The Guardian's report about the NSA's XKeyscore program upped the ante on discussions about internet privacy in the United States and beyond. The report revealed government efforts to gather as much information as possible about online activity, with the goal of identifying and combating threats to national security by tracking "nearly everything a person does on the internet."
Much of the debate so far focuses on government invasion of privacy. While the privacy issues are certainly important, also significant is what could happen if the collected information got into the wrong hands. XKeyscore is a golden target for hackers and others seeking to cause problems by releasing government-held information, and this information is both more personal and more concentrated than was previously believed. We should address questions about the government's capability to defend (from the outside) and control (on the inside) data it collects.
More than just identity theft
To start, consider what types of information the government is collecting. An individual's data, if accessed, could be used for far more than identity theft. Identity theft typically relies upon information -- such as credit card details and social security numbers -- that can be used to withdraw money from a bank account or go on a shopping spree. But this information pales in comparison to the contents of the NSA program.
Personal information collected under XKeyscore not only includes information that could be stolen as part of identity theft, but also encompasses contents of emails and lists of websites visited. It can reveal details about an individual's opinions and interests, as well as personal issues. For example, many people enter health questions into online searches, so this information could reveal an individual's medical conditions. Moreover, hackers would have the ability to uncover individuals' broader search histories. Just a few years ago, there was concern about the collection of an individual's history of borrowing library books. That information is miniscule compared to web history, which could be exploited in numerous ways.
Can it be hacked?
Next, one can ask whether the government could be hacked. The details of government internet security are, for good reason, highly classified. So it's difficult to use public information to confidently assess the strength of government defenses. But given past incidences including one at the Pentagon when 24,000 sensitive files were stolen, it's not unreasonable to be concerned.
According to the Guardian, there is actually so much information being collected that most cannot be stored for more than a week (if even that long). However, the damage from hacking might not be inherently limited to a few days' data. An undetected hacker could penetrate a system and return over-and-over again. Such a scenario would be like a bank that failed to notice that its vault was being robbed each week, and continued to deposit valuables. In order for the penetration to be limited, it must be quickly noticed and thwarted.
Can it be leaked?
Even if we trust the government to protect our data from the outside, we could still worry about the possibility of internal personnel leaking information. And though the government may do a commendable job seeking to prevent leaks, it isn't batting 1.000. From the Pentagon Papers to Wikileaks, revelations from the inside happen. If Edward Snowden could release a training document for XKeyscore, it is unclear why we should believe that there are adequate checks against leaks of the program's contents.
The NSA responded that XKeyscore is secure because "Every search by an NSA analyst is fully auditable, to ensure that they are proper and within the law." But this capability is reactionary and may not deter a rogue employee. Even if it allows for the identification of the leaker, it does not undo the release of the initial information. As CNN wrote, "an analyst must simply complete an onscreen form, and seconds later, your online history is no longer private." An individual seeking to cause trouble for a politician or business official could publicly reveal embarrassing information, and spies could pass along information to foreign governments or groups.
Looking ahead
Numerous aspects of XKeyscore have not been revealed in depth, such as with which countries the U.S. shares information, how the program contends with encrypted content, and how the program evolved in recent years. Nonetheless, lack of additional information should not discourage valuable public debate.
Despite all of the possible flaws of XKeyscore, the government claims some real benefits, such as 300 terrorists captured by 2008. Without doubt, considering the contributions to national security is crucial when weighing the benefits and costs of the program. On the other side of the scale, however, are potentials for exploitation of the information, in addition to concerns about privacy and the role of government. Individuals may disagree on whether to support the program, but they ought to recognize the dangers of collecting so much information on so many people.
The debate about technology and privacy will likely continue in many forms. Throughout the discussions, we should think critically about the full range of considerations. After all we've seen in the past few years, it would be unfortunate if the debate about government surveillance programs (revealed by a leaker) did not include discussions about the potential for information collected by these programs to escape the government's grasp.