Good morning, everyone, and thank you so much for coming this morning, and thank you as well to the Association for inviting me here to speak.
I, over the last 20 months, have spoken at countless events in literally dozens of countries around the world, and the opportunity to participate in this event has generated among the greatest excitement for me.
And I say that because I really believe that the epicenter of the debate that has been enabled by the disclosures of Edward Snowden lie with the people in this room, which I realize is a fairly heavy and even dramatic responsibility to place on your shoulders,
especially so early in the morning, but I actually think it's really true.
Whenever I talk about the NSA debate, I'm invariably asked two questions far more commonly than any others, one of which I'll address in a few minutes, but the first most common of which, by far, is the question of, well, what has really changed?
And like many questions, that question is actually an argument masquerading as a question, and the argument is essentially one that posits the following.
The disclosures we've been able to make, the reporting we've been able to do, has certainly generated lots of media attention, people who believe this viewpoint will say.
They'll say there's been a great debate around the world, but nothing has really fundamentally changed about the spying powers on which you've reported.
There hasn't actually been much change.
The spying continues more or less in the same form as it was two years ago.
And what they mean by that is that if you drive 45 minutes away from here to Fort Meade, you can see the headquarters of the NSA, it's still, the building is still standing, the doors are still open, people are going in and out of it, and that building is still the venue for a great deal of electronic surveillance.
And what they also mean is that if you drive much closer, five minutes away, to the Capitol, you will search in vain, in complete futility, for any new laws that have been enacted in the wake of this reporting that limit what it is that the U.S.
government and its allies can do when it comes to spying either on American citizens or foreign nationals.
And all of that is absolutely true as far as it goes, but I don't think it goes very far at all.
In fact, I think that it actually fundamentally misapprehends the nature of this debate specifically, but political change more generally.
It is certainly true that the NSA continues to stand and that the NSA continues to spy, but I think it's always important to realize that the intelligence community of the United States is one of the most powerful factions within what is still the world's most powerful government.
And when you talk about factions that exercise a great deal of power, they aren't simply defeated or even undermined quickly or easily without a significant and long struggle.
But I think more important is the question of where statutory change within Washington fits into the question of what has actually changed.
When I was in Hong Kong and meeting with Edward Snowden along with my colleague Laura Poitras, and we were thinking about all of the possible outcomes that might arise from the reporting we were about to do and the way in which mass surveillance might be reined in,
the question of what laws might be passed by the U.S.
government to limit the power of the U.S.
government is one of the issues on which we spend the smallest amount of time and mental energy.
And the reason for that is that I just never thought that the way in which the power of the U.S.
government to spy on people would be limited would come from limitations that the U.S.
government would place on itself.
Because that just isn't the nature of human beings and it's not the nature of political power.
People don't walk around thinking about how they can limit their own power.
That was never the expectation.
And I think the question of what laws have been passed in Washington is probably the least interesting and least relevant metric in trying to understand whether there have been substantial changes as a result of this debate.
There have been extremely substantial changes that have arisen over the last 20 months in terms of the ability of the United States and its partners and other governments around the world to spy on our activities and communications on the Internet.
And I think the U.S.
government itself would probably be the very first party to acknowledge that to be true.
It's true in all different ways.
There are numerous countries around the world which have learned for the first time about the extent to which the privacy of their citizens is being compromised who are taking all sorts of steps from creating international regimes to reconstructing physically how the Internet functions so it doesn't rely as exclusively on the United States to working together to prevent U.S.
hegemony over the Internet that pose very substantial barriers to the ability of spy agencies to engage in mass surveillance.
Much more important, I think, is the fact that individuals around the world now realize for the first time the threat posed to their privacy from mass surveillance and they are able, and not just able, but are in fact now doing, to exploit all sorts of tools such as encryption and browsers that enable anonymity to protect their communications from being spied on.
And if you look at all sorts of studies that are remarkable, they all conclude that there are extremely significant increases in the amount of human beings in continents all over the world who are using encryption for the first time.
Encryption is a very serious barrier between the ability of the U.S.
government and its partners and your communications to be able to spy on.
It's not invulnerable, but it's a very serious problem.
And the way that I know that it's a serious problem is that, as you might have heard, I happen to have many tens of thousands of their most secret documents, and they spend a great deal of time very worried about the fact that people will use encryption if they understand the extent to which surveillance has been implemented.
So individuals turning more and more to encryption is a very real and very important change that can provide a great barrier on the ability of the United States and other governments and stateless organizations to invade privacy on the Internet.
But I think the most important change is the change in the incentive scheme that now exists for companies that collect and store and manage people's private data and the behavioral changes that we've seen on the part of those companies as a result in the alterations of those incentive schemes,
by which I mean things like the very vitriolitive conflicts between the U.S.
and British government on the one hand and companies like Facebook and Apple on the other over those companies' decisions to embed end-to-end encryption in services like WhatsApp or to embed very serious encryption products in some of their new and most used products.
Now, whenever I talk about the changes in behavior on the part of tech companies as a way in which our privacy can be better protected in the future, it meets with a great deal of cynicism from people all over the world.
And I think with very good reason.
Some of that cynicism is just about a general ideological view that the nature of private companies or corporations is that they're geared not to doing social good like protecting people's privacy but instead maximizing their own wealth and their own profit.
But some of it is actually based in more specific evidence about the role that tech companies have played when it comes to compromising people's privacy.
There are a whole series of, I think, fairly disturbing statements that have come from leading Silicon Valley executives about views of privacy going back 15 years when a Sun Microsoft executive said privacy is dead, get over it.
Or the rather sneering response that was given by the CEO of Google, Eric Schmidt, when asked in an interview about the ways Google invades privacy and he said, if you're doing something you don't want others to know about, maybe that's a good reason not to be doing it.
Or the proclamation by the CEO of Facebook, Mark Zuckerberg, that privacy is no longer a social norm.
The series of statements along those lines have created a perception that Silicon Valley is not particularly interested in protecting privacy and in fact willing to undermine it.
And then more specifically, a lot of the Snowden documents entail very clear evidence prior to the world's understanding of what the surveillance system was of not just Silicon Valley companies but financial companies and especially telecoms actively collaborating with the NSA to undermine the privacy of their clients and customers and users.
Often to the extent that the law required them to do so, but in many cases far beyond the extent of what the law required.
And the reason for that was that there were all sorts of benefits two years ago and before for companies to actively cooperate with the government to undermine their users' privacy.
There were all kinds of benefits from creating positive relationships with the government at almost no cost because so much of it was being done in the dark.
And I think what the Snowden revelations have changed more than anything else is that calculus.
So now it is no longer true that there is no cost to collaborating with the U.S.
government and its partners to undermine the privacy of people's data or their activities.
There is a huge cost to doing so because people around the world are now aware of it.
And I think tech companies for the first time rationally are genuinely petrified that they will lose an entire generation of users to South Korean or Brazilian or German companies who say, don't use American tech companies because they'll give your data to the NSA.
You should use ours instead.
There are a lot of people inside Silicon Valley companies and tech companies and banking companies who are genuinely devoted to privacy, not for business reasons, but as a societal belief, as a societal value.
I've met some of them at this conference who work at very high levels in those companies.
But the nature of companies is that if privacy is seen as an antithetical force to business prosperity, it will be a huge uphill battle to get these companies to really meaningfully protect privacy.
And what has changed is that privacy is no longer I view it as an adversary to business prosperity.
It is now a great complement to it.
It's actually urgently necessary for private companies to demonstrate to the public that they are serious about protecting their privacy.
And that, to me, has been the greatest change in terms of the Snowden revelations.
And that's not just true for me.
The U.S.
government and the British government and its allies clearly view that change in incentive scheme as a serious threat to their ability to engage in ongoing mass surveillance.
I think one of the most extraordinary changes of the last six to nine months has been the rhetoric that has been unleashed on the part of British and U.S.
officials towards companies like Facebook and Apple and others who are starting to embed serious encryption into their products.
They're now all but accusing them of the things they used to accuse only journalists and human rights activists of being, which are friends of the terrorists or aiders and abettors of the terrorists.
That is the real front in this battle that's taking place right now.
The U.S.
government and the British government want to change that incentive scheme again.
They don't want tech companies to view it as being in their interest to protect privacy.
They want tech companies to view it as dangerous to protect people's privacy and to resist surveillance.
And their tactic for doing that is to threaten to demonize these companies as at fault if there is a terrorist attack or as allies or aiders and abettors of people who want to engage in violence, to coerce and pressure them to cooperate once again, to reenter that system of collaboration upon pain of having those labels and accusations applied to them.
And this question that tech companies now face is one that journalists face, that activists have long faced, that all sorts of people face who want to resist government orders or dictates or the exercise of power, which is the extent to which you're willing to stand in defense of values you believe in,
even upon pain of being subjected to those kinds of accusations.
And I think the reason that the NSA reporting that we have done has triggered such an intense and enduring debate, not just in the United States but around the world, is because of the nature of the Internet.
The Internet, I think everybody agrees, is one of the most extraordinary inventions ever, but the extent to which it will be applied is very much in question.
By which I mean that the Internet, the promise of the Internet has always been that it could be this extraordinary tool of liberalization and democratization, and it still can be that, and we see examples of that all the time.
But it could also be the opposite.
It could also be the most extraordinarily potent tool of oppression and coercion and control of all time.
And I really think we're at the crossroads in determining how the Internet will be used.
And the question of how that will be resolved, I think, is very much open.
It's not fatalistically predetermined.
It's a byproduct of our choices.
The choices that we make every day about what we do in our lives and the values that we defend and the ones we're not willing to defend will determine what the resolution of that question is.
And I really do believe that the choices that you make as privacy professionals or privacy activists or people working within the companies that now control so much of our data will play as big of a role, if not a bigger role, than any other single factor in determining the question of what the Internet actually will be.
Now, I just want to spend a little bit of time talking about my experiences working with Edward Snowden, because I think that there are all kinds of really critical lessons to draw from examining and understanding the actions that Edward Snowden took and the choices that he made.
I know that the lessons that I learned working with him will profoundly shape and influence everything that I think about and the way that I look at things for the rest of my life.
And so I just want to share with you a little bit of that personal anecdote and some of the thoughts I have about it.
I think it relates quite directly to what we just discussed, as well as just being valuable on its own.
When Laura Poitras and I boarded a plane in June of 2013 to go to Hong Kong from New York, we knew we were going to meet a source who claimed to have extremely incriminating evidence about the mass surveillance programs engaged in by the United States,
but we knew almost nothing else about him.
We didn't know where he worked or how old he was or what he looked like or even what his name was.
And everybody has had that experience when you have an exclusively online interaction with somebody and then you meet them for the first time in person.
What they actually look like is completely different from what you imagine them to be.
That was definitely our experience as well.
We had been assuming that the person with whom we were communicating was in his 50s or 60s, near the end of his career, for all kinds of reasons.
And when we got to Hong Kong, we saw someone who looked like a kid.
He was 29 years old at the time, but he looked much, much younger.
He looked 22 or 23.
And so when I sat down with him for the first time and spent the first two or three days with him, my number one priority by far was to try and understand what his actual motive was in making this choice that he had made, that if he went through it, it was going to send him to prison for the rest of his life.
Because it was crucial to us not to be part of somebody's unraveling unless it was really grounded in genuine autonomy and agency, a truly rational thought process.
And so it was vital for me to apprehend what his actual motive was and not to accept kind of a preordained script that was superficial, but to actually get to his motives.
And I spent many hours doing it.
And part of what I learned, or much of what I learned over the course of the two or three days that I explored his motive was the following.
The things that I actually came to believe were genuinely what motivated him.
One is that he talked about the value of the Internet in his life and the fact that as somebody who grew up in a lower middle class environment in northern Virginia with a father who worked for the federal government for the Coast Guard, he felt like he didn't have an opportunity to explore the world.
The Internet and the ability to function on the Internet anonymously let him explore the world, explore who he was, to interact with people who he would never otherwise interact with, to engage in exploration of alternative ideas and identities that was only possible because he was able to do that anonymously without the record of what he was doing permanently being attached to him.
And he said the thought that that might be lost, that something so crucial to him and the people he loved might be permanently lost was something that he regarded as a truly profound injustice that he was not willing to allow to happen without taking steps that he could take to do something about it.
More generally, when we talked about what the likely consequences would be for him, specifically the almost certainty that he would end up spending decades in an American prison and why he was willing to engage in that behavior, what he said to me was,
and this is what I ultimately came to believe was really driving him, he said, actually there's a little bit of selfishness in this.
And the selfishness is that if I have to spend the rest of my life knowing that I confronted this grave injustice, what I regard as a grave injustice, and believed I had the ability to do something about it but chose not to out of fear or some other concern for my immediate material well-being,
that the pain of having that sit on my conscience for the rest of my life would be much, much worse than anything that the United States government could do to me, including me putting me in prison for the rest of my life as punishment for engaging in what I regard as an act of conscience.
He also talked a great deal about a sense of betrayal that he felt.
This was somebody who had been inculcated from the time of childhood to believe certain things about how his government behaves in the world, about the kind of political culture that we have, about what democracy actually means.
He joined the U.S.
Army voluntarily to go fight the war in Iraq, thinking that this was a war of liberation in defense of freedom.
And it was not suddenly but over time, gradually, many years, that he began to think differently about what the role of the United States government in the world actually was, about the nature of what kind of democracy we really have, if so much of what was being done by our government of the greatest significance was being concealed from the American people rather than disclosed to them.
And he felt as though his duty as a citizen was no longer to comply with unjust law but rather to break it in pursuit of what he regarded as his duty as a citizen.
And these were the motives that he talked about.
And the lesson for me that I drew more than any other, that I think everybody actually can value from at least thinking about, even if you don't ultimately accept it, is this.
I've been writing about politics for ten years now.
I was a lawyer before that.
I started writing about politics in 2005.
And one of the things I immediately saw and have seen ever since is that paying attention to politics very easily breeds this sense of defeatism and powerlessness.
It's very easy if you think about injustices or view things that you regard as unjust in the world to tell yourself that you would like to do something about this but you're simply somebody who lacks the power to really do anything about it.
That these forces are so formidable and powerful that there's simply no way for you to make meaningful, take meaningful steps in resistance to them.
And to me the story of Edward Snowden should be the permanent antidote to that kind of defeatism.
It's actually tempting to think that, that we're too powerless to confront injustice because it actually relieves us of the obligation to do so.
We have an incentive to accept that.
And yet for me the Edward Snowden story and having seen it up close illustrates actually what a fiction that is that we can tell ourselves sometimes.
What a fraud.
Edward Snowden is somebody who grew up completely powerless.
I mean when I met him he was as ordinary of a person as it gets.
He was in his 20s.
He was a high school dropout.
He was an obscure employee of a huge mega corporation, Booz Allen.
He was somebody who had no family connections, no wealth of any kind, as ordinary as it gets.
And yet whatever else you think of him, he did change the world.
He changed the world.
He caused hundreds of millions of people, if not more, around the world to think in radically different ways about not just surveillance and the value of privacy in the digital age, but the danger of government secrecy and the role of journalism in a democracy and the role that the United States plays in the world.
And if you look at the most significant instances and unexpected instances of societal change, you typically find that they're actually catalyzed by extremely ordinary people, whether it's the civil rights movement in the United States being catalyzed by the refusal of an obscure woman to sit at the back of the bus or the Arab Spring challenging the most entrenched despots because an anonymous,
completely ordinary street vendor in Tunisia set himself on fire in protest.
These should be permanent solutions to the temptation to think that we actually lack power to do things about injustices that we perceive, and we don't need to be as extreme as Rosa Parks or the Tunisian street vendor or Edward Snowden or other whistleblowers in sacrificing and unraveling our lives.
There are choices that we confront every single day in our lives as citizens, in your jobs, that pose these same questions about the values that you believe in, and not just the ones you say you believe in, but the actions that you're willing to take in their defense.
And whatever choices you make, you should never allow yourself to believe that you lack the power to have an impact on all of these questions.
So the last point I just want to talk about is the other question that I'm asked most frequently about.
I began talking about the one I'm asked most frequently, which is, well, what has changed?
The second most frequent question I'm always asked in any media interviews I do or events like this is, you've done all these stories from the Snowden archive, you've done all these disclosures of documents, what has been the most shocking story to you?
What has been the most shocking revelation?
And what I always say is that the most shocking revelation that I encountered when I began working on this material, and to this day I regard as the most significant, is the overall explicit goal of the NSA and its allies, which is captured by a phrase,
a motto, that the NSA uses over and over and over again in multiple documents that it creates when describing its own institutional purpose.
And that motto is, collect it all.
That is the institutional mandate of the NSA.
Not to collect lots of communications about terrorists or to collect lots of communications in the world, but to collect all electronic communications that take place by and between other human beings.
And that's not me saying that, that's their own documents which have been published over and over.
And that's another way of saying that the goal of the NSA and its allies is the elimination of individual privacy in the digital age.
That is not hyperbole, that is a literal description of their institutional mandate.
And they are not regarding this as some future pipe dream, but as an institutional goal which they are very close to fulfilling.
The NSA and its partners collect billions, billions of communication events from around the world every single day.
Their greatest challenge by far, institutionally, is where to store the gargantuan amount of data they are collecting, even though huge amounts of data can now be stored on tiny little thumb drives.
And they are building new facilities in places like the UK and in Utah to store the information they're collecting.
They want to collect the internet as a whole so that they can monitor that which they want to review.
Now that poses obvious and very serious threats to individual privacy.
And I don't really have time to talk about why that's so significant.
I actually did a TED talk for anyone who's interested about why privacy matters and why not just terrorists and criminals, but every single human being in this room and outside of it values privacy and has things to hide.
And the things we lose as individuals when we allow governments or anybody else to subject us to the possibility of constant monitoring, the knowledge that we no longer have a place where we can go and think and explore without judgmental eyes being cast upon us.
And you can go and look at that if you're interested.
But beyond the subversion of privacy, that that policy obviously poses, I think even more significant is the subversion of democracy that it poses.
I mean, we can debate and reasonable people can debate and do debate the extent to which some of the details of these programs ought to be kept secret.
And there are people who think we publish too much, and there are a lot of people, although they're not heard from as much, who think we've published too little.
And if forced to choose, I would actually say that the latter critique is the more valid one.
But there's reasonable debates that one can have.
But what I think is not reasonable is to take the position that we would have been better off if we had remained completely ignorant of the broad strokes of what our government is doing.
You can call your system of politics democracy and point to the fact that every four years, we get to go to the ballot booth and punch one of the two names to determine who occupies certain offices.
But democracy is really not meaningful.
It's really a process that's illusory if the most consequential actions that the people who wield political power are taking are concealed from us in their entirety.
And whatever else you think about these questions of mass surveillance, and the need to monitor, and all of those other questions, if the government is going to do something as profoundly and obviously consequential as turn the internet into a realm of indiscriminate mass surveillance to adopt a motto,
collect it all, that's certainly something that in a healthy democracy, citizens had a right to know.
And I think the question that Edward Snowden faced when he decided whether or not he should come forward and unravel his life to disclose this information to journalists, and the question that we as journalists faced when deciding whether or not to report on this,
was the extent to which democracy required this information to be known.
And for me, that is only the first step.
We do now know the extent to which surveillance is being pursued.
And I actually think that the question is now in all of your hands about what will be done about that.
Do we actually want the internet to become this tool of unprecedented monitoring and coercion and surveillance, or do we think it's critical that individuals retain the ability to do things without others monitoring and watching what they're doing?
And all I ask is that as you make the choices that will determine the outcome of that debate, that you think about those questions very seriously, as well as your duties as a citizen and as a member of a democracy.
Thanks very much for listening.
I really appreciate it.