News that US intelligence services tapped the phones of allied leaders has generated understandable outrage in Europe. But far more significant is the American government's practice of monitoring the communications of millions of ordinary people, who have no legal redress in the United States because they are foreigners.
Electronic surveillance has become easy. Authorities can reconstruct someone's life with a simple request to their mobile phone provider, while the costs of storing and processing massive amounts of data have declined dramatically. We already live much of our lives through digital communications, and the trend will only accelerate, so we need swift reform, or the problems will escalate. The issue is not just our emails and mobile phones but also our calendars, address books and medical and banking records. Governments and corporations are increasingly able to track people's location, associations and communications.
Existing legal frameworks were devised in an analogue age, when cross-border communication was rare and online communication and social media were unheard of. In that pre-internet age, surveillance techniques were labour-intensive and time-consuming, which helped to constrain arbitrary and abusive practices. The law has to catch up.
A good place to start would be a set of principles unveiled in September by a coalition of non-governmental groups and technology experts aimed at keeping communications surveillance lawful, necessary, proportionate, and subject to adequate safeguards against abuse.
The EU is sensitive to data protection by private actors, and has set the global standard in regulations to ensure people have control over what data they give to companies and how those companies use it. But lawmakers and regulators on both sides of the Atlantic have much more to do.
When it comes to European governments' demands for access to data, which companies must retain for a substantial period, oversight standards are quite relaxed. The US, in turn, has left data privacy regulation to its 50 states, resulting in a cacophony of rules.
It's time for governments to come clean about their practices, and not wait for the newest revelations. All should acknowledge a global obligation to protect everyone's privacy, clarify the limits on their own surveillance practices (including surveillance of people outside their own borders), and ensure they don't trade mass surveillance data to evade their own obligations. Of course it is important to protect security, but western allies should agree that mass, rather than narrowly targeted, surveillance is never a normal or proportionate measure in a democracy.
Washington is finally grappling with the Snowden revelations, holding hearings and considering legislation that might help to rein in the NSA's seemingly unconstrained power. Some of these bills would limit or end bulk data collection, institute greater transparency, and give the secret court that oversees surveillance requests a more adversarial character. These are important proposals, but none include protection for non-Americans abroad. The US has the capacity to routinely invade the digital lives of people the world over, but it barely recognises any privacy interest of those outside the US.
Every country thus has an interest in seeing the US rein in the NSA and oversee its surveillance operations effectively. And as one revelation after another shows that the data of US-based internet companies is not secure from NSA prying, they too face an imperative to restore consumer trust by pressing for stronger privacy protections. If Washington won't listen to foreigners, at least it might listen to its own companies, who risk severe damage to their overseas businesses.
