The Razor’s Edge: Liberalizing the Digital Surveillance Ecosystem

Open societies and democracies can demonstrate global surveillance trends similar to authoritarian regimes and swing states, including the expansion of digital surveillance in the name of public safety and growing private sector capabilities to collect and analyze data on individuals. Yet these trends toward greater surveillance still occur within the context of pluralistic, open societies that feature ongoing debates about the limits of surveillance. However, the pandemic stands to shift the debate in these countries from skepticism over personal data collection to wider acceptance. Thus far, the spectrum of responses to public surveillance reflects the diversity of democracies’ citizenry and processes.

Summary of Recommendations

The United States should respond to the illiberal use of surveillance technology in four ways:

1. Draw in like-minded democratic partners to work multilaterally, with a particular focus on global swing states.
2. Enshrine data privacy protections in statute for American use—demonstrate what “right” looks like.
3. Support U.S. tech companies in establishing a ruleset for engaging with authoritarian government use of surveillance tech abroad.
4. Partner with tech companies to develop a “privacy solution” (commercially viable, privacy-preserving digital products), which can act as the free-world alternative to the illiberal use of surveillance tech.

The United States should:

1. Actively engage other democracies, especially swing states, to articulate and establish a set of democratic principles that undergird state use of digital surveillance.

• The State Department should convene a bloc of democratic allies to debate and craft a specific set of democratic norms. Advanced democracies can use Britain’s “D10” approach as a blueprint for this summit of democracies.¹ The United States can then leverage its position as a founding member of the Open Government Partnership (OGP)—and similar bodies—to draw countries at risk of instituting repressive digital surveillance policies further into democratic governance models for technology.²
• The United States and other advanced democratic nations should engage the other OGP founding members, including Brazil, Indonesia, and the Philippines, using the OGP’s Peer Learning and Exchange Subcommittee of the Steering Committee as a vehicle for policy discussions. The United States should lobby to include surveillance issues at the top of the agenda for the 2021 OGP Summit.

2. Develop a secure and privacy-protecting, free-world alternative for the handling of digital data—establishing a model for what “right” looks like.

• Congress should enshrine data protections for American citizens and consumers by creating a national data protection framework that incentivizes consistent, open, and transparent data practices.
• Congress should approve and ratify the Cyber Solarium Commission’s Key Recommendation 4.7 and pass a “national data security and privacy protection law establishing and standardizing requirements for the collection, retention, and sharing of user data.”³

3. Map the foreign digital surveillance ecosystem to help U.S. tech companies assess risks of abuse of their technology abroad.

• The State Department should establish a scorecard for U.S. tech companies to reference when operating abroad. The scorecard would assess levels of risk associated with specific uses of surveillance technologies. Tech companies can refer to this scorecard when making policy decisions regarding the potential illiberal use of their technology by foreign governments for surveillance purposes.
• This scorecard should be accompanied by a risk-based compliance framework for export controls of surveillance-enabling technology, as defined by the State Department, in coordination with the Commerce Department and other relevant agencies.⁴

4. Fund the development of freedom-enhancing and privacy-preserving technologies and export democratic models of surveillance technology.

• The U.S. government, via the Defense Advanced Research Projects Agency, the Intelligence Advanced Research Projects Activity (IARPA), the State Department, In-Q-Tel, and the National Institute of Standards and Technology (NIST), should research and fund the development of privacy-preserving technology solutions. The private sector will drive development in surveillance tech and the ability to exploit it, but there are too often insufficient private sector incentives for privacy-preserving solutions. The United States must be at the forefront of these developments to provide an alternative to Chinese technology.
• The United States can leverage existing technology research and development initiatives via In-Q-Tel or IARPA or through updated exercises like NIST’s 2018 “Differential Privacy Synthetic Data Challenge” to help develop the “privacy solution” hand in hand with the U.S. private sector.⁵ Solutions can serve as democratic models of surveillance technology, imbued with privacy protections, for export abroad.

Introduction

The world is saturated with sensors. These sensors, along with a projected 6 billion people with access to the internet, will generate between 80 and 90 zettabytes of data worldwide by 2025.⁶ By next year alone, approximately 30 billion devices will be connected to the web, creating a prodigious “digital exhaust.”⁷ This digital exhaust consists of the data trail left behind when users rely on connected devices: from wearables that capture running routes to cameras that double as doorbells to social media applications that provide geolocation data. Nearly every facet of the daily life of an individual—wittingly and unwittingly—is logged and captured by the sensors and digital applications in the new information environment. DNA is collected by medical companies, voices are collected by banks, faces are collected by phones, and sleep cycles are collected by rings and watches. As the surveillance infrastructure expands, this connectivity, when used to identify individuals and match them to the data they emit, will make privacy much harder to maintain. And systems that do the matching will be in much higher demand. As one Chinese technology company put it in an advertisement to Chinese police: “People pass and leave a shadow. The phone passes and leaves a number.” Now systems are built expressly to “connect the two.”⁸ Further, surveillance technology, driven by artificial intelligence (AI) and machine learning (ML), will play an increasingly significant role in the digital environment. From facial recognition to the Internet of Things (IoT), technology will alter the ways nation-states fight wars and police their citizens, and even the way populations behave.

Legitimate uses for surveillance exist across the globe. Public safety and health, counterterrorism measures, and quality of life are all critical to a functioning society. Facial recognition systems to detect stalkers at concerts, drones that aid in disaster response, and software that identifies criminals after a shooting spree are elements of surveillance that can contribute to public good. Digital surveillance technologies like contact-tracing apps can help at-risk individuals avoid COVID-19 hotspots during the pandemic. Commercial uses of surveillance technology can also make services more efficient, such as reducing wait times at popular amusement park rides or advertising a product perfectly tailored to an individual’s needs. Surveillance that makes travel more convenient at airports and on subways during rush hour, decongests the roads, and improves emergency response times enhances quality of life in real ways.

But the risk of potential abuse of these and related technologies is profound. Facial recognition helps Chinese authorities implement ethnic targeting in the Xinjiang region, where approximately 1.5 million Uighurs are imprisoned in reeducation camps. Sources for Human Rights Watch and the International Consortium of Investigative Journalists point to license plate trackers at gas stations, “data doors” that collect SIM card information, facial recognition checkpoints erected to monitor the Uighur minority, and a mass data system employing artificial intelligence to flag “entire categories” of Xinjiang residents for detention. The risk of abuse exists in democracies as well. Citizens are rightfully wary of opaque algorithms, the potential for unlawful detentions based off false positives generated by facial recognition software, and privacy invasions exploited for commercial gain.

Yet understanding how surveillance technology is used around the world is important in calibrating a U.S. response. First, understanding the global digital surveillance ecosystem is foundational. A mutually reinforcing ecosystem of sensors, networks, and processing capabilities advances as each technical component improves. Soon, surveillance technology will be cheaper, easier to conduct, and everywhere. Recognizing how political systems influence the way countries adopt these technologies will also be critical to formulating a U.S. approach. Authoritarian regimes, with China leading the way, are using digital surveillance to enforce and enhance internal control, as well as peddle their methods to other countries on the cheap. China is leading the world in using technology to monitor its population and influence behavior. Open societies exhibit some of the same troubling trends, but are ultimately making use of a democratic process to stall rapid deployment of some surveillance technologies and debate their use. Initial responses to the pandemic are reinforcing and accelerating these trends and offer inchoate lessons for how surveillance will be employed in the future.

All of this occurs in the context of a global contest between freedom and authoritarianism. Democracies like the United States maintain a system of checks and balances to provide a bulwark against the abuse of technology within their own borders. Properly applied, democratic systems offer institutions and practices—the rule of law, independent judiciaries, a free press, and engaged citizenries—to act as guardrails on the state’s internal use of technology. But this is no longer sufficient. Democracies must also decide how to respond to increasing abuse of these technologies abroad. Democracies must establish a model for the use of these technologies globally that helps ensure the preservation of individual freedom and liberty. Due to the pace of technological advancement, China’s success at spreading surveillance technology far and fast, and the eagerness of autocrats to employ it against their own populations, the window to get this right is closing. Understanding the ecosystem—not just the technology, but the actors, markets, and governance that shape its use—is critical to establishing policies the free world can export.

The Digital Surveillance Ecosystem: Easy, Inexpensive, and Everywhere

Surveillance technology is best understood as an ecosystem of mutually reinforcing technologies.⁹ The surveillance ecosystem is loosely composed of sensors, networks, and processing capabilities.¹⁰ In order to conduct surveillance, sensors are needed to detect, generate, and collect data. In turn, a network must transmit these data. Methods to exploit the raw data gathered by sensors and transmitted on networks are then required to draw value from the process. Sets of technologies and techniques, including AI, can help manage this sensor-derived information, organize it, and turn it into insights.

All of these components are evolving as technological developments improve. Sensors are more distributed, leading to the collection of more data (volume), along with different types of data (variety) and at higher rates (velocity). Faster networks with lower latency provide quick transmission and higher throughput to handle these formidable data flows. More compute power and computer options, such as cloud or edge computing, to sort and process the data are advancing in concert. Developments in ML and sophisticated analytics that extract value from data are also growing exponentially.¹¹ These improvements fit together in mutually reinforcing ways. For example, fifth-generation telecommunications (5G) will provide application-heavy smart cities the necessary bandwidth to function; IoT devices are optimized by edge-computing capabilities; AI parses the data generated by IoT devices on 5G networks to detect patterns. In aggregate, these advancements amount to surveillance that is less personnel-intensive, less expensive, more capable, and ubiquitous.¹²

New avenues of surveillance are cropping up in the wake of the COVID-19 pandemic. From Facebook-sponsored disease migration maps to hospital bed availability applications to QR codes that act as health status indicators, developers and—often—their government sponsors are responding to the virus with more expansive data collection. MIT Technology Review’s COVID-19 Tracing Tracker documented 25 robust global automated contact-tracing efforts in early May 2020.¹³ Iran claimed to collect location data from 4 million of its citizens via its first state-sponsored contact-tracing application before Google pulled the app from its digital store.¹⁴ South Korea relaxed its infectious disease law to allow automation and give government officials access to patient information.¹⁵ If the United States and its allies are not careful, this environment can exacerbate certain political and social effects deleterious to democracy already driven by digital surveillance. In fact, the pandemic appears to accelerate some of these existing trends, especially in autocracies.

Authoritarian Regimes

Prior to the pandemic, authoritarian regimes exhibited certain distinct trends of using digital surveillance for internal political and social control. China is at the “bleeding edge” of using data aggregation and data exploitation for this control. As security scholar Sheena Greitens argues, China is the “index case” for mass surveillance and the precipitation of its spread around the globe.¹⁶ Though not perfectly implemented, Beijing’s philosophy for control is characterized by “standardized” and “integrated” “information collection,” in the words of Chinese authorities.¹⁷ To effectively do this, the party-state aims to aggregate enough useful data—synching multiple data sets will allow authorities to look for patterns in behavior—with the goal of “totalizing control,” as one New York Times reporter observed.¹⁸ China’s data collection practices help influence behavior in the service of this goal.

Attempts to link the digital and physical world—where online transgressions equate to near real-time, physical confrontation by authorities—further tighten the party-state’s grip on its citizens. Concurrently, China’s investments in surveillance technology abroad and its export of norms, values, and governance practices represent a push to set the terms for global use. Specifically, the party-state seeks to influence technology standards and provide legislative models that allow broad access to data by governments.

China as an Advanced Surveillance State

China at the “bleeding edge” of data aggregation for social control.¹⁹ China’s data practices demonstrate the bleeding edge of what is possible when surveillance tools are turned inward on a population. China’s 1.34 billion citizens are watched by around 200 million cameras on the mainland today. By the end of 2021, China is expected to house over half of the world’s more than 1 billion surveillance cameras.²⁰ And by 2022, China could have one public CCTV camera for every two people across the mainland.²¹ Its “Golden Shield” project of widespread censorship and surveillance; “Sharp Eyes,” the state-sanctioned rural surveillance program; and “Skynet,” its urban counterpart, help lay the groundwork for a massive surveillance net.²² This is punctuated by more pointed surveillance testing labs in high schools, grocery stores, banks, and public spaces that hoover up biometric data, experiment with micro-expression technology, and expose jaywalkers.²³ The Social Credit System is also used to monitor and assess the conduct of individuals and influence behavior on the basis of reward and punishment (e.g., redlists and blacklists enabled by information-sharing platforms). According to China’s Supreme People’s Court, 8.8 million individuals were blacklisted in the period from late 2013 to late 2017, at times limiting their government subsidies, job advancement, real estate purchases, ability to get a loan, and more.²⁴ Data extracted from spyware, malware unwittingly installed on devices that mines them for data, also adds to this data pool. Data extraction software called MFSocket,²⁵ employed as a routine security check on citizens’ phones, can allow access to “image and audio files, location data, call logs, messages and the phone’s calendar and contacts,” according to the Financial Times.²⁶ Other more experimental methods of data aggregation under this authoritarian regime include a reported voice biometric database, which is augmented by an artificial intelligence program known as automatic speaker recognition to accelerate matching between this and other databases.²⁷ Human Rights Watch has reported that these police-held databases link voice data to:

the person’s identification number, which in turn can then be linked to a person’s other biometric and personal information on file, including their ethnicity, home address, and even their hotel records. … Official tender documents and police reports suggest that police are collecting voice patterns together with other biometrics—fingerprints, palm prints, and profile photos, as well as urine and DNA samples.²⁸

The Xinjiang Uighur Autonomous Region is the consummate test lab for China’s digital surveillance tools.²⁹ Chinese officials demand voice samples, 360-degree photos and videos, and eyelash samples from some Xinjiang natives in order to monitor the Uighur population for “dissident” behavior.³⁰ Further, Xinjiang’s predictive policing platform, the Integrated Joint Operations Platform, synchronizes biometric and behavioral data to detect and ultimately identify individuals for potential detention.³¹

However, these attempts at instituting effective large-scale surveillance—throughout China and in the Xinjiang region—are far from perfect. The lack of interoperability, or systems’ ability to communicate with other systems, will hamper efforts to synchronize disparate data sets and identify patterns in behavior. Maya Wang of Human Rights Watch describes Chinese authorities’ travails with “incompatible datasets and systems developed by different companies,” especially those born out of discrete municipalities run by local officials, as stymieing efficiency.³² New York Times reporter Paul Mozur has detailed how police struggle to consolidate location data collected in their local jurisdictions due to lack of data sharing by Chinese telecommunications companies. Local police are forced to build their own trackers to obtain data, resulting in duplicative databases that operate on different networks and can contain conflicting information.³³ Further, class differences expose the “holes” in the surveillance blanket, with upper- and middle-class Chinese citizens more likely to register with the government and make use of technologies that can be linked to their personal identity, like high-speed trains or the internet.³⁴ Additionally, not all cameras are created equal. Some of China’s hundreds of millions of CCTV cameras are equipped with facial recognition; most are not.³⁵ Yet overall, China’s developing surveillance regime, combined with low-tech human surveillance efforts, amounts to an inordinate—and growing—amount of control. Moreover, the holes in China’s surveillance dragnet do not necessarily reduce its effectiveness as a deterrent on individual behavior, since individuals are unlikely to know which cameras have facial recognition and which do not, which databases are linked and which are not. The uncertainty and capriciousness of government power can be an asset in creating a climate of fear, since citizens never know when they are being watched.

Interconnecting the digital with the physical. The ability to link online behavior with reality is a trend that will increasingly be leveraged by governments with malign intent. In China, police cultivate efforts to respond to digital behavior in real time. According to Wired, if Uighurs are contacted on their smartphones by non-Chinese numbers, the result can be “instant arrest.”³⁶ Research laboratory Citizen Lab found evidence that certain users of China’s most popular social media platform, WeChat, were arrested for insulting police officials or threatening government facilities online since at least 2018 in addition to facing automated real-time censorship.³⁷ The New York Times’ Paul Mozur offers corroborating observations regarding physical responses to online content considered unacceptable by Chinese officials:

China’s internet police are increasingly responding in real time to question people who have said things deemed questionable online. Eventually the goal is to link all online and offline behavior. … What the police are doing is putting in the ground floor on a system to control reality as tightly as the internet.³⁸

Increasing investments in surveillance technology. In the past five years, the Chinese government and private companies have scaled up financial investments in surveillance technology at home and abroad. In terms of industry projections, the China Security & Protection Industry Association predicted that surveillance and safety product sales would rise to an estimated 800 billion yuan ($114.8 billion) in 2020, up from a surveillance and safety industry worth 490 billion yuan ($70 billion) in 2015.³⁹ Specifically, a 2018 International Data Corporation report estimated that Chinese investments in smart-city initiatives would surpass $38 billion by 2023.⁴⁰ In 2019, Huawei more than doubled its smart-city technology reach to 90 countries, up from 40 countries in 2017.⁴¹

Proliferation of the Chinese Model

China’s focus on internal control does not exclude deliberate and opportunistic expansion of China’s surveillance technology outside its borders. China is narrowing the digital divide between countries that possess high-tech surveillance capabilities and those that do not by exporting both its tools and its policies abroad.

Beijing is shortcutting its access to the world’s data reserves by exporting Chinese technology and, at times, transmitting data to Chinese-owned servers. The list of these incursions is extensive. For instance, in Venezuela, Chinese company ZTE stores data generated by a smart chip–based ID card used by its citizens, the creation of which was inspired when Venezuelan officials took a trip to China over a decade ago.⁴² In 2018, the Chinese AI firm CloudWalk Technology sold Zimbabwe’s government a mass facial recognition system, giving the firm access to part of that country’s biometric data pools. Starting in 2011, the government-subsidized technology company Huawei and the state-run China National Electronics Import & Export Corporation built most of Ecuador’s surveillance system, ECU-911.⁴³ Malaysian police forces use automated facial recognition cameras from Chinese AI start-up Yitu.⁴⁴ A Yitu executive also declared “big potential” in Singapore in 2018, opening up an office there that year, in addition to a research and development center in 2019.⁴⁵ Chinese AI start-up SenseTime also explored a bid for Singapore’s facial recognition software market, which includes a planned 110,000 facial recognition cameras in addition to the 80,000 cameras already installed in public areas.⁴⁶ In 2019, SenseTime reportedly established an office in Abu Dhabi; there have also been reports of meetings between SenseTime’s representatives and the United Arab Emirates’ smart-city officials in 2018.⁴⁷ Belgrade, Serbia intends to import a Huawei system consisting of 1,000 cameras for 800 locations.⁴⁸ One accelerant to this trend is the ability of Chinese firms such as Huawei to undercut competitors on price due to government support and the incentive for those firms to siphon off local data once entrenched in those countries. In addition to its commercial footholds, China is laying the technical foundation for access to a high volume and variety of data collected by its surveillance technology across the globe.

In total, China is exporting AI surveillance technology to more than 60 countries, including 36 Belt and Road Initiative (BRI) countries, and possibly more, according to a report from the Carnegie Endowment for International Peace.⁴⁹ And the spread is not limited to typical BRI countries. Eighteen countries, including Germany, are using “intelligent monitoring systems” made in China, according to New York Times reporting.⁵⁰ The list of countries importing Chinese surveillance technology even includes the United States. As recently as April 2020, Amazon ordered 1,500 thermal cameras from blacklisted Chinese company Dahua, with plans to use at least 500 of the cameras in the United States.⁵¹

Along with its technology, China is also exporting its norms, values, and governance practices to the rest of the world. It does this by actively attempting to promote its own indigenous technology standards to international standards bodies. Simultaneously, Beijing is inspiring the rapid expansion of legislation with low thresholds for access to data by the state. China makes no secret of its ambitions to promote the “global influence” of its “national champions,” industrial conglomerates heavily subsidized by the government, and push its “proposition of internet governance toward becoming an international consensus,” according to the Cyberspace Administration of China.⁵² China is also investing in patents linked to the overall advancement of surveillance systems, in addition to setting standards to influence global technology development. China published 530 video surveillance–related patents in 2017, compared with 96 in the United States that year.⁵³ China submitted every standard related to surveillance technology to the United Nations in the past three years, in an attempt to influence how this technology is used throughout the world and to displace existing U.S. influence.⁵⁴

Other countries are also adopting China’s legal frameworks in order to build stronger foundations for their own authoritarianism. This includes imitating laws and policies that offer broadly scoped data localization, storage, and retention provisions and make it easier for governments to conduct surveillance on their people. For instance, Vietnam officials attempted to implement a cybersecurity law akin to China’s in June 2018, with a key provision that service providers must “disclose user data to authorities without … a court order.” This draft law contained strict data storage provisions (giving access to a government “task force”); a mandate to open offices in Vietnam if requested by Vietnam’s Public Security Ministry; and overarching definitions of content, including “information chosen for upload, sync or import from device” and information about “friends [and] groups that users connect with or interact with.”⁵⁵

Uganda and Tanzania implemented similar cybersecurity laws, and Singapore’s “fake news” law has a similarly broad data provision. Russia is also getting in on the game. By legally requiring a number of private technology companies in Russia to install equipment for its targeted surveillance mechanism, System for Operative Investigative Activities, the government provides its own agencies with access to users’ identifying information, including email and internet protocol (IP) addresses.⁵⁶

Global Swing States

How “swing states”—non-Western nations like India, Brazil, Turkey, the Philippines, and Indonesia that exhibit forms of both democratic and illiberal governance—choose to use surveillance technology will be key to how it is adopted globally. Thus far, nations with large populations, technical capability, and current spikes of unrest exhibit troubling trends, especially for nations undergoing democratic backsliding, such as Hungary.⁵⁷

Swing states such as Brazil and India, poised to become the world’s biggest security camera markets, are imitating authoritarian surveillance practices.⁵⁸ According to Human Rights Watch, multiple Brazilian officials visited China in 2019 to observe and learn more about its surveillance techniques.⁵⁹ On their return, a policymaker introduced an August 2019 bill to mandate the installation of facial recognition cameras in all public spaces, citing public safety as the justification.⁶⁰ Additionally, Brazilian President Jair Bolsonaro signed two 2019 decrees to establish a central database of biometric and other personally identifiable data on Brazilian citizens.⁶¹ Likewise, in the Philippines, lawmakers ultimately relented on the “Safe Philippines” contract—signed after CCP leader Xi Jinping traveled to the country in 2019—which seeks to install 12,000 CCTV cameras from Chinese telecom company Huawei for $400 million in Manila.⁶² Similarly, Indian government proposals for a centralized facial recognition system, data localization practices, forays into internet shutdowns, and a biometric identity database of its 1.3 billion people augur bad news for privacy and civil liberties in swing states.

Open Societies and Democracies

Open societies are demonstrating some of the same trends as swing states and even elements of these authoritarian practices, including the expansion of digital surveillance in the name of public safety and growing capabilities of the private sector to collect and analyze data on individuals. Similar to authoritarian regimes, some surveillance applications are legitimate and some are illegitimate. Genuine tradeoffs exist between public safety/health and privacy, convenience and commercialization, and rapid product rollouts and product security. The difference between open societies and repressive regimes is that, in democracies, how best to balance these tradeoffs is up for debate.⁶³ What distinguishes surveillance practices in democracies from repressive regimes is that the process to settle these questions takes place in the court of law, through an engaged citizenry, civil society groups, and the free press.

Expansion in the Name of Public Safety

Even in democracies where widespread surveillance is already entrenched, the expansion of its use will continue as a stated public safety imperative. The United States nearly matches China in its surveillance coverage, with one camera for every 4.6 people, compared to China’s one for 4.1 individuals.⁶⁴ Facial recognition is currently used for entry at borders (Global Entry), Transportation Security Administration checkpoints (CLEAR), and more than 20 sports stadiums. Success stories include the detection of Maryland’s Capital Gazette shooter in 2018 and the detention of multiple individuals using false passports at Dulles International Airport in the Washington, D.C., area that same year.⁶⁵ For over a decade, the FBI has used driver’s license and visa photos to look for criminals.⁶⁶ Many large-scale surveillance projects are underway—MIT’s Lincoln Labs licensed camera-cluster technology that provides up to a 360-degree field of view as the future of “high-tech aerial surveillance” to Consolidated Resource Imaging in 2019.⁶⁷ In December 2019, the city of Baltimore announced the deployment of a pilot program for wide-area motion imagery, providing about 90 percent coverage of the city with three aircraft flying simultaneously. Baltimore Police Commissioner Michael Harrison claimed Baltimore would be “the first American city to use this technology in an attempt to solve and deter violent crime.”⁶⁸ Other cities are following suit. In 2020, San Diego plans to fly a General Atomics MQ-9B SkyGuardian, a version of a drone used by the U.S. military, in test sorties over the city.⁶⁹ The Center for the Study of the Drone at Bard College estimates that as of March 2020, more than 1,500 U.S. public safety agencies had procured some form of drone.⁷⁰

Other Western democracies are expanding their use of surveillance technologies as well, with an eye toward harnessing the latest tech developments. In January 2020, the United Kingdom’s Metropolitan Police Service announced it would use live facial recognition technology to immediately identify potential suspects in real time. The technology will be employed in areas “where intelligence suggests [they] are most likely to locate serious offenders.”⁷¹ Other metropolises around the world employ drones, social media aggregators that monitor sentiment, and beacons that connect to smartphones in the name of public safety.⁷²

Private Sector Access to and Commercialization of Personal Information⁷³

U.S.-based tech companies are using emerging tech to elicit more value out of consumer data. As both the amount of data and the ability to exploit it increase, companies are finding ways to use it more effectively. For example, applying artificial intelligence to parse through big data repositories that include voices, faces, and other personal identifying information allows them to analyze the data for targeted advertising purposes, often without notifying consumers. To illustrate the reach of these companies, one German researcher installed 14 apps on his phone in a 24-hour period, only to discover 7,305 data transmissions to 636 servers in those hours, including 64 percent of transmissions occurring when his screen was locked and 18 percent overnight.⁷⁴ Outside of such manually downloaded apps, databases like Google’s SensorVault store device ID information scooped up in major “geofence” searches (i.e., passive collection). As of April 2019, Google is collecting “detailed location records involving at least hundreds of millions of devices worldwide and dating back nearly a decade”—demonstrating “the whole pattern of life” through this type of geofencing and its SensorVault storage.⁷⁵ In December 2019, Facebook admitted to collecting user data even when users are not logged in to the Facebook application. As early as 2015, Democratic Senator Sheldon Whitehouse noted that “the greatest collector of data on ordinary Americans is not our government, but the private sector entities gathering personal data for marketing and commercial purposes.”⁷⁶ Additionally, tech companies’ ability to exploit this information is vast and expanding. Johns Hopkins’ Thomas Rid explains:

The big revolution in intelligence is happening in start-up-y spaces in the private sector due to the combination of vast amounts of customer (& other) data: amazing engineering, stunning analytics, deep regional expertise, native language skills, intel feeds, graphing, machine learning. . .⁷⁷

Process: Debating, Litigating, and Reworking Digital Surveillance

In democracies, surveillance practices are up for debate. The process to settle these questions involves civil society groups, public commentary and pushback, legislative deliberation, and courts of law. For instance, some tech rollouts and developments are facing increasing resistance among various groups, lawmakers, citizens, and even technology companies themselves, especially those based in the United States.⁷⁸ In 2019 and 2020 there was a wave of grassroots bans against government use of facial recognition. As of January 2020, 10 state legislatures had introduced bills to limit, study, or generally increase transparency surrounding the use of facial recognition.⁷⁹ Cities in California (Oakland and San Francisco) and Massachusetts (Brookline, Somerville, and Cambridge) have enacted bans on the use of facial recognition technology by local law enforcement and municipality representatives.⁸⁰ And as of early 2020, Indiana, Michigan, Maryland, New Hampshire, New Jersey, South Carolina, and Washington were considering varying forms of restrictions and regulation.⁸¹ In the U.K., public outcry against the use of facial recognition in London’s transportation system forced an Information Commissioner’s Office investigation and resulted in the ultimate cessation of the program.⁸² Even private companies are engaging the public, lawmakers, and external stakeholders to influence their internal decisions. U.S. tech company IBM announced in May 2020 that it would end its “general purpose” facial recognition program, citing mass surveillance and potential racial profiling as factors in its decision.⁸³

Other potential privacy invasions invite further scrutiny under democratic processes. Litigation as a method to temper potential abuse of surveillance technology will grow as strains on civil liberties increase. For example, Facebook and Twitter suspended social media monitoring start-up Geofeedia’s access after a challenge from the American Civil Liberties Union (ACLU) in 2016.⁸⁴ Clearview AI, a U.S. tech start-up that bases its facial recognition app on over 3 billion images scraped from public websites, is the subject of another ACLU lawsuit in May 2020.⁸⁵ In addition to privacy issues, potential exacerbation of inequality and social impacts of widely deployed facial recognition systems, including the repeated misidentification of minorities, high false-positive rates, and potential for algorithmic bias, will engender additional legal challenges—yet another tool in the democratic toolkit to address the public’s privacy concerns.

The debate over personal data highlights the differences in how authoritarian regimes and democracies approach surveillance technology. These differences are an opportunity for the United States and other democratic nations to articulate the right way to imbue technology with privacy protections from the outset, in addition to maintaining a strong system of checks and balances to redress privacy infringements that do occur. Repressive regimes, if competing on this playing field, will come up deficient. For example, many democracies are developing and deploying digital surveillance systems with some form of safeguards built in. The governments of Germany, France, Italy, and the United Kingdom are all rolling out their own versions of surveillance in the name of public safety and—concurrently—some accompanying version of checks and balances. Just as the UK Metropolitan Police’s facial recognition systems come with a multi-year trial period by Scotland Yard, Germany’s Safety Station Südkreuz project comes with the EU’s General Data Protection Regulation protections. Though not perfect, these measures at least provide initial constraints or attempts to shield privacy for the individual citizen. They demonstrate an intent by democratic governments to consider individual privacy in these rollouts, in stark contrast to repressive regimes around the world.

COVID-19 Response Lessons

Attempts to surveil populations using digital tools as a response to the COVID-19 pandemic offer a glimpse into the future of surveillance.⁸⁶ The way countries are adopting COVID-19-related technology is determined by the political systems and governance structures that incubate or adopt them. China is accelerating trends underway, such as mass surveillance for social control, and is seeking to make them permanent. Swing states appear to be taking cues from China’s authoritarian model, while the spectrum of democratic responses reflects the diversity of democracies’ citizenry and processes.

Authoritarian Regimes: Expand Powers and Make Them Compulsory and Permanent

China is taking advantage of the crisis to expand its surveillance powers and make these more extensive measures permanent. Its Alipay Health Code system is a “black box,” using QR codes to indicate health status without clear justification for the algorithm’s decision. The developers have not publicly revealed how the assessments of green (unrestricted freedom of movement), yellow (possible seven-day quarantine), or red (mandatory two-week quarantine) are determined. Further, The New York Times reported that the application was developed in partnership with police, and its data is possibly transferred to law enforcement and other servers without the user’s explicit consent.⁸⁷ In May 2020, the health commission of the city of Hangzhou—one of the first cities to use the app—suggested making this tool permanent, and even expanding its capabilities to assign health scores that encompass additional health records, physical exams, and lifestyle choices like smoking or alcohol consumption.⁸⁸

In Russia, in addition to a mandatory, Communications Ministry–designed program that tracks COVID-19 patients (and accesses device data like location and storage information), the government also introduced a compulsory QR code–based permit in April 2020 for use on public transportation in Moscow.⁸⁹ This digital tracking method requires the input of travel routes and an upload of identification documents, tax information, and license plate details.⁹⁰ In Iran, developers suspected of building tools for Iranian intelligence agencies helped release an application, AC-19, in early March. The program functioned as a surveillance tool, requesting real-time geolocational information, before its removal from the Google Play store, likely due to Google’s quality control.⁹¹ Its new version, Mask.ir, also collects location information, signaling the regime’s intent to add to the reported 4 million individuals whose data was obtained by the original app.⁹²

Swing States: Still Mostly Democratic but Taking Cues from Dictators

Hungary, in a continued expansion of illiberal policies, is using the pandemic to allow Prime Minister Viktor Orbán “extraordinary powers” to “rule by decree” for an indefinite time period.⁹³ At the technical level, other crackdowns in swing states include the Turkish Health Minister’s mandatory order for infected persons aged 65 years or older to download the “Life Fits in the Home” app, part of a larger effort to isolate and monitor COVID-19 patients. The app uses personal data to track users’ movements and send them text messages if they violate quarantine.⁹⁴ If these messages are ignored, repeat offenders are reported to law enforcement and face jail time or other sanctions.⁹⁵ Thus far, Indonesian government’s contact-tracing application, PeduliLindungi, developed by a state-owned telecommunications company, is not mandatory. But if installed, it can help notify national police when large crowds are detected, monitor foreign nationals and citizens back from recent travel, and feed into a Web-based dashboard operated by the Health Ministry.⁹⁶ Finally, India continues to straddle the free world and illiberal practices. In spite of officially declaring its COVID-19 detection app voluntary, India requires government workers to download Aarogya Setu, which sucks up Bluetooth and location information and determines infection risk using a color-coded system.⁹⁷ According to the Home Affairs Ministry, certain cities threaten fines and potential jail time if the app is not used.⁹⁸ However, in a display of democracy at work, at least 45 organizations and a critical mass of individuals complained about the “mandatory imposition” of the system, according to India’s Internet Freedom Foundation.⁹⁹ In late May 2020, India’s Ministry of Electronics and Information Technology announced that it would release the source code of the Aarogya Setu app.¹⁰⁰

Democratic and Open Societies: A Chance to Get It Right

While the pandemic has also accelerated surveillance trends in democracies, elements of society are pushing back to slow the wheels of the surveillance machine. This includes resistance from civil society groups, appeals to an independent judiciary and a free press to amplify privacy concerns, and active opposition at the individual level. In line with late April polling by more than five organizations on public attitudes toward contact-tracing technologies developed by tech companies, civil society groups like the ACLU are already pushing back against unfettered use of public health surveillance technology.¹⁰¹ In a white paper released in May 2020, the organization admonished government officials and private sector leaders to consider the negative impacts of building widespread surveillance infrastructures.¹⁰² In Israel, the Supreme Court in late April 2020 blocked its internal security service, Shin Bet, from using location data from COVID-19 patients. The decision was contingent on the ratification of privacy protection legislation and followed a parliamentary oversight committee’s decision to stall similar use by police the week prior.¹⁰³

Democracies are also responding to the crisis differently. Some democracies are electing to institute more invasive public health–centered surveillance measures, with minimal nods to privacy. Although South Korea has elected to integrate virus tracking data collection with location data and financial transaction records—among the more expansive COVID-19-related data integration practices in democracies today—local officials have been at least in part responsive to privacy concerns. Korea Centers for Disease Control and Prevention (KCDC) officials turned Korea’s smart-city technologies into expanded surveillance nets during the pandemic but ultimately rejected facial recognition as a part of this data pool due to privacy issues.¹⁰⁴

The way these new surveillance technologies collect and store data is also the subject of robust debate among policymakers, tech companies, civil society, and other groups.¹⁰⁵ Friction between Apple and the French government is demonstrative of democratic processes at work. In May 2020, France’s government lobbied Apple to make an exception to one of the company’s privacy-enhancing protocols, claiming this “technical hurdle” impeded the French government’s efforts to streamline the efficiency of its “StopCovid” app.¹⁰⁶ According to French officials, Apple deferred to its default settings, upholding its existing privacy standards.¹⁰⁷ French Digital Minister Cedric O confirmed the conflict, stating that French authorities intend to develop a “sovereign European health solution that will be tied to [their] health system.”¹⁰⁸ Nevertheless, French Prime Minister Édouard Philippe allowed representatives in the lower house of Parliament to vote on whether or not to release the app, in the hope of increasing buy-in and the tool’s legitimacy in the eyes of the French public—a concession the government was previously unwilling to make.¹⁰⁹ Meanwhile, Germany, an original adherent to the centralized architecture, decided in late April 2020 to adopt a mostly privacy-protecting, decentralized approach to digital public health surveillance.¹¹⁰

Recommendations and Conclusion

The United States should respond to the illiberal use of surveillance technology in four ways:¹¹¹

1. Draw in like-minded democratic partners to work multilaterally, with a particular focus on global swing states.
2. Enshrine data privacy protections in statute for American use—demonstrate what “right” looks like.
3. Support U.S. tech companies in establishing a ruleset for engaging with authoritarian government use of surveillance tech abroad.
4. Partner with tech companies to develop a “privacy solution,” or commercially viable, privacy-preserving digital products, which can act as the free-world alternative to the illiberal use of surveillance tech.

Recommendation: The United States should actively engage other democracies, especially swing states, to articulate and establish a set of democratic principles that undergird state use of digital surveillance.

• The State Department should convene a bloc of democratic allies to debate and craft a specific set of democratic norms. Advanced democracies can use Britain’s “D10” approach as a blueprint for this summit of democracies.¹¹² Once drafted, the United States can leverage its position as a founding member of the Open Government Partnership (OGP)—and similar bodies—to draw countries at risk of instituting repressive digital surveillance policies further into democratic governance models for technology.¹¹³ The United States and other advanced democratic nations should focus on OGP founding governments, including Brazil, Indonesia, and the Philippines, using the OGP’s Peer Learning and Exchange Subcommittee of the Steering Committee as a vehicle for policy discussions. The United States should lobby to include surveillance issues at the top of the agenda for the 2021 OGP Summit. Within these bodies, advanced democracies can:
• Formalize and fund information-sharing mechanisms for fledgling democracies or aspiring democracies. Advanced democracies can help develop information-sharing processes and tech exchanges between democratic actors from polities on the frontlines (e.g., Hong Kong and Taiwan) to fight back against the authoritarian use of technology. For instance, resource the exchange of surveillance-defeating technology standard operating procedures between vetted dissidents. The State Department can invest in specific disinformation-combating efforts with threatened democracies through the Global Engagement Center.
• Open dialogue about increasing democratic states’ engagement and cooperation in international standards bodies and intergovernmental organizations to combat the uptick of authoritarian influence in these institutions.¹¹⁴

Recommendation: Develop a secure and privacy-protecting alternative for the use of digital data—establishing a model for what “right" looks like.

• Congress should enshrine data protections for American citizens and consumers by creating a national data protection framework that incentivizes consistent, open, and transparent data practices.
• To mitigate public safety and security tradeoffs, any government use of surveillance technology in the United States should require keeping the public informed on how their personal information is being used and protected. As part of this framework, Congress should also articulate clear policies and limits around data retention by the federal government, such as strict time limits and no indefinite data storage. Further, biometric data should be classified as “sensitive data,” and additional protections around this data, including limited interoperability, should be added.
• Any identity management systems used by the federal government must be secure and reliable, based off proper standards and measurements, and in accordance with National Institute of Standards and Technology (NIST) guidelines.¹¹⁵ And Congress should enforce data protection inspections and oversight among agreed-upon parties.¹¹⁶
• Congress should approve and ratify the Cyber Solarium Commission’s Key Recommendation 4.7 and pass a “national data security and privacy protection law establishing and standardizing requirements for the collection, retention, and sharing of user data.”¹¹⁷

Recommendation: Map the foreign digital surveillance ecosystem to help U.S. tech companies assess risks of abuse of their technology abroad.

• The State Department should establish a scorecard for U.S. tech companies to reference when operating abroad. The scorecard would assess levels of risk associated with specific uses of surveillance technologies. Tech companies can refer to this scorecard when making policy decisions regarding the potential illiberal use of their technology by foreign governments for surveillance purposes.
• This scorecard should start by defining what constitutes “abuse” of technology for surveillance purposes (e.g., specific activities or data collection architectures) and provide assessments to help tech companies create their own rulesets to respond to nation-state governments.¹¹⁸
• The scorecard should include a key set of indicators for this potential abuse, especially by repressive regimes or swing states, including but not limited to the following criteria:¹¹⁹
  • Data aggregation with established intent of political or social control (including the assessments on the levels of interoperability and data integration between technical systems).
    • Whether a “national architecture” for data collection on citizens is present or in advanced stages of development.¹²⁰ Is a repressive regime laying the groundwork for state surveillance and widespread data aggregation with punitive elements? Is this data collection compulsory and are these mandates enforced? Are elements of algorithmic scoring preset in systems that influence social behavior? Do that nation’s private companies work with the central government to integrate overseas records with data on its citizens held domestically?
  • A significant increase in surveillance technology investments, domestically or abroad.
  • Significant evidence of government subsidizing private industry.
  • A track record of exporting to and investing in surveillance systems for regimes consistently ranked low on Freedom House, World Bank, etc., rankings or those found to have committed gross violations of human rights as defined in the Foreign Assistance Act of 1961.¹²¹
  • Systemic risk due to a nation’s political institutions, including lack of an independent judiciary, free press, and mechanisms for recourse against government demands for private data. For instance, China lacks sufficient rule-of-law protections, specific corporate governance practices, and democratic features that would allow companies to resist arbitrary requests for information from the Chinese government.
• This scorecard should be accompanied by a risk-based compliance framework for export controls, as defined by the State Department, in coordination with the Commerce Department and other relevant agencies.¹²²
• Tech companies, in turn, should assess the systemic as well as reputational risk associated with aiding authoritarian governments and incorporate these factors as standard in their due diligence practices.

Recommendation: Fund the development of freedom-enhancing and privacy-preserving technology and export democratic models of surveillance technology.

• The federal government and private companies should stack the deck in favor of democratic principles and values by developing commercial solutions to the illiberal spread of surveillance technology.
• U.S. tech companies should devote substantial engineering capacity to designing protocols with built-in data privacy protections. This “privacy by design” concept builds in safeguards for users at the outset. This can be done by promoting user control of data through differential privacy, federated models of machine learning, or encrypted domain name servers.
• The U.S. government, via the Defense Advanced Research Projects Agency, the Intelligence Advance Research Projects Agency (IARPA), the State Department, In-Q-Tel, and NIST, should research and fund the development of privacy-preserving technology solutions. The private sector will drive development in surveillance tech and the ability to exploit it, but too often there are insufficient private sector incentives for privacy-preserving solutions. The United States must be at the forefront of these developments in order to provide an alternative to Chinese technology. The United States can leverage existing technology research and development initiatives via In-Q-Tel or IARPA or through updated exercises like NIST’s 2018 “Differential Privacy Synthetic Data Challenge” to help develop the “privacy solution” hand in hand with the U.S. private sector.¹²³ Solutions can serve as democratic models of surveillance technology, imbued with privacy protections, for export abroad.

From public safety to pandemic response, few governments appear immune to the allure of “tech-solutionism.” Even democracies are falling prey to the siren song of expanded surveillance. But early responses to the pandemic offer lessons for a longer-term battle. Democracies must resist the impulses to build permanent digital surveillance infrastructures or risk losing a broader global contest between open societies and repressive regimes. They must instead fight back on the merits of innovation, using technology and policy solutions grounded in democratic principles.

Acknowledgments

Thank you to Maura McCarthy, Loren DeJonge Schulman, Paul Scharre, Col. Sarah Albrycht, and Megan Lamberth for their reviews and clarifying conversations on all stages of the draft. Maura McCarthy and Melody Cook provided excellent assistance in editing and graphic design. Finally, CNAS would like to thank the Quadrivium Foundation for its generous support of this and other digital freedom initiatives.