Surveillance and Privacy

In August 2014, the Australian government announced it intended to require internet service providers to retain "metadata" on every customer for two years for the use of law enforcement.

A first pass at this policy, offered by Prime Minister Tony Abbott and Attorney-General George Brandis, suggested the government wanted ISPs to collect the internet browsing history of all users.  A second, evidently revised version of the policy was announced a few days later by the Communications Minister Malcolm Turnbull.  The new version was much narrower.

Privacy is a condition;  and a highly subjective and context dependent one at that.  But we all require privacy to function and thrive.

Neither variation of the proposal is an Antipodean invention.  In 2006 the European Union's 2006 Data Retention Directive required EU member states to introduce similar sorts of mandatory data retention laws.

These proposals come on top of the revelations about the United States' National Security Agency's vast global surveillance apparatus.

Democratic countries are now faced with fundamental questions.  Can the right to privacy survive the expansion of the surveillance state?  Or more fundamentally, is privacy a value worth protecting?

There's a claim you often hear in discussions about privacy:  someone who has done nothing wrong has nothing to hide.  In other words, privacy is only a concern for those who are avoiding the law.

To the extent it is a serious argument, this claim has some serious practical problems.  First, it presumes that we can trust government agents to uphold their duties fairly.  That is not a trust which has been especially earned.  Second, it ignores the fact that the expanding reach of public law, the over-criminalisation of minor rule-breaking and the expanding scope of the regulatory state has bought more and more activity into the realm of the justice system.  Finally, law enforcement agencies and regulators operate as much by discretion as they do by commandment.  Not every law or regulation is just, or justly enforced.  It is not always obvious when you are doing wrong.

But more significantly, privacy is necessary for more than just the evasion of legitimate or illegitimate government action.

There is no consensus on how privacy ought to be defined, what its central attributes are and how it ought to be balanced with other principles such as the right to freedom of speech.  Privacy is a condition;  and a highly subjective and context dependent one at that.

But we all require privacy to function and thrive.  Let's start with the mundane.  Obviously we desire to keep personal details safe — credit card details, internet passwords — to protect ourselves against identity theft.  On top of this, we seek to protect ourselves against the judgment or observation of others.  We close the door to the bathroom.

We act differently with intimates than we do with colleagues.  We often protect our thoughts, the details of our relationships, our preferences, from prevailing social norms.  We compartmentalise.  How many people would be uncomfortable with a colleague flipping through their mobile phone — with the window into a life that such access would provide?

Public life is one in which we all play roles, heavily mediated by social norms, assessments or assumptions about the values of our peers.  Private life is a respite from that mediated world — a place we can drop our masks, abandon the petty deceptions that are necessary for smooth social interaction.

This desire for privacy applies to communications as well.  Eroding privacy undermines our liberty to speak our minds.  Thus, government surveillance interferes with the free-ness of speech.  The feeling — real or imagined — that we are being watched, or that our actions are being recorded, affects the way we express ourselves.  One 1975 study examined how the knowledge of surveillance changed stated attitudes on moral and legal questions.  The study concluded that "the threat or actuality of government surveillance may psychologically inhibit freedom of speech".

The legal scholar Louis B Schwartz illustrated how entangled free speech and privacy are by describing the characteristics of communication in private:  "Free conversation is often characterized by exaggeration, obscenity, agreeable falsehoods, and the expression of anti-social desires or views not intended to be taken seriously.  The unedited quality of conversation is essential if it is to preserve its intimate, personal and informal character."

The belief that a speaker might have to answer for, or justify, their speech, especially their speech to those with whom they have an intimate or close relationship, is a constraint on that speech.  We all understand how easy it is for others to misinterpret our words, and how speech can be willingly misconstrued.  As Cardinal Richelieu put it in his famous (and possibly apocryphal) words, "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."

What does this mean for the debate over surveillance?  As the recent debate over mandatory data retention has shown, the law governing telecommunications interception is complex, and the technologies it applies to even more so.  On top of these technical and legal complexities, the nature of the national security threat is unclear.  National security is a highly opaque area of public policy.

That opacity means the surveillance state is hard to control by democratic means.  In their book Privacy on the Line, Whitfield Diffie and Susan Eva Landau argued that the "very invisibility on which electronic surveillance depends for its effectiveness makes it evasive of oversight and readily adaptable to malign uses."  The Princeton academic Rahul Sagar has concluded that the challenge of democratic control is so great that we mostly have to rely on whistleblowers to learn what the surveillance state is doing in our name.

In April 2014 the European Court of Justice ruled that Europe's Data Retention Directive was unconstitutional.  In the court's view, the directive "interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data" and did so in a manner that was disproportionate to its stated objective of fighting serious crime.

Mandatory data retention has been wound back in many of the states that implemented it, in part because of the civil liberties issues raised by the European Court of Justice, and in part because the policy has not been a particularly effective law enforcement tool.

For Australia, that record, and the importance of privacy to individual flourishing, ought to create a presumption against the expansion of the surveillance state.