INET Washington DC: Surveillance, Cybersecurity and the Future of the Internet

>> Good afternoon again
and welcome to GW.

My name is David Dolling and
I'm the Dean of the School

of Engineering and
Applied Science here

at the George Washington
University.

I don't think it would
be news to anybody

that there's been a lot of
documents out there recently

with respect to cyber security.

We've seen the White
House's executive order aimed

at protecting our
critical infrastructure.

We've seen a report from the
Security Company Mandiant

that exposed a Chinese
military hacking group.

And very much in the news
now although it's faded

after the press conference
yesterday afternoon have been

documents related
to NSA's prison

and telephone surveillance
programs.

Well today, we are
very fortunate

that have several
experts with us

to discuss their various
view points on surveillance

on cyber security and the
future of the internet.

As we try to be secure
while protecting privacy,

we do need to be guided by
knowledge from many disciplines

and in fact, this was stated
quite explicitly last December

at the launch of the GW
Cyber Security Initiative.

The initiative's chairman,

former DHS Secretary Michael
Chertoff spoke of the need

for university's
like ours and others

to give students an
understanding of the triad

of technology, business
policy and how they interact

to create difficult cyber
security challenges.

While I'm on the podium here,
I'd like to just take advantage

of a captive audience because I
know you all too polite to cheer

or get up and move out to say
a few things about the School

of Engineering and
Applied Science here at GW

which is a very thriving
and growing enterprise.

Our Department of
Computer Science

in fact anticipated
Secretary Chertoff's remarks

by launching last fall
the Master of Science

in Cyber security in our
Computer Science Department.

It's the first program

in Washington DC designed
specifically to respond

to the large and
fast growing need

for technical cyber
security experts locally,

nationally, and internationally.

Underscoring our commitment
here to cyber security education

and public service, our NSF

and DHS sponsored CyberCorps
scholarship programs.

These programs fund students who
are going to be future leaders

in the federal government
on cyber security

and indeed some of
them already are.

Each week, the CyberCorps
students meet in class often

with current or former
federal employees as well

as industry experts to learn

about the major cyber security
issues so they're prepared

to meet the challenges that
will certainly great them

after they graduate
here and take jobs.

This course which was
previously only available

to CyberCorps students is now
available to all GW students

as a hybrid cause
conducted mostly online

with the short intensive

in person learning
experience or the beginning.

Starting next year,
some doctor or students

in the graduate school
of education

and human development
here at GW on human

and organizational learning
will also be taking this class a

required part of their
cyber security focus.

Well, let me say that
today's event which looks

to be very well populated
and looks like it's going

to be very interesting
is sponsored

by the cyber security policy
in research institute.

We abbreviate that around
here to CSPRI of the School

of Engineering and
Applied Science.

In addition to overseeing
the CyberCorps program,

it facilitates and execute
into disciplinary research

in education in cyber
security across GW.

One example of this is its
work with the graduate school

of education in human
development supporting the

national cyber watch
center in a joint project

to develop the nation
cyber security workforce.

More information on that program

on CSPRI Cyber Security
Scholarships and School

of Engineering and Applied
Science can be found

in the material available
the registration desk.

We're happy to have
as a cosponsor

of this event today the internet
society and it's my pleasure

to now introduced Paul
Brigner, Regional Director

of the North American Bureau at
the Internet Society to come up

and tell you a few
words about it

and its role and
in today's event.

So, on behalf of GW, the
School of Engineering

and Applied Science,
CSPRI and the Department

Of Computer Science,
welcome to GW

and I hope you have
a great afternoon.

Thank you.

[ Applause ]

[ Pause ]

>> Thank you Dr.
Dolling and thank you

to the George Washington
Cyber Security Policy

And Research Institute
for partnering

with us on this event today.

And thanks to all of
you for joining us

and that means not everyone here
in the room but also to those

who are at a remote
hub in New York City.

That remote hub is
being sponsored

by the internet societies
New York chapter.

I know we don't have
a good view of them

with the camera right
now but what's going

to happen is they
will walk up to

that camera and ask questions.

And by the way, they've
been meeting

on this topic already
this morning.

They've had their
own meetings today,

so maybe that gives you an idea
of how passionate that group

of individual is about
the topics we will be

discussing though.

So, thank you to the New York
chapter for getting together

to join us as remote hub.

And definitely, thank you
to all those on live stream.

We have a very good crowd
already gathering on live stream

to watch us from
all over the world.

My first order of business today
is makes sure that you're aware

of the internet society.

If this is the first time you're
joining from one of our events,

we are a global nonprofit
cost driven organization

with a very straight
forward vision.

That is the internet
is for everyone.

We work to achieve that vision

by promoting the open
development evolution and use

of the internet for the benefit

of tall people throughout
the world.

Some of our key functions
involve facilitating the open

development of standards,
protocols, administration

and a technical infrastructure
of the internet.

Supporting internet education
in developing countries.

Promoting professional
development in community meeting

to faster greater
participation and leadership

in areas important to the
evolution of the internet

and fostering an environment
for international cooperation,

community and a culture

that enables internet
self governance.

Well, I saw staff lead specific
projects on these topics.

Much of our work is achieved
through the work of our members

and chapters around the world.

And speaking of chapters,

I would like to give
special recognition

to the local DC chapter.

I am very fortunate that our
headquarters is just not far

away in western Virginia so
I'm able to interact personally

with our DC chapter
on a regular basis.

And I can attest to the fact

that they are really a
first class group of people

that regularly hold very
interesting meetings related

to the internet societies
mission.

So, if you're a local
and you're not involve,

you're really missing out, I
do hope you will get involved.

And if the leaders who are here

from the internet society DC
chapter would stand briefly,

I just want to make sure
that you're recognized.

So, great.

So, you know who they are.

Please make a special
effort to talk

to them today during
this event if you'd

like to get involve
with the chapter.

[ Pause ]

One of my key functions
at the internet society is

to work closely with our
chapters in the region not only

to plan iNET events like this
but to assist with their events

and to have an open
dialogue on policy issues.

That dialogue in turn
helps me and my colleagues

at the internet society to form
our policy positions and help

to set the agenda for
our regional meetings

like the one we are
attending today

and that brings me
to today's agenda.

The topic of this iNET
has really been driven

by the interest of our members

in the North American
region and around the world.

It so happens today that one of
our panelist is the President

and Chief Executive Officer

of the internet society
that's Lynn St. Amour.

So, she will have
the opportunity

to address the concerns
of our constituency today.

Now, without further delay,

I would like to introduce
Professors Lance Hoffman.

He is the Director of the Cyber
Security Research and Policy--

I'm sorry, the Cyber
Security Policy

and Research Institute here at
George Washington University.

I first met Professor Hoffman
when he sponsored a debate

on PIPA and SOPA and
I knew that he was,

based on that experience, I
knew that he was game to talk

about some very controversial
topics.

So, I guessed right, he
was interested in talking

about this one as well and
it's been really a pleasure

to partner with him
on this event.

So, I want to sincerely
thank you for that.

It's really been a
great experience.

I'd also like to thank all
of our fantastic panelist

who have agreed to
speak here today.

We really have an all
star group of people

who have taken their time out
to share their views with you.

I'd like them all to come up
and take their sits on stage now

if they would and I
will turn this event

over to Professor Hoffman.

One thing I forgot to mention
is that if you want to Twitter

or tweet about this event,

please use the hashtag
iNET DC, iNET DC.

Thank you all over much.

[ Applause ]

[ Noise ]

[ Inaudible Discussion ]

>> Good afternoon everybody.

Let me add my welcome to that of
Dean Dolling and to Paul Brigner

and let me also thank the
internet society, our cosponsor

for this event for
their programmatic

and financial assistance
in making it possible.

I also want to thank from
CSPRI, my Associate Director,

Dr. Costis Toregas and our
intern and research assistance

who have worked on this and are
helping here today tray hair

[phonetic] Dustin
Benanberg [assumed spelling],

Jaime Moore [assumed spelling],

and Greg Ziegler
[assumed spelling].

My role today is to set the
stage for our excellent panel

and into moderate that panel
discussion on cyber security

in the future of the internet
given the recent revelations

about prism and other
surveillance programs.

The panelist of each degree
to summarize their thoughts

in a four minute statements
so we could have lots of time

for questions from the
audience including the audience

in cyber space.

After the audience question and
answer session in a short break,

participants will return for
a very interesting session

around table discussion where
we will see their world views

on this, where there
world views agree,

and where there are tensions and
talk about this in a round table

which will be informed by
their previous statements

and the audience
questions before hand.

I'm delighted that
for this event,

we will have an experience
moderator Professor Steve

Roberts leading the
round table discussion.

Many of the students and
faculty here may recognize Steve

as the superior professor
of media

and public affairs here at GW.

But others including
those viewing on this

on the internet maybe
more familiar with him

from his appearances
as a commentator

on many Washington
based television shows,

as a political analyst
on the ABC radio network,

and as a substitute host
on NPR Diane Rehm Show.

Another rule where he-- this
is material from experts

and clarifies it to facilitate
informed public discussion.

But before the round table,

let me identify the
participants on stage.

We will not have lengthy
introductions here

since their bio sketches have
been made available to you

in the brochure which you
have gotten or can get

at the registration desk.

But anyway, let me
introduce very briefly

and you see their name
tags in front of you,

Danny Weitzner is the
Director and Cofounder

of the MIT Computer Science

and Artificial Intelligence
Laboratory.

>> Not the whole lab.

>> Not the whole lab?

>> I'll explain.

>> OK. Lynn St. Amour
is the President and CEO

of the Internet Society.

Let's see, who's next.

Laura, Laura DeNardis
is professor of School

of Communication at
American University.

Melissa Hathaway is President of
the Hathaway Global Strategies.

Let's see.

Who's down there?

I don't have you on my list.

>> Oh no.

>> I apologize.

>> That would me.

>> Oh Randy, of course.

Randy from-- I don't have here.

I mean, OK.

Randy-- where are you from?

I'll let you introduce yourself.

I'm sorry.

[Inaudible Remark]

>> I'm the University
IT Security Officer

at Virginia Tech.

>> I didn't want
it to get it wrong

and say something
wrong-- wrong university.

Sorry Randy.

OK, let's see.

Leslie Harris is from Center
for Democracy and Technology.

And last but not the least,
John Curran, President and CEO

of American Registry
for Internet Numbers.

OK, so without further ado, I am
going to suggest to be each go

down the-- I have to
decide, I'm going to leave it

to I guess either Danny or
John on who wants to go first.

>> No, no, no.

Go ahead.

>> John?

>> OK.

>> OK?

>> OK John, go on.

Four minutes please.

>> Well, thank you.

I'm happy to be here and I
want to thank the opportunity

to present at this panel.

Keeping my remark short,
I will say that we're

in an interesting period of
time with respect to the future

of the internet and
how it's governed.

People may not realize
it but the fact is,

there is a coordination
function that's existed

since the earliest days of the
internet which is necessary

so that we can actually
use the internet

so that it actually functions.

For example, computers

on the internet have
unique identifiers.

Several, actually, one of
them is the IP addresses

which is part of what
Aaron [assumed spelling] is

involved in.

We can't have computers
using the same IP addresses.

Every computer needs
its own IP address.

Likewise, there's coordination
of things like domain names

to make sure that a
domain name is a sign

to one organization,
et cetera, et cetera.

This is called technical
coordination

and it's been a function of the
internet, necessary function

for the protocols
to work as designed

since the very beginning.

People may not realize that
this use to all be done

by one gentlemen, Dr. Jon Postel
who we no longer have with us

but was an amazing individual.

And in the late '90s, we
actually went about setting

up infrastructure to enable
this technical coordination

so that IP addresses and
domain names could be available

to everyone globally for
their use on the internet

but coordinated so that
they actually interoperated

so that they work as expected.

This structure involves
a lot of organizations.

Aaron is one, there're five
regional registries throughout

the globe.

Aaron is the one that handles
North America, so with Canada,

the United States and about
half of the Caribbean.

Though there are four
other regional registries

and then there is the DNS
coordination that goes

on through organizations
such as ICANN.

The international
coo-- [laughs].

Sorry. International--
[Noise] --

Organization for assigned
Names and Numbers.

So, the fact is that these
bodies all work doing technical

coordination is very important.

But, they've been doing it based
on a historical trajectory.

A trajectory that originated
with projects and programs

out of the US government
which have

since been increasingly
moved out to independence

but were not quite there yet.

In fact, some of you maybe aware
that these organizations were

under supervision somewhat
indirect but still supervision

of program such as NTIA in
the department of commerce.

And so, one of the things that
we now find ourselves facing is

that there is a unique
role in the US government

with respect to the internet.

And this unique role is one that
is based on-- it's experienced.

It's a steady hand,
behind the scenes,

helping the internet
mature and grow.

Recently however, we've now
seen that there's another hand

that maybe busy doing
other things

such as surveillance
in cyber security.

And so, the question that comes
up is how do we reconcile those?

How do we reconcile an open
global transparent internet run

for everyone with
the possibility

that there is also surveillance
going on and other things

that may not meet
the expectations

of global internet users.

And so, this is the
challenge in front of us.

It's particularly
highlighted because of the fact

that the US governments
unique oversight role in this

and it's brought
to the forefront

by the recent discussions where
we now say that it is not simply

for the benefit of
all the internet,

but there's also some
national priorities

and national initiatives that
the US government also pursues

over the same infrastructure.

I think that's the challenge
that we will now face more

so than ever in light
of the revelations

for the last few months and
the net result would be a lot

of the discussion in
forum such as this.

Thank you.

>> Thank you and I'll try

to make this iPhone
behave a little better--

>> OK.

>> Although--

>> I thought I was over on time.

>> Yes.

>> You were right on
time, you were great.

>> OK.

>> Leslie?

>> It's time, I guess.

So, I also want to get us out
of the DC bubble and the focus

on the rights of people
in the United States.

I've been talking about
that for the last six weeks.

And congresses about to
considering an amendment that's

going to reign in
the NSAs ability

to collect our metadata
from phones.

I want to pivot away from that
'cause I think there're three

other things that we ought
to be considering at least.

What-- and the reactions of
governments and internet users

around the world and what this
means with the architecture,

not just the governance, the
architecture of the internet

and also for the
protection of human rights

of global internet
users and that turns

out to be a very
thorny question.

Certainly for governments,

I think this entire kerfuffle
is reinforced the concerns

that the global internet has
undermined their sovereignty

in control over their citizens.

And it's further
illuminated this sort

of privileged position
of the United States.

Certainly, with respect
to ICANN and some

of the other critical resources,

we continue to have a
disproportionate share

of internet traffic, all
that's declining and obviously,

we have a dominance in our
global internet companies.

For some, and the EUs, I
think I have a good example,

this illuminates
left an inability

to protect the human
rights of their own citizens

and we have a major fight coming
up in the data directive there

about whether they're
going to allow data to come

to the United States at all.

At the same time, it's an
extraordinary opportunity

for authoritarian governments
to exert more control

over the people in data in their
own boarders and it's, you know,

rushes now dusting of a
legislation that has to do

with national servers.

You're going to see
that elsewhere as well

and I think it's fair to worry
whether this carefully honed

narrative as US narrative of the
why is trusted neutral stored

of the internet can
really hold and it's fair

to ask whether we're moving
towards the balkanization

of the internet as
government sees these moment

to impost local server
requirements or worse

and we saw some of these
proposals last year.

I know we're supposed to be
acronym free at the wicked.

I'll explain-- routing
requirements

to either avoid the
United States of literally

to direct the routing of traffic

and the worst outcome
being literally ring fans

to national or regional
networks.

If I were in Latin America and
notice that there was 80 percent

of my traffic still coming
from the United States,

I may start to wonder why
we're still relying on Miami

to reach most of the world.

Some of that might be
a weird salutary effect

that we finally get internet
exchange points in some places

that have not had them.

But I think governments becoming
involved directly in the rooting

of internet data would
opposed a profound challenge

to the open end-to-end internet

and I think all these things
are going to be on the table.

I think you are also kind of
expect to see a reexamination

of the world's relationships

with our cloud providers,
already seeing that.

You know, there's a Netherlands
provider and no prism,

no surveillance, no
government backdoors.

And finally, I think we may have
lost some of the rapprochement

that happened in the governance
wars in the last year.

There are number of important
forums and discussions coming

up about various treaties

and how much various treaty
buddies ought to be able

to impose their--

post themselves into internet
debates, I think we're going

to lose some ground there

and it could be I
think quite troubling.

Last point, global
internet users are furious.

They believe their human
rights have been violated

and I think they
don't yet realize

that it's not entirely clear
whether they have any recourse

for that.

There's a lot of ambiguity
in human rights law.

Human rights law are
pretty much applies,

if countries make commitments
to protect the human rights

of people within their
boarders or their control,

I don't think we began to
understand or have any clarity

on how-- who's responsible
for human rights

where there's non-physical
action

such as electronic surveillance.

And they're not going to be
happy when they understand

that FISA and all
the conversations

in the United States about
safeguards and minimization are

to protect our rights but
have absolutely nothing

to do with them.

I don't think congress
is going to care.

But I think there's a
massive laws to respect

and when we're talking about
five zeta [inaudible] whatever

that is, a non-US
person data going

into a new Utah data center, I
think that the irony at the end

of the day will be that one

of the FISA permissible
activities is collecting

intelligence for foreign
affairs and foreign policy.

And I think at the end of
the day, we may see people

of the world uniting with
their governments around kinds

of restrictions and ring fencing
of the internet that will come

to both underlying rights

and undermine the
openness of the internet.

So, that is my anxious
persons guide to the--

to what's been happening.

>> Thank you Leslie.

Randy?

>> How many of you noticed
accounted how many surveillance

devices you've past
to get to this room?

Yeah. I just walked in from the
restaurant a couple blocks away.

I counted 22 surveillance style
devices just in the walk outside

of this building and there's
at least in this room right now

that not counting your
smart phones and all that.

I hope you all can find the six

because they're pretty
obvious as to what they are.

My point on all of this
is that as a practitioner,

I'm the Sisa for Virginia Tech.

My office is responsible for
monitoring and responding

to any attacks against
our network infrastructure

at Virginia Tech.

We have our main campus down
the Blacksburg, Virginia.

It's about four and a
half hours from here.

We have a Northern
Virginia campus right

across the river in Boylston.

And so my charge,
my office is charged

to monitor any attacks
from there.

Anybody who has ever managed
an internet infrastructure has

known since the very beginning

that the internet has never
been anonymous in the sense

of tracking a machine.

From day 1, we've
always been able to track

where our machine was.

We were not able to track
who is at the machine

with any reasonable
amount of accuracy

but we've always been able
to track where machines are.

The big thing was of course
data, storage capabilities.

We didn't have enough
data storage capabilities,

disk drives.

In 1992, when I've
got involved--

first involved with the computer
security stuff, you know,

we had a one gigabyte drive and
we thought that was, you know,

the entire disc storage
in the entire free world.

And, you know, nowadays, with
the huge disk forms that are

out there, that is allowing
this collection of data.

So, from our standpoint,
that's always been the case.

So, my challenge is,
you all let this happen.

You all let knew that this was
happening and you let it go on.

There is nothing new about the
prism stuff and all of these.

It's kind of ironic for people

in my world 'cause we all
sit back and we go, you know,

in 2010, the Washington
Posts, Dana Priest

and William Arkin wrote an
excellent series called Top

Secret America where
they're talking about all

of the built way companies

that are building the
surveillance technologies

that the federal government
and other entities are using.

All out there was an excellent
series on the newspaper

that I read it back then.

Newsweek came out in
2008 where they talked

about a whistle blower
who mentioned

about NSA's warrantless
wiretapping so to speak.

It was all out there.

If you go back and you look
through the press things,

there was always something
there and nobody reacted to it.

So, it's ironic from
my viewpoint

that everybody is having
this big flop about it now

because it's been there
and you let it happen.

So, my charge to you is don't
let it happen again, OK?

When you do read
about these things,

you need to influence your
legislatures about what's going

on 'cause they do not
understand the technology.

One quick example, in Virginia,

there's data bridge
notification laws

of social security is disclosed.

You know, somebody
gets a spreadsheet

and it explodes out there.

Yet I can go to a county
courthouse website and look

up public records deeds,
divorce decrees, whatever,

and what's on those documents.

Yet the kind of clerks can't
redact that information

because until recently,
the law forbid it, OK?

Everybody was in a rush for
eGovernment but never thought

about what's in those
documents that going there.

So, we need to be
able to influence

and educate the legislatures
who are--

who are building the policy.

So, this is the whole thing.

I'm a technologist and everybody
in here, the computer scientists

and all that, you all
learned in here with me.

We help build this
infrastructure.

We may have had a
misgiving where we thought

that as builders we could
control the people who use it.

But as, you know,
previous history shown

with the atom bomb development
and all these other things,

that's not always the case.

Builders do not control
the controllers.

That's my first point.

The second point is that, again,
you all have smart phones.

Actually I don't.

I have kind of a dumb phone
and people always laugh.

They go, "You know,
you're a technologist,"

and I just have a little,
you know, Samsung Integrity

with the nice little
flippy thing.

And I said, "Because the
guys in my lab have busted

into the smart phones

and tracked everybody
all over the place."

But actually the reason
why I don't this is

because the battery life is not
long enough for my taste, OK?

But a great quote, Lyn Paramore
[assumed spelling] wrote a great

article and in there quoted
things that are supposed

to make our lives easier.

"Smartphones, Gmails,
Skype, GPS, Facebook,

they have become
tools to track us.

And we've been happily
shopping for the bars

to our own prison one prison at
a time, one product at a time."

So, we're in the-- we're
to blame for all of this.

We are allowing that to happen.

The last thing I want to talk

about is this Federal
word play thing.

Whenever I confront a student

or a professor whose been
violating a university policy,

you let something
go out on the net.

And I go. "Why did you do that?"

And it's kind of like watching,
you know, a six-year-old.

"I don't know, you know, it
wasn't my fault," you know.

That type of stuff.

And you get this
word play, you know.

Richard Pryor, a long time
ago had an excellent thing

when his son broke something
and he asked his son happened.

And all the word play that his
son came out with, you know,

"Some invisible man came
out and broke the thing."

That's what we're seeing now.

We're seeing this when they
say we're not collecting data

on you.

Well, OK, your not collecting it
technically but you're buying it

from people who are
collecting it from us.

So, that's-- that's
one thing there.

The network companies that say,
you know, the data providers,

the Verizons, the Googles,
they say, "Hey, you know,

we're not willingly giving it
to the federal government."

Well, of course not.

You're being subpoenaed
for the document.

You're not giving it
willingly to the-- to there.

You know, Zack Holman
wrote a great little tweet.

It says, "We don't give
direct database access

to government agencies."

That quote has become the
new "I didn't inhale," OK?

And so the key word is direct.

Marketers are being collecting
information on us all the time.

And, in fact, that was
one of the big things

that helped us with 9/11.

On a positive side,
that did help us

in 9/11 identify the hijackers
when the marketing companies

and the credit card companies
realized that they could help

because they had that data.

So, we need to be sure that
things are done correctly.

Everybody says we're
doing it legally.

And that's correct.

The laws stated they can do it.

It's the creation of
that law that's the flaw.

And that's my surveillance guide
telling me it's time to quit.

Those are my points.

>> Thanks, Randy.

Melissa?

>> Thank you.

Well, I think it's
important to look

to our past to inform
our future.

And I'm going to take a
little bit different direction

than my colleagues.

The very first transmission of
the internet was October 29th,

1969 and it was an e-mail
between two universities.

And today we have more than 204
e-mails are sent per minute.

More than 1,300 new mobile
users are added per minute

to the internet, 47,000
applications are downloaded,

100,000 tweets, 1.3 million
videos are uploaded to YouTube,

two million searches to Google,
and six million Facebook views.

The internet is part of
every part of our life

and over the last
45 almost years,

we have embedded the internet
in every part of our society.

And it is the backbone of our
core infrastructure of every--

every country's core
infrastructure.

It represents e-government,
e-banking, e-health, e-learning,

the next generation of
air traffic control,

the next generation
of power grids

and every other essential
service has been concentrated

onto one infrastructure,
the internet.

And that is putting
our businesses

and our national
security at risk.

And I-- when I speak about
our, I'm really speaking

in as a global citizen.

If I were in France I would be
speaking about it in France.

If I were Iran or
Israel, it's the same way.

And so I think that
that has really began

to change the conversation

that we can't have any one
single point of failure,

economic failure and/or national
security failure to any one

of our-- of our core
businesses or infrastructures.

And so when we're talking about
cyber security and we're talking

about different government
actions and we wrap it all

into one conversation, I ask
you to start to think about it

as multiple conversations.

And it's not helpful
to bundle into one term

of cyber security
and/or surveillance.

So, I'd you to-- I'd like
you to think about it

in six different ways
of why our governments

and why our industry are
talking past each other.

The first is is when we're
talking about cyber security,

we're sometimes talking
about political activism.

Those who would like to bring
transparency to policies

and to our initiatives
that they don't agree with.

In the United States, one could
say that that was WikiLeaks

that brought about a great
amount of transparency

to US policies as they
leaked our information

into the internet.

All right, one could argue
that that was also Snowden.

But in other countries
political activism is being used

by Twitter, using Twitter and/or
Facebook to organize people

in these squares like Taksim
and/or in Turkey or Egypt

to express political
discontent with their government

with the intent to
overthrow the government.

Political instability.

And so when our governments
are starting to talk

about surveillance on the
internet and/or filtering

of the internet, some believe in
political democracy and freedom

of that speech on the
internet and others do not.

And it has different
mechanisms of how they're using

that surveillance
or the technology

around political activism.

Now that should not be
confused with organized crime

on the internet, the real modern
day bank robber who's stealing

ones and zeros which
is real dollars

out of your credit accounts
or out of your real banks,

and as being passed on as
a cost for our citizens.

We have many of our
governments who are talking

about the importance
of organized crime.

When I was just in Europe
just a few weeks ago,

it was 30 million dollars stolen

out of 45 different
cities in 30 minutes.

That's a real problem
for our banks.

It's a real problem
for our credit cards.

And we're having to deal
with that organized crime

and real theft of
ones and zeroes.

Now that should not be confused
with intellectual property theft

and industrial espionage.

That's very different.

And many of our government
leaders in the United States

and many government leaders
in Europe are talking

about the unprecedented theft
of intellectual property.

Thefts, meaning,
illegally copying the plans,

processes and/or next
generation technologies

out of our corporations
for the economic advance

of their companies
and/or countries.

And so the intellectual property
theft is then not the same

as espionage.

And there are governments
that are conducting espionage.

Most governments do to steal
the plans and intentions

of other governments and
know their capabilities.

In the United States, we
sort of bundled the two,

IP theft and espionage.

When were talking about it, in
fact, we're talking about it

as Pearl Harbor and other
very exaggerated terms.

If we are going to bundle
intellectual property theft

with espionage then we have
to be willing to put espionage

that we would walk from
it as a government.

And I don't see any
government willing

to walk away from espionage.

So, why don't we talk about
what's really the problem

and that's intellectual property
theft and/or the protection

of intellectual property
and patents, et cetera.

There are two other areas that
are becoming more concerning

for most companies and
countries that are--

the first is disruption
of service.

And this is the distributed
denial-of-services actually

degrading real services
in your e-banking

and your e-infrastructures
that are preventing our banks

from allowing you to actually
access those infrastructures

and/or capabilities.

And we just had a--
and a significant,

in the United States,

we're having a distributed
denial-of-service

against our financial
institutions

and so are many others
in Asia and Europe.

And then finally the
destruction of property.

There was just recently a
malware that was released

against Saudi ARamCo

which destroyed 30,000
of their computers.

And when we start to actually
think about destruction

of property and how one
might recover from that

that is a different set of
capabilities than you would deal

with from organized crime
and/or political activism.

So, as we talk about this
on our panel over the course

of the next hour, I ask
you to start to think

about which problem
are you talking

about because we're not
talking about the same thing

in each of our conversations.

I'd like to wrap up and that

over 100 countries have
these capabilities,

and they are using these
capabilities to deal

with these different problems
whether it's political activism

to overthrow government
or its political activism

to bring transparency
to policies they don't

like is different
than organized crime

or intellectual property theft.

And there are three strategic
things that are happening

in the global order of things.

First, some are using disruptive
technology like a Stuxnet

or a Shamoon to bring
down core infrastructures

or core businesses
around the world

or some are implementing
surveillance tools to bring

about transparency or to
show the vulnerabilities

for those infrastructures
to be brought down.

So, disruptive technologies
are being used.

Second, strategic alliances
are also being wielded

to actually gather that power
and control over the internet.

And that's playing out in
the UN and the ITU and NATO

and ACION [assumed spelling]
and other of the forum

where countries can
align against each other

for particular motives.

And then finally there
are strategic properties.

And I mean that in the
very sense of it is.

There are 25 internet
service providers

that control 90 percent

of information flow
on the internet.

There are internet
exchange points

that actually control the
flow of technology and/or ones

and zeroes from continent to
continent or within a continent.

And there are data aggregators

who have actually more
information on us like a Google

or a Facebook than any
foreign intelligence service

of any other country.

So, you have to think

about where are the
strategic properties

and how they're being used

by all governments not
just by one government.

Thank you.

>> Thank you, Melissa.

Laura?

>> Good afternoon everyone.

I'm very delighted to be here.

And I wish to thank the Internet
Society for the invitation

and for GW for hosting
it as well.

I view PRISM as an
opportunity to draw attention

to the implications of broader
global internet governance

conflicts that have
implications for economic

and expressive liberty.

I recently-- recently the
last two or three years spent

that time researching

and writing a new book
called the Global War

for Internet Governance.

And it's going to be
published later this year

by Yale University Press.

Now in this book, there are
approximately four pages

at the end of acronyms.

So, what I've done is I've
challenged myself today

to not use any acronyms.

So, what I would like to ask you
to do is to pound on the table

if I use an internet governance
acronyms, so pay attention

to that, and I know some
of you will do that.

But what I tried to do

in the book is describe
the various layers

of how the internet is
already governed and what some

of the current debates are that
I expect to shape the future

of freedom and innovation
in the coming years.

Now what is internet governance?

This panel has already
described it.

If I had to give one definition,

I would say internet governance
is the design and administration

of the technologies
that are necessary

to keep the internet operational
and then the enactment

of substantive policy
around those technologies.

But there is no single system
of internet governance.

John said it best when he was
describing the various roles,

names and numbers,
administration,

standard setting, private
interconnection, arrangements

between telecommunication
companies, the privacy policies

that are enacted by social
media, by search engines

and other information
intermediaries.

And, of course, cyber security
governance not necessarily

enacted by governments
but by entities

such as certificate
authorities that are handing

out digital signatures
and things like that.

So, those are just
a few examples.

So, we need to take this
conversation outside

of discussions about
just governance.

However, one of themes that
I do take up in the book

and in my work in general is

that internet governance
conflicts are the new spaces

where political and economic
power is working itself

out in the 21st century.

We see this with PRISM,
we see this with Stuxnet,

we see this with the
turn to intellectual--

to infrastructure

for intellectual property
rights enforcement,

with governments cutting off
access during political turmoil.

And as Mellissa said,

we had denial-of-service
attacks often used

to suppress human
rights and expression.

So, internet governance points
of control are really not just

about keeping the internet
operational although

that is absolutely vital.

But there are also a proxy
for broader political

and economic conflicts.

So, the fact that PRISM
draws attention to some

of these broader global
internet governance issues is

an opportunity.

But keep in mind that government
surveillance ad censorship

for that matter which is in my
opinion an even greater problem

around the world
is not something

that happens in a vacuum.

So, it's delegated and
it is made possible

by certain arrangements
of technical architecture

and by private ordering.

So, infrastructure governance
just to give you a few examples,

infrastructure governance is
directly tied to privacy issues.

So, I have an information
engineering background.

I am also a social scientist
who studies the politics

of technical architecture.

And I can say that, you
know, you probably could say

to use a Harry Potter analogy.

There are some dark arts
of internet governance

that have a good intention but
they can be used for other uses.

So, one of these, for example,
is the deep packet inspection.

I didn't use the acronym
so no pounding on the table

which is a capability that
allows network providers

to inspect the actual
content of packets sent

over the internet rather
than just the packet headers.

So, this can be used
for a variety

of very important function
such as network management,

detecting viruses and worms.

It could also be used for
customized advertising,

now getting outside of
the operational role,

or for surveillances
or for throttling

and blocking of traffic.

So, this is a very significant
development made possible only

by advances and processing
power and storage.

And we need transparency
and accountability

in issues like this as well.

So, another area of
infrastructure related

to privacy is the hidden
identity infrastructure

that makes possible business
models that are based

on online advertising.

So, this is a good thing
for freedom of expression

because there are free products
that we are able to use,

but we are almost at the
point where the prospect

for anonymous speech considering
this identity infrastructure is

almost impossible.

We have technical identifiers
at the level of hardware

like Ethernet cards at the level

of virtual identifiers
locationally via cellphone

location, wireless fidelity
AKA wifi, it's my one acronym

or global positioning
system and through things

like platform mediation and real
identification requirements.

So, if you put this all
together, this is at the heart

of business models that
we need at the heart

of online advertising, at the
heart of having free software.

But it also is the
technical capability

that can enable new
form, even newer forms

of surveillance in the future.

So, these are new
opportunities for surveillance.

Two other infrastructure issues
I'll mention I'll mention

quickly include a current
rethinking and redesign of the

"who is" protocol
which keeps track

of who is registering a
domain name and, of course,

also the issue as has
already been mentioned

of internet exchange points.

How these are governed and
how they are distributed

around the world is something

that is very related
to civil liberties.

The Internet Society and we'll
hear from next has really been

at the forefront of
this area which--

having more internet
exchange points,

looking at the criticality
of them for human rights

for infrastructure development

and as concentrated points
of information flows.

So, the truth is that global
internet choke points,

of course, exist.

And the internet is governed
not by any one entity

but multi-stakeholder governance
which I'm sure we will take

up in the roundtable later.

But that this governance
is not fixed anymore

than architecture is fixed.

So, the architecture
is constantly changing

and the governance is
constantly changing as well.

The basic theoretical
or conceptual framework

of my own work is
that arrangements

of technical architecture are
also arrangements of power.

So, it's critical for the public
to be engaged in these debates

because the future of
internet architecture

and governance is
directly related

to the future of
internet freedom.

So, I appreciate the opportunity
to discuss that here today.

Thank you very much
for listening.

>> Thank you, Laura.

Lynn?

>> Good afternoon.

This has been a very
comprehensive set

of speaking points, I
have to say to date.

So, the Internet Society is
a cause-based organization.

We advocate for an
open global internet.

In the recent revelations

about the mass scale
interceptions not only

by the US, the UK, but
many, many other countries

around the world have
serious implications

for the open global internet.

ISOC is an international
organization.

We have members, org
members and chapters

in virtually every country

of the world perhaps even
every country of the world.

We have headquarters in
just outside of D.C. here

in Western Virginia and
Geneva, Switzerland.

And we have a very senior policy
and technical staff in little

over 20 countries of
the world often times

in the same individual
which is more

and more the future in any case.

I spent 27 years in
Europe, just moved back

to the US a little
over a year ago.

And the one thing I'd really
like to do is to make sure

that here in D.C., in
this country's capital

that we recognize that this
is not just about US citizens

and it's not just
about the foreigners

that the US is surveilling.

This affects every
individual in the world.

It affects some of
them very directly

but it will affect the
internet we all have access

to going forward to tomorrow
and to generations to come.

If we are not careful, we will
actually rob both individuals

today, tomorrow and future
generations of all the freedom

and the benefit and
the innovation

that the internet has brought.

The Internet Society actually
deals an awful lot in principles

and the principles that make the
internet what the internet is.

First and foremost,
it's a platform.

It allows everybody to go out
and develop what they choose to,

to access what they choose to,
to innovate on material that's

out there and make
that available.

If we're not careful,
we'll loose all of that.

So, the-- in particular
recently,

the unwarded collection
storage and the ease

of correlation amongst all
the data that's collected.

And I actually don't
differentiate a lot

between metadata and content.

You can get so much
information from metadata

that we shouldn't kid
ourselves by saying,

"It's just metadata we're
collecting, it's OK."

That-- though the collection
that will undermine many

of the key principles
and relationships.

And in particular some of those
natural conclusions will start

to impact the physical
infrastructure

of the internet itself whether
it's using some of the IXPs

as choke points or
whether it's using some

of the technical
capabilities that exist

to help with surveillance.

Those are all things
we want to I think--

think through very,
very carefully.

One of the principles we argue

for is multistakeholder
dialogue.

And it's because so much of what
we're all facing whether it's

in a policy or a technical

or a social environment
has never been done

in the world before.

We're breaking barriers
every single day and we need

to bring everybody to the
table for a discussion

and move forward
thoughtfully and carefully.

That is even more so when we
look to governments particularly

in their role in
protecting citizens.

We believe that the internet
must be a channel for secure,

reliable, private communication

between entities
and individuals.

And surveillance without due
process is simply unacceptable.

And as some other articles
have said recently, frankly,

it's very creepy as well.

And if that makes it more
personal, this is good

because we need everybody to
care about what's happening now.

We also challenge the
view that policies

to ensure security
must always come

at the cost of user's rights.

I'd also argue with the fact
that we all know it was coming

so what are we concerned about?

Due process wasn't followed.

That's what were
concerned about.

Did most people that
pay attention

to this field understand that
you could do all these sorts

of things with the data?

Yes. Did we believe our
governments were doing it

without due process
and certainly

without an adequate
level of transparency?

I might answer yes
but hopefully--

hopefully we didn't
and [inaudible]

to happen as Frank said.

One of the things we'd actually

like to do is really
get everybody to focus

on the multistakeholder.

A lot of the principles

that have given us the internet
find new forms, structures

and processes to address that.

Don't revert back to we
need a new institution.

I don't think that is the answer
in almost every situation.

Some of the recent proposals
that have been put forward

to address some of these
aspects would call for treaties.

Treaties are largely
intergovernmental.

They don't allow for
the private sector.

They don't allow
for civil society.

And honestly I don't
know how you get some

of those private
sector companies

to sign on to a treaty.

So, I don't think treaties
are the answer either.

We're going to need to create
new processes and new forums

and certainly at the
core of all that ought

to be thoughtful
informed dialogue.

So, I think, you
know, it's our hope

that as these discussions
continue across the world

that we recognize and
come to agree again

on some other high
level principles.

Some of the ones I'd throw
out for further debate,

is it unwanted surveillance
even in the furtherance

of national security
is not acceptable.

Unwarranted surveillance
is not acceptable.

The disproportionate
surveillance is also

not acceptable.

That surveillance
without accountability is

not acceptable.

And further, turning

to something a little
more positive,

that there should be
transparency with respect

to policy and its
implementation,

that we should be harnessing the
expertise of all stakeholders

to discover better ways
to protect citizens

in a global community.

And most importantly,
encore to everything we do

that we uphold human rights.

And so I look forward to
the discussion for the rest

of the day, and thank you.

>> Thank you, Lynn.

Danny?

>> Thanks, Lance.

So, thanks to the Internet
Society and GW, Lynn and Lance,

for getting-- Paul for
getting us together.

And at the end of the
panel, I'm always reminded

of this very distinguished
member of Congress said

at the near the end of a very
excruciatingly long hearing,

everything's been said but
not every one has said it.

So, I subscribe to much
of what has been said

by many of my fellow panels.

I want to just make three points

about what I think we've
been experiencing as a result

of this surveillance
debate over the last month.

I think fundamentally what
we've had is a certain degree

of a crisis in confidence
and a crisis in trust

about the internet environment.

The question is, should
you trust it or not?

And as Mellissa noted,
it's, I think, useful to try

to breakdown to some extent
our current sources of trust

in the internet in particular,
in society in general.

I want to just make three
points about the institutional,

legal and political levels of
trust that we tend to look to.

To start with the
institutional, you heard from--

you heard from John and
from Lynn about some

of the institutions that
make the internet work.

You know, I think
it's interesting

when you look purely
technically at the internet.

People pretty much trust that
the pack is going to arrive more

or less in the right order.

And enough of them
will get there

that you could get your
message through it.

You can watch video.

We don't-- we don't have a
lot of debates about that.

I will note just as a kind of
a observation of the sociology

in a certain way of people

in the internet technical
community.

There is a sense in some
ways as Lynn suggested

that if any third party
can get in the middle

of a communication stream
between two parties,

but that is in a sort of
very idealized sense a

technical failure.

It's the internet
not working properly.

Now that's a narrow
technical view

of the internet environment.

We, of course, have a
broader legal and social

and political view of our
societies, and we do recognize

that that surveillance
and espionage will happen.

But part of the challenge, I
think, in closing the trust gap

that we have is to articulate
better what those sorts

of expectations are.

We do have administrative
institutions

like that run the
domain name service

and IP address assignment.

Thanks to people like John.

They just kind of worked--

people grumble about
I can't [phonetic].

But so far, you know, people
are getting new domain names.

They are being maintained.

Nothing has completely
fallen apart at that point.

What I think is more complicated

on the institutional trust
front is that in many cases,

we're used to looking
to government

to establish trustworthiness
in society.

And certainly governments
believe their job is

to establish trustworthiness
in society.

But as you've heard, many
of our sources of trust

in the internet are
actually not governmental.

They are working perfectly well
largely without governments.

And I'll come back
and talk about that.

But again because of that
somewhat unusual circumstance

that Lynn alluded to, these
multistakeholder processes,

we probably have to understand
that a little bit better

so that people can trust
those environments.

You know, on the-- when we
look at legal institutions,

we rely a lot on our
legal institutions

to establish trust in society.

We hope that our legal
institutions make it

so that most people and most
institutions mostly do the right

thing most of the time.

We don't expect perfection

but we do expect our legal
institutions to set standards

and that there are consequences
when they're not followed.

I think when we look at
the privacy issues raised

by the current surveillance
practices

that had been revealed, the
problem that we have, I believe,

is that every one would like
there to be a sense of privacy

in our communications
environment.

But I think we have a real--

a lot of confusion about
just what that ought to mean.

We tend to think about
privacy particularly

in the computer network
environment as being able

to keep things secret.

Well, I think we all understand
now that we don't have a lot

of secrets, and we rely
on lots of third parties

to maintain our information.

So, we don't keep secrets as
well as we may be used to.

And my own view is that that
means we have to start thinking

about privacy more as a question

of whether information is used
properly whether it's misused,

whether it's used

to discriminate unfairly
against people.

But that's going to require
certain amount of discussion.

Lots of people have
mentioned accountability.

We're going to need better
accountability mechanisms

for these more complex
privacy rules.

When privacy is not
a binary phenomenon

that is either it's secret or
it's not, we need mechanisms

to assure trust in the way
personal information is handled.

I think there's a very
simple analogy actually

that we can draw from
the financial world.

Huge parts of our economy,

huge parts of the
world's economy run based

on a pretty well understand
set of accounting rules.

We're used to looking at
balance sheets for corporations

and having some sense of trust

that those balance sheets
reflect what's actually going

on in the financial life
of the corporations.

We don't expect to see
all the transactions

in the general ledger in order
to look and get a picture

of whether the corporation is
profitable, not profitable,

paying its taxes
correctly, not, et cetera.

Now there are-- this doesn't
always work perfectly,

but I the analogy particularly

to the NSA surveillance
situation is quite strong.

We do as citizens of the
United States want to be able

to have a sense of confidence

that our intelligence agencies
are following the rules

that they say they're following.

My guess is they probably do
about 90 percent of the time.

But we want to know that
there's some accountability

to those rules.

I think we understand that
we're not going to be able

to send auditors, independent
auditors inside classified

environments and can have
them come back and report

on everything they found.

But if we follow this balance
sheet model, if we follow

to a methodology of assessing
how information is used,

we can get that sense
of trust back.

And finally, as a
matter of political trust

and by political,
I don't mean kind

of small P Washington politics.

I really mean politics
in the sense

of how we organize
ourselves as a society.

As people on this
panel have noted,

our sources of political
trust are complicated

in the internet environment
and unusual.

We are used to the
idea of states

of government's exercising
authority directly

on institutions often
on intermediaries,

but in the internet
world and we're--

and if you considered
the analogy

between telephone
networks in the past

and internet service providers
today, telephone networks,

broadcast networks were
really creatures of the state.

They were authorized by
the actions of legislatures

and therefore controlled in that
way at the local state federal

and even international
legal level.

The internet doesn't--
has not happened that way,

it was not a creature of the
state ever, it was really

in many ways a creature of
individual and voluntary action

by some people on this panel,
by others all around the world

who participate in making this
internet institutions work.

But now when we're
nervous about how they work

and how the state work
we have rethink some

of these relationships.

So, we're going to have
to get use to the fact

that governments-- I
would submit cannot reach

into these internet institutions

like the internet engineering
test force like I can--

like the worldwide
web consortium

and achieve exactly
the result they want.

But of course at the same time
governments will make laws

and rules about how individuals
and corporations act whether

for intellectual
property protection

or privacy protection
or anything else.

So, I think that what this--

the whole surveillance
experience has revealed is

that the rules and expectations

that we have are quite
a bit more nuanced

than the very binary
technical behavior

of the internet environment.

And I think our challenge
is now to do a better job

of articulating just
what we expected,

all these different
institutions at all these levels

and how we're going
to find accountability

to those expectations.

Thanks.

>> Thank you Danny and thank
you everybody on the panel.

I think what we'll do now,
I'm going to open up first

to the panelist for
five or 10 minutes

so they can ask questions
of their fellow panelists,

make further, you know,
comments, go some back and forth

that way for five or 10 minutes.

In the meantime if
you in the audience,

if you have a question would
you please if you're physically

in the audience here
at GW step up to one

of these two microphones in
either of the isles, form a line

and when your turn comes please
state your name and affiliation

and then ask your question.

If you are in the internet
world, if you're off

in the clouds somewhere and
want to communicate send it in,

Paul any other directions
on that

or you have some
questions already?

While you're waiting, I want to
give the panelist a chance first

but any other protocol?

>> So, they type the
questions into live stream

and I'll be reading them
here at one of these mics.

So, that's for the
live stream panelists.

In New York they can just line
up at their microphone there.

>> In New York they can
line up their microphone

and we'll see them
live up there?

>> We'll see them,
yes, that's right.

>> OK.

>> Very good.

>> All right.

This will be interesting.

OK, but first let's get to the--

give the panelists a chance
to ask questions, Leslie?

>> So, I want to ask a question
of Danny because talking

about the concern or persuading
people that, you know,

winning people of off
government is sort

of the governance structure
for the internet and trying

to educate them that it's
not really government,

it's all of these other
institutions and we do them

in a multi-stakeholder
way and many people

up here have spent
considerable time trying

to move people to that model.

It just seems to
me that the rest

of the world right now is going
to think we've been involved

in a slight of hand

that basically we're
saying governments stay out,

governments don't get
too involved here.

All these other into multi
stakeholder institutions are

really the core of
the internet and then

at the same time
building an environment

where the United States
uses historically--

historical dominance

to basically trump all
of those governance.

So, I hear what you're saying
but it was a hard argument

to make to the rest of
the world beforehand.

I'm just curious
whether you're continuing

to say it with a straight face.

But I'm having trouble.

>> It's a habit.

I guess what I would say
is the ability to make

that argument really
depends on--

as several people
have said the layer

at which you're making
the argument.

I don't believe that the NSA
surveillance changes one bit the

question of who should be
setting standards for TCPIP

or who should be determining
how domain names get assigned.

I do believe that as you
said Leslie that the question

of government espionage
activities whether it's the NSA

or GCHQ or MI5 or, you know,
the German Intelligence Agency,

the French Intelligence
Agency, anyone of them,

all of which you're doing
exactly the same thing.

I do believe that we now have
to have a more public discussion

about what our expectations are

for surveillance
including espionage

in the internet environment.

But that shouldn't get confused
with the question of whether all

of a sudden we need
a treaty about how

to set internet technical
standards.

And I believe that, you know,
I'm highly uncomfortable talking

about the rest of the world.

But I think that what we saw in
the internet governance debate

at the United Nations at the--
in Dubai where the proposition

from Democratic countries like
Iran and China and Russia was

to exert greater control

over the internet environment
was rejected not just

by the usual suspects, that
is the 34 OACD countries

who you could somewhat
expect to do that.

But by another 20 countries,
from Africa and South Asia

and different parts of
the world, that I think

at Brazil have recognized that
while we could always do better

with the current internet
governors arrangements

that they're working and
messing with them has a cause

for all those countries.

So, I think as long as we
keep these issues distinct

and don't confuse them
I think there's a way

to have both discussions
in a coherent way.

>> Well, so I agree with you.

>> I know you do.

[laughs]

>> But it seems to me
the opportunity here

for many countries to
combine them together

to not make them distinct.

The opportunity to
reclaim control

by basically bringing
this together.

>> Sure. So, what
did Russia say?

What did Russia say this-- you
know, Russia said in response

to the NSA we need more
government control--

>> Right.

>> -- of both the
internet infrastructure

and the internet companies.

It's a-- I mean, I think the
question is how does anyone say

that with a straight face

when the concern was undo
government intrusion?

But, yeah, I mean it--

people who want to make those
arguments will find ways

to make them.

>> I worry that many of those
in between are suddenly going

to become more persuadable
because of the outrage.

>> So, I have a question
for my fellow panelists.

And it's sort of following
what Danny just raised.

In December we had an
interesting conference,

the World Conference

on International
Telecommunications.

I'll use the acronym
WCIT not 'cause I want

to have the table bounded.

I explain the acronym first.

>> You did.

>> But you hear the
term WCIT so I want

to pronounce it as
you might hear it.

But the World Conference

on International
Telecommunications was look

at some treaty arrangements.

So, some tariffs.

Regarding interconnection
and there were number

of very interesting proposals
that shut up in Dubai.

And I'm struck by the
timing because that happened

and now we now have a lot of
events regarding surveillance

and then I say and
so on and so forth.

And I guess with my panelists
I'd ask the question,

does anyone care to speculate
if water had been reversed?

What the outcome
would have been?

Because I've had a
few people suggest

that that's an interesting
exercise.

I am not sure whether or not
the outcome that we had in Dubai

in December is what
we would be seeing

if in fact it was being
done instead next month.

>> Hold on, that was my concern.

That's my concern.

Well, I think that if you
look at the World Conference

on International
Telecommunications,

it was an important treaty
negotiation, renegotiation

that hadn't been renegotiated
since 1988, is that right?

'88. And as Americans we look
at these negotiations as one--

as a one negotiation and I think
that that's a poor perspective

because the WCIT was really

about how does one monetize
the internet and to pay

for court infrastructure.

And it is one of a multi-series
of negotiations, the world--

there's another
telecommunications conference

on policy, WTPF, it
just happened in Geneva

and they'll be the world
summit on information society

that will be culminating
in 2014 I think, right?

2014, '15.

>> So on, yup.

>> And there will be 24
negotiations to go between now

and then that will ultimately
be where things will land.

And then from-- the world summit

on information society
will be the strategy

by which will be executed
in the WTPF for policy.

The WCIT for regulation and
in the internet standards--

in the international
standards organization

for the overall technology.

So, I think if you are a
person in the corporate world

and you're worried about these
things you shouldn't just look

at one of these forums
as one off.

And if you're worried about it

from a government perspective
it's not just the policy forum

where the regulatory forum,
it's all of this forum

and they're all interconnected.

So, I would say that yes, I
think you actually suggested

that it was a positive outcome
at WCIT in Dubai and I think

that the United States lost
in that negotiation but--

and I think that the United
States and many are going

to continue to lose and it's
going to be a quick erosion

of our stance not a slower
version of our stance.

>> I'll take one more
question from the panel.

Any other panelist has
a question before we go

out to the audience?

Going once?

OK.

>> Mike Nelson with
Bloomberg Government

and with Georgetown University.

I want to commend the internet
society for great panel,

we got the lawyers,
we've got the techies,

we've got the scholars,
we've got the activists,

and that's great but we
tend here in Washington

to talk about the policy.

And Danny I tweeted your--

a [inaudible] of your talk
which I thought was exceptional.

And that was--

>> You got it to 142 characters?

>> Less than that.

But you basically said, data
will flow, we can't really focus

as we used to on
controlling that flow,

we have to control the
misuse of that data.

Policy makers are starting
to understand that.

But I think we also
have to figure out a way

that techies can start
implementing systems

that reflect that.

And the first way to
do that is to make sure

that systems are more
transparent so that we can see

where data is being misused.

And I guess I'd challenge the
audience to think about privacy,

not to tell the audience
and the panel to think

about transparency by design.

We've heard about privacy by
design but has anybody thought

of examples of where we're
building in the transparencies

so its in the technology
and other places

where we could do that better?

Just an open question.

>> Laura?

>> OK. I think that's a really
great question and a good point.

I'll give one example of where
I think the transparency is

excellent and then
a couple of examples

where I think we need
more transparency.

What is one of the oldest and
most vulnerable institutions

of internet governance?

The internet engineering
taskforce jumps to mind.

So, this is the-- one

of the standard setting
organizations for the internet.

There are many others
but they have set many

of the core standards so they
have a tradition of being open

in three different ways.

They're open in the
development of a standard

and that anyone can participate.

Now, granted there are a lot
of barriers to participation,

it requires a lot of
technical knowledge,

it requires in many
cases money to go to some

of the events in time.

But it is basically
open to anyone.

They are also open
and transparent

in that the actual
specification.

So, a standard is
not really software

or hardware specifications
that are written down

and people can go
online and view them.

So, I would differ with some
of the panelists and say that,

"Oh the technology
is-- it is political."

So, the technology designers
make political decisions

in the design whether they
like to call it that or not.

So, sometimes privacy
is designed in.

Think about encryption
standards for example.

Think about unique identifiers
and the privacy implications.

Yet the specification is
open so there are some degree

of accountability where
people can view it.

It's also open in
the implementation

because it results in
multiple competing products

that are based on that standard.

So, that's an example.

In other cases we don't have a
lot of transparency and I agree

with you that we need more.

So, here is an example, how do
we look at interconnections?

So, this is an area where
I'm worried because of all

of the calls for greater
government regulation

of interconnection in an area

that has worked fairly
well up until now.

Well, part of the reason
we're seeing this calls

for a regulation is that we
can't really see what the

agreements are between
these private companies.

So, I think it would be more
helpful to have transparency

in an area such as that as well
as other infrastructure areas.

>> So, I want to go
back to Danny's premise

which you apparently
support which seems to be--

data will flow, everybody
will collect it

and we should only
focus on the uses.

And that's certainly a
discussion we've had on sort

of the consumer side
of the ledger?

You know, Google will
collect it and where we have

to focus our attention
is how they're using it.

I have to submit the government
is collecting information

and certainly the US government
collecting information really

to-- is subject to-- I mean in
our own country it's subject

to this little thing called
the Fourth Amendment and I know

of no case and I stand-- I'm
willing to stand corrected

that says, you can go in--

I mean, this is essentially
what the governments is arguing

in NSA collection.

And they're calling it
acquisition and not collection

that acquiring the
information is not collection.

And that any rights that
might attach don't happen

until you open and
look at the packets.

I don't know, you know, I've
never heard anybody come

into somebody's house, walk
away with their desk drawer

and say, "We're acquiring."

To let you know if we ever
get around to looking at it.

And so-- Danny and I have
some disagreement although I'm

getting persuaded
more and more by his--

by the question of use
in the commercial side

of this big data world.

But, I'm not willing to go
there in terms of governments.

And I think it's a really
dangerous thing to do.

>> So I-- just to
clarify, my observation

that data will flow is not
meant as a moral conclusion.

And I think the extension
which we choose to put limits

on how much data government
can acquire from those

who have already
collected it, right.

Because that's what
we're talking about here,

it's very important and I think
that historically we have relied

on technical barriers to large
scale information collection

as a way to limit how much
power the government has

and we don't have those anymore.

So, we're going to have
to get very explicit

about what limits we think
government should have

on both the collection
and the use front.

My only observation kind of
back to your point Mike is

that we are much
better technically

at managing collection
limitation

than we are managing
use limitation.

Just as a pure matter
of the kinds

of computer science techniques
that we have available

and I would submit
that's because, you know,

the computer security community
cryptographers have taught us a

huge amount about how
to keep data secret

and control access to data.

There's a whole other set
of disciplines developing

in computer science that try to
characterize information usage,

track information usage,
but it is a different--

but there is less progress
on that because I think

that that's not a
view of privacy

that computer sciences
have previously focused on.

So, I think you're
exactly right to point

out that we need
more work there.

>> I'd actually hear
from the techies.

Because I wasn't thinking
so much about transparency

at the institution
level at layer eight.

I was thinking more
the lower levels.

Well, like--

>> Oh, I'll give the--
let me give the--

>> -- like route to tracing,
you know, when we send an e-mail

to each other you can find out
where it balanced along the way.

>> Let me give the techies
about two minutes before we move

on to another question
because we will have a chance

to circle back in
the round table again

so we can take another
bite at the apple here.

>> Yeah.

>> Go ahead.

>> I just want to--
just very quickly.

Stealing is stealing.

It doesn't matter whether
it's in the physical world

or in the cyber world.

So, whatever the techniques you
have to collect data of a theft,

in the physical world you
can apply the same techniques

in the cyber world.

The difference is speed.

I mean it takes me
physically a long time to go in

and steal a laptop from
the gentleman's tester

but I can steal all the
information on his laptop

in a second, probably as long
as it took me to do it as long

as I can connect
it over the net.

So, the comment about
the government, you know,

and the search warrant in
the constitution, you should,

you know, that's why it's there.

That's why we have
the constitution is

to follow those laws.

And you can still achieve
the same goals and stay

within the constitutional
limits.

It's been done.

It's just that what's happened
is we got a bunch of people

at the policy level that
didn't understand what the

implications are.

And that's where-- everything

that they've done
has been legal.

It-- the law is the problem.

Not what whether
they're doing it or that.

>> I would question that.

>> But--

>> OK. I'm going to move
this along because I want

to give Joanne a chance and
I'm sure Steve is getting a lot

of farther for the round table
to come back to just later on.

>> So, I don't want
to pick up on thing

which is the internet has
a tradition or convention,

I wouldn't say tradition,
convention of protocols

which behave in an open manner.

And so, this is for
example, your--

when you're looking at how
packets flow, there are commands

like traceroute that let you see
how they go through the internet

and you can map them through an
exchange point most of the time.

When you look at mail headers,
you can look at e-mail headers

and you can actually see,
wow that's not my e-mail,

it got from point A to
point B and it's visible

and you can see those
most of the time.

When you look at a packet that
you've received you can look

at the source address and
say, "Oh, where is that from?"

And you can look it up and
find it most of the time.

Now, there is no
obligations that any

of this information is accurate.

It's all sufficiently accurate

to keep the internet
running or at least so far.

And we hope it will
just keep it running,

but there's no actual
obligations and you need

to be careful because while
there would be some benefit

to having an attribute that says
there's an actual obligation

to make this accurate, then
I see people emerging saying,

"Well, wait a second, now I'm
worried about my anonymity

because now you can trace my
IP, or you can trace my e-mail."

So, we have just a
convention of transparency

which has been enough to
keep the internet running.

There is a question on
whether or not that's going

to actually work long term.

The point that was made by
Randy which is that the rate

at which you can attack
something digitally is a lot

faster than physically.

And this means that the ability
to have an accountable internet

where we can actually figure
out who sent the bomb threat

or figure out who sent the
e-mail which cause the problem

at the school is
potentially a very large duty

and it may require us making
a tradeoff between anonymity

and curated anonymity in
order to have accountability.

Right now it's not
clear that one

or the other is the
right answer.

>> So, we may-- we'll circle
back to this in the round table.

Let me move on to the
next question over here.

>> All right, I'm [inaudible]
cofounder of Codex for Africa.

This is more to as
the techie side too

but at the same time
from a global view.

We represent thousand
of developers in Africa,

in the upcoming years it's going

to be more software
developers who're are going

to be creating thousands of
applications on mobile and web.

And one of the things is what
are the strategies there,

when you have emerging countries
or emerging economy jumping

on a bag of bandwagon of using
the internet to do transaction

with the US or the
western world.

What do you think what would
happen because I could be

in a country like Synagogue,
you know, do some hacking,

I can do anything I can because
you don't have access to the--

maybe the continent
level network.

But as well as the
western world,

what are your strategies
and all that?

>> Well, this is where
the law comes into play.

What we hear on the
techie side for instance is

of course there is laws
in hacking in the US,

but there is no laws
in hacking in China,

as we would understand it.

So, each country gets to define,
you know, what a hacking is.

Some may take it as an
assault against the government

if you are hacking, you know,

some might just say it's
a plain and simple theft.

So, you're going to have to-- I
would think you'd have to look

at each individual
country's definition

of what they considered to
be hacking in that case.

Now, on the other side, again,
if you're writing an application

for someone like that then
you're going to do logging,

you're going to do all of this
type of stuff because you want

to provide an auditor
if you will

if it's a financial
application with some record

of whatever transactions
your software handles.

So, there's always going to be
a record of something that you--

either your app did or
where your app went.

Whether it's accurate or
not that's another question

but there's always
going to be a record.

And again, metadata
analysis I can use that

and make some inferences

as to what you did even
though I can't see what you--

what's in your individual
packets if you encrypted them.

>> John?

>> So, that's an amazing
wake up call here.

So, we have this internet
that's remarkable.

It allows people to interact,
people in different countries

with different expectations
to interact.

And yet, the conventions

by which governments work
haven't evolved fast enough.

The idea that citizen in country
A is interacting with citizen

in country B and it might be
illegal in one country and not

in another is a whole
new concept

that governments are going
to take some time to try

to figure out how to deal with.

So, we have a problem.

We literally have an
internet that has capabilities

that governments haven't
come to grip on how

to handle their duties
and responsibilities.

I know governments
have feel very strongly

about protecting their
citizens against pornography

or against certain
types of content.

I know governments
in other countries

that feel very strongly that
that's up to each citizen.

But the reality is that that
intersection has now happened

because of the internet.

Two governments can have
very different views

on what their responsibilities
of their citizens are.

So, to answer your
question in a general case,

the internets move
faster than governments.

Governments literally do
not know how to interact

with the situation you describe.

On a practical matter, if
you end up doing something

of significance, something
that causes a lot of harm

or actually there's a very
nice list of types of attacks,

distraction of property, theft
of intellectual property.

There's different types
of extortion or DDoS,

if you actually do something of
a major magnitude you'll find

out that law enforcement does
cooperate between countries

and it works very well.

It's just not set up for
the scale of the internet.

And it's in the age
of the cooperation

between law enforcement

and various computer
response teams is one step

above fax machines ringing
and going back and forth.

We have the mechanism to
handle the really bad events

fairly slowly.

We don't have anything
to handle the scale

of automatic attacks
happening 24 hours a day

around the entire
globe which don't--

>> Let me move to Danny.

He wanted to say something
and then I'm going to move

on to the next question.

By the way, I can't
really talk to anybody

in New York once
I ask a question.

So, what they do I guess
they'll stand up or something

or else go through Paul.

Danny, go ahead.

>> I just want to make one
observation about the challenge

of international law
enforcement cooperation.

Most people in this room
are probably familiar

with the SOPA debate that was
proposed in United States.

In a certain sense we only
have that debate with all

of its cataclysm because of the
failure of current mechanisms

in international law
enforcement cooperation.

We have that debate, the
Congress was considering

that law blocking access

to websites outside
the United States

that might have infringing
content because people

in Congress were concerned

that US Law Enforcement didn't
have an effective way of working

with law enforcement
authorities from the countries

where the infringement
was actually happening.

I think that we have to get a
lot better as John is suggesting

at add enforcement cooperation.

There are realms where that
works reasonably well but it's--

the problem is it's mostly
cooperation in the form of how

to make a criminal conviction
against someone to stick.

Law enforcement cooperation
mechanisms are good

at exchanging evidence,
it make sure

that you have the information
you need to, you know,

bring someone to
trial but not good

at actually stopping
the behavior

that maybe harmful
as it's happening.

So, I think it's a
very big challenge.

>> All right, go to Paul for a--

>> I actually did see that
David Salmon [assumed spelling]

of the New York Society's
chapter president would

like to have a question.

So, why don't we go
to him if he will--

I think they have a
little bit of a delay.

So, he might just be
hearing this in a second.

>> OK David.

[ Inaudible Remark ]

>> OK, that's your cue David.

>> OK. I'll speak to the
camera then or-- yeah.

OK, so.

[ Inaudible Remark ]

OK, we have some delay here.

My question is what sort

of scenarios do our
panelists envision

and what would be some
alternative solutions

if our government specifically
Congress is unwilling or unable

to rain in agencies such as the
NSA in terms of surveillance?

If they can't do
it or choose not

to what would be
the consequences?

Are there technical solutions
or are there possible solutions

that could be implemented
without US government?

>> OK. The panelists are being--
the panelists are being asked,

is there a work around congress?

>> I would just to
speak to it just

as an individual not
as a panel member.

But if congress can't rain

in the government agency we
have a lot more serious problems

than what's going
on in the internet.

>> When was the last time
we passed a federal budget?

>> I mean, they are
government agency.

Congress has to do that.

Now, again, there is
classified information

and all this other stuff that
can influence how law is passed.

But quite frankly if congress
didn't have that power

to do it then we wouldn't see
General Alexander making a run

up to talk to members, I
think was it today or--

>> No, it's tomorrow.

>> Yeah, the vote is tomorrow.

So, you know, doing that,

so certainly I would think
congress has the ability to do

and should have the ability or
else we don't have a democracy.

>> OK, any other
panelist winging on that?

Lynn?

>> Well--

>> You can just say quicker
than I'm-- oh, I'm sorry.

>> No please.

>> That, you know, there
are ways for people

to manage their traffic.

I know I'm certainly certain
that would be even more ways

for people to manage their
traffic and choose the routing.

We actually are quite
concerned about that

because it will make the global
internet much less resilient.

It will-- putting something
in a box doesn't mean it's--

it maybe protecting it from
one country actually examine it

but it doesn't protect
the other country.

And so, I'm not quite sure
what David's question was but,

you know, if it's about
routing and the ability to route

around what you see as a
problem, I think we need

to be very, very
careful about what some

of those potential solutions are

and because I don't think
it will address the question

you're-- the problem you're
trying to route around.

And in fact it will overtime
make the global internet much

less resilient.

>> Paul?

>> OK, I have a question
from live stream.

It's from Garth Gram
[assumed spelling].

He asks, is the real
issue autonomy

and self determined
choice rather than privacy?

And if so, what is
the role of identity

in addressing the
issue of trust?

>> Well, I'll take
one step at that.

I think that in the
discussions of privacy

over the last 10 years or
so, maybe longer I think

that we've gotten a little
bit distracted by the promise

of individual choice as
somehow the key to privacy.

I think that a lot of
the privacy values--

and what I mean by that
is the dialogue box is

that everyone sees in, you
know, one website or another

where you have to click here
to accept the privacy policy

or swat away a dialogue
box to proceed.

And I think certainly in-- it's
actually a remarkable point

of convergence between the
United States and Europe

in the last couple years
both the White House

and the Federal Trade Commission
issued major privacy policy

statements that noted
the limitations of this

so called noticing choice or
individual determination model.

The European certainly have
pointed that out as well.

A lot of the things
that we value associated

with privacy are
collected values.

We want to make sure
people can associate freely,

can engage in politics,
can engage in commerce,

can seek medical
care, et cetera.

And I think that giving
people the choices to opt

out of those things or
somehow control their identity

when they are trying to
speak to their doctor or make

up public political
statement really seems

to be exactly the opposite of
some of our core privacy value.

So, I think that
there are situations

in which individual
autonomy is quite important

but a little bit also to the
last question about the NSA.

I don't think we get ourselves
out of these privacy problems

by just giving people, you
know, 20K long encryption keys

to wield against everyone else.

>> Laura?

>> That's a really
interesting question and I want

to tie it back to something

that I think Danny said
before about data will flow.

And, you know, while
I agree with that,

that's also not necessarily
the case.

We have interconnection disputes
that have resulted in outages,

we've had countries
that have cut off access

for their citizens.

We have areas of the world
that have infrastructures

of complete censorship.

We have digital divide
issues, we have trends away

from interoperability where
we're going in the cloud

to more proprietary
protocols for example.

So, it's-- so data will
not necessarily flow.

But one of the things
that is required for it

to flow is this issue of trust
that the questioner brought up.

So, I think I can mention just
a couple of areas or maybe three

that are very important.

So, the trust has always excited
between network providers

to exchange information about
IP addresses that are either

in their control or that they
can reach on the internet.

But we have seen
examples that's done

by through a boarder
gateway protocol.

There have been examples

where false routes have been
advertised whether intentionally

or not and outages
have occurred.

So, there is-- our effort
is underway now to secure

that which are very necessary.

So, we have to build
trust into the network.

It's not something that
we can just assume.

It has to be designed in,
it has to be build in.

The same thing with how the
domain name system works.

We have servers located around
the world that resolve queries

of domain names like maybe I'm
up here looking at cnn.com,

I'm not but the domain
name server would resolve

that into its IP address
and route the information.

Well, that can be gamed also

and that there can be a
false return of a query.

So, having things like domain
name system security extensions

has to be continued
to be implemented.

You know, these are just
a few of the examples,

an answer to the question
that it has to be designed in,

same thing with website
authentication.

If I'm saying that correctly the
role of certificate authorities

and how they verify
through a digital signatures

that a website is who
the website says it is.

So, again, this is an
example of the politics

of the architecture, it's
no just about agreements

between people but about
designing this trust

and identity into
the infrastructure.

>> I'm going to move on
to the next question just

because I want to get the
audience as much opportunity

as I can because the
panelists are going to be able

to circle back on this
later on over here.

>> So, I'm Luke Wadman [assumed
spelling], I'm a student working

as a policy analyst intern,

analysis intern for
IEEE this summer.

I'm working on internet
governance issues.

And does the panel
think there is any--

would it be a good way to
frame the debate on privacy

and internet governance and
et cetera in economic terms

because if I've learned
anything in my time in DC it's

that catching the ear

of our congressional
representatives is easy

if you start talking about
jobs and job creation

and we've already talked a
little bit about the impact

of things like prism on US-based
IT companies like Google

and Facebook, particularly
in the EU

but also around the world.

One case is that Google isn't
really competitive in China

and that's probably going to
continue in that direction.

So, would that be a good way to
frame this whole conversation

and actually encourage some sort

of positive congressional
action?

>> So, I would never say
that I have any idea how

to encourage positive
congressional action.

I just want to put
that on the table.

I think it is true

that everything that's
happened this sort

of last six weeks inside this
sort of NSA bubble has happened

without any reference
as to what it might--

the impact that it might
have on US industry.

And I think it is possible
that the impact at least

in the short run maybe severe.

On the other hand a
lot of people may carry

on about being unhappy
about discovering

that the NSA is sucking
up their data.

Historically, when
the big comp--

if you look at the SOPA fight

which I think was
probably the first time

that US internet industry sort
of held hands with activists

and technologist, it does
get congresses attention.

I will say though that
National Security is different.

It is just always
different and the arc

of National Security has been
more, more, more since 9/11

and the question is whether
these revelations have sort

of pushed us beyond the
more and more place.

>> OK. Let's move over here.

>> Hi, I'm Susan Aaronson
with GW, I'm a professor here

and I work with the
Worldwide Web Foundation

on measuring internet openness.

And I want to ask you a
question that relates to trust,

the trust of policy makers.

So, in the last couple of
days we've seen [inaudible]

and Angle a Miracle [assumed
spelling] make these delightful

comments about sever locations
and threats in terms of privacy.

And again, I wonder
if there are--

so, they're basically saying
if the server can't be located

where we can control, where our
privacy rules dominate we might

not accept for example some

of the things the
United States wants

in the trade agreement or--

and we see similar things with
the Trans-Pacific Partnership

and I just wonder if you
could talk a little bit

about this now.

You know, you can always, for
national security reasons,

you can always say you have
a particular policy in place

and it's not protectionist.

But this is opposite
of that, right?

They're saying that
for privacy reasons,

they want to essentially
protect their citizens

from their information
being traded

by having the server
location in the United Stated.

If I may add one other
thing which is Frank La Rue,

who works for the-- who is
the UN Special Representative

on Freedom of Expression,
he has said basically

that the US' failure to protect
the privacy is a violation

of its human rights' obligation

because that is a
basic human right

under the Universal
Declaration, blah, blah, blah.

So I want to hear your comments.

>> Sure. I'll do this.

Pull it out there.

I'll-- the Trans-Pacific
Partnership

and the US Free Trade Agreement
is and always will have had

to address the data
privacy laws.

The Safe Harbor that
we had in place

in 2001 will actually
expire with the agreement.

And the United States, as you
know, has no national umbrella

for data breach and
data privacy.

We have 47 individual states
with their individual programs

and no national umbrella.

And so, if we're recalling
for congressional action

that had an economic, you
know, significant impact,

there are 52 pieces of
legislation currently

in 113th Congress
around cyber security,

about 10 of which
around data breach.

It would be wonderful
if we could get

to some bipartisan
agreement on that

so we could enable the
overall Free Trade Agreement

to move forward between
the two continents.

More specifically though, noting
the 47 different state laws

and noting the difference
between the Europe

and the United States,
cloud computing

and where the data is
stored follows the geography

and will always follow
the geography.

So if there's a data breach
here in the state of Virginia,

it follows a different
set of rules

than Massachusetts
and in California.

And a company, whoever the
company might be, actually has

to know all sets of laws
for that particular state

in this case in order to follow
the regulatory compliance,

et cetera.

That also is the same
for if it's stored

in the United Kingdom,

it follows the United Kingdom's
laws, and the Netherlands,

and Brazil, and you
pick the place.

And so when the EU and
the leaders of Germany

and elsewhere are talking
about the data protection

and data privacy, and they are
looking at the United States

and worried about how our data--

we're protecting
data and the privacy,

then it would be also important
understand how the European

companies are mirroring data
in other countries like Brazil

or South Africa or
Egypt or China or India,

et cetera because the data
always follows the law

of the geography
that it sits in.

>> I'll just add to that
that one of the things to--

I mean, obviously, the
NSA revelations have sort

of strengthened the EU's
hand in a discussion

that was going long before.

We have a particular view
of what privacy means.

It doesn't match up, going back
to this question earlier about,

you know, what economic kind of
motivation might move Congress.

One would think the US
companies would move forward

on a comprehensive
data protection regime

in the United States that
might be more flexible

and perhaps reflect the internet
more than the European one,

but I haven't seen them
step forward on that.

I think it would be interesting
for somebody to ask the question

about the various EU countries
in their surveillance regimes

because as much as I say
some very unpleasant things

about ours, I think you
would find that it--

with the exception
of our capacity

for the just incredible
scale of collection,

that the actual legal
protections are no better

at best and probably
a lot worse.

>> Just one comment on
the trade discussions.

Suzanne, I think
it's a very good,

it's a very important question.

I certainly think that,
you know, as you well know,

better than probably anyone
in this room, you know,

trade agreements have always
made exceptions for things

like national security,
public morals,

sometimes consumer
protections, things like that.

I think what we see now is
that simply pushing them off,

those issues off into the
exception category is not going

to work so we need
some kind of mechanism

that on the one hand
respects the fact

that governments do
have a legitimate

and important interest in
protecting their citizens

against unsafe products,
against human rights violations

if that's the way they do
privacy, against, you know,

security breaches,
what have you.

But tying that to the
location of data is, I think,

just an overly simplistic way
of accomplishing that purpose,

and I think, you know,
you can make fancy--

well, you can make fancy trade
arguments about why that's not,

you know, most favored
nation treatment.

But I think the bottom line is,
we used to have trade agreements

that were fundamentally about
tariffs and we've mostly dealt

with those issues, and now we
are going to trade agreements

that are fundamentally about
the non-tariff barriers

that exist between economies.

So we're going to have
to deal with that either.

I think that in the, you
know-- for some period of time,

I think the surveillance issues
will cloud those discussions

but we'll come back
to them at some point

and they will be
the same issues.

So-- and I-- the only thing I--

the only final thing I
would say, I think that one

of the big challenges
we're going to have

in the trade context on
internet issues is the challenge

that we found with ACTA,
that the ACTA was making--

[Inaudible Remark] Sorry, oh,
sorry, oh God, Steve is going

to throw that look at me.

So there was a trade agreement
involving intellectual property

enforcement whose
acronym is ACTA

and was very strenuously opposed
by civil society groups all

over the world because they
didn't know what it was,

they didn't know what was in
the agreement and they argued,

I think-- I thought,
quite legitimately

that if there are
going to be rules made

about intellectual property
rights that affect individuals,

there should be some
public discussion

of what those rules are.

Trade people believe they
somehow can't negotiate

in public.

And that's a sort of an article
of faith in the trade world.

They're going to have to learn
to be a little bit more public

if they're going to get anything
done on these issues is my deal.

>> Lynn, you got the last
word before the break.

>> Just quickly.

Not only-- it wasn't that they
wouldn't negotiate in public,

they would not authorize
a release

of the documents
post-negotiation.

They were not available
publicly.

>> So this sounds
like a thread going--

circling back to NSA and FISA
and all that, but I am sorry

that we have hit the point
where we promised we were going

to take a very brief five-minute
break that you're going

to have a chance to stretch
your legs, then we're going

to come back and people on the
panel will mix it up some more,

even better I suspect,
moderated by Steve Roberts.

But let's take a quick
five-minute break.

There will be one other
opportunity for you all to meet

and greet at least
most of the panelists

and there's a reception that
starts at 5:15 afterwards.

But for now, five-minute break,
we'll convene at 4 o'clock.

Thank you very much.

[ Inaudible Discussions ]

Well, thanks for
sticking around.

I know it's been
a long afternoon.

As Lance said, I'm
Steve Roberts.

I'm a professor here at
GW in the School of Media

and Public Affairs,
right across the street.

And my job is to try to
crystallize some of the issues

that we've been discussing

and [inaudible] some
conversation among

the panelists.

And I want to start by quoting
a couple of things I heard.

Lynn, for instance, said that

"unwanted surveillance
is not acceptable."

Leslie talked a lot
about human rights.

But there was a phrase

that I did not hear the entire
first hour and a half except

in passing, and that word
was "national security."

And so I want to pose this
question to the panel.

Isn't national security
a human right?

Isn't safety a human right?

Isn't the unwanted surveillance,

one person's unwanted
surveillance is another person's

protection from danger
and from terrorism?

So, I want to ask everybody,
what's the tradeoff here?

The whole idea in the first half
of this panel was the importance

of the freedoms in the internet.

But what are the limits,

and what are the
legitimate tradeoffs,

and how do we balance
legitimate human rights

against legitimate
rights to be safe

from terrorism and
other threats?

Who wants to start?

Go ahead, John.

>> So I'm going to almost answer
the question, but not quite.

It is true that the
governments have certain roles

and responsibilities.

And one of those roles is
there's a certain protection,

a certain defensive role

that a government feels
it has to provide.

And the question is how do
governments do what they see

as their obligations,

their actual responsibilities
given the internet.

The internet has not been
very good at this, OK?

So, --

>> Would you excuse me.

It's not just an obligation,
it's not just something

that they passing, this
is the first obligation

of government, is to protect--

>> Right.

>> -- people.

Isn't it the first obligation?

>> Ideal. One of the things that
[inaudible] does, of course,

is we're responsible for
maintaining a registry

of IP addresses and that
registry is often used

because someone does
something in cyberspace

and the first thing
law enforcement would

like to know is, where is
that in the real world?

Because real world has the
people in organizations

and the cyberspace has to do

with domain names
and IP addresses.

And so, governments
feel they have

to enforce laws for example.

And yet the internet wasn't
built with an interface

for government is saying, "If
you're trying to do your duty,

here's how you go about
finding that person.

Here's how you go about doing
what you see as an obligation."

So, I know a lot of
people look at this

and they go this entire area of
governments and what they want

to do with the internet and
they want to take control

and they want to
do surveillance.

If you turn it around
and look at it,

remember that from the
government's perspective,

in many cases, these governments
feel they have an obligation

and the internet is
actively preventing them

from doing something
they're required

by their citizens to do.

So, we need to not omit the fact

that the internet doesn't
provide a friendly interface

to government.

So, me people would see that
as a feature but it's a fact

that shouldn't be
overlooked in the discussion.

>> Tradeoff.

What's the tradeoff?

Leslie?

>> So, I want to back this up.

This is not a new question
and it doesn't have

to do with the internet.

I mean, we have a--

an international
human rights framework

that explicitly makes national
security an exception for--

exception for-- in
human rights treaties.

It is an obligation of
the countries themselves

to protect our national
security.

But we also have an entire
developed jurisprudence

about publicly enacted
transparent law,

proportionate law, fair
process, remedy and oversight.

And, you know, I think
we just throw this

into the internet context, we're
just missing, there's a bit--

you know, there's a basic--
there's bodies of law and norms.

And the question here is not
whether there's a tradeoff,

it's whether you
reach a balance.

And I think when you have
most of this process secret,

the judicial process
secret, the oversight secret,

the interpretation
of the law secret,

then you cannot achieve
that balance.

The question at the
end of day is balance.

I certainly would take
issue with the idea

that the internet has been
unfriendly to law enforcement

and it's always this, you
know, we're going dark

and we can't see anything.

I think if we learned anything
over the last couple of months,

it's that law enforcement
really has access

to much more information

and that there is
therefore a temptation

to use what technology
has created

to go beyond what a balanced
human rights frame would allow.

And I think that's
what our problem is,

not that they're not
supposed to be [inaudible].

It is a first order of
business for government.

They are supposed to
protect their citizens.

But Steve, if you look at this
framework that's been created,

it was framework that was
created on a battlefield in Iraq

to make sure that you had every
less possible bid of information

to make sure you would
know about the IED.

And this whole haystack
and needle analogy assumes

that collecting a
haystack is proportionate,

and I don't think it is.

>> But the President
has said this program

of surveillance is
essential, the Director

of national security said that
it's essential, the Chairman

of the Senate Intelligence
Committee,

a liberal former mayor

of San Francisco had
said it's essential,

what's your quarrel with this?

And how do you rebut their
argument of everybody

who has had access to the
secret, say this is justifiable.

I'd like other people
to deal with this.

>> Please.

>> Yeah. [Multiple Speakers]

>> OK. So, it's-- there's

so many portrayals
of this as a binary.

And, you know, I think
the issue is more one

of degrees [phonetic] and
a more granular issue.

But there are some
binaries here, right?

We either have a
constitution or we don't.

We either have a fourth
amendment or we don't.

But if you start looking
at the actual practices

and I don't think we have a full
picture of exactly what's going

on but based on some of the
things that we've heard,

there are ways to enact the
necessary national security

without crossing the lines
that would be unacceptable

to the majority of the people.

So, having low level-- so
layers of control and layers

of accountability in the
processes of surveillance,

right, so not just having any
low level analyst being able

to take a fire hose of
information and download

that unto their computer just
to exaggerate the point, right?

So, there's the granularity,

there's getting the
information that's necessary,

there's the process
of accountability,

there's the issue
of judicial review.

So, I think that there are ways

to enact the necessary
national security now

that our public's
fear is online and now

that we have the privatization
of that public's fear

without going to the extremes

of basically having
the fire hose analogy

and just downloading
whatever data about anybody.

>> Anybody else on the panel
who want to pick on this?

Please, go ahead.

>> So, you want us to talk about
tradeoffs but I actually want

to suggest that I think a more
accountable clear system is

better for national security.

I think what's happening
now where you have very,

very broad authorities that
are unclear is almost the worst

of all possible worlds
for both civil liberties

and national security
because you have--

you have policy officials,
other governments, activists,

et cetera, poking
around in the business

of the intelligence community,
and that's not a very good thing

for them frankly, they want
to able to do what they do

of quietly and-- but in
order for us to do that,

in order for that to happen,
there has to be a clear sense

of what the rules are.

One sense I which-- I
largely agree with Leslie

but the one sense in which
I think this is an internet

problem is it's really
kind of a 9/11 problem,

and then I think a lot of
what's going on is going

on under the kind of exceptional
basis that we've handled a lot

of national security
issues post 9/11.

And to quote the President
again, ironically enough,

just a few weeks before this
whole surveillance story broke,

the President went to the
National Defense Universities,

you know, and gave a
speech saying, number one,

it is bad for a country
to be perpetually at war,

and number two, that
the threat level

from Al Qaeda was basically
below the level that it was

at 9/11, and that we should--

and that we should start
treating that threat,

that national security threat
as part of the norm not

as an exception that
we have to respond

to with these kinds
of exceptions.

This whole surveillance
program was created

as the President's
surveillance programs, you know,

as an exception, and
that's its problem.

If the problem is not--

>> Although continued by
a democratic president--

>> Yes, that will-- that's
right but I think that it needs

to be continued on a more
clear accountable basis.

And so I don't tend to accept
that the issue gets solved

by saying more surveillance,
less surveillance.

I think that the issue
is surveillance according

to what rules and with
what accountability.

>> Lynn I quoted [phonetic]
you-- please, your turn.

>> Yeah. I mean, I'll come
to my point [inaudible]

but just [inaudible] said
unwarranted surveillance.

I recognize the difficulty
in unwanted thief

in the perspective
of the individual.

So, it's very much
an unwarranted.

>> Thank you.

>> But-- And I just
really wanted

to echo the three comments

that have been made here
very, very, very strongly.

When-- In a system
like the internet

which is breaking all barriers
where we're so interconnected

and so interdependent, we
have to change our paradigm

of looking at this and move
it to one of managing risk.

We can talk about in the context
of tradeoffs if you like.

But we really do
have to look at--

>> Wasn't that the only context?

Or isn't tradeoff is the only
legitimate way to talk about it?

Because we-- isn't that
what we do everyday?

>> I think tradeoff
is legitimate way

but I'm not sure we're
making the right tradeoffs

and I think we continue to
focus on national security

and quite often run
by flagrant abuses

than we're conflating the issue
or we're not pulling it apart.

It's not about national security
and what is the best way

to protect national security.

From my perspective, you know,

what our members
are actually upset

about is the flagrant
abuses and the lack

of transparency and the secrecy.

>> Yes, please.

>> And I think part of
the problem that I have

with hearing what they've said

for giving the reasons is
we haven't heard the reason

that makes sense.

It's-- why are you
collecting the data,

it's like the equivalent
of your mom

and dad saying well,
because I said so.

You have to give it something
behind that, you know, to--

is there a credible threat
at whatever level there is.

I think Danny is right.

I think the threat level from
what we've read in previous,

you know, speeches
by the President is

that the threat level is a
lot less than it was at 9/11.

Well, if it's a lot less
than it wasn't 9/11,

why do we need to expand this?

Give us something to look at.

But I think when I hear
them talk about these things

and give these reasons as
somebody who does this type

of metadata analysis
and, you know,

just as for my own
infrastructure was certainly

in my own infrastructure I
can do a lot of that analysis.

But there's an uplink to me.

And those people that
control that infrastructure,

my infrastructure,
your infrastructure,

they can do the same
type of analysis

and it trees all the way up.

It's-- So, why?

You have to give us
a credible reason.

>> But was running through a lot

of your comments is a basic
mistrust of government.

I mean you've been told--

public has been told by
the Intelligence committees

which have in brief that this
is a very valuable tool PRISM

and other surveillance are
very valuable to the President.

Duly elected democratic liberal
president had said it's a very

valuable tool, the
liberal chairman

of the Senate Intelligence
Committee has said it's a very

valuable tool and everyone
of you is doubting it.

So, what is the source of your
suspicions and your mistrust

of what you're being told?

>> So, I actually
don't, you know, when--

there's no way for us to
know if it's a valuable tool

or not a valuable tool.

So, you could take them at face
value that it's a valuable tool.

Collection of data
is a valuable thing.

It's just not the only analysis
in a democratic society.

And I think-- so, I mean, I--

and that's I think
the problem here,

we live in a democratic
society where we're supposed

to have proportional laws
that more than a small number

of people are able to know
about to assess that balance

between liberty and security.

We really don't have that.

I mean, if this was a discussion

that they were tasking
these companies

with specific request
based on articulable facts

about specific individuals

or even several hundred
individuals,

we might be having a different
discussion about the balance

between liberty and security.

But we're having a
discussion about the value

of basically collecting
the data potentially

on everybody in the world.

I mean, we don't know the set.

So, it's not about trust
of government or not.

You know, I think you could
probably come, you know,

device a program where you
know everything about everybody

in the world and claim
it makes you safer,

maybe it makes you safer.

But we no longer are
following either the values,

the constitution
or the norms of it.

>> Well, we see you're not
following the constitution.

These laws were passed by
democratically-elected Congress.

>> Well, having been there.

Yeah.

>> Yeah, right.

>> Having been there,

they didn't know what
they were passing

and they didn't know
what [inaudible].

>> So, [inaudible] to that, you
just said the issue wasn't trust

and you now you just say, well,

they didn't know what
they were passing.

>> They didn't know--
they didn't know--

>> If you believe well-- well,
let me ask you the question.

If you believe in a democratic
system, now you're saying,

I don't believe

in the democratic process
that's passed these laws.

>> No.

>> That they were
misinformed and we know better?

>> No. The laws have been
after the fact, stretched

and manipulated in ways
the Congress didn't intend.

And that's where-- and that's
where we've gone off the rails.

Nobody who is in Congress
at that time, Section 215,

the metadata law
that we're talking

about which is aimed
specifically US citizens.

In making the changes they
were making, nobody believed

that relevant data meant
everybody in the United States.

>> Let me ask you--

>> So, you know, this is--
so this is ultimately--

yes, it's a question
of trust in so far

as the people implementing the
law have made it as elastic

as possible without it
completely exploding

and it might not be exploding.

>> John.

>> I've expressed no view
on whether it's desirable

or undesirable or whether
it's illegal or legal.

Neither of those questions
are really interesting to me.

When it comes to
the internet though,

the question is there's
a set of events going

on regarding surveillance,

and the internet is
global in nature.

We have allies and
trading partners

and organizations globally,
other governments who want

to understand what's going

on because they may
have the same desire.

There may be another government
that wishes for its reasons

to engage in surveillance of
communication in its country.

And it wants to understand
what is the framework

by which this is occurring
and how does it happen

in the internet, how was it's
supported, how does it go

on because they have their
own national interests

and they may pass laws in their
region that are perfectly fine

and acceptable according
to their processes.

So, we now have this
framework that says,

there are circumstances during

which surveillance is
apparently an accepted part

of the architecture.

What we don't have
is a transparency

about where that's occurring and
how that occurs and what happens

if another 130 countries
also do it.

I believe that if we're to have
equitable internet governance,

it's necessary to have
a fully articulated

and transparent framework.

I do not know whether
or not everyone is going

to like what their country
chooses for what it does

with surveillance or not.

That's a different question.

That's a question of laws
and governance structure.

But if this is going to go
on, we need to understand

where it occurs and how
it occurs and the fact

that it could be occurring
in a lot of places.

And that should be understood
and documented as part

of a clearly transparent
recognition

that this is part
of the internet.

>> Let me ask you
all this question.

You said you're not
interested in legality.

But one of the key debates
here is the legal framework

for PRISM and the FISA law.

And there's not much
debate about whether

or what's been taking places
legal or not under the law,

but there's a big debate about
whether the law is the right law

and whether the framework
should be altered.

If you all were to testify
before an intelligence

committees and others
on the Hill and asked,

how should this law be change

to advance the values
your talking about?

What would be some
of your suggestions?

Go ahead.

>> I think we have to start
by walking out the changes

that we made in the
records law because we took

out all the words that
make it proportionate

and make it targeted
and transformed it

into a broad collection statute.

And I, you know, I think
the ways to walk it back

that allows substantial
collection of targets

and information related to
that targets and backs it

out of this broad relevancy
standard that allows it--

if one to be collected
on anybody but also not--

it just takes out the whole
national security purpose.

Basically, you no longer
have to be collecting data

because of a particular
terrorist

or particular intelligence
activity.

You only have to be
collecting in order

to be protecting
the United States.

And that is simply to fraud
and to likely to abuse.

It is harder for me to
note what have changed 702

because we still don't
understand what they're doing.

>> And [inaudible] going
to thought about these--

>> Except for the transparence--
except for greater transparency.

>> 'Cause this is-- this
is going to be debated

in the weeks and months ahead.

It's a very important question.

>> But the traditional method

of before the haystack
love [phonetic],

if you allow me to call it that.

Before that was placed,
the traditional methods

of law enforcement
worked, and they would work

with whatever the
internet had to provide.

You needed to identify somebody.

You usually identify them
through a non-technical aspect.

You had an informant
somebody tell you, "Hey,

I think that you were doing
something illegal," and that--

that puts the focus on you.

From there, you would use
your traditional tools whether

they're on the net or
not to find, you know,

to find out what's going on.

Collecting data when there's
no evidence of a crime is kind

of counter intuitive and
kind of productive in a way

because it's sitting there.

So, if it were me and I was an
adversary of the United States,

I would find where those--
that database was being stored

and I would go after it to
collect all that information

because I can do the same
type of metadata analysis

that could be done that way.

The third thing is--
the reason why we--

you've mentioned earlier that
maybe we've mistrusted is

because we know what can be
done with that data and we know

when somebody-- we know

when somebody has given
us a [inaudible] answer.

Because I know that if I
control my infrastructure,

I know the power that I
have doing in my office,

I have to act responsibly
and within, you know,

the laws and all that.

But I know what can be done

if there's no oversight
on my position.

And that's why I
think you hear--

>> But there is oversight.

It is, you know, I mean they--

>> It would be if you were-- if
you were the oversight committee

for what I would do technically,
do you have the technical skills

to know what I'm doing?

[Inaudible Remark]

>> So I'm going to
leave the legal--

so the legal policy
questions, I largely agree

with what has been said.

I don't think that we
have adequate oversight.

And if I were-- I was talking
to Congress about what to do

to increase the trust
in this environment,

I would say that that Congress

and the FISA court
needs a more effective

accountability mechanism.

There is no way that the FISA
court judges or the members

of the Intelligence
community are looking

at every single query--

>> Right.

>> -- that NSA analysts
are performing

on these enormous
amounts of data.

It is technically possible to do

that to Mike Nelson's [assumed
spelling] earlier point

to actually evaluate whether
when Bob led the general counsel

of ODNI says, "Yeah, we have
the whole state haystack

but we only ask questions
based on certain predicates."

I know Bob and I more
or less trust him

but I think it's outrageous
for the government to say

to its citizens,
"Don't worry, trust us."

We give the government
considerable authority

but we need mechanisms
to make sure it's being

used responsibly.

And none of the oversight
mechanisms that exist

that you've mentioned are
able to provide that kind

of accountability
other than to call

up a responsible
person like, you know,

Mr. Ledin [assumed
spelling] say,

"Are you following the rules?"

And he says, "Yes, we're
following the rules."

He doesn't even know what
every single analyst does

in the agencies that's
responsible for it.

>> Let me ask you about one of
the proposals that has been made

and why they debated
in Washington.

And so, a lot of people
pointed out one of the flaws,

critics had pointed
out one of the flaws

in the FISA process is there's
no adversarial mechanism

within the FISA system that the
government comes in and asks

for permission and there
is no counter voice.

There is no adversarial
proceeding.

And in most legal systems, there
is a mechanism for challenging.

So, a number of legislative
proposals have been advanced

in one form or another.

Is this one of the mechanism set
that Congress should be looking

at to try to reorder
this balance that many

of you think is out way?

>> Yeah. I actually think
this question of some kind

of a public advocate and
I think it's probably--

we figured it out how to give
private lawyers the ability

to look at classified
information

and criminal procedures.

We ought to be able to come up
with this table of those people

who litigate the
national security state,

who can stand in for the public.

And, you know, I think it's one
of many potential points of sort

of strengthening oversight here.

I think it's-- I think
it's critically important.

I think different levels of sort

of reporting back
to the FISA court.

I think part of the
problem and the reason

that people are responding
is, I mean,

it's interesting FISA was
a civil liberties measure

when it was adopted in 1978.

And, you know, it's basically
my mentors were the civil

libertarians who
proposed this crazy idea.

And the world is really
different from the ones in 1978.

And being in contact with
a foreign person, I mean,

you know, there was
an iron curtain.

If you were-- if they
could actually figure

out you were communicating
with a foreign person,

it probably had some
significance.

We now live in this
world where 20 percent

of us are first generation,

where our corporations
are global,

where we travel all the
time, and where we--

people don't identify
themselves in that the same kind

of we-them way and
yet we have a law

and a designation
of foreign persons.

That really is a Cold
War era and almost has

to be reconsidered
all by itself.

And the law can't
be working very well

because it's not
supposed to sweep

up American's communications.

And all you have to do is read
the minimization guidelines

to understand how much of our
communications [inaudible].

>> Hal Berghel wrote
an interesting article

that just came out in
IEEE Computer magazine.

It's called "Through
the PRISM Darkly".

And there's a quote
in there that says,

"The Foreign Intelligence
Surveillance Court has an

approval rate of 99.93 percent
of all surveillance requests.

While this might not meet
the strict definition

of a kangaroo court,
it seems to fall

within the marsupial family."

So--

[ Laughter ]

The point of it is is that there
are, you know, there are two

and he calls them cyber urban
myths that deal with this.

One is that you do need
to all of this, you know,

information to do it
and that there's not--

there's sufficient oversight.

And I think we all agree,

there's not sufficient
oversight.

You wouldn't ask me to be on
a medical oversight committee

to review surgical procedures

because I'm not a
doctor, I'm not a surgeon.

I don't have that
expertise in that area.

And so, I think that's the--

I think that's the thing

that bothers the technology
people is we know it is a small

community of the actual people
that know the nuts and bolts

about technology security
from that standpoint.

And if we don't know
each other by--

personally, we know each other
by reputation and whatever.

And so when you look and
you query your other peers

and they have the same
misgivings that you do,

then it makes you
wonder what's going on.

>> I just want to make one
other point about the people

who are being swept up in
this-- in this surveillance.

I think one of the reasons

that more fine-grained
accountability is really

critical is we don't know

but I think it's a safe
assumption that, you know,

somewhere north of 90 percent
of the people who are on any

of these terrorism watch list
who were the targets of any

of this surveillance
are Arab-Americans

who have some connection
to the Middle East,

many of whom are
probably Muslims.

In this country, we don't
have a great history

of treating minorities
perfectly fairly.

And part of the reason we
have oversight mechanisms,

part of reason we have open
courts, part of reason we try

to have due process with public
visibility is to make sure

that we actually do
our job and really--

and really treating people
fairly and not discriminating.

And again, I don't--
I don't think--

I think it's really interesting,
you hear this panel,

you hear the public discussion.

I don't think through
that many people saying,

"Stop the Surveillance."

People are not saying that I was

in Boston during the
marathon bombings.

People are clamoring for the
instillation of more cameras.

You know, the question
I really believe is not

about whether law enforcement
should have these tools.

It's about whether
we can feel confident

that they're using
them responsibly.

>> One of you made
the point that--

actually, this is
not a new issue--

that just a few years ago,
Washington posted an expose,

a very lengthy one, Diana Press
[assumed spelling] and others.

And there was not anything
like the same kind of reaction

that there's been lately.

And I'm wondering why you
think what's the difference,

why has there been such--
why are we having this panel

and not three years ago.

Why is there so much
conversation now

about this issue
when, in fact, when--

at least some of this
was made known through--

to post another mechanisms
some years ago?

>> Smartphones.

>> We didn't have the numbers,
we didn't have the numbers.

I mean, from the Verizon
order, we now know.

It's-- I don't remember
how many millions

of people's records were--

tens of millions of people's
records were collected.

We had-- we have
general outlines

from the post reporting,
from, you know, from all kinds

of things but we did-- it was
not dramatized with numbers.

And I think and now we know
it's basically everyone's data.

We never actually knew
that was happening.

>> Right. I think that's right.

I also think there was an uproar

when the warrantless
wiretapping was first revealed.

We had a very big
battle in Congress.

People were really
worried about it.

People who were not
following it closely

and they passed an amendment
might have actually thought

that what we wound
up with was some kind

of additional procedural
protections.

Instead, we wound up-- what we
wound up with was a ratification

of that program, immunity

for the providers,
and not much more.

And so I, you know, I
think a lot of us knew some

of this was going on but
I think we didn't know.

One of my colleagues, Jim
Dempsey who's on the Privacy

and Civil Liberties Oversight
Board wrote an article saying,

"Did they just approve
a vacuum cleaner?"

And lots of people then
responded with, "Oh,

you know, that's ridiculous."

Well, no, in fact, they
approved a vacuum cleaner

and we didn't know it.

>> Laura? Laura.

>> I agree with those points.

I think it is a matter
of scale in this case.

But I think there are
few other points, too,

that are a little
bit more subtle.

So, one issue is that this came

after Hillary Clinton's
internet freedom speech

and this entire mean
[phonetic] that has been created

and I think rightly
replicated around the world

about internet freedom.

So, this is a very important
issue and what this does is it--

it's providing an opportunity
for people to challenge

that notion of the internet
freedom and to point

out what they're
calling hypocrisy.

So, that to me is a problem.

It can also be an opportunity
if it's addressed appropriately.

Another issue is that individual
citizens are living their life

online to a much greater extent

than they did five
years ago even.

It's really amazing
if you think.

I mean, I'll just give you
an example I was talking

about today.

So, five years ago, I was--

I would read the paper
in the morning and now,

I'm completely connected to
my smartphone all the time

and I am posting information,
I'm communicating in it.

So, the public sphere
is what's at stake here.

The public sphere is online.

And I think that
that is much greater

than during these last
instances a few years ago

that were mentioned.

So, scale, the issue of
people being more cognizant

about how their internal
private life is lived

out in the digital
realm and also the mean

that has been fairly successful

about internet freedom
has ensued

in these intervening years.

>> I think those were
grilling [phonetic] points.

>> Yeah. [Multiple Speakers]

>> I was just going
to say quickly

that technology makes lots of
things possible and it was clear

at the time of those articles.

It's clear today.

It doesn't mean that
it's eminently minable

but that's done outside
of due process.

And I think those are the things

that are getting
people excitable.

It's not technology and it's
not what's technically possible

or even what's technically
feasible.

It's actually ultimately
the full mining

and then the lack
of public scrutiny.

>> What about the argument
that you hear from some people

that not only are we three
years farther away from 9/11?

Several of you made
the point that a lot

of these original
processes were passed almost

in a battlefield mentality,
one of you used that phrase.

And that there were extreme
circumstances with the value

of national security

in protecting the
homeland very much

in the forefront
of a public debate.

So you got three years later
but some people would argue--

there's almost a
contradiction here.

Certainly the intelligence
community would say, "Well,

actually people are more
relaxed now and less concerned

about the threat because
our systems have worked

and that you shouldn't
be dismantling systems

which have actually made
people more secure."

How would you answer that?

>> Let's concentrate to what
the President has said though.

I mean, what the
President has told us--

>> Although he has said
he's in favor of the system.

>> Yes. And he said that
the capability is necessary.

He's in no way precluded
additional oversight.

I think he's actually
welcomed the discussion of--

>> Sure.

>> -- of what kind
of oversight we need.

But he said we're living
it in a lower threat level

and that we need to make
changes as a society

and as government
in response to that.

So, not the other way around.

>> Edward Snowden, to some
people he's a traitor.

To some people, he's a hero.

What do you think?

>> Everybody, on your clearance
you signed a document that says,

"If you disclose secrecy,
there's a penalty."

So, from that standpoint,
you clearly violated

that document and, you know,
I don't have a problem with--

with being prosecuted
because of that.

On the oversight--

>> Because it this contractual--

>> Because it is contractual.

I mean, it states, "Anybody
who has a clearance."

You have that-- it's in
your-- in the agreement,

and it says clearly that you,
you know, 25 years in prison

or whatever it is that--

>> You actually read that?

>> No, it's-- yeah.

It happens when you come from
a family of lawyers, you know.

>> It's privacy policy.

>> No. I mean, you look-- yeah,
I mean, if I'm going to go

to jail, I want to know
what I have to say, right?

And, so I think-- I think
from that standpoint, yes.

I think the rest of the
community is still trying

to divide it as to whether
or not the information

that is disclosed is a problem.

And some people go back kind

of like what I was saying
is there have been articles

about this for, you
know, a long time.

You know, you can go
back into the '70s

when NSA had the ECHELON
program, in the mid-'90s

with Omnivore and
Carnivore, you know,

all of those type of things.

You've had this type

of electronic surveillance
for quite sometime.

So, we're not quite sure what
it is and not having seen all

that is disclosed but we're
not quite sure of what it is

that he's telling the world
that we don't know already.

And so from that stand point,
I think part of my community,

we're not sure about
the content.

But certainly he violated an
agreement and he, you know,

that's what they're going
to go after him for.

>> So I have mixed views
about Snowden because I think

that whistleblowing in a
free society and a right

to know is critically important.

And if you go back
to Pentagon Papers

and terrible things did not
happen with the publishing

of the Pentagon Papers.

[ Pause ]

So-- so, part of--

>> I'll cover the
Pentagon Papers story and--

>> I'm sure--

>> -- cover Daniel
Ellsberg's trial.

So, I'm--

>> And Ellsberg's trial.

>> Yes.

>> And Ellsberg is very,

very out there right
now about Snowden.

I was kind of right with him

until he started keeping away
the US cyber security strategy

with respect to China
while he was in Hong Kong.

And then I started to wonder
exactly what he's motivations

were, you know.

And so, I do feel like
there's a level or recklessness

that worries me and although
it's hard for me to really know

if there's damage to national
security because I've set

in some of these meetings
with national security people

who I've held up the
minimization guidelines

and said, "Is there anything

in here that's really
secret or should be?"

And they said, "No."

The existence of
these programs sort

of have been broad-brushed
some people knew.

So, if at the end of the day,

it's that the public
finally knows

that it's happening
'cause I'm not sure

if any thing's been revealed
that will allow people

to somehow evade all of this,
that, I think, you know,

society has to make
room for whistleblowers.

I just wish we had
whistleblowers

who were a little less reckless.

>> Well, you know,
as a whistleblower,

he appears to have
delusions of grandeur.

>> Well, right.

>> I mean, the first
couple of days, he had--

he'd made statements
such as saying--

such as that he could order
a wiretap of the President

and he could, you know,
had all the locations

of all the NSA stations.

Pretty unlikely, that said,
I guess the, you know,

I think that his disclosures
have done a public service.

I think he's a whistleblower
in that sense.

I actually agree.

It seems like he
just broken the law

and doesn't seem
very complicated.

What I find confusing and--

is that somehow the
traditional notion

of civil disobedience seems
to have been lost track

of in what he's doing.

I mean, I wish-- I mean, look,

he's obviously has put his
life at total risk and--

>> Although traditional
idea is you pay the penalty

for having broken the law.

>> You pay the penalty and
you [inaudible] having a trial

and you expose-- you expose the
things that you're concerned

about and you expose
them, further look at me.

He's a civilian.

He wouldn't be tried in a
court martial the way Bradley

Manning is.

>> Right.

>> He could've staged
a public trial

and a big public discussion that
he chose not to and I, you know,

again, it's not for me

to say how people should put
their lives at risk as he'd has

but I think it's a-- I think
it's an incomplete active

civil disobedience.

>> Anybody else want
it, got a view on that?

Let me ask you another question.

One of the things that
Dan said that the--

are the very interesting
analysis when he talked

about the internet not being
a creature of the state,

how earlier forms

of communication whether
it's telephones and telegraph

and so many of them grew up.

Television spectrums,
I mean, they were sold

by the government,
right, and still are.

So, there was an inherent
regulatory legal organic

connection between earlier
forms of communication

and government regulation which,
as you point out is missing

in a large part in this
particular system we've all been

talking about.

>> But it's more than a legal
question it seems to me,

it's also a cultural question,
that a lot of you being soaked

in this culture and committed

to this culture have evinced
skepticism of government

and of regulation and yet at
the same time, you're grappling

with the notion of how do you
bring some order to a system

that continues to cry out
for some kind of regulation.

I'm interested for you
to use a little bit

about the contradiction between
sort of the historic origins

and the culture of this
system and the need

to bring some order
and regulation to it.

It seems to me there's an
inherent conflict that's worth

talking about.

Start.

>> I'll kick off the
discussion about that.

I think sometimes when
you go to a workshop

that discusses internet
governance,

it descends into a question
such as who should grab the keys

of internet governance, right?

So, the question of--

so if question were asked

such as should the United
Nations control the internet

or should the United
States control it

or should Google control it?

Like those kinds of
questions don't make any sense

in their first instance.

And part of that is because
there is no monolithic system

of internet governance.

It's highly granular,
it's multi layered.

There are-- there are
so many different levels

of internet governance.

I mean, I-- my book is very long

and I only get into
some of them.

But the issue here is
multistakeholder governance

and what that means.

So, internet governance is very
interesting because it is not

about governments necessarily
but that doesn't mean

that there's not a
role for government

in many different areas.

So, if I have identity theft,
I'd like the government

to step in and help me.

I expect antitrust enforcement.

I expect laws about--
some laws about privacy.

I expect some laws

about intellectual
property rights enforcement.

I expect certain national
statute on any variety

of things related to
trade, child protection.

So, there are many places
for the government to be

in internet regulation
and governance.

But most functions
that are related

to the operational
stability and security

of the internet have
not been the purview

of traditional governments

but they have been enacted
by private industry.

And I think that that's
a very important point.

Now, tying this back
to the PRISM issue,

one concern that I have is
that the one separate area

of how the internet is
being used in the data

that can be collected
and gathered will bleed

into this other area of
the operational stability

and security of the internet.

So, we can expect to see
this issue used as a proxy

for governments that are
interested in gaining control

in certain operational
areas of the internet.

I guarantee that
that will happen.

So, we'll see that in some--

once he calls for
international treaties.

Again, that leave
out private industry.

That leave out civil society.

We'll see it in additional
calls for bringing

in a more multilateral control

of some critical
internet resources.

So, I think one bleeds
into another.

But that it's really not
about private industry

versus governments
or civil society

versus private industry,
for example.

It's about the more
contextual question

of what governance is
necessary for what--

which particular area.

So, in certain cases, it's
completely appropriate

for only the private
sector to be involved.

In other cases, it's the
purview of government.

So, it has to be asked
in a contextual area,

and that's what multistakeholder
governance is.

It's not everybody in charge
of every-- it's granular area.

That's not it.

It's about what's
the appropriate form

of governance in
a particular area.

>> John?

>> So the one thing
we do know is

that the internet
evolves very quickly.

I was involved 25 years of
it and it changes rapidly.

What was dial-up
modems and just Telnet

and FTP quickly became
circuits and high speed fiber.

Yeah, OK, sorry.

[Inaudible] And the web--

>> My work here is done, yeah.

>> The fact is that that
evolution doesn't work well

with government regulation.

Having been involved in
the telecommunication side

of the industry as opposed the
internet side, I also dealt

with a lot of [inaudible]
regulations.

And generally, we're dealing
with regulations that were three

to ten years behind the
time trying to drag them

into current circumstance,
and it was inevitable.

The process of regulation
doesn't work well

with a forward-looking
rapidly evolving internet.

So, when we start
thinking about--

about the non-governmental
nature of the internet,

as the internet grows up, we
find ourselves in a conundrum

because the internet
is no longer optional.

The internet is intwined
in everyone's life.

Governments are looking at
their economies and going,

"Some percentage of my
economy is tied to this?"

You can say I have a choices
to whether or not I'm going

to participate but I don't.

I have to be involved.

So, governments are now
realizing they have no choice,

they need to be involved.

They look at their duties,
their responsibilities.

And they go, "How do I
affect what I'm required

to do in this new media?"

And it's a big challenge,
folks, because the protocols

and the operational conventions

that hold the internet
together have to be global.

They have to interoperate
on global basis.

But governments are
used to acting

on a national basis
occasionally regional,

occasionally bilateral,
multilateral, but generally,

they act on a national basis

and you can easily break
the internet by attempting

to regulate it without the
idea of a global context

in which it operates in.

This is really what's
been opened

up in the last five years.

In the last five years,

governments are realizing
they do need to get involved,

they don't understand
the framework

by which they can do so safely.

In general, this has resulted
to not much regulation

but that's not necessarily going
to be the case going forward.

And it's-- the internet
community and I say

that being the operators,
the various entities

that operate pieces

of the infrastructure
aren't exactly forthcoming

to government saying, "Here,

this is how to safely
regulate the internet.

That guide book has
not been written."

And so, without a meeting
of the minds on this topic,

we run the risk that governments
are going to make regulations

that make no sense or break
portions of the internet.

Until this an understood
common framework

for this, we're all at risk.

>> Lynn, do you wanted to talk?

>> Yeah, very good comments
both from Laura and John,

and I just want to make sure
that we're left with a myth here

that much of the internet
committee believes

that there's no rule
for governments.

We've been engaging
with governments

and certainly we could have
done it better over the years.

But, you know, for many,

many years when ISOC had a very
small staff of seven people,

I was going to [inaudible]
and spending weeks

because you don't go to United
Nations meeting for two days,

you'd go for two
and three weeks.

That's a significant investment,

and we went because
we wanted people

to understand how the
internets actually worked.

And I-- it's like a slight
disagreement with John

and nobody has the answer
but how we regulate for a lot

of this new environments.

It's not because we think
there should be no regulations

because we can't
figure out what sort

of regulation there should be.

And to John's other point,
it is because of the pace

with which the internet changes.

And it is to the fact
that it has broken

so many global boundaries.

You can do it within
any single context.

So, it is a very,
very complex world.

And we continue to advocate for
dialogue discussion, thoughtful,

let it take the time it needs.

We need to pull apart lots
of different complexities

and let the right thing emerge.

That is not the same
as saying no rule

for governments but
it often gets--

>> And another dimension of
this is not all governments are

the same.

Because you can talk about China
being a pretty malign force

in terms of internet freedom
to say nothing of Iran

which uses the internet to roll
up all networks of descent,

where in Tahrir Square,

the internet is a
mechanism for expression.

So, part of it, you can--

part of the problem
is government even

as a concept is subject to
many different definitions.

Yeah.

>> It is Steve but that's
probably why the western

governments that operate
in democracies with legal

and constitutional frameworks

that it's particularly
important.

And one of the reasons people
are particularly unhappy

about this particular
surveillance is if we're trying

to come up with this
nuanced role

about where government belongs,

we haven't exactly
sent the right message

to the rest of the world.

And I think that's part
of the problem here.

>> I just want to offer a
kind of a friendly amendment,

I hope to John's view, you know.

I think John correctly
points out that attempting

to regulate the internet
infrastructure whether it's the

institutions that
operate and design it

or the actual operators
is very [inaudible]

because it changes
very quickly and it has

to work on a global basis.

That was the experience of the--

of SOPA, the Stop
Online Privacy Act,

was that policymakers
thought they could reach in--

>> Piracy.

>> -- sorry, Piracy Act.

>> [Inaudible] is the stop--

>> That's right.

Thank you, thank you, thank you.

Right, you know, governments
thought they could reach

in to the internet
infrastructure

to solve a problem
that is really

about human behavior
and violating laws.

However, at the same time
there are plenty of legal rules

that actually work incredibly
well on the internet.

You know, the FTC is still using
the Fair Credit Reporting Act

from 1970 which was one
of our first piracy laws

in United States to stop very
advanced sophisticated online

services from harming people.

That's not causing
John any problems.

He's not-- he [inaudible]
even think about it.

And so I think there's-- I think
that it's when governments try

to do this sort of
shortcuts that they were used

to doing is you were suggesting
with the broadcasters, you know,

say, "You guys have to behave
this way in order for us

to achieve a broader
policy goal."

That's where we really
have problems

in the internet environment.

>> You know, number of you have
used the word privacy as a value

and as a very curious
[phonetic] value.

But I want you to
play with the idea

that perhaps we're
actually really ambivalent

about the question of privacy
because in fact in many ways,

the wide availability of data is
actually an enormous convenient.

Every time you go to
a website and you put

in your e-mail address
and up comes your password

and all your credit
card information

and at one stop shopping
at Amazon, right?

We all love it but isn't that--

>> But we've made a decision
to share that with them, so.

>> Well--

>> Wait just a minute.

I want a-- I want a--
I understand that.

But I want to pose a question
about whether at some point,

aren't we really ambivalent
about this question

that we actually like people
to have information about us

when it serves our purposes of
convenience and accessibility.

And that there was a certain--

I understand your
point about voluntary.

But this will mark [phonetic]
a point here as well.

>> I think part of
the problem is--

is the public is
realizing that the people

that are storing the
information that we give

to them aren't doing a good
a job in protecting it.

I could go to my local bank--
I grew up in Falls Church.

I used to go to the local
First Virginia Bank right there

in Falls Church.

I gave them all my
information when I opened

up my first account
when I was a teenager.

And I had a reasonable
expectation

that the only way they
were going to get that--

anybody else is going to
get that information was

if they actually went in and
rob the bank and stole the file,

you know, the file
cabinet or whatever.

>> Or if anyone in the
government wanted it?

>> Or if anyone in the
government want it?

I mean that-- I mean
that, you know, that--

that's a reasonable thing.

But nowadays when we find

out that you have all these
massive data leaks, you know,

and when you examine
the root cause of what--

what the leak was from
a tactical standpoint,

I should have been
fixed 15 years ago.

You know, some of these attacks,
I do a talk now if they ask me,

you know, I guess it's because
I had gray hair and I've been

in the security business
for 20 years.

I think I noticed something

but I do [inaudible]
that the contract--

>> It's because of the ponytail.

>> I think it is.

You know, it's the-- it's the
same attack methods that we saw

in the early '90s are
still effective in 2013.

And so my question to the
technical community was,

what have we been doing
this last 20 years?

I mean, you know, I in the SANS
Institute that I was a part of,

we drew up a top
ten threats in 2001.

I pulled it out and today
in 2013, every single one

of those top ten threats from
2001 is still affecting today.

So, what have we been
doing to protect ourselves?

And I think it's that type

of thing that's causing this
rumble about, you know, well,

private industry isn't
doing anything about it,

individuals aren't
doing anything about it.

So, that only leaves
a government

to do something about
it, you know.

And so I think that's why
we're seeing that pushing

that direction, 'cause
historically when you look

at it, the same things
are still affecting us,

it's just that what's
happening now is back in 2001,

the scope of a data breach
was much less than the scope

of the data breach now.

>> Sure, sure.

>> And just one last
aside [phonetic].

The iPhone, I think,
I looked it up,

is five years old
today-- this year.

So, to answer your question
about why the difference from--

>> Hold on just a second.

John and Leslie, you want a-- is
there a point you wanted to make

about the voluntary
submission of data.

>> I don't think so.

I think every point has been
made by everybody quite well.

>> OK. John?

>> You thought-- say that maybe
people don't value privacy

over convenience, and that
that we give up privacy

and there's no outrage
about that.

Why is there an outrage
in some cases?

And I guess the question
that comes up is,

a lot of people voluntarily
give up privacy

because we want the convenience.

We want to click the button
and get the order done.

We want the website
to know who we are.

We want to fill out
all the information

on the airline profile because
it just makes traveling a little

easier and anything
that makes it easier--

>> And who can not remember all
those damn passwords anyway,

right?

>> So there are times
we do that.

But the reality is that there's
also times when you consent

to losing your privacy
in situations that aren't

for your convenience but
you're going to anyway.

Next time you're
going to your doctor,

pick up that HIPAA form
and look at it, OK?

It says, "We're going to
share your data with the CDC

because if there's an
outbreak of something,

we're going to do that, OK?"

It's not for my convenience,
hopefully, I'm not relevant,

but the fact is they're
going to do what--

and we consent with because
well, we knew about it.

We understand--

>> And there's a public
interest involved because--

>> There's a public
interest but also as annoying

as that form is, they
took the time to tell us.

I do think that's a
different question

when there's surveillance
is going on

and you don't know
about it at all.

And I think that might be the
angst behind a lot of this.

>> Leslie?

>> Well, I also think
that there's difference

between surveillance
by the government

and surveillance by companies.

I mean I think they've
become more joined together

because they are now the
source of all the information

that the government
is collecting.

But I think at least in
the constitutional system,

not in Europe where they're
making a distinction.

Having that government who has
the capacity to impose penalties

on people and make choices about
who is going to be prosecuted,

et cetera, is entirely different
matter than whether I like

or disliked it, you know,

Google Profiles keep
sending me the same crib

for my pregnant daughter
over and over again.

I'm annoyed, I'm
extremely annoyed.

But I also think--

>> They knew she was
pregnant before she did, yes?

>> Yes.

>> Well, they probably
did, but they knew

that I did this thing once
and it's following the--

it's literally following
me around the world.

I mean it's became
kind of a joke.

But I find that annoying and
I'm somebody who knows how

to set my privacy settings.

So, you know, in one-- in
one circumstance it's a loss

of some measure of control,
we ought to have more control,

it's one of the reasons we
ought to have a baseline build

to give us some fair
information practices.

In the other, you know, the
government has the capacity

to make very important
decisions about us.

And we have a constitution that
says they have to follow rules.

And so we do react differently
to the crib and to the NSA.

>> Yeah.

>> The one thing I would
say about our tension

between convenience and
privacy is-- I just think that--

I think privacy has always been
a kind of a contested concept.

I mean, it's not an absolute.

I don't think there's
anyone hardly in the world

who thinks it's-- it's
an absolute condition.

But we know, as Leslie
is saying,

we have different
privacy expectations.

We want different privacy
results at different times.

And some of the-- some
of the privacy promise

that we have [inaudible]

like seeing the same
crib too many times.

Others have real consequence

like if you're credit
report is wrong

and you can't get a mortgage,
you're really, you know,

it really-- or you don't
get a job, you know,

it really makes a difference.

And I think that-- I think
in a way the phrase--

I think categorizing privacy

as a single right is what
makes the conversation a little

confused because it-- the
reality is it's a number

of concerns wrapped up into one.

>> But in this day and age,
isn't it a little naive to say,

I'm going to give my
information to Amazon?

Or I'm going to give my
information to Google

for my own purposes because I
choose to, and somehow I'm going

to be able to control--

>> Oh, yes.

>> -- all the use
of that information.

>> Yeah, that's not--
that's not doable,

and I don't think any
privacy law we would pass

in this country would
change that.

>> It is naive but I think--

I think the problem is I don't
mind giving you any information

you ask about me if you tell me
ahead of time what you're going

to do with that information.

So, what John was talking
about in the HIPAA thing

when they say, "We're going
to give it out to the CDC,"

and you tell me ahead of
time before I give you

that information, that's much--

that's a much different
environment than giving it here

and then buried in [inaudible]
fine print is a little click

thing that says,
"Oh, by the way,

we're going to just give
this to anybody we want."

>> We only have few
minutes, and I want to--

you've mentioned out, a number
of you, the fact that we're--

we're dealing with a very
complex system as Laura said

with a lot of stakeholders here.

And one of the stakeholders are
these providers whether it's

Google, whether it's Yahoo,
who take that information.

They don't warn you in some
ways that they're going

to give it away because they're
not voluntarily giving it away.

They're being subpoenaed,

they're being ordered
to by the government.

And they are caught.

We have-- this institution,

these huge institutions
are private institutions,

but as we've learned
through PRISM

and all the revelation
subject to government orders

and government warrants.

And many of them are fighting
this at least fighting

to be able to be more
transparent because they have--

they're stakeholders, too.

And-- and they are worried
that their brands are going

to be tarnished by
being swept up in this.

And to talk a little bit
about the special role

of this institution, these
intermediary institutions,

the Apples, the Microsofts,
the Googles who are

on one hand are getting
pulled by the government

to release information.

On the other hand, they're being
pressured to keep it private.

>> Yeah.

>> Yeah, that's a really
important question.

And if you look at-- Let me
just back it up to before PRISM.

If you look at even just the
Google transparency reports

which probably don't have
everything and I think

and even Google says that
national security isn't--

not everything is reflected
in the transparency reports.

But when you do look
at something like that,

you can see that there
is a very big disconnect

between what governments
are asking information

intermediaries to do and
what they actually do.

So, you can see that--
just to give an example.

Maybe they disclosed data about
an individual in 37 percent,

37 percent of the time in--
to the Brazilian government

or 47 percent of the time
to another government.

Do you see what I'm saying?

There is a disconnect in that
differential between the request

to turn over user data
and the actual instances

of turning over the data.

That's where they have this
special governance role.

And that's an important
point the make.

But they also bear a burden
in carrying out a request

such as the more
recent revelations

because there is a
public relations hit.

There is the cost of hiring
numerous attorneys to deal

with the fallout from this.

And there's the possible
economic impact

of having trouble doing business
in other parts of the world

that might be suspicious
towards those companies.

>> Yeah, you might be thanking--
they might be thanking Snowden

for the revelations
because and, of course,

by the national security
letters.

They're not allowed to--

to let anyone know that
they collected the data.

So, now on the other
hand, you have the--

the Snowden revelations
which were saying, "Hey,

these guys had to
give out the data".

So, you know, and
now that's come out.

What they should have
said is instead of trying

to back [inaudible]
been saying, "You know,

trying to save their
reputation."

We said, "Look, you
got subpoenaed,

we know you got subpoenaed,

you gave up the data
because it's a law."

But I think that that
piece of it is the secrecy,

not being able to say why
something was collected,

you know, and not being able
to even say anything about it.

Lesley?

>> Well, the question raised
is this bigger question

when we talk about players
in the internet echo system.

The intermediaries
are a critical part.

And we have-- under our law, we
sort of provide them with a lot

of special protections
because they can't be liable

for everything that's going
on in their platforms.

And yet there under
enormous pressure,

this national security
revelation is one small piece

of this very complex
environment where when you ask

about governments and government
is trying to regulate,

the first place that governments
go in trying to solve anything,

a social problem is to
try to figure out how

to get the intermediaries to
take on that responsibility.

So, this has been sort of
a tension that's existed

since we actually had any
kind of powerful intermediary.

So, that's one side, and the
other side is the amounts

of power they have as
a governance entity

to set the rules of
[inaudible] for the internet.

And so--

>> And one of the
interesting variables here is,

I noticed just recently that
several of the big players,

Microsoft, Google, Yahoo,

I think three have
all filed suit--

>> Right.

>> -- in an attempt to be
able to be more transparent

about the role and the-- and
the requirements they're under.

I think in part because of
the point Laura was raising

that they themselves, given the
culture that they're part of

and the stakeholders they have,

they are taking a big public
relations in branding hit

for this kind of cooperation.

>> And they also have
real leverage here

which they have exercised
on occasion, you know.

Many of the big intermediaries
Google, Twitter,

others have at times gone to
court to challenge subpoenas

and other kinds of court
orders they receive saying

that they're too broad.

I mean, Google had been--

had been under order to
turnover large volumes

of search log data, this
was just a criminal case,

it's not [inaudible] cases.

>> Right.

>> And they've challenged
those and they, you know,

so the intermediaries have
a really important role

because at least until
there's a change in the law,

they are often the only ones
who can actually bring any kind

of challenge to the
scope of the--

of the authority that the
government is claiming.

>> This is nothing new
because in World War II,

the federal government used to
look at the telegraphs at RCA

and look at the phone system
for records and stuff like that.

I mean what's changed
is the number of players

because back then it was
just those two, I suppose,

plus maybe some minors.

Now you have you know multi--

multinational groups
all over the place.

But the technique, I mean,
the tactic of government going

to a provider and getting the
information they need, it's--

it's [inaudible] been there.

>> I would assume the
Egyptian government did

that when the communications
were chiseled, you know,

letters chiseled
on stone tablets.

>> I'm going to-- We
have five minutes left.

I'm going to give each
you one minute to--

we've had a long day,

very attentive audience,
lot of issues.

But I want to give each of you
a chance to make a final point

after this conversation.

You started with
your initial remarks.

But what do you want the
audience to be left with?

What-- in each of your mind
is something significant we've

talked about today, an issue
that you want to reinforce?

I want to give each you
a chance to do that,

and since we've started
with you earlier,

I'll start with you this
way and we'll go down.

>> So as contentious
this processes is,

I think it's incredibly
important,

the dialogue that's happening
in the United States.

Hopefully, we can do more than
just, you know, have battles

in the newspapers and on panels
like this and really look

at our legal system and make
sure that it has the kind

of accountability
that we needed.

Laura said, you know,
the problem here is scale

and I really agree with that.

Courts have been good

at supervising electronic
surveillance [inaudible] one

wiretap on one phone number
or a handful of phone numbers.

The scale of intrusion here is
such that we can only manage it

and have it a proper oversight
with using exactly the same kind

of computational tools
and analytic tools

that are being used by the
intelligence agencies to try

to mind this data to begin with.

And the one other thing I
would just say is, this is--

as several people said,
this is a global discussion.

The US is obviously an important
part of the internet environment

but we are not the only
country on the internet

and we do not control the whole
internet and I think that just

as we are examining the behavior
of our intelligence agencies,

I think it's very important
that other countries

that have democratic values
that believe in transparency

and due process really look
very hard at their intelligence

and surveillance
practices as well.

>> Thanks, Dan.

Lynn.

>> I guess I'd start with saying

that everybody's voice is
extraordinarily important,

not only here in the US

but every individual
around the world.

And we need attention
and we need voice

to every issue whether it's
this particular set of issues

or it's United Nation's
expressed interest

in some portions of
the internet ecosystem.

And I think specific
to this issue,

the only thing I would say is--

[inaudible] we're all
very interconnected

and very interdependent.

And when we think about
things such as security

or managing risk or trying
to manage those tradeoffs,

we actually need
to do that in a--

with both sides of the dialogue.

One actually looking at what
we can actually do to protect

and ensure things that
support economic prosperity

and social development
while trading off

against preventing
any perceived harm.

I think we're far too much to
[inaudible] over in the side

of preventing perceived harm,

and that we don't quite
have the balanced rate yet.

>> Laura.

>> I think it's important not to
take the stability and success

and the security of the
internet for granted.

So, we're used to it working for
the most part because of efforts

like John's organization and
others and it is working,

but we also have examples
of problems with denial

of service attacks, examples

of government is
cutting off access,

examples of interconnection
problems.

We have trends away
from interoperability

which I think is a
really big problem.

We have trends away
from anonymity

which changes the nature of
the technical infrastructure.

So, point one is that we
cannot take the stability

and security for granted.

It has required a
tremendous amount of effort

on the parts of many,
many people.

And it's something that concerns
me everyday when I see some

of the trends away from
interoperability and security

and interconnection
security, basically.

So, that's point number one.

The second point
is if we believe

that we have the public sphere
in the online environment,

if we believe that there's
a technical mediation

of the public sphere,
then we have to think

about what that means.

What does the democracy look

like when the public
sphere is now digital?

So, we know historically that
possibility is for anonymity

or at least traceable anonymity
have been closely linked

to democracy.

So, I think it's important
to just ask the question

of what does democracy look

like when we have this technical
mediation of the public sphere

and the privatization of
conditions of civil liberties

where private companies are
getting a request delegated

from governments or carrying
out their own governance

of these infrastructures.

So, don't take the
internet security

and instability for granted.

Remember that we have
the technical mediation

of the public sphere
and the privatization

of conditions of
civil liberties.

And the final point is that
internet governance is something

that is-- that the
public can be engaged in.

We've seen examples of
civil society action

of private action, civil
liberties advocates involved

in decisions about
internet governance.

There are many avenues
to do that.

That the-- I do have an
engineering background

but the technology
is not that hard

that people can learn the
technology, learn the issues

and get engaged in these
debates which are very important

because as goes internet
governance,

so goes internet freedom.

>> Randy?

>> All of you here that are
attending this panel discussion,

you all have stake in what
we've been talking about.

And so I would challenge you
guys to not only make sure

that your peers understand
what some of the pressures are

and what some of the
pitfalls and what are some

of the disadvantages are of
working with the internet.

But also, you guys are
probably going to be on a track

where you're going to be
working with legislators

and policy makers
and things like that.

And make sure that they
understand the implications

of whatever it is that they're
trying to write up or implement,

both on the legal side
and on the policy side.

That's to me what I see your
contribution to the whole thing.

It's going to be
very incremental.

It's going to take a long time.

You know if some people talk
about the fact that it's

like when the automobile was
first introduced at the turn

of the century and it took us
25 years to come up with the set

of laws and procedures
to make things work

when we didn't do that.

But you guys are the ones that
are going to be talking to

and down the road
influencing policy and laws.

And so, you know,
take the challenge,

do it and influence
what you can.

>> Leslie.

>> So I'm just going
to make one point.

And that's that those of us
who are Americans or people

in the United States have
a voice in this debate

that we need to exercise.

But we need to exercise
it with more

than our own rights in mind.

If-- the interesting thing
about the internet and the lack

of a government control is the--

it's also very unclear
about who's responsible

for the human rights of people
in the online environment.

And we-- I think the NSA example
that we have data flowing all

over the world, states
have obligations to people

within their borders, and
a few other kinds of places

that the law has developed.

We're not sure who has the
obligation for the rights

of internet users in
this kind of environment.

And it's a conversation
that really needs to happen

because the-- our lives,
some significant part

of who we are is now online
and flowing through these wires

and who ultimately is
responsible to make sure

that basic privacy and free
expression rights are honored

has become increasingly complex.

So, people need to
take that on as well.

>> Last word, John.

>> It's a global internet.

There needs to be an
equally global discussion

about the principles
by which we operate it.

And part of what's occurred

over the last few months will
help encourage one aspect

of that discussion.

So, it's a probably
a good thing.

>> I want to thank all
of you for being here.

I want to thank the
Internet Society.

I want to thank the GW
Engineering Department

and their [inaudible]
Lance Hoffman's Institute.

Long afternoon, thanks
for your patience.

I hope you learned something.

Come back again.

Thanks a lot.

[Applause]