Democratic and authoritarian countries are competing to see which of them can carry out mass surveillance most and best (worst).

State mass surveillance USA and their friends in the surveillance alliance Fourteen Eyes have demonstrated that they have the capacity, the desire and the experience to monitor who they want, when they want, anywhere in the world. There are two types of mass surveillance. Commercial, which you can read about here. And mass surveillance carried out by states and rulers. Both are reprehensible, and our attitude is well-established: mass surveillance infringes individuals’ human rights, invades the personal privacy free societies are built on, and is also ineffective against the problems it’s claimed to solve. This is the ultimate core of our business. Our company was founded in 2009 because the surveillance laws were going in the wrong direction, and our message to those in power all over the world is the same now as it was then: there’s a difference between surveillance and mass surveillance. Don’t get involved with the latter: don’t carry out mass surveillance on your population or that of other countries. Use targeted surveillance if there’s a suspicion of a crime, in a proportional way and via independent court decisions. We think human rights are worth preserving and defending. And it’s important to remember that they’re there to protect people against the state. They are a landmark to cling to, to prevent the worst parts of human history repeating themselves. They are there because people and those in power take bad decisions. Because governments change. Because no state should have total and uncontrollable power. Ultimately, the state should be there for the people and not the other way round Even if a large part of today’s mass surveillance is global, it originates in different countries and changes depending on what country you live in. You can read about the consequences of mass surveillance here. But in this article, we’re going to take a look at some of the clearest examples of how widespread it has become in large parts of the world. USA: with the capacity and experience of monitoring the entire population of the world. There’s a problem with reporting the mass surveillance carried out by countries like the USA (at least if you want to stick to proven facts): they aren’t very happy about you talking about it. Of course there are exceptions. Like when self-satisfied managers like the CIA’s chief technology officer Ira ‘Gus’ Hunt give presentations and boast to journalists about how “we try to collect everything and hang onto it forever”.

Or when a senior Defense Department official explains that not even the Pentagon’s employees can expect to have their privacy respected: “We want our people to understand: they should make no assumptions about anonymity. You are not anonymous on this planet at this point in our existence. Everyone is trackable, traceable, discoverable to some degree”. And sometimes a building says more than a thousand words, like when the NSA constructs enormous server halls out in the Utah desert to store data. But to get mass surveillance down in black-and-white, to produce hard facts and figures, it requires brave whistleblowers like Edward Snowden. It’s only through this type of hero that we get an insight into what’s actually going on. Even now we still don’t have better answers than what Snowden gave us in 2013. We’d hoped for change in the wake of his revelations, but unfortunately they’re still relevant today, so that’s where we’ll start. Snowden's revelations showed that American authorities were monitoring hundreds of millions of people all over the world – every day. American mass surveillance is possible thanks to Section 702 of the Foreign Intelligence Surveillance Act (FISA), a law that the USA renews every five years. Section 702 is the key to why American authorities need no court decisions to monitor people. The law came into being on the pretext that terrorists were being tracked after the 9/11 attacks, and would ‘only’ refer to eavesdropping on non-American citizens, but as the law is written and as the internet is constructed, in practice it means surveillance of both foreign and American citizens. When Snowden’s revelations emerged, it also turned out that it wasn’t just being used against people suspected of a crime, but that the American administration was carrying out mass surveillance of millions of people. Other documents that Snowden leaked demonstrated how the National Security Agency (NSA) had the capacity to monitor essentially every person on the planet, and that they weren’t saving their powder: the documents showed, amongst other things that they collected 200 million text messages from different parts of the world – every day. Using the program Xkeyscore, the NSA’s analysts had access to a database covering “nearly everything a typical user does on the internet”. This included both direct data like emails in people’s inboxes, chat conversations and private messages on Facebook.

But also things categorized as metadata; search histories and exactly what sites millions of people were visiting. Using XKeyscore the analysts could also do searches on people’s internet behavior – entirely without judgments from either a court or even a superior inside the NSA. Either via a hard search: for example through an IP address or email address, which could give them access to virtually everything a specific person did online. Or via a soft search: a search for a keyword or phrase, which could give them lists of people with a particular internet behavior. Snowden showed the world how easy it was for the NSA to search in XKeyscore and how much they could get out from the program. But where did all the data come from? Section 702 contains two parts that give American authorities such as the FBI, CIA and NSA access to enormous quantities of data, and they go by the names of PRISM (downstream) and Upstream. PRISM means that they have the right to demand data from American companies without a court decision. When the authorities have free rein to request information from the world’s biggest tech companies, it’s not surprising that it ends in mass surveillance. But Snowden revealed that the situation was even worse. The leaked documents revealed that the authorities didn’t even need to request the material, but that they more or less had direct access to the tech companies’ systems and servers. As Snowden wrote in his book Permanent Record: _”_PRISM enabled the NSA to routinely collect data from Microsoft, Yahoo!, Google, Facebook, Paltalk, YouTube, Skype, AOL, and Apple, including email, photos, video and audio chats, Web-browsing content, search engine queries, and all other data stored on their clouds.” Of course all the tech companies on the list denied that the FBI, CIA and NSA had direct access to systems and servers. Which maybe wasn’t all that strange, because the law can actually mean that it’s illegal for the companies to admit their involvement. The systems reacted to keywords such as 'anonymous internet proxy' or 'protest'. There, algorithms decide which of the agency's exploits – malware programs – to use against you. Once the exploits are on your computer, the NSA can access not just your metadata, but your data as well. Your entire digital life now belongs to them.

Edward Snowden While PRISM gave the NSA the right to demand data from American companies such as Microsoft, Facebook and Google, Upstream gave them the right to directly connect to the backbone used by American telephone and internet service providers. This involved major American telecoms companies such as AT&T but also the world’s biggest router manufacturers, who built monitoring for the NSA into their products. Snowden again: “Upstream collection, meanwhile, was arguably even more invasive. It enabled the routine capturing of data directly from private-sector internet infrastructure – the switches and routers that shunt internet traffic worldwide, via the satellites in orbit and the high-capacity fiber-optic cables that run under the ocean.” It would take a lot to prevent global internet traffic from traveling via American servers, cables and services. That’s how the digital infrastructure and power relationships are constructed. In principle, PRISM and Upstream therefore gave the American authorities the possibility of monitoring every person on the globe. Snowden showed that they could search people’s history, but also monitor them in real time. Handling that quantity of data required sorting, which was done via the TURMOIL and TURBINE programs. In Permanent Record, Snowden wrote: “You can think of TURMOIL as a guard positioned at an invisible firewall through which internet traffic must pass. Seeing your request, it checks its metadata for selectors, or criteria, that mark it as deserving of more scrutiny. Those selectors can be whatever the NSA chooses, whatever the NSA finds suspicious: a particular email address, credit card, or phone number; the geographic origin or destination of your Internet activity; or just certain keywords such as ‘anonymous internet proxy’ or ‘protest’. If TURMOIL flags your traffic as suspicious, it tips it over to TURBINE, which diverts your request to the NSA’s servers. There, algorithms decide which of the agency’s exploits – malware programs – to use against you. Once the exploits are on your computer, the NSA can access not just your metadata, but your data as well. Your entire digital life now belongs to them.” Snowdens whistleblowing revealed that the American authorities were eavesdropping on people’s conversations, reading their messages and even looking right into their homes via cameras in computers and mobile phones. And yet it’s common for states carrying out mass surveillance to deny it and try to hide behind the phrase ‘we only collect metadata’.

As if that wasn’t enough. American cryptographer and security expert Bruce Schneier describes it as follows in his book Data and Goliath: “In a text message system, the messages themselves are data, but the accounts that sent and received the message, and the date and time of the message, are all metadata. An e-mail system is similar: the text of the e-mail is data, but the sender, receiver, routing data, and message size are all metadata. Metadata may sound uninteresting, but it’s anything but. Collecting metadata on people means putting them under surveillance. Eavesdropping gets you the conversations. Surveillance gets you everything else. Metadata reveals our intimate friends, business associations. It reveals what and who we’re interested in and what’s important for us, no matter how private.” Metadata includes all the websites you visit and your entire search history, and when you realize that, the ‘we only collect metadata’ defense suddenly becomes very thin. Stewart Baker, former general counsel for the NSA, expressed this clearly: “Metadata absolutely tells you everything about somebody’s life. If you have enough metadata you don’t really need content.” You can read more about metadata here. For example, metadata can be used to identify journalists critical of the American mass surveillance apparatus. Two of them are Laura Poitras and Glenn Greenwald, the journalists Snowden reached out to when he decided to blow the whistle. Snowden chose them because they had already criticized the NSA and had suffered personal consequences as a result. When he handed over the documents to them, in that Hong Kong hotel room, it was revealed that the NSA partner GCHQ had been monitoring journalists from the New York Times, Le Monde, and the Washington Post, among others, and classified investigative journalists as a threat equal to terrorists and hackers. The fact that the NSA was monitoring journalists wasn’t particularly surprising. The American surveillance apparatus wasn’t merely eavesdropping on terrorists and criminals. They were also carrying out industrial espionage and monitoring human rights organizations like Amnesty and Human Rights Watch. They weren’t simply listening to hundreds of millions of Americans, but for example also captured 70 million French phone calls per month. And of course the system was used to monitor politicians and world leaders. We haven’t been able to get as good an insight into how the American authorities work since Snowden’s revelations. We don’t know exactly how they carry out mass surveillance today.