Inside the massive (and unregulated) world of surveillance tech

What is a weapon in the Information Age? From microscopic "smart dust" tracking devices to DNA-tracing tech and advanced facial recognition software, journalist Sharon Weinberger leads a hair-raising tour through the global, unregulated bazaar of privatized mass surveillance. To rein in this growing, multibillion-dollar marketplace that often caters to customers with nefarious intents, Weinberger believes the first step is for governments to classify surveillance tools as dangerous and powerful weapons.

A few years ago,

an American defense consultant I know

told me about a trip
he took to Uzbekistan.

His role there was to help sell technology

that the Uzbek government could use
to spy on its own citizens.

He eventually shared with me
the marketing material

he'd presented to the Uzbek government.

One glossy brochure featured technology
that could not just intercept phone calls,

but identify the caller,

regardless of what phone number
they were using,

based on their unique voiceprint,

and then identify their exact
geographic location.

This is a guy who had been involved
with the arms trade for years.

He wasn't some Hollywood-type gunrunner
doing backroom deals.

He was just a guy that worked
with legitimate Western companies

to help sell their weapons abroad.

But he wasn't bothered
by marketing this sort of technology.

For him, it was just the next step
in the arms trade.

And it was even easier than, say,
selling weapons to Iraq,

because it didn't require
an export license

from the US State Department,

the way most arms sales would.

It turns out that these
tools of surveillance

are almost completely unregulated,

because as of today,
they're not defined as weapons.

But they should be, and we need
to regulate them that way.

I'm a journalist
who has spent the last two decades

looking at how the military
and intelligence world

spurs the development
of new science and technology.

I've tracked the emergence of new weapons

and looked to see what happens

when companies start to market
these weapons abroad.

But what is a weapon
in the information age?

We know that armed drones are weapons,

missiles and bombs are weapons,

but the State Department
actually classifies

broad categories
of technologies as weapons.

So for example, a scientist going abroad
on an oceanographic research vessel,

they want to take
the latest night-vision goggles?

That, according to the State Department,
is potentially a weapon.

Why?

Well, because though night-vision goggles
are used today by scientists

and hunters around the world,

it was a capability
first developed for the military.

And yet, tools of surveillance

that an authoritarian regime could use
to spy on its own citizens,

on dissidents, on journalists,

that, according to the US government
today, is not a weapon.

And yet, these tools of surveillance

are part of a growing secretive
multi-billion-dollar industry.

The genesis of this spy bazaar
goes back some 18 years,

to a Hilton hotel in northern Virginia,

just a few miles away
from the US Central Intelligence Agency.

A few dozen people,
mostly dark-suited men,

gathered there in the spring of 2002

for a conference with
the unassuming name of ISS World.

You know, at first glance, this conference
probably looked like dozens of events

that used to take place
around the Washington, DC area.

But this event was unique.

ISS stands for Intelligence
Support Systems,

and the people who were there

were from companies
that built technologies to spy

on private communications.

In other words, these were
sort of wire-tappers for hire.

And the reason they were there
was that less than a year earlier,

the 9/11 terrorist attacks
on New York and Washington

had spurred the Congress
to press through legislation

known as the Patriot Act.

This gave the government
broad new authorities

to monitor communications.

Emails, internet activity, phone calls,

even financial transactions.

This created an instant demand for data.

And in the true American
entrepreneurial spirit,

an industry rose up
to help collect this data.

But back in 2002,

this was still a pretty modest affair.

Only about 10 percent
of the world's population

was even online using the internet.

So most of what was being collected
were simple emails and phone calls

over landlines and cell phones.

But over the next few years,

the way that we communicate
began to change rapidly.

There was the introduction
of Skype, Facebook

and then, crucially, the iPhone,

and within a few years,

billions of us were walking around
with little computers in our pockets

that do everything
from monitor our exercise habits

to help us find romantic partners.

And suddenly, you didn't necessarily need
the advanced capability

of the National Security Agency
or big telecoms

to monitor everyone's communication.

In some cases,

all you needed was access
to that device in their pockets.

And that gave birth to an entirely
new type of industry.

You know, not many companies
can build missiles or aircraft,

but it doesn't take a lot of capital
to create software

that can hack into someone's smartphone.

Computer hackers
have been around for years,

but now their skills could be used
to build technologies

that were in high demand
by law enforcement

and intelligence agencies.

And soon, dozens
and even hundreds of companies

were getting into this
wire-tappers' market.

And that little conference in Virginia,

it grew and soon became known
as the Wiretappers' Ball.

Well, not much was known
about the Wiretappers' Ball

in those early years,

because the conferences
were closed to everyone

except the companies
and their government customers.

But journalists did begin to see
and hear reports

of companies getting
into this private spy market.

Spooky entrepreneurs
going around the world,

doing deals,

often with authoritarian regimes.

And it was, from the start,
a really loosely regulated market.

Some countries do require permission
to sell these technologies abroad,

but rarely with the type of scrutiny
that is given to traditional arms.

So for example, the Italian-based
company Hacking Team

reportedly sold its technology
to authoritarian regimes

in Egypt and Kazakhstan.

The Israeli-based company NSO Group
has reportedly sold its technology

to the regime in Saudi Arabia,

which has been accused of harassing,

and even, in one case,
killing one of its political opponents.

And we do think of weapons
as things that kill people.

But in the information age,

some of the most powerful weapons
are things that can track and identify us.

This is something that the Pentagon
and CIA have recognized for years,

and they've tried to build technologies

that can track people,
suspected terrorists, around the globe.

The Pentagon has invested
in something called smart dust,

little microsensors
the size of specs of dust

that you could scatter on people
without them knowing it,

and then use it to track their location.

The Pentagon, through
its venture capital firm,

has invested in a beauty products company
once featured in "Oprah Magazine"

to build a device that could
surreptitiously collect DNA

just by swiping across the skin.

But something remarkable has happened
over the past decade.

In many cases, what the private
marketplace has been able to do

has far outstripped what the Pentagon
or CIA even thought was possible.

Back in 2008,

the Pentagon had a secretive database
of DNA from terrorists.

It had about 80,000 samples.

Well, the private company AncestryDNA

today has samples
from over 15 million people.

23andMe, the second-largest
genealogical database,

has samples from over 10 million people.

So now, maybe you don't need
these James Bond-worthy techniques

of collecting DNA

if we're willingly handing it over
to private companies

and even paying for the honor of doing it.

Well, what could you do
with a sample of someone's DNA?

In the United States and China,

researchers are working
on using DNA samples

to build images of people's faces.

So if you pair DNA
with facial recognition technology,

you have the basis of a really
powerful surveillance system

that could be used to track individuals
or entire ethnic groups.

And if you think that sounds
a little bit paranoid,

keep in mind that the Pentagon
last year sent out a memo

to all of its service members,

warning them precisely not to use
those commercial DNA kits

over concerns that information
could be used to track them

or their family members.

And yet, even with the Pentagon
raising concerns about this technology,

almost nothing has been done
to reign in this market.

One American company, Clearview AI,

has been collecting billions
of images of people's faces

from across the internet,

like those pictures you post on Instagram
of you and your friends and family,

and then selling its facial
recognition services

to US government
and law-enforcement agencies.

And even if you think

that's a perfectly acceptable
application of this technology,

there's nothing to stop them
from selling to private individuals,

corporations or even foreign governments.

And that's exactly
what some companies are doing.

That Wiretappers' Ball
that started in northern Virginia?

Today, it's held in multiple cities
around the globe.

Thousands of people now attend
the ISS trainings and conferences.

And more of the companies showing up
are coming from the Middle East and China.

The spy bazaar has gone global.

And at arms shows now around the world,

you'll see companies displaying
facial recognition technology

and phone hacking software,

displaying right next
to traditional arms manufacturers

with tanks and missiles.

And walking around these arms shows,

it's pretty easy to go down
dystopian rabbit holes,

thinking about future
surveillance technology

that will track our every move.

And I remember one
Pentagon adviser telling me

that what the military really needed
were space-based satellites

that could track people anywhere on earth
based just on their DNA.

It's enough to make you invest
in tinfoil hats.

But the truth is,

we don't know what sort
of technology the future will bring.

But we know that today,
in the absence of regulation,

this marketplace is already exploding.

And in fact, one of those companies
accused of selling surveillance technology

to authoritarian regimes,

today, it's offering to help track
those infected with COVID-19.

And of course, technology does offer
the tantalizing promise

of helping control a pandemic
through contact tracing.

But it also opens up another door,
to privatized mass surveillance.

So what do we do
about this private spy bazaar?

We can hide, go offline,

get off social media,
ditch our smartphones,

go live in a cave,

but the truth is, we're not trained
to be professional spies,

we can't live under false identities
or with no identities.

And even real spies are having a hard time
staying below the radar, these days.

It doesn't matter how many
passports Jason Bourne has

if his face or DNA
is in someone's database.

But if even governments have lost control
of the tools of spying,

is there anything we can do about it?

One argument I've heard

is that even if the US
were to restrict companies

from selling this sort
of technology abroad,

companies based in China
might simply step in.

But we regulate the arms trade today,

even if we do it imperfectly.

And in fact, there was a multilateral
proposal several years ago

to do just that,

to require export licenses
for surveillance software.

The United States
was among those countries

that agreed to these
voluntary regulations,

but back in Washington,
this proposal has simply languished.

We have an administration
that would rather sell more weapons abroad

with fewer restrictions,

including to some of those countries

accused of abusing
surveillance technology.

I think to move forward,
we would need to revive that proposal,

but even go one step further.

We need to fundamentally change
how we think of surveillance technology

and define these tools as weapons.

This would allow government

to regulate and control
their sale and export

the way that they control
traditional arms,

advanced aircraft and missiles.

But that means recognizing
that technology that tracks who we are,

what we do, what we say,

and even in some cases, what we think,

is a form of advanced weaponry.

And these weapons
are growing too powerful,

available to the highest bidder,

and according to the whims
of the spy bazaar.

Thank you.