Why 'I Have Nothing to Hide' Is the Wrong Way to Think About Surveillance

Many don’t understand why they should be concerned about surveillance if they have nothing to hide. It’s even less clear in the world of 'oblique' surveillance, given that apologists will always frame our use of information-gathering services like a mobile phone plan or Gmail as a choice. if everyone’s every action were being monitored, and everyone technically violates some obscure law at some time, then punishment becomes purely selective.
Image may contain Human Pedestrian Person City Town Urban Road Building Street Walking Path and Silhouette
Dell's Pics/ Flickr

Suddenly, it feels like 2000 again. Back then, surveillance programs like [Carnivore](https://en.wikipedia.org/wiki/Carnivore_(software), Echelon, and Total Information Awareness helped spark a surge in electronic privacy awareness. Now a decade later, the recent discovery of programs like [PRISM](https://en.wikipedia.org/wiki/PRISM_(surveillance_program), Boundless Informant, and FISA orders are catalyzing renewed concern.

The programs of the past can be characterized as "proximate surveillance," in which the government attempted to use technology to directly monitor communication themselves. The programs of this decade mark the transition to "oblique surveillance," in which the government more often just goes to the places where information has been accumulating on its own, such as email providers, search engines, social networks, and telecoms.

Apologists will always frame our use of information-gathering services like a mobile phone plan or Gmail as a choice.Both then and now, privacy advocates have typically come into conflict with a persistent tension, in which many individuals don't understand why they should be concerned about surveillance if they have nothing to hide. It’s even less clear in the world of “oblique” surveillance, given that apologists will always frame our use of information-gathering services like a mobile phone plan or Gmail as a choice.

We Won't Always Know When We Have Something To Hide

As James Duane, a professor at Regent Law School and former defense attorney, notes in his excellent lecture on why it is never a good idea to talk to the police:

Estimates of the current size of the body of federal criminal law vary. It has been reported that the Congressional Research Service cannot even count the current number of federal crimes. These laws are scattered in over 50 titles of the United States Code, encompassing roughly 27,000 pages. Worse yet, the statutory code sections often incorporate, by reference, the provisions and sanctions of administrative regulations promulgated by various regulatory agencies under congressional authorization. Estimates of how many such regulations exist are even less well settled, but the ABA thinks there are ”nearly 10,000.”

If the federal government can’t even count how many laws there are, what chance does an individual have of being certain that they are not acting in violation of one of them?

As Supreme Court Justice Breyer elaborates:

The complexity of modern federal criminal law, codified in several thousand sections of the United States Code and the virtually infinite variety of factual circumstances that might trigger an investigation into a possible violation of the law, make it difficult for anyone to know, in advance, just when a particular set of statements might later appear (to a prosecutor) to be relevant to some such investigation.

For instance, did you know that it is a federal crime to be in possession of a lobster under a certain size? It doesn’t matter if you bought it at a grocery store, if someone else gave it to you, if it’s dead or alive, if you found it after it died of natural causes, or even if you killed it while acting in self defense. You can go to jail because of a lobster.

If the federal government had access to every email you’ve ever written and every phone call you’ve ever made, it’s almost certain that they could find something you’ve done which violates a provision in the 27,000 pages of federal statues or 10,000 administrative regulations. You probably do have something to hide, you just don’t know it yet.

#### Moxie Marlinspike

##### About

A security researcher who has published numerous attacks on SSL and other secure protocols, Moxie Marlinspike was formerly the director of application security at Twitter and co-founder and CTO of Whisper Systems.

We Should Have Something To Hide

Over the past year, there have been a number of headline-grabbing legal changes in the U.S., such as the legalization of marijuana in Colorado and Washington, as well as the legalization of same-sex marriage in a growing number of U.S. states.

As a majority of people in these states apparently favor these changes, advocates for the U.S. democratic process cite these legal victories as examples of how the system can provide real freedoms to those who engage with it through lawful means. And it’s true, the bills did pass.

What’s often overlooked, however, is that these legal victories would probably not have been possible without the ability to break the law.

The state of Minnesota, for instance, legalized same-sex marriage this year, but sodomy laws had effectively made homosexuality itself completely illegal in that state until 2001. Likewise, before the recent changes making marijuana legal for personal use in Washington and Colorado, it was obviously not legal for personal use.

Imagine if there were an alternate dystopian reality where law enforcement was 100% effective, such that any potential law offenders knew they would be immediately identified, apprehended, and jailed. If perfect law enforcement had been a reality in Minnesota, Colorado, and Washington since their founding in the 1850s, it seems quite unlikely that these recent changes would have ever come to pass. How could people have decided that marijuana should be legal, if nobody had ever used it? How could states decide that same sex marriage should be permitted, if nobody had ever seen or participated in a same sex relationship?

>If everyone’s every action were being monitored, and everyone technically violates some obscure law at some time, then punishment becomes purely selective.

The cornerstone of liberal democracy is the notion that free speech allows us to create a marketplace of ideas, from which we can use the political process to collectively choose the society we want. Most critiques of this system tend to focus on the ways in which this marketplace of ideas isn’t totally free, such as the ways in which some actors have substantially more influence over what information is distributed than others.

The more fundamental problem, however, is that living in an existing social structure creates a specific set of desires and motivations in a way that merely talking about other social structures never can. The world we live in influences not just what we think, but how we think, in a way that a discourse about other ideas isn’t able to. Any teenager can tell you that life’s most meaningful experiences aren’t the ones you necessarily desired, but the ones that actually transformed your very sense of what you desire.

We can only desire based on what we know. It is our present experience of what we are and are not able to do that largely determines our sense for what is possible. This is why same sex relationships, in violation of sodomy laws, were a necessary precondition for the legalization of same sex marriage. This is also why those maintaining positions of power will always encourage the freedom to* talk* about ideas, but never to act.

Technology and Law Enforcement

Law enforcement used to be harder. If a law enforcement agency wanted to track someone, it required physically assigning a law enforcement agent to follow that person around. Tracking everybody would be inconceivable, because it would require having as many law enforcement agents as people.

>Those in power will essentially have what they need to punish anyone they’d like, whenever they choose, as if there were no rules at all.

Today things are very different. Almost everyone carries a tracking device (their mobile phone) at all times, which reports their location to a handful of telecoms, which are required by law to provide that information to the government. Tracking everyone is no longer inconceivable, and is in fact happening all the time. We know that Sprint alone responded to eight million pings for real time customer location just in 2008. They got so many requests that they built an automated system to handle them.

Combined with ballooning law enforcement budgets, this trend towards automation, which includes things like license plate scanners and domestically deployed drones, represents a significant shift in the way that law enforcement operates.

Police already abuse the immense power they have, but if everyone’s every action were being monitored, and everyone technically violates some obscure law at some time, then punishment becomes purely selective. Those in power will essentially have what they need to punish anyone they’d like, whenever they choose, as if there were no rules at all.

Even ignoring this obvious potential for new abuse, it’s also substantially closer to that dystopian reality of a world where law enforcement is 100% effective, eliminating the possibility to experience alternative ideas that might better suit us.

Compromise

Some will say that it’s necessary to balance privacy against security, and that it’s important to find the right compromise between the two. Even if you believe that, a good negotiator doesn’t begin a conversation with someone whose position is at the exact opposite extreme by leading with concessions.

>We’re not dealing with a balance of forces looking for the perfect compromise between security and privacy, but an enormous steam roller.

And that’s exactly what we’re dealing with. Not a balance of forces which are looking for the perfect compromise between security and privacy, but an enormous steam roller built out of careers and billions in revenue from surveillance contracts and technology. To negotiate with that, we can’t lead with concessions, but rather with all the opposition we can muster.

All the Opposition We Can Muster

Even if you believe that voting is more than a selection of meaningless choices designed to mask the true lack of agency we have, there is a tremendous amount of money and power and influence on the other side of this equation. So don’t just vote or petition.

To the extent that we’re “from the internet,” we have a certain amount of power of our own that we can leverage within this domain. It is possible to develop user-friendly technical solutions that would stymie this type of surveillance. I help work on Open Source security and privacy apps at Open Whisper Systems, but we all have a long ways to go. If you’re concerned, please consider finding some way to directly oppose this burgeoning worldwide surveillance industry (we could use help at Open Whisper Systems!). It’s going to take all of us.

*Editor’s Note: A version of this article first appeared on the author’s blog. *

Wired Opinion Editor: Sonal Chokshi @smc90