficult part.

Keen:  Yeah, Constantijn’s hard enough for me, but the last one is even harder. And he’s from the European Commission. He’s part of the cabinet of Vice President Neelie Kroes. And I thought he would be an interesting beginning because I think he’s going to explain why the title or the description of this panel doesn’t work. So maybe you could start.

Van Oranje-Nassau: Again, I’m put in the role of the negative one.

Keen: You have a counter-reaction.

Van Oranje-Nassau: Yeah, yeah, I have a counter-reaction. I think probably what I talk about is a counter-reaction to the open Internet, and the global Internet, the non-divided Internet. I don’t really see that as such a counter-reaction to the Internet per se. I think we are maturing in the way of how we’re discussing the use of the Internet and behavior on the Internet, like we did also in the offline world. And I think sometimes we overreact a bit when governments get involved. For instance, I remember when the European Commission proposed to allow to block, or to actually force to block websites that had child pornography. Immediately there was a big counter-reaction, saying how can you block freedom of speech? And these kind of conversations are a bit odd if you are dealing in the normal world. So sometimes we overreact to anything that deals with the Internet, that limits it, also privacy discussions we tend to take into a very existential domain, as if the Internet is being closed down or something.

Keen: Theresa Swinehart from ICANN. Exaggeration, Theresa? Is there really an existential threat here in terms of someone out there, some dark force, whether it’s Erdogan or Putin or someone in China or Iran shutting this whole thing down?

Swinehart: No, no, I actually agree. I think that we actually have to look at this as it’s a disruptive technology, it’s changed business models, it’s changed power struggles, and it is not a model or a medium that can be managed in the same way as other things, because of the decentralized nature. And so it creates situations of chaos, it creates situations of ambiguity about how we solve for issues. And so I agree, we tend to have extreme reactions in some things. Then it has to cater itself out in order to figure out how to solve certain issues. I think the Putin thing, I think the Facebook issues are all things that are going to come up. We’ll have to work to find solutions around it. But I think this is all about change and a disruptive technology.

Keen: So Theresa, very, very briefly, what’s going on here? What should we be talking about today? What is worrying and what are issues that we collectively perhaps can influence?

Swinehart: So I actually think the most important thing is the conversations around how to retain an Internet that’s not fragmented. ICANN deals with the addressing space, so it’s a single root, it’s a single global Internet, but I think many of the issues coming up for discussion have a risk of fragmenting the Internet at the content layers, at the service layers, and I think the conversation that we need to be having is how to be forward thinking on solving problems without disrupting the Internet overall.

Keen:  David, you’re the co-founder and CEO of AnchorFree, a technology company that reunites or—I don’t know what the opposite of Balkan is, maybe Austro-Hungary or something.

[LAUGHTER]

But you’re in the business of solving this problem. Is it just a technology problem or is it a political problem? What does your company, what does AnchorFree do?

Gorodyansky: AnchorFree is the world’s largest Internet freedom and privacy platform. About 300 million people around the world have downloaded our app, Hotspot Shield, to gain uncensored access to all the world’s information and security and privacy. I think the answer to your question is that it’s a mix between product and policy. It’s got to be both. But I want to deemphasize the importance of policy a little bit, because I think a lot of people think that as long as we’ve got these think tanks talking about policy all day long—and I’ve spent enough time with people in D.C. to know that you’ve got all these great policy discussions, but they don’t really go anywhere. If the CTO of Microsoft comes out and says, “I’m going to condense my privacy policy from 12 pages to two” or something, nobody’s going to read that, right? So from my perspective, it’s got to be a balance between policy and product, but I think product is a lot more effective and efficient.

Keen: But you’re a for-profit company, so you’re empowering people to sort of hide behind masks of anonymity. Some people might say that’s the problem rather than the solution.

Gorodyansky: Providing people with control over their personal privacy and access to information are both basic human rights according to the United Nations. So I would say that it’s a solution, and it’s an important one because we live in a world where we have a lot of entities that want our data. We have 11 million Americans had their identities stolen last year. Millions of China Mobile users had their identities stolen last year. I think 40 percent of Internet users in Brazil had some kind of threats over unsecured Wi-Fi networks. And so at some point it’s very hard to distinguish between threats from malware, identity thieves, websites trying to collect our personal information, or governments. And at some point I think the citizens of the world have to just stand up and say, “Look, nobody’s really going to protect my data except for me.”

Keen: Barton, is that the challenge, citizens of the world standing up and demanding privacy? You’re an expert on the NSA. You were one of the earliest people that Edward Snowden was talking to. Is the problem here one of privacy in terms of this supposedly Balkanized Internet?

Gellman: It’s a question of power, I think. Information is power, communication is power. Let’s look at the long-term trend here. Internet begins as this decentralized, very independent force, almost sort of without much notice from government. So there’s the famous John Perry Barlow Declaration of Independence of the Internet, you know, we don’t care about you, governments, and—

Keen: Which he made, by the way, from Davos.

Gellman: Yes. And, you know, the famous cartoon, “On the Internet, no one knows you’re a dog.” Now everyone knows you’re a dog, and everyone wants to know where you’re wandering around the neighborhood. And so you would say that the reaction was that large institutions, for economic and political reasons, tried to impose controls on the Internet. The—

Keen:  Which is understandable, right?

Gellman: Well it’s certainly understandable from the point of view of their incentives. It may not be optimal. So it went something like a VPN, a virtual private network does, or more slowly but—pardon the expression, but I would argue more securely, the Tor network does—and Facebook just put in a Tor address. It does two fundamental things. It allows you to be much more anonymous, and it allows you to circumvent censorship, because whoever’s sort of watching the pipes and watching your data go by, it’s very hard for them to know who you are, where you are, and where you’re going. And so if China wants to tell you you’re not allowed to go to Facebook, or if the BBC wants to tell you that from New York you can’t watch its shows, you switch on one of these things and you appear to be coming from somewhere else. So it’s a user empowerment technology.

Keen: KP—

zu Guttenberg: T.

Keen: T. Nearly right. KT.

zu Guttenberg: Two letters, that’s—

Keen: And we’ve got our two Europeans to my left, perhaps not un-coincidentally.

[LAUGHTER]

KT, is this the—because you’re an expert on the relationship between the U.S. and Europe over tech policy and you’re sort of, you’re somewhere in between. You’re a mid-Atlantic character. Is the big issue—at least when it comes to the U.S. and Europe—privacy, the thing that Barton and David are talking about, or is there something more profound? Maybe there isn’t something more profound than privacy.

zu Guttenberg: It is certainly a different perception of privacy on both sides of the Atlantic, which we haven’t resolved yet. And it’s also a different perception of the interrelation of privacy and security, again, the perception of security as well on both sides. So there we haven’t found any common ground yet, and—

Keen: We haven’t?

zu Guttenberg: No, we haven’t.

Keen: None at all?

zu Guttenberg: I don’t—specifically if I look at my home country, Germany, and the U.S., where let’s say the outcry of disgust was probably one of the most remarkable ones in those times, I don’t see very much common ground. Then we have a political problem, probably on both sides. So we have mentioned it already, and it goes along with—and I have been for quite a while in government. It goes along with a dramatic lack of knowledge when it comes to the details of what we’re talking about here.

Swinehart: It’s true.

zu Guttenberg: They’re still scratching on the surface. The speed of politics, or the pace of politics doesn’t really allow to dive into it substantially. And that goes along with another problem, and that’s probably the emotional problem you may have specifically countered, after the NSA revelations, again on the other side of the Atlantic probably more than over here. So it’s a couple of levels we have to face here, as well as a certain amount of levels of hypocrisy.

Keen: But do you believe in the idea—and maybe we can go along the panel here, from left to right. Do you believe in the idea of common ground, or is that just another sort of self-serving Silicon Valley ideology as it colonizes the world? What does common ground mean?

zu Guttenberg: It could also be a self-serving European ideology. So—

Keen: Or both.

zu Guttenberg: Maybe both. So I don’t see—I would not pretend that we come to a solution where we would happily embrace each other on every single topic we are talking about. But there are a couple of things where I do at least see potential trans-Atlantic common grounds, because there are a couple of things we really do share in perception and perspectives. And I do see, actually—

Keen:  What? Give me specific.

zu Guttenberg: Well for instance, the whole question of how to deal with and to counter also others like Russia and China, of how to deal with industrial espionage, for instance. That’s a thing where we could start with after the whole NSA revelations we have been in. We could find common ground when it comes the topic of how to get into some encryption commonalities. It’s why not doing that together, and why not starting with the European Commission—

Keen: Constantijn, common ground. Tell me where—you’re a special advisor—where there really is genuine common ground, potentially, between the U.S. and Europe? And are you as pessimistic about the, at the moment at least, the complete absence of any common ground when it comes to Internet policy, global Internet policy?

Van Oranje-Nassau: Well I don’t agree that there’s a complete absence. I think you were talking about a specific part before, on privacy, where in the negotiations and at a trade level there are difficulties finding common ground. But if you look at where, yes, the philosophy might be different, but I think American citizens care a lot about privacy, European citizens care a lot about privacy, and finding maybe different ways of dealing with that. I think if we look at—if we take a step back and we look at the world, there’s no market than the European and the Americans that have more in common and are exchanging more data than which other market in the world. So if we’re talking about commonality, I think it’s in both our interest, but also interest in how the Internet develops, that Europe and the U.S. find common ground in how to exchange data. And I think it’s happening already, and sometimes we’re over-exaggerating the actual differences. And I think most companies, bigger U.S. companies are doing very well in Europe. Sometimes the Europeans are actually complaining, because the Americans have maybe lower regulatory burdens and are coming to Europe and have deeper pockets to cross borders where the Europeans don’t. So I think a lot of—I think it’s up to our interest in Europe to keep our markets open, open to U.S. companies, but also other companies in the world.

Keen: So some people are considering closing the European market to U.S.? Is that what you’re saying?

Van Oranje-Nassau: No, but sometimes in the rhetoric, that’s what you’re hearing.

Keen: What do you mean? From who?

Van Oranje-Nassau: Well, the title of this thing is—you seem to equate authoritarian regimes with a privacy policy in Europe that’s closing down the Internet. I mean I find that a bit absurd, but—

Keen: Theresa?

Swinehart: So I think this is raising a whole slew of issues. You know, whether you have innovative markets or whether you have common ground and values and solutions to that. But I think it’s interesting to have a conversation between the U.S. and across the Atlantic, but there’s emerging economies that are the Internet users of the future and how one actually finds common ground to dealing with issues that respect the values of different cultures around the world, I think it’s a challenge. And I think it’s going to be a very hard challenge, but I think it is doable.

Keen: Give me some examples. What does that mean?

Swinehart: The privacy issue, for example, or the cybersecurity issue, or the trade issue, or content and what’s acceptable content and what’s not acceptable content across national jurisdictions. And so we have to find solutions that are scalable globally, that bring parties together, that respect the values, that allow for the investments into the markets and the innovation that needs to be taking place. And frankly, that’s not easy. It gets noisy.

Keen: But you believe that there are, in terms of knitting this thing together, that collectively, in theory, we have common ground?

Swinehart: Yes, I do. Yes.

Keen: On everything?

Swinehart: No, not on everything.But I think if one takes the premise of does one want to keep a global Internet, does one want to allow the cross-services across different jurisdictions, does one want to respect values of different countries and priorities of different countries, I think if one takes some basic principles, and starts working toward solutions in that area—it’s utopian and, yes, maybe it’s a bit theoretical, but I think it is workable.

Keen: Barton, do we want to keep a global Internet? How does that connect with your work?

Gellman: Well, as someone who communicates for a living and wants a wide readership, I’m all for a global Internet in that way. I’m—as someone who seeks information, I count on the least possible impediment to my seeking that information, so of course I think that’s a good thing. I don’t have a lot of sympathy for either governments or private companies that want to say that you’re allowed to talk to this one and this one but not that one, you’re allowed to read this and this but not that. And to the extent the argument is about that sort of sovereign control over citizen behavior, I’m not interested.

Keen: But let’s say you were to turn your considerable critical talents to doing a book about China or Russia. Wouldn’t it be kind of inevitable that that work wouldn’t be as accessible there as it is here?

Gellman: Well, I understand all their incentives. I know why—I mean, they—and they’re complicated, because they need a considerable flow of open information in order to be successful in their experiments with controlled capitalism—and I guess you’d no longer call it an experiment. I mean, they have a relatively free market economy that needs information, and they have a relatively unfree political system that requires control of communications and of what they would regard as potential plots against their monopoly on power. So I mean, I understand why they want it. I don’t see why we’d want to collaborate in helping them obtain it.

Keen: So but, David, you—again, coming back to—is the common ground technology like yours, really technology—again, coming back to this original question—is technology the solution, or do we need politics as well?

Gorodyansky: I think it’s a combination of both. I think technology is more scalable than politics and can travel across borders faster. But I also think that the narrative has to change here from self-interest to global interest, to common interest. I think the United States and Europe and the rest of the world have to really say, “Look, we no longer have self-interest. Our interests are global.”

Keen:  But that’s easy to say if you’re like you and your self-interest and global interest are the same thing.

Gorodyansky: Well, I mean the reality is that we are, it’s a fact. So if we keep on thinking about self-interest, let me just ask you guys, and just take a step back from the conversation on privacy, is climate change a U.S. issue or a European issue, or a Brazilian issue, or an African issue? The world’s biggest global challenges are global. And we’ve got to address them by working with the world, not by protecting or promoting our own self-interest. That’s the only way forward.

Keen:  Theresa, is the best argument for keeping an open Internet, a global Internet, is it an economic argument rather than a moral one? Do we all get richer if we create this common ground or is there something more philosophical here at issue?

Swinehart: So it’s not just an economic argument, though the economic arguments are pretty strong. I mean 2.5 GDP growth on average on an Internet that’s global is pretty strong. But I think if one looks at the societal norms, the opportunities for education in the next generation, healthcare opportunities, dialogues that are happening at this conference about different tools that are out there that are existing because of the Internet, I think it’s actually the next generation of opportunity and it’s our choice to either continue to allow the innovation to be occurring or not to be occurring, but the opportunities are going to be missed.

Keen: Constantijn, do you agree? Is that what you’re finding in Europe?

Van Oranje-Nassau: Well, yes, of course. But—

Keen: Why do you say “of course”?

Van Oranje-Nassau: Because well, you know when you use the Internet you’re trying to—you get your services from across borders, you get information from across borders, so you do want information—it’s not just about business, it’s about how you’re interacting with friends. You’re probably all on Facebook because it connects you with your global set of contacts, instead of going for a national social media platform. So I think that seems quite obvious. But I think for governments that have the option between closing down because they are maybe authoritarian and they want—so they have a political view on the one hand. The moment that they start to get integrated in the global Internet commercially, they will have to start weighing their options. So with Alibaba, for instance, the Chinese e-commerce company, actually they’re going beyond the borders of China. I think that’s a strong incentive for the Chinese also to start to think, or to think about how they play their cards in the global Internet game and if they want to be part of retaining and strengthening the global Internet or if they want to play on this Balkanization scenario—

Keen: And doesn’t Europe have the worst of both worlds? You don’t really have many Internet companies, and everything’s coming from America, and yet you’re sort of open at the time, whereas at least Russia or China shut their markets off and they are able to build indigenous Internet companies.

Van Oranje-Nassau: Well this question is so far beyond my understanding that I don’t really know how to answer it. But, no, I—

Keen: Well, but Europe has struggled to create—I mean, Google’s got more market share in Italy or Spain or France, I think, than it has in the U.S..

Van Oranje-Nassau: Yet, it’s providing good service, so why would we cut off our consumers from good service?

Keen: KT, common ground? Where does it lie? What are you seeing? You’re a mid-Atlantic guy. I mean, aside from privacy—

zu Guttenberg: A left-sitting mid-Atlantic guy. One common ground would be, going back to the question is it self-interest or global interest, I would always say it’s both. And that’s one of the things we need to understand. You will not find a single government around the globe which will not combine self-interest with a certain amount of global interest. So the self-interest will always play into it. And the self-interest of course is then tied to certain election cycles, and where it’s extremely easy to play the populist card. And this is one of the things we need to see from a realistic point of view as well. We can dream a lot about where to get together, where to find common ground. But then we have to analyze the players involved, and the players involved are governments against governments. It’s foreign governments against American tech companies, it’s governments against its own tech companies. So it’s not the broad brush stroke that helps here, it’s actually trying to cut it down to—

Keen: Give me some examples of companies or governments which have balanced global and self-interest which would be a model for moving forward.

zu Guttenberg: Well I don’t see the role model yet, as such, but I think there is a potential in this country and there’s a potential in certain European countries as well. Constantijn has just mentioned China. I think China is on an interesting way, and we should not counter-react immediately as we hear about China that this is probably the worst-case scenario we’re facing right now. It could be actually an interesting case.

Keen: And Theresa, you have some—I think, following on, your idea of the Great Wall of China, which is sort of conveniently porous, might be a model. Is that fair?

Swinehart: I wouldn’t say it’s a model, but I would go to the point that Constantijn has made about they are engaging. So they have businesses, they are developing businesses, they’re going to cross borders. We’re certainly finding in some of the international fora and discussions around Internet policy issues, including ICANN, that they are sending very senior officials and very strong participants. So I think that there’s an emergence of a realization of the value of engaging and participating in the Internet space, in Internet companies, versus also the point around self-interest and how do you strike that balance. But that’s for respective countries and governments to find the solutions for. But we’re certainly finding engagement, including from Iran, by the way.

Keen: Are you horrified by this, Barton, the idea of even mentioning the Great Wall of China in a vaguely positive way?

Gellman: I don’t feel sufficiently qualified. I mean, if you want to take a—

Keen: Well you’re saying it’s sort of a moderate kind of censorship, but—

Swinehart: Look, it’s a model that China has chosen to use. Whether one agrees with it or not, it is the choice of the country, and it’s the choice of the country to see whether it has an impact on their economic growth or not. It’s certainly evident that there have been workarounds. People still communicate, companies still evolve. There’s probably less stringent controls now than potentially there were before. So I think one sees a shift. But it’s for the country to determine whether they want that or not.

Gellman: I mean one way to look at what China’s doing is it is blocking content and blocking communications behavior for the great majority of people in a way that, if you’re sufficiently interested and determined, you can get around. And Facebook has just made a very interesting move on this, by—so I’ll just explain slightly more for those who aren’t familiar. Tor is a U.S.-developed technology to anonymize. And there’s such a thing as a Tor hidden service, which you hear about on the news that it’s being used by drug dealers and such, but it’s also used for lots of other much more beneficial purposes. Facebook has just given itself a Tor hidden service address. You’re not anonymous to Facebook, you still have to log in, but you’re anonymous to all the points on the Internet between yourself and Facebook. And so the government of China in particular is not going to know who’s going on Facebook or who they are or where they are, unless it expends enormous effort that so far it has not expended. And that’s a very interesting move by Facebook, which wants to do business in China, and it’s a liberating move.

Keen: David, you’re originally from Russia. What’s your take on what’s happening there? And I assume that it’s hard to take anything positive out of that, as opposed to the Great Wall of China.

[LAUGHTER]

Gorodyansky: Well, we don’t—you know, most of our business is here, and really we’ve got users in 190 countries, including China. Russia’s not one of the countries where we have a lot of users. Mainly because they don’t really censor the Internet. China does. So in China, Facebook is censored. Twitter, you can’t get to Twitter, many different news sites, many social networks. Not the case in Russia. We haven’t seen a lot of users from there, we haven’t seen a lot of things get censored.

Keen: I’m going to have one more round, and then please—yes?

Van Oranje-Nassau: One this on this Tor. So we keep talking about the Internet as the open Internet. There’s a lot of people that complain, especially from industry, that there’s no kind of quality of service Internet or that everybody can enter anonymously, which has actually led to a lot of abuse, and that you can’t ever win the Internet security race, blah, blah, blah, all of that. So they’re basically calling for an Internet that is IP secured, it’s not anonymous. Do we see now, between Tor and what we currently have, is the open Internet also an Internet emerging that is much more controlled for business purposes, where people are identified, or do we see—I mean, I don’t know, how does this development evolve? Because Tor is now, as you said, was portrayed as the place where drugs are sold and you can buy your weapons and you can do all these kinds of things. But that’s what people said about the common Internet as well. They said there’s this anarchistic space. So are we seeing that the former anarchistic space of the Internet is becoming more controlled and regulated, whereas now we have this new Internet, which is unregulated, and does that mean that the current, say the common Internet—

Keen: Could you explain—because I’m not sure if everyone here is as hardcore technologist as some of you. What does this mean, Tor, and how does this play out? Could you explain it a bit more?

Van Oranje-Nassau: Well maybe your neighbor can more than I can.

Keen: Yeah, David, what does that mean? How does that change things?

Gorodyansky: Sure, so Tor is basically a product that routes your traffic through other computers. So it’s a volunteer network—

Gellman: Okay, we’re going to do a little demonstration here. So I want to talk to your water glass, I connect to a Tor node, it’s an encrypted connection. This one passes me to another Tor node, which doesn’t know who I am because it only knows it got it from here. It goes through three nodes, hits the water glass, nobody along the way, except for certainly hypothetical crazy—

Keen: So it’s a P-to-P form of communication.

Gorodyansky: It’s a P-to-P form of communication, but the problem with it, as you just saw, is you have three or four hops, so it’s very slow. And so my take on it is mainstream consumers aren’t going to adopt Tor just because it’s relatively slow. And I do think that there is—there has to be some balance between using something like Tor, which is relatively complicated, and basically not using anything and giving up all of your data. There are times where you want to be private and anonymous, there are times when you don’t. If you go to your bank site, you don’t need to be anonymous. There’s no reason to be anonymous on your bank’s site, unless you want to hack it or something. If you’re going to Google or Facebook you may very well want to be anonymous.

Keen: Why? Because of their business model?

Gorodyansky: Yes, because you don’t want them to collect your data. I mean, if you search for healthcare related things on Google, all of the sudden your insurance premium goes up. You don’t want that to happen.

Keen: So Google’s watching everything we do.

Gorodyansky: Absolutely.

Keen: KT, do you agree on—

Gellman: One other quick example here why an ordinary person would want privacy. Look, as an investigative reporter, I need privacy to communicate with people confidentially. Human rights workers do, lots of other people do. But I have a Verizon phone. We’ve just learned through security researchers that Verizon Wireless and AT&T are actually injecting code into the data stream of their mobile devices that uniquely identifies me, so they’re able to track me around the Internet and sell my data. Even though I’m paying them quite a bit of money for their service, they’re still harvesting my data and selling it. If I use David’s service, a VPN, or if I use Tor on the phone, either of which you could do, then they can’t do that. They can’t inject the code because it’s an encrypted link and they don’t know where I’m going.

Keen: So you’re—but how do they respond to that afterwards? Isn’t this a sort of endless cat-and-mouse game of one side does one thing, another side does the next?

Gorodyansky: No, because if we encrypt all the traffic, basically Verizon and AT&T or whoever can’t collect and sell our data. It’s all encrypted.

Gellman: I mean I feel like it’s an extraordinary—it’s a betrayal of me as a customer that they’re doing this to me, or trying to. It would be a whole other universe of betrayal if they took active steps to attack and to break VPN connections of their customers. That would be—that probably would be unlawful.

Keen: Theresa, you’re the most reasonable person here, I think, in the room. I trust you.

[LAUGHTER]

Swinehart: That’s actually quite worrisome.

Keen: Are Verizon and all of these other carriers, are they really reading everything we do?Are we entering, you know, Orwell, Big Brother and all that?

Swinehart: Well actually, I can’t really comment on those specific things, but what I do want to come back to is, we’re actually dealing with a situation now where it’s user choice and user demand, right? And so as we’re looking at some of these different initiatives that are happening and whether people want to be using Google or they want to be using Facebook or whatever it might be, there’s certain attributes that exist in using those services that users have a choice not to use them if they want to. And so I think there’s that aspect of it.

I think that there’s also a bit of a shift in where the roles and responsibilities of the players go. Historically, it’s always been the government may have responsibility to regulate in order to make the world safe. Then it shifted over to corporations may have responsibility. I think the users play a tremendous role in that now on being accountable also to how they’re using the medium themselves.

Keen: KT, why can’t Europe come up with the anti-Google, or at least the anti-Google business model?

zu Guttenberg: I think there are a couple of interesting ideas floating around, which are not necessarily connected to data secessionism. But an idea I’ve heard about, it’s nothing entirely new and revolutionary, but three or four weeks ago a company popped up that said—well it’s actually an American company that wants to move to Europe, because they fear to lose the other markets if they do it from the U.S.—

Keen: What’s the name of the company?

zu Guttenberg: And they said let’s not only go for opt-out opportunities, okay, let’s also go for opt-in opportunities. And it’s nothing that has to do anything with encryption or anonymity. And it’s a tiny little idea and the European ISPs jumped on that idea immediately, so—

Keen: What do you mean jumped on it? You mean—

zu Guttenberg: Well they loved it, let’s put it that way.

Keen: But you always hear of these technologies or companies that seem to be solving the problem—we used to read a lot about DuckDuckGo—but none of them seem to ever get any traction.

Gellman: DuckDuckGo’s actually got a huge growth attraction.

Van Oranje-Nassau: Microsoft is offering these services of European routing and data localization, so I mean I don’t—

Keen: Well, what they—

Van Oranje-Nassau: It’s where there’s a customer base. I think we’re sometimes over-making this a policy thing. I think if there really is a demand for privacy, I think companies—and for local routing, companies will start offering it. And we saw that. Maybe we sometimes need a wakeup call like Snowden, but I think we should work much more with the market than try to overregulate.

Keen: Was it a wakeup call? I just saw—we were talking about this. I saw “Citizenfour,” and Snowden now seems almost like ancient history. Has it really been a wakeup call? Has it changed anything?

Van Oranje-Nassau: Well like the banking crisis hasn’t changed banking, yet some people would say that they think it was a wakeup call.

Keen: You agree, Theresa? Was it a wakeup call?

Swinehart: Absolutely.

Keen: What’s changed? But a wakeup call means you wake up. Then what happens?

Van Oranje-Nassau: Well I mean you have a siesta.

[LAUGHTER]

Keen: You go back to sleep.

Swinehart: Well said.

Keen: But what’s changed? Why is the world now different a year on, or 18—when did the thing break? A year ago, 18—

Gellman: A year and a half-ish.

Keen: What’s changed?

zu Guttenberg: I think amongst or in between governments a lot has changed. And—

Keen: But we don’t see that. What does that mean?

zu Guttenberg: From the consumer side, I’d say they’re back fast asleep. And so many are.

Keen: But it’s a convenient sleep. They don’t want to be woken up. They don’t want to know the reality, right? So in terms of government, it’s like German-U.S. relations have changed?

zu Guttenberg: Well they have changed not for the better, but this is change, and it’s actually the lousiest relation I’ve seen in the last 15 years between these two countries. Again, it offers opportunities.

Keen: Because of the data stuff?

zu Guttenberg: Because of the data stuff. Not only because of the rusty old cellphone of the Chancellor. It’s a bit more behind it. But, again, there is a lot of hypocrisy in the game there as well. So of course we found out that the Germans are trying the same. It’s not as sophisticated as they do over here. It’s also, from the consumer side, on one hand you give happily away your data, on the other hand you feel compelled by what’s happening around you. And the private sector as well, it’s an outcry of disgust. How can we be treated as we have been treated by the NSA? And the question is actually are we moving more from government to Google-ment […] than the other way around? And so it’s […] But this is the debate we’re in also in Germany and this is a change. I think that’s a significant change. We wouldn’t have had that discussion about two or three years ago.

Keen: Barton, do we need to wake consumers up? Are they conveniently sleeping, they want all the cool free services and then they’re not willing to acknowledge what they’re really paying for this stuff?

Gellman: So I’ll answer that, but I wonder if I could have the privilege also of asking a question also to our European friends.

Keen: Yes, absolutely.

Gellman: But the quick answer is that—

Keen: Yes, and please, you know, don’t be mute. Don’t be like consumers. Wake up.

Gellman: Yes, consumers, when it’s a hypothetical question, don’t seem to put a really high value on privacy, although their behavior is much more complex than that. For example, people say teenagers will tell anybody anything. That’s not true at all. They might be happy to tell their friends this or that. They don’t want tell their parents or their principle, and so they speak in code. They use song lyrics and so forth on Facebook that they all understand and that we don’t. But when you make it more concrete, when you show someone exactly how much is known about them—I’ve done this experiment a couple of times myself on colleagues who didn’t think they cared about privacy—they have a quite different reaction.

Keen: So what’s your question?

Gellman: So my question is, in terms of the different conceptions of privacy, it seems clear to me now, and I didn’t understand it before Snowden, that the U.S. government, the intelligence community, and the NSA in particular, does not want to acknowledge the validity of any signal, any content from any place by any person using any forms of self-protection like encryption. That should be out of their reach. They don’t want to know everything about everybody, but they want to be able to know anything about anybody. And so they do it because—if I was in their jobs, I’d probably do it the same. I mean, I would say well my responsibility is unbounded, to know everything—

Keen: So question.

Gellman: So is that a difference? Is it that your governments believe there ought to be boundaries, sanctuaries of privacy that governments can’t get into?

Keen: And these guys aren’t the official representatives of Europe, to be fair.

Gellman: And if I could just say, as you must—as must have occurred to you, there’s a very high probability that each of you individually has been targeted for collection by NSA.

Van Oranje-Nassau: It’s an insult not to be targeted.

[LAUGHTER]

Keen: That’s no joke.

zu Guttenberg: I take it with a certain pride. I think a major distinction lies in the question whether you come from the side where you accept that you have the power to control or whether you control the power. And the Europeans actually have a very—so many Europeans actually like the aspect of controlling the power, Germans specifically, due to their history. And I think there lies one of their biggest differences across the Atlantic in that very regard, and where you can also try to find solutions. It’s one of the things that could add up to something we could see from the complementary side, but it’s a long way to go.

Van Nassau-Oranje: But the tension is I think universal between the intelligence community wanting to have access to everything if they think it’s necessary and other parts of civil society that think that should not be the case. But as you said, if you’re in the shoes of the intelligence agency, you would want to have that access. So that is not either European or American, it’s in how do you organize that. And then we get to the point of controlling the power. So what democratic control do you have over those that seek access to everything? And when they get access, how do you manage that and how accountable are they for it?

Keen: Well let’s have some comments. This lady here.

Westby: Jody Westby from Global Cyber Risk. So we know the NSA’s collecting and we know that governments and intelligence bureaus are also collecting and exchanging. I’m not supposed to spy on my people, but you can, and I’ll spy on yours and we’ll exchange information. But we also know that providers are packet-sniffing for what you were talking about. It is a direct violation of the U.S. code, and they aren’t being called on it. So that’s one thing is all your traffic’s being sniffed. But the third thing is the government’s involvement in—like with Tor. So remember when they cancelled the Carnegie Mellon presentation where they were going to show—these researchers were going to show how they could hack into Tor and suddenly that presentation was cancelled. I talked to the lead people at Carnegie Mellon and they—I was trying to figure out, because there’s a software engineering institute—which is an FFRDC and federally funded; lots of DoD money goes in there—and then there’s academic freedom on the university side. Three days ago all of these people were arrested by federal agents because they broke into Tor. So is Tor safe?

Keen: So what’s your outrage? Is it against the security services?

Westby: Well it’s against the government, one, suppressing academic freedom. Two, are they in the back of technologies, where they can use it to their benefit and keep it away from the people? And, three, you know, the surveillance. And, four, what the providers are doing—everyone knows it, and the government’s not doing anything about it. So, yeah, I’m pretty outraged on all fronts.

Keen: Should she be outraged, Theresa?

Westby: Hi, Theresa.

Swinehart: How are you? It’s good to see you again.

Keen: Should she be outraged?

Swinehart: Well I’m not familiar with the exact situation, but, yes, it sounds like, you know, this is a problem.

Keen:  Who else shares this outrage? Be outraged. Are you outraged in the same way as this lady?

Westby: I’m just more astonished that it’s actually happening.

Swinehart: Yeah, I’m astonished myself.

Keen: You mean post-Snowden, or just any time?

Westby: I’m the only person publicly that’s called on the press repeatedly for an investigation, a full and open investigation. Not another major press, not another civil liberties organization. And why? And the people I talk to, people say, “I don’t care, I have nothing to hide.”

Keen: Well, Barton—you’ve got one of the top investigative journalists.

Westby: I know.

Keen: Why don’t you write something about what this lady’s saying?

Westby: He reported the news but his editorial page won’t call for the investigation.

Keen: Could you respond to this? This seems to be a major story.

Gellman: Well, several dimensions here. It’s true, “The Washington Post” editorial page has been—the opinion people, they really are two completely different hierarchies that don’t overlap at all. So I’ve broken lots of stories about what the NSA is doing in “The Washington Post” news pages, and on the editorial pages you have people saying that reporters who break these stories should be put in jail. I’m actually quite proud of that. I like the very clear demonstration of independence of news from opinion.

As far as—I don’t know enough about, and I respectfully suggest that nobody knows enough yet about why the research presentation on Tor vulnerabilities was cancelled. And I imagine we will learn that over the coming months. And it may just have been postponed. You have these things come up from time to time, at Black Hat or DevCon, or CCC security conferences, where there’s a scheduled presentation and then it mysteriously disappears, but the research comes out in the end.

And as far as packet-sniffing, which is the practice of your Internet service provider looking deep into the packets, so your digital traffic is busted up into lots of little pieces, and spying on what you’re doing so it can figure out interesting things about you, that’s exactly what I was talking about before and I hate that.

Keen: Let’s actually, let’s have some more questions or comments about the more global element here, rather than how the government’s spying on us, because that seems to be a symptom rather than a cause. I mean I think people get sick of this. I mean how many more stories can you get. It’s like when the Snowden thing, it was like slow torture. Every day there was, oh, it’s going to get worse and it’s going to get worse, and after a while that just gets boring, right? I mean how much more can we put up with this as news consumers?

Gellman: Well, be patient. My book’s coming out.

[LAUGHTER]

Keen: This gentleman. You might introduce yourself.

Persson: My name is Michael Persson from the Dutch newspaper De Volkskrant. Yeah, I want to take it back a bit more globally and go back to the title with counter-reaction. One of the cases that we’ve seen the last year was the court in Europe, the judge saying that the right to be forgotten should be a definite right for people and their names on the Internet, especially for search machines not to find these people. This is one of the cases where you see a counter-reaction. There’s also the other one, a court case against Facebook. And there is a definite difference of opinion between what Europeans think and what Americans think. And especially Google made a very strong case against this outcome and really trying hard to confront this counter-reaction. They make a huge lobby trying to erase this verdict mostly. So my question actually is does the Internet and do tech companies actually allow a counter-reaction or is it a force in itself that is unstoppable, looking at this European resistance?

Van Oranje-Nassau: Well first the right to be forgotten wasn’t held up by the court. The court just said that Google, as a big data company, also falls under this right. And to the credit of Google, they actually made it work. I mean they have started to actually implement it, whereas—I think they are the only company that does it. I guess there’s a lot of other companies in the same line of business should be doing the same. And European companies as well, but they might not have the infrastructure to do it.

For me it’s an interesting phenomenon, because it’s been there since the late 1990s, this provision. And now it’s implemented because of this court order. And it actually triggered a debate, which is a really interesting one, can you do this? And the more interesting one is, is Google really the arbitrator between what should be forgotten and what not, and can you retroactively, for instance, erase journal articles, you know, media articles about someone because you don’t favor the tone of the article? I think there you have this kind of retroactive editorial role—

Keen: Well Michael, you’re a journalist. What do you think?

Persson: I think this right should be—I know a couple of cases—I can right now name one. This was a guy who appealed to Google for his right to be forgotten, it was a guy—actually there was a story in our newspaper in the 1990s. He was featured in this article playing a didgeridoo in Vondel Park in Amsterdam. Very innocent. But whenever anybody types in his name in Google or Yahoo or whatever, the first search result is for him playing a didgeridoo in the Vondel Park, and he looks like a hippie. He tells something about being stoned all the time, which is really relatively innocent in Amsterdam.

[LAUGHTER]

Keen: Half the population.

Persson: But now, 20 years on, he’s not a didgeridoo player anymore, but he’s trying to be a financial consultant or something like this.

[LAUGHTER]

Keen: So you’re sympathetic to him having the right to have that didgeridoo erased, or lowered in the search engine?

Persson: In the end it was honored, I must say. This was honored so this story doesn’t come up anymore in the Dutch domain of Google. If you go to Google.com it’s still there, so I mean the right to be forgotten is really relatively applied by Google. It’s still on Google.com

Anyway, I think it’s good that this history can be erased. This guy is never in the news and then suddenly he’s reduced to a didgeridoo player, which he is not anymore. There’s no—well I think even as a journalist, and of course finding every—the freedom of information and freedom of speech, everything that’s so very important. But I think in this case it’s not that relevant anymore. The story’s actually is still sitting in our archives.

Audience: How have you had to remove it.

Persson: Sorry?

Audience: How have you had to remove it?

Persson: We actually, we have removed his surname, so the story’s in our archives. And if you go to our online archives, the story’s there without the man’s surname. In the real closed archives, so you won’t find it on Google search, but in the closed archive it’s still complete. So there, if you want your history, if you want to have our complete information, it’s still there. So we make a difference now between what should be known by typing in somebody’s name and what can be known. If you really want to know, then you have to go to the newspaper’s archives.

Keen: KT?

zu Guttenberg: I’m a bit more critical about the whole thing, again, from the European perspective here, because of raised expectations specifically amongst the public, which are in my opinion unfulfillable.

Swinehart: Yes, exactly.

zu Guttenberg: And of course there was compliance by Google to a certain extent. There were tens of thousands of cases they have to work on at the moment. I think this is quite a challenge to do that. And in the end you may gain a right of being partially forgotten maybe, but—if at all. And I think it’s a pity that this very phrase actually turned out to be the catchphrase for the whole thing then, because it’s—I think we’re far away from what actually would be expected from those looking at it a bit more deeply.

Van Nassau-Oranje: Yeah, I agree. I think this conversation is really important, because we’re actually in the process of adopting regulation where this is much more seriously ingrained. And I think we—this conversation tells us it’s not as simple as we thought it would be. It is technically impossible. You’re raising expectations. The second thing is that it is who is arbitrating this? Normally the courts would arbitrate things like this and to have Google arbitrate between what can be forgotten and what shouldn’t be, or arbitrate between what is freedom of speech and what not, I think is a very interesting point to discuss.

Keen: Kara?

Sprague: Yes, Kara Sprague from McKinsey. We’ve been talking a lot about privacy and individual freedoms on the Internet, but I wonder if we could talk a little bit about the other side of it, which is there is a reason why the NSA is so interested in being able to look into various packets and understand what people are doing online. We just came from a discussion where we’re talking about the next biggest threat to the world and even the United States would be a cyberattack. So how do we balance the two, between individual privacy and freedom versus actually protecting a large global infrastructure that’s increasingly based on the Internet?

Gellman: Well, for one thing, you would want to have that debate to some extent in the open, so that all stakeholders can express views and describe costs and benefits of a proposed course of action. And we have not had that until very recently. And the intelligence community, as intelligence communities do, has done its best to stuff that back under the rug. So there are big initiatives that the NSA would like to take in terms of being able to deep packet inspection in order to protect against cyberattacks, which would have the additional impact of allowing it to filter all traffic that enters or exits the United States, which, you know, has its disadvantages as well. And I will say, there is a certain hypocrisy in the cyber threat-cybersecurity conversation. It’s got to at some point include and acknowledge the fact that I think it would be fairly hard to dispute that the world’s most proficient offensive cyber operation is run at the NSA. The big distinction that they make is that they don’t steal other country’s economic secrets to give private U.S. companies a market advantage. I believe that to be true. But you’re not going to expect every country in the world to play by rules in which the NSA implicitly is saying you’re allowed to steal any secrets you want as long as they don’t come from the area in which we’re already dominant, which is economic innovation. I mean, that’s not a rule that’s going to be universally accepted.

Keen: This gentleman.

Hargreaves: Jonathan Hargreaves, European managing director at Edelman. I’ve got a comment on this challenge of the global privacy issue. And I’m going to refer to a joke told me by a German colleague. They refer to the German privacy paradox, and that’s that you get a riot if you’re on the Google Map on the street, but German’s really enjoy being in a sauna naked, and that this paradox is something that they actually quite enjoy. And to put that forward […] As always, there’s a serious point to a German joke.

[LAUGHTER]

And the issue being this, that cultural relevancy plays a massive role in the way that you actually tolerate different interactions with your privacy rights. And as you become more and more aware of the impact from these digital technologies, opinions are changing and moving backwards, moving forwards very fast, and we see this in the tracking data. And actually, I think, in terms of the industry, one of the important things would be to find some form of trying to manage and deal with this fast-evolving issue, rather than simply just seeing it as a form of outrage or something that you comply with without being aware of it.

Keen: But isn’t that the problem, that we live in an age of—the media that we’ve built around us is designed as an engine of that outrage, but—so we all can get very, very angry about stuff, but we never come up with any solutions to any of it.

zu Guttenberg: I think the political landscape and spectrum is just way too slow for it. And that won’t change for a while.

Keen: For a while? Will it ever change?

zu Guttenberg: It will probably never change, but the discrepancy is even higher than it used to be, and so that really brings us to your question, do we probably face a restructuring even of the political system in this regard. And that’s a wider question but it’s one we should actually address.

Keen: Well that’s one we can spend another hour talking about.

Hargreaves: Well, just as a final point on that, that’s really what […]

Keen: David, you haven’t said anything for a while.

Gorodyansky: Yes, I wanted to come back for a second to the point about consumers being asleep and needing a wakeup call. And I actually think that consumers are not asleep. They’ve woken up a while ago. And I think the testament is that at AnchorFree we just surpassed 300 million downloads of our application, Hotspot Shield, and every single day, 200,000 people every single day download our app on their mobile phones and computers. And I think people aren’t waiting for politicians or for policy. I think they’re just moving forward and finding solutions that will protect them online. And we’ve done some surveys, we’ve asked our users, what’s more important to you? We do three things for you, we protect your privacy, we provide you with uncensored access to information, and we secure everything you do online. Which of those three things, security, privacy, access, are more important? And most of our users do know the difference. They do distinguish those three things into three different buckets. It wasn’t freedom, security, and privacy, it was like, “I want secure and private access to everything I do online. That’s why I’m using you.”

And so, you know, I think it’s not only a privacy and a freedom point, it’s also a security point. People want to protect their data from malware, from identity thieves, from governments, from everyone. And I think they’ve woken up and I think they’re doing it.

Keen: Barton, just a quick—

Gellman: Well I think there’s a unified narrative you can out of the German sauna paradox, which is—

Keen: It was a joke, not a paradox—

Gellman: Well but a joke that has a serious point. But the narrative is that people want to decide for themselves who gets to see them naked. That’s actually exactly what Scarlett Johansson said in her magazine interview after her account was hacked. Just because you’ve posed for a photo doesn’t mean that you’ve decided you want to let everyone see it or that you want someone to take it against your will.

zu Guttenberg: David, do you also have, in this survey you have made, do you also have—it’s a banality, but have you asked people as well whether they do read the privacy laws of the apps they are downloading, sophisticatedly as they do? So whenever I talk to people who can maneuver quite well within the app world, I don’t see a single one, including me, who would actually read the 30 plus pages of how they deal with their privacy—

Keen: And can you be very brief? We’ve got two more questions, then we’ve got to end.

Gorodyansky: Yes, I agree. So people don’t read privacy policies and don’t—I think, I mean the answer is we just have to provide—the security industry at large has to provide really simple privacy levers, so it’s super simple, you press this button and you’re private, right? Because the people who want to abuse our privacy ask us to click a nice looking“like” button, and we click it and they collect all of our data. So there has to be something else.

Keen: Two more quick comments and then we’re going to end.

Davidson: The question is, is it possible that we’re not actually outraged enough—I’m sorry, I’m Alan Davidson with the Open Technology Institute in Washington—that we’re not outraged enough about the fact that certain basic values that we’ve taken for granted online might be in peril? So, you know, we take it for granted that the Internet’s a force for free expression and it’s for access to knowledge, for individual empowerment and , but actually, at the same time, we’ve got major services blocked, you can’t get Twitter or YouTube, not just in China and Iran but places like Turkey occasionally.

Keen: You’re not Turkish, why would you be outraged about that?

Davidson: Well I think if you care about those services being—if you care about access to knowledge—

Keen: What if you’re Twitter, though?

Davidson: Well, I think we all should care about it. And that gets to this point, which is that developing the technology may not be enough. I think the greatest reaction to Snowden is that people are actually trying to secure and get access, but we actually have to also choose as to make an informed choice.

Keen: I think there’s going to be a lot of outrage to get outraged about Twitter in Turkey. Final question, final comment? And then we’re going to get our final, final comments from the—

Audience: I think where we have a gap right now is we’ve got a big disconnect between what has happened technologically and where the regulatory system is at. And we’re missing a framework, so if you look at the framework that is starting to see finally some emergence, it’s around the fact that personal information is an asset. And there are three key sort of—there are three forces vying to get access to the asset. The government is trying to tax it, corporations are trying to—essentially trying to buy and sell it, trade in it. And then shady characters trying to steal it. But there’s no asset model, there’s no ownership model. So anybody who can get ahold of it essentially can use—

Keen: Where are we going to get that framework? Left to right again. KT, please.

zu Guttenberg: Will we ever, or where?

Keen: Where. You’ve got to be positive. We’re in America.

zu Guttenberg: Not around unfortunately—

Keen: Optimistic, where is that framework going to start? Where are we going to get it from? Because I think that was a great final comment.

zu Guttenberg: I think at the place where the outrage is probably the highest. And I do see a certain opportunity in Europe. I do.

Keen: So the outrage is more in Europe than in the U.S.?

zu Guttenberg: Oh, it is.

Keen: Constantijn, you’re in Europe. Is this where the framework’s going to come from? Because as everybody said, you had an idea, the right to be forgotten, which has been a disaster. You said it wasn’t implementable.

Van Oranje-Nassau: Well it is implemented, so, but I don’t think—

Keen: But it’s not practical. So where’s the framework going to come from? Is it going to come from Europe, from Neelie Kroes?

Van Oranje- Nassau: No, not from her. She’s left. Maybe that’s a better position to start a framework.

I think it is a topic where the U.S. and Europe could really unite on, because there are some very significant barriers to overcome. So it’s significant work, but there’s also a very big common interest to show some leadership in this going forward. So I would hope that we can deal with that in our negotiations.

Keen: Theresa, a framework, where’s it going to come from?

Swinehart: I think it has to come at the global level. With all due respect to the U.S. and European dialogues that are happening, I really think the conversation has to happen at the global level. It has to bring together the leadership in governments, the private sector, civil society, and look at certain issues in a transparent way and find solutions.

Keen: And that’s doable?

Swinehart: I think there’s dialogues happening right now. You have—

Keen: Give me an example.

Swinehart: You have the Internet Governance Forum dialogues, you have ICANN meetings, you have the Net Mundial discussions that are happening, you have dialogs such as these that are bringing people together from around the world and looking at certain issues. I think these are the opportunities that we need to use amongst all the different forums to look at policy issues.

Keen: Barton, framework, where is it coming from?

Gellman: I think it’s lots of layers. There’s naming and shaming, because there are social norms, absolutely, there are social norms. I mean, so I—my business is transparency. My business is putting facts on the table so that people can act on them in a regulatory framework, in a legislative framework, enabling them to bring lawsuits that were thrown out for lack of standing until facts changed that. The day that I wrote one of the stories about what the NSA was doing, cracking into the Google cloud and the Yahoo cloud, that day Yahoo announced that after four years of resisting it, it was going to encrypt its links to users.

Keen: But that’s not a framework. That’s just one—

Gellman: My framework is to let the normal mechanisms of accountability, which are varied from social to political to legal, operate. The more you know, the more they operate.

Keen: David, wrap it up. Tell us where we’re going to get our framework from. And not your technology, because that’s too obvious.

[LAUGHTER]

Gorodyansky: I want to point out that there’s two and a half billion smartphone users in the world today. There’s five billion feature phone users. Those feature phone users are going to come to smartphones soon, and none of them are going to be in the U.S. They are all coming from emerging markets. The next billion people, the next five billion people that are going to come onto the Internet are coming online from India, from Africa, from China, from Brazil. And it would be foolish not to include those countries in dialogue. The framework has to be global I agree with Theresa.

Keen: So with that global framework note, I want to thank—this was a hard one, but I think we kept you all awake anyway. Thank you very much.