The Battle for Power on the Internet
Distributed citizen groups and nimble hackers once had the edge. Now
governments and corporations are catching up. Who will dominate in the
decades ahead?
BRUCE SCHNEIER OCT 24 2013, 7:07 AM ET
Vivek Prakash/Reuters
We’re in the middle of an epic battle for power in cyberspace. On one side
are the traditional, organized, institutional powers such as governments and
large multinational corporations. On the other are the distributed and
nimble: grassroots movements, dissident groups, hackers, and criminals.
Initially, the Internet empowered the second side. It gave them a place to
coordinate and communicate efficiently, and made them seem unbeatable. But
now, the more traditional institutional powers are winning, and winning big.
How these two side fare in the long term, and the fate of the rest of us who
don’t fall into either group, is an open question—and one vitally important
to the future of the Internet.
In the Internet’s early days, there was a lot of talk about its “natural
laws”—how it would upend traditional power blocks, empower the masses, and
spread freedom throughout the world. The international nature of the Internet
bypassed circumvented national laws. Anonymity was easy. Censorship was
impossible. Police were clueless about cybercrime. And bigger changes seemed
inevitable. Digital cash would undermine national sovereignty. Citizen
journalism would topple traditional media, corporate PR, and political
parties. Easy digital copying would destroy the traditional movie and music
industries. Web marketing would allow even the smallest companies to compete
against corporate giants. It really would be a new world order.
This was a utopian vision, but some of it did come to pass. Internet
marketing has transformed commerce. The entertainment industries have been
transformed by things like MySpace and YouTube, and are now more open to
outsiders. Mass media has changed dramatically, and some of the most
influential people in the media have come from the blogging world. There are
new ways to organize politically and run elections. Crowdfunding has made
tens of thousands of projects possible to finance, and crowdsourcing made
more types of projects possible. Facebook and Twitter really did help topple
governments.
But that is just one side of the Internet’s disruptive character. The
Internet has emboldened traditional power as well.
On the corporate side, power is consolidating, a result of two current trends
in computing. First, the rise of cloud computing means that we no longer have
control of our data. Our e-mail, photos, calendars, address books, messages,
and documents are on servers belonging to Google, Apple, Microsoft, Facebook,
and so on. And second, we are increasingly accessing our data using devices
that we have much less control over: iPhones, iPads, Android phones, Kindles,
ChromeBooks, and so on. Unlike traditional operating systems, those devices
are controlled much more tightly by the vendors, who limit what software can
run, what they can do, how they’re updated, and so on. Even Windows 8 and
Apple’s Mountain Lion operating system are heading in the direction of more
vendor control.
I have previously characterized this model of computing as “feudal.” Users
pledge their allegiance to more powerful companies who, in turn, promise to
protect them from both sysadmin duties and security threats. It’s a metaphor
that’s rich in history and in fiction, and a model that’s increasingly
permeating computing today.
Medieval feudalism was a hierarchical political system, with obligations in
both directions. Lords offered protection, and vassals offered service. The
lord-peasant relationship was similar, with a much greater power
differential. It was a response to a dangerous world.
Feudal security consolidates power in the hands of the few. Internet
companies, like lords before them, act in their own self-interest. They use
their relationship with us to increase their profits, sometimes at our
expense. They act arbitrarily. They make mistakes. They’re deliberately—and
incidentally—changing social norms. Medieval feudalism gave the lords vast
powers over the landless peasants; we’re seeing the same thing on the
Internet.
It’s not all bad, of course. We, especially those of us who are not
technical, like the convenience, redundancy, portability, automation, and
shareability of vendor-managed devices. We like cloud backup. We like
automatic updates. We like not having to deal with security ourselves. We
like that Facebook just works—from any device, anywhere.
Government power is also increasing on the Internet. There is more government
surveillance than ever before. There is more government censorship than ever
before. There is more government propaganda, and an increasing number of
governments are controlling what their users can and cannot do on the
Internet. Totalitarian governments are embracing a growing “cyber
sovereignty” movement to further consolidate their power. And the cyberwar
arms race is on, pumping an enormous amount of money into cyber-weapons and
consolidated cyber-defenses, further increasing government power.
Technology magnifies power in general, but rates of adoption are different.
In many cases, the interests of corporate and government powers are aligning.
Both corporations and governments benefit from ubiquitous surveillance, and
the NSA is using Google, Facebook, Verizon, and others to get access to data
it couldn’t otherwise. The entertainment industry is looking to governments
to enforce its antiquated business models. Commercial security equipment from
companies like BlueCoat and Sophos is being used by oppressive governments to
surveil and censor their citizens. The same facial recognition technology
that Disney uses in its theme parks can also identify protesters in China and
Occupy Wall Street activists in New York. Think of it as a public/private
surveillance partnership.
What happened? How, in those early Internet years, did we get the future so
wrong?
The truth is that technology magnifies power in general, but rates of
adoption are different. The unorganized, the distributed, the marginal, the
dissidents, the powerless, the criminal: They can make use of new
technologies very quickly. And when those groups discovered the Internet,
suddenly they had power. But later, when the already-powerful big
institutions finally figured out how to harness the Internet, they had more
power to magnify. That’s the difference: The distributed were more nimble and
were faster to make use of their new power, while the institutional were
slower but were able to use their power more effectively.
So while the Syrian dissidents used Facebook to organize, the Syrian
government used Facebook to identify dissidents to arrest.
All isn’t lost for distributed power, though. For institutional power, the
Internet is a change in degree, but for distributed power it’s a qualitative
one. The Internet gives decentralized groups—for the first time—the ability
to coordinate. This can have incredible ramifications, as we saw in the
SOPA/PIPA debate, Gezi, Brazil, and the rising use of crowdfunding. It can
invert power dynamics, even in the presence of surveillance censorship and
use control. But aside from political coordination, the Internet allows for
social coordination as well to unite, for example, ethnic diasporas, gender
minorities, sufferers of rare diseases, and people with obscure interests.
This isn’t static: Technological advances continue to provide advantage to
the nimble. I discussed this trend in my book Liars and Outliers. If you
think of security as an arms race between attackers and defenders, any
technological advance gives one side or the other a temporary advantage. But
most of the time, a new technology benefits the nimble first. They are not
hindered by bureaucracy—and sometimes not by laws or ethics either. They can
evolve faster.
We saw it with the Internet. As soon as the Internet started being used for
commerce, a new breed of cybercriminal emerged, immediately able to take
advantage of the new technology. It took police a decade to catch up. And we
saw it on social media, as political dissidents made use of its
organizational powers before totalitarian regimes did.
Which type of power dominates in the coming decades?
Right now, it looks like traditional power.
This delay is what I call a “security gap.” It’s greater when there’s more
technology, and in times of rapid technological change. Basically, if there
are more innovations to exploit, there will be more damage resulting from
society's inability to keep up with exploiters of all of them. And since our
world is one in which there’s more technology than ever before, and a faster
rate of technological change than ever before, we should expect to see a
greater security gap than ever before. In other words, there will be an
increasing time period during which nimble distributed powers can make use of
new technologies before slow institutional powers can make better use of
those technologies.
This is the battle: quick vs. strong. To return to medieval metaphors, you
can think of a nimble distributed power—whether marginal, dissident, or
criminal—as Robin Hood; and ponderous institutional powers—both government
and corporate—as the feudal lords.
So who wins? Which type of power dominates in the coming decades?
Right now, it looks like traditional power. Ubiquitous surveillance means
that it’s easier for the government to identify dissidents than it is for the
dissidents to remain anonymous. Data monitoring means easier for the Great
Firewall of China to block data than it is for people to circumvent it. The
way we all use the Internet makes it much easier for the NSA to spy on
everyone than it is for anyone to maintain privacy. And even though it is
easy to circumvent digital copy protection, most users still can’t do it.
The problem is that leveraging Internet power requires technical expertise.
Those with sufficient ability will be able to stay ahead of institutional
powers. Whether it’s setting up your own e-mail server, effectively using
encryption and anonymity tools, or breaking copy protection, there will
always be technologies that can evade institutional powers. This is why
cybercrime is still pervasive, even as police savvy increases; why
technically capable whistleblowers can do so much damage; and why
organizations like Anonymous are still a viable social and political force.
Assuming technology continues to advance—and there’s no reason to believe it
won’t—there will always be a security gap in which technically advanced Robin
Hoods can operate.
Most people, though, are stuck in the middle. These are people who have don’t
have the technical ability to evade either the large governments and
corporations, avoid the criminal and hacker groups who prey on us, or join
any resistance or dissident movements. These are the people who accept
default configuration options, arbitrary terms of service, NSA-installed back
doors, and the occasional complete loss of their data. These are the people
who get increasingly isolated as government and corporate power align. In the
feudal world, these are the hapless peasants. And it’s even worse when the
feudal lords—or any powers—fight each other. As anyone watching Game of
Thrones knows, peasants get trampled when powers fight: when Facebook,
Google, Apple, and Amazon fight it out in the market; when the U.S., EU,
China, and Russia fight it out in geopolitics; or when it’s the U.S. vs. “the
terrorists” or China vs. its dissidents.
The abuse will only get worse as technology continues to advance. In the
battle between institutional power and distributed power, more technology
means more damage. We’ve already seen this: Cybercriminals can rob more
people more quickly than criminals who have to physically visit everyone they
rob. Digital pirates can make more copies of more things much more quickly
than their analog forebears. And we’ll see it in the future: 3D printers mean
that the computer restriction debate will soon involves guns, not movies. Big
data will mean that more companies will be able to identify and track you
more easily. It’s the same problem as the “weapons of mass destruction” fear:
terrorists with nuclear or biological weapons can do a lot more damage than
terrorists with conventional explosives. And by the same token, terrorists
with large-scale cyberweapons can potentially do more damage than terrorists
with those same bombs.
The more destabilizing the technologies, the greater the rhetoric of fear,
and the stronger institutional powers will get. It’s a numbers game. Very
broadly, because of the way humans behave as a species and as a society,
every society is going to have a certain amount of crime. And there’s a
particular crime rate society is willing to tolerate. With historically
inefficient criminals, we were willing to live with some percentage of
criminals in our society. As technology makes each individual criminal more
powerful, the percentage we can tolerate decreases. Again, remember the
“weapons of mass destruction” debate: As the amount of damage each individual
terrorist can do increases, we need to do increasingly more to prevent even a
single terrorist from succeeding.
The more destabilizing the technologies, the greater the rhetoric of fear,
and the stronger institutional powers will get. This means increasingly
repressive security measures, even if the security gap means that such
measures become increasingly ineffective. And it will squeeze the peasants in
the middle even more.
Without the protection of his own feudal lord, the peasant was subject to
abuse both by criminals and other feudal lords. But both corporations and the
government—and often the two in cahoots—are using their power to their own
advantage, trampling on our rights in the process. And without the technical
savvy to become Robin Hoods ourselves, we have no recourse but to submit to
whatever the ruling institutional power wants.
So what happens as technology increases? Is a police state the only effective
way to control distributed power and keep our society safe? Or do the fringe
elements inevitably destroy society as technology increases their power?
Probably neither doomsday scenario will come to pass, but figuring out a
stable middle ground is hard. These questions are complicated, and dependent
on future technological advances that we cannot predict. But they are
primarily political questions, and any solutions will be political.
In the short term, we need more transparency and oversight. The more we know
of what institutional powers are doing, the more we can trust that they are
not abusing their authority. We have long known this to be true in
government, but we have increasingly ignored it in our fear of terrorism and
other modern threats. This is also true for corporate power. Unfortunately,
market dynamics will not necessarily force corporations to be transparent; we
need laws to do that. The same is true for decentralized power; transparency
is how we’ll differentiate political dissidents from criminal organizations.
Oversight is also critically important, and is another long-understood
mechanism for checking power. This can be a combination of things: courts
that act as third-party advocates for the rule of law rather than
rubber-stamp organizations, legislatures that understand the technologies and
how they affect power balances, and vibrant public-sector press and watchdog
groups that analyze and debate the actions of those wielding power.
Transparency and oversight give us the confidence to trust institutional
powers to fight the bad side of distributed power, while still allowing the
good side to flourish. For if we’re going to entrust our security to
institutional powers, we need to know they will act in our interests and not
abuse that power. Otherwise, democracy fails.
In the longer term, we need to work to reduce power differences. The key to
all of this is access to data. On the Internet, data is power. To the extent
the powerless have access to it, they gain in power. To the extent that the
already powerful have access to it, they further consolidate their power. As
we look to reducing power imbalances, we have to look at data: data privacy
for individuals, mandatory disclosure laws for corporations, and open
government laws.
Medieval feudalism evolved into a more balanced relationship in which lords
had responsibilities as well as rights. Today’s Internet feudalism is both
ad-hoc and one-sided. Those in power have a lot of rights, but increasingly
few responsibilities or limits. We need to rebalance this relationship. In
medieval Europe, the rise of the centralized state and the rule of law
provided the stability that feudalism lacked. The Magna Carta first forced
responsibilities on governments and put humans on the long road toward
government by the people and for the people. In addition to re-reigning in
government power, we need similar restrictions on corporate power: a new
Magna Carta focused on the institutions that abuse power in the 21st century.
Today’s Internet is a fortuitous accident: a combination of an initial lack
of commercial interests, government benign neglect, military requirements for
survivability and resilience, and computer engineers building open systems
that worked simply and easily. Corporations have turned the Internet into an
enormous revenue generator, and they’re not going to back down easily.
Neither will governments, which have harnessed the Internet for political
control.
We’re at the beginning of some critical debates about the future of the
Internet: the proper role of law enforcement, the character of ubiquitous
surveillance, the collection and retention of our entire life’s history, how
automatic algorithms should judge us, government control over the Internet,
cyberwar rules of engagement, national sovereignty on the Internet,
limitations on the power of corporations over our data, the ramifications of
information consumerism, and so on.
Data is the pollution problem of the information age. All computer processes
produce it. It stays around. How we deal with it—how we reuse and recycle it,
who has access to it, how we dispose of it, and what laws regulate it—is
central to how the information age functions. And I believe that just as we
look back at the early decades of the industrial age and wonder how society
could ignore pollution in their rush to build an industrial world, our
grandchildren will look back at us during these early decades of the
information age and judge us on how we dealt with the rebalancing of power
resulting from all this new data.
This won’t be an easy period for us as we try to work these issues out.
Historically, no shift in power has ever been easy. Corporations have turned
our personal data into an enormous revenue generator, and they’re not going
to back down. Neither will governments, who have harnessed that same data for
their own purposes. But we have a duty to tackle this problem.
I can’t tell you what the result will be. These are all complicated issues,
and require meaningful debate, international cooperation, and innovative
solutions. We need to decide on the proper balance between institutional and
decentralized power, and how to build tools that amplify what is good in each
while suppressing the bad.
