Despite the digital revolution, unfortunately, the standard view of privacy and ethics in Place Schuman in Brussels has not changed much. It's the "Big Brother is watching" paradigm, and it goes back to the age of totalitarianism when the idea of an all powerful state following your every move became a standard metaphor. It is also known as Orwellian, often followed by the word "nightmare", as in Orwellian nightmare. In its more Pynchonian version (as in the author Thomas Pynchon), it was them, generally the vaguely governmental or a conspiracy that was following your every move.
I would like to challenge that traditional Big Brother view on privacy. If I were to stop right here, then I would say that the point of my talk is that in an age of digital technology, when finally the government possesses the capability to do all of what Orwell, Pynchon and countless others have envisaged, it is not the government we should fear. To the contrary, one of the key tasks of the government should be to be the guarantor of privacy.
As a footnote, I should add here that in totalitarian or authoritarian societies the information technology has of course benefited the regime enormously and enabled much of what Orwell describes.
But in free democratic societies the government is not to blame. Rather, the question is "follow the money" – the Big Data has the replaced Big Brother Government. And it is not the Big Brother, it is the Big Data we should be worried about.
The model developed over the past 60 years is the Datenschutz of West Germany as a reaction to the practices of the Third Reich. The idea was to limit the use of private data by the government. It was a good model as long as the government was the only one with the capacity to store and process data. That has all changed today. In today's world where data processing is no longer a monopoly, the Datenschutz model protects no one. This is not a new problem. Since computing became widely available in the 1990s, the Datenschutz approach has been found to hinder for example epidemiological research and prevent a public good from being implemented.
For example, with computer data, we could establish that, say, 5 different people with a rare disease actually all lived in the same area 30 years ago. And that there was a Soviet nuclear waste dump there that no one knew about. The Soviet government just covered it up and later built a children's playground on it.
In fact, Datenschutz would allow one to look at a separate case here and there, but you couldn't actually look at the data comprehensively, and say where they are from and what they have in common, because the law said basically that you can't do that. Datenschutz would not let us connect the dots even though now we had the technology to do so.
Where the problem comes in is that caught up in our fears of government, we have forgotten that now people from outside can follow us. It is no longer just the government that can store, manipulate, and do things with our data. We can do it ourselves. We can do it with other people. Private companies, private individuals can do just as much to violate your privacy as the government. And in fact, the worst cases of violation of privacy are not what the government has done, it's what everyone else has done.
We all own mobile phones, we have computers. Is there anyone here who doesn't have a mobile phone? And it doesn't have to be an iPhone. Just a regular phone. How many people don't have computers? How many of you know what a cookie means? Not the cookie that you eat, but a cookie as in computer terms.
Let me tell you – there is no such thing as a free App. It is possible to follow all of your preferences, all of your searches, what you want, music videos you watch on YouTube, what it is that you search for on Google, and so forth. We have all these wonderful things. We have Facebook, free. We have Google, free. We have YouTube, free. And we can go on and on and on. Why are they free? Are they free? They have monetized our data, our preferences, what we look at, our musical tastes, our searches. We are in the era of Big Data. All of these data are sold. Today we're in an era of Big Data. That's where the money is.
Why does someone spend time to develop an app for your iPhone or Nokia? Because he sells your data. And he sells your data we all put up there. Our heart rate, our eating behaviour, our mood cycles that we're putting out there voluntarily. So why are you worrying about what the government is potentially doing with your health records?
Newspapers, by the way, they all have cookies. A couple of weeks ago, the Washington Post published a list of newspapers that, including themselves, have cookies, that follow when you read it, what it is you're looking at, they know. Maybe they sell it. They probably do. The people sell that so you can be targeted with the right kinds of ads. And this is before I get into the idea of bad guys.
And then there are the bad guys:
Luis Mijangos, who sent emails, got into people's computers and started looking at their private lives through the web camera. Luis Mijangos was a wheelchair-bound guy, I don't think he even graduated high school, he had nothing to do, because he was wheelchair-bound, so he just went into people's computers. He looked for women on the web, he saw their pictures there, then he figured out by going into Facebook who their friends were, their brothers and sisters, and then do a spear-fishing attack.
He would send a file. The file would be downloaded, and then the person would open it, and say, "Oh, my sister sent me something". The file was corrupt and she didn't know. And what it did was the file turned on your webcam in your computer, if you have a modern computer, but what did he do? He just spied on these people. He got into the computer, got into the webcam, and would follow the person, in general it was a woman.
He didn't engage in blackmail. He was a pervert, he started sending mail to these women, and say, "Oh, I see you did this, your had your boyfriend come over at this time," and so forth. This is one private individual using contemporary technology who got into this and was abusing it grotesquely. That's a webcam. You can do it with keystrokes. If you open a silly file, it's so easy, just every keystroke that you write can be followed.
So today, the problem is not the government. Instead I would argue that the job of the government today is to be the guarantor of your privacy. That today internet and data security is a major public good, and if that good can be provided at all then only the government has the resources to provide that good.
For the remainder of my speech, I'd like to talk about the public trust we have managed to build in Estonia in our digital services. Trusted identity and data protection in cyberspace are crucial.
In Estonia, the various systems that modify our e-government have been operational for nearly a dozen years and have adoption rates nearing 100%, with more and more services available every year. Estonia has gone further than any other country in the world in investing into digitizing the basic processes of society, within government, between government and citizen and enterprises, between citizens.
A way to conceptualize this is that we have a parallel internet for public services, which forms the backbone of our e-government. Technologically powerful, it is conceptually rather simple and hardly unique. Paraphrasing Bill Clinton's campaign slogan, it's all in the architecture, stupid. At the core of this digital architecture lies a secure, verifiable and reliable identification system that ensures that every critical informational transaction can be trusted. It is an enterprise service bus implemented at the level of the entire government and open to participation by the private sector. A system like this will necessarily be at the core of the inevitable move in the future to government cloud computing.
What we've done in Estonia: basically we've developed a system out of our poverty. It is a highly developed e-government architecture. The e-government services that we provide here have almost a hundred percent adoption rate and have basically gone further than anyone else in investing in digitizing the basic services of society within the government, between the government and the citizen, between the citizen and private sector, between citizens and citizens.
A quarter of the electorate votes on line, 95% of tax returns are done online. A similar percent of prescriptions are filled online. Citizens, as legal owners of their own data have access to their digital medical and indeed dental records.
All this is done securely – in the dozen years our e-government infrastructure has been in use, there has not been a single successful attack on the underlying infrastructure.
In Estonia, we have developed a two-level system. If you want to log on it as a citizen you take your chip card, which is pre-coded. You put in your own code, this guarantees that you are you, this is authenticated by a separate entity, and the same thing is true of where you want to go.
The problem with data security in most, if not in almost all of the world, is that the architecture is wrong. The architecture is too simple, it's one-level architecture, and penetrating that kind of data storage is no problem at all. In our case, in all cases in which you go into our system, you are logged.
This system is not perfect, obviously, but we have to think about these kinds of issues, this kind of security, because what is happening in all the areas I just talked about before, there is this massive move to cloud computing. That all data is going up somewhere that will be accessible.
I'm now also heading a Could Partnership Steering Board for the EU. And the future of the cloud is going to be the big headache. It's that we have to rethink our notions of privacy and identity, which his the primary source of objections to the collection of data.
What we need to do is rethink the whole model and think of the government as the guarantor of secure transactions online. I know this is a rather technical, but privacy these days comes down to guaranteeing secure transactions. Whatever that transaction is – financial, medical data, transaction as an email to your boyfriend – all of those things are transactions, and the idea is that someone has to make sure those are secure.
Here, in Estonia at least, the government has stepped in where elsewhere we observe complete market failure. I think there are also some other countries that are moving in this direction, too. It sounds uncharacteristic or perhaps socialistic for a country like Estonia to claim to be the guarantor of a public good where there exists market failure, but we don't have to get into the ideology of it. We just have to face up to the reality of technology today, and what we have to do.
In many ways you could say that the government is doing here what maybe Hobbes, and later in a different format, Locke argued is that the role of the government is to provide that service which guarantees the safety and security of the population. We have a social contract that says that we will allow the government to deal with us because it is protecting us. And the old days it was the government protecting you from foreign invasion, who's protecting you from criminals on the street.
None of us are willing to go back to the pre-digital age. We will not give up our iPhones, iPads, iMacs, or whatever other variants there are. We want to live digitally. We want to use our internet. We want to use our apps, where we put in our everyday weight numbers. All of that is what we want to do. But we, in so doing, have opened up an area to outside inspection that has never been there.
And so in this new reality, we have to come up with a new digitally informed data protection system. Not an old one that is based on the old George Orwell/Big Brother model, but one which looks at current reality. Remember, if you want security in the way that it used to exist, information security, data protection, privacy, then give up your iPhone, give up your iMac, don't write a single email, don't do a single Google search, don't read newspapers online.
Thank you.
