Inside the massive and unregulated world of surveillance tech Sharon Weinberger
A few years ago,
an American defense consultant I know
told me about a trip
he took to Uzbekistan.
His role there was to help sell technology
that the Uzbek government could use
to spy on its own citizens.
He eventually shared with me
the marketing material
he’d presented to the Uzbek government.
One glossy brochure featured technology
that could not just intercept phone calls,
but identify the caller,
regardless of what phone number
they were using,
based on their unique voiceprint,
and then identify their exact
geographic location.
This is a guy who had been involved
with the arms trade for years.
He wasn’t some Hollywood-type gunrunner
doing backroom deals.
He was just a guy that worked
with legitimate Western companies
to help sell their weapons abroad.
But he wasn’t bothered
by marketing this sort of technology.
For him, it was just the next step
in the arms trade.
And it was even easier than, say,
selling weapons to Iraq,
because it didn’t require
an export license
from the US State Department,
the way most arms sales would.
It turns out that these
tools of surveillance
are almost completely unregulated,
because as of today,
they’re not defined as weapons.
But they should be, and we need
to regulate them that way.
I’m a journalist
who has spent the last two decades
looking at how the military
and intelligence world
spurs the development
of new science and technology.
I’ve tracked the emergence of new weapons
and looked to see what happens
when companies start to market
these weapons abroad.
But what is a weapon
in the information age?
We know that armed drones are weapons,
missiles and bombs are weapons,
but the State Department
actually classifies
broad categories
of technologies as weapons.
So for example, a scientist going abroad
on an oceanographic research vessel,
they want to take
the latest night-vision goggles?
That, according to the State Department,
is potentially a weapon.
Why?
Well, because though night-vision goggles
are used today by scientists
and hunters around the world,
it was a capability
first developed for the military.
And yet, tools of surveillance
that an authoritarian regime could use
to spy on its own citizens,
on dissidents, on journalists,
that, according to the US government
today, is not a weapon.
And yet, these tools of surveillance
are part of a growing secretive
multi-billion-dollar industry.
The genesis of this spy bazaar
goes back some 18 years,
to a Hilton hotel in northern Virginia,
just a few miles away
from the US Central Intelligence Agency.
A few dozen people,
mostly dark-suited men,
gathered there in the spring of 2002
for a conference with
the unassuming name of ISS World.
You know, at first glance, this conference
probably looked like dozens of events
that used to take place
around the Washington, DC area.
But this event was unique.
ISS stands for Intelligence
Support Systems,
and the people who were there
were from companies
that built technologies to spy
on private communications.
In other words, these were
sort of wire-tappers for hire.
And the reason they were there
was that less than a year earlier,
the 9/11 terrorist attacks
on New York and Washington
had spurred the Congress
to press through legislation
known as the Patriot Act.
This gave the government
broad new authorities
to monitor communications.
Emails, internet activity, phone calls,
even financial transactions.
This created an instant demand for data.
And in the true American
entrepreneurial spirit,
an industry rose up
to help collect this data.
But back in 2002,
this was still a pretty modest affair.
Only about 10 percent
of the world’s population
was even online using the internet.
So most of what was being collected
were simple emails and phone calls
over landlines and cell phones.
But over the next few years,
the way that we communicate
began to change rapidly.
There was the introduction
of Skype, Facebook
and then, crucially, the iPhone,
and within a few years,
billions of us were walking around
with little computers in our pockets
that do everything
from monitor our exercise habits
to help us find romantic partners.
And suddenly, you didn’t necessarily need
the advanced capability
of the National Security Agency
or big telecoms
to monitor everyone’s communication.
In some cases,
all you needed was access
to that device in their pockets.
And that gave birth to an entirely
new type of industry.
You know, not many companies
can build missiles or aircraft,
but it doesn’t take a lot of capital
to create software
that can hack into someone’s smartphone.
Computer hackers
have been around for years,
but now their skills could be used
to build technologies
that were in high demand
by law enforcement
and intelligence agencies.
And soon, dozens
and even hundreds of companies
were getting into this
wire-tappers' market.
And that little conference in Virginia,
it grew and soon became known
as the Wiretappers' Ball.
Well, not much was known
about the Wiretappers' Ball
in those early years,
because the conferences
were closed to everyone
except the companies
and their government customers.
But journalists did begin to see
and hear reports
of companies getting
into this private spy market.
Spooky entrepreneurs
going around the world,
doing deals,
often with authoritarian regimes.
And it was, from the start,
a really loosely regulated market.
Some countries do require permission
to sell these technologies abroad,
but rarely with the type of scrutiny
that is given to traditional arms.
So for example, the Italian-based
company Hacking Team
reportedly sold its technology
to authoritarian regimes
in Egypt and Kazakhstan.
The Israeli-based company NSO Group
has reportedly sold its technology
to the regime in Saudi Arabia,
which has been accused of harassing,
and even, in one case,
killing one of its political opponents.
And we do think of weapons
as things that kill people.
But in the information age,
some of the most powerful weapons
are things that can track and identify us.
This is something that the Pentagon
and CIA have recognized for years,
and they’ve tried to build technologies
that can track people,
suspected terrorists, around the globe.
The Pentagon has invested
in something called smart dust,
little microsensors
the size of specs of dust
that you could scatter on people
without them knowing it,
and then use it to track their location.
The Pentagon, through
its venture capital firm,
has invested in a beauty products company
once featured in “Oprah Magazine”
to build a device that could
surreptitiously collect DNA
just by swiping across the skin.
But something remarkable has happened
over the past decade.
In many cases, what the private
marketplace has been able to do
has far outstripped what the Pentagon
or CIA even thought was possible.
Back in 2008,
the Pentagon had a secretive database
of DNA from terrorists.
It had about 80,000 samples.
Well, the private company AncestryDNA
today has samples
from over 15 million people.
23andMe, the second-largest
genealogical database,
has samples from over 10 million people.
So now, maybe you don’t need
these James Bond-worthy techniques
of collecting DNA
if we’re willingly handing it over
to private companies
and even paying for the honor of doing it.
Well, what could you do
with a sample of someone’s DNA?
In the United States and China,
researchers are working
on using DNA samples
to build images of people’s faces.
So if you pair DNA
with facial recognition technology,
you have the basis of a really
powerful surveillance system
that could be used to track individuals
or entire ethnic groups.
And if you think that sounds
a little bit paranoid,
keep in mind that the Pentagon
last year sent out a memo
to all of its service members,
warning them precisely not to use
those commercial DNA kits
over concerns that information
could be used to track them
or their family members.
And yet, even with the Pentagon
raising concerns about this technology,
almost nothing has been done
to reign in this market.
One American company, Clearview AI,
has been collecting billions
of images of people’s faces
from across the internet,
like those pictures you post on Instagram
of you and your friends and family,
and then selling its facial
recognition services
to US government
and law-enforcement agencies.
And even if you think
that’s a perfectly acceptable
application of this technology,
there’s nothing to stop them
from selling to private individuals,
corporations or even foreign governments.
And that’s exactly
what some companies are doing.
That Wiretappers' Ball
that started in northern Virginia?
Today, it’s held in multiple cities
around the globe.
Thousands of people now attend
the ISS trainings and conferences.
And more of the companies showing up
are coming from the Middle East and China.
The spy bazaar has gone global.
And at arms shows now around the world,
you’ll see companies displaying
facial recognition technology
and phone hacking software,
displaying right next
to traditional arms manufacturers
with tanks and missiles.
And walking around these arms shows,
it’s pretty easy to go down
dystopian rabbit holes,
thinking about future
surveillance technology
that will track our every move.
And I remember one
Pentagon adviser telling me
that what the military really needed
were space-based satellites
that could track people anywhere on earth
based just on their DNA.
It’s enough to make you invest
in tinfoil hats.
But the truth is,
we don’t know what sort
of technology the future will bring.
But we know that today,
in the absence of regulation,
this marketplace is already exploding.
And in fact, one of those companies
accused of selling surveillance technology
to authoritarian regimes,
today, it’s offering to help track
those infected with COVID-19.
And of course, technology does offer
the tantalizing promise
of helping control a pandemic
through contact tracing.
But it also opens up another door,
to privatized mass surveillance.
So what do we do
about this private spy bazaar?
We can hide, go offline,
get off social media,
ditch our smartphones,
go live in a cave,
but the truth is, we’re not trained
to be professional spies,
we can’t live under false identities
or with no identities.
And even real spies are having a hard time
staying below the radar, these days.
It doesn’t matter how many
passports Jason Bourne has
if his face or DNA
is in someone’s database.
But if even governments have lost control
of the tools of spying,
is there anything we can do about it?
One argument I’ve heard
is that even if the US
were to restrict companies
from selling this sort
of technology abroad,
companies based in China
might simply step in.
But we regulate the arms trade today,
even if we do it imperfectly.
And in fact, there was a multilateral
proposal several years ago
to do just that,
to require export licenses
for surveillance software.
The United States
was among those countries
that agreed to these
voluntary regulations,
but back in Washington,
this proposal has simply languished.
We have an administration
that would rather sell more weapons abroad
with fewer restrictions,
including to some of those countries
accused of abusing
surveillance technology.
I think to move forward,
we would need to revive that proposal,
but even go one step further.
We need to fundamentally change
how we think of surveillance technology
and define these tools as weapons.
This would allow government
to regulate and control
their sale and export
the way that they control
traditional arms,
advanced aircraft and missiles.
But that means recognizing
that technology that tracks who we are,
what we do, what we say,
and even in some cases, what we think,
is a form of advanced weaponry.
And these weapons
are growing too powerful,
available to the highest bidder,
and according to the whims
of the spy bazaar.
Thank you.