Governments' Internet Surveillance: Privacy And Security Concerns

Internet surveillance is the monitoring of computer activity and data stored on a computer or data being transferred over computer networks such as the internet. This monitoring is often carried out by governments, corporations, criminal organizations, or individuals. Surveillance allows governments and other agencies to maintain social control, recognize and monitor threats or suspicious activity, and prevent and investigate criminal activities.

In recent years, internet surveillance laws have come under scrutiny, with many people criticizing them for being too broad or for failing to adequately address data collection.

Internet service providers (ISPs) monitor users' online activity and can sell their data to corporations and governments. Governments can access this data through legal requests or as part of intelligence-gathering efforts.

Various technologies and methods are used for internet surveillance, including IP address tracking, deep packet inspection, browser fingerprinting, metadata collection, and social media monitoring.

While internet surveillance is often justified as necessary for national security and combating criminal activities, it raises concerns about privacy violations and the potential for self-censorship.

Internet Service Providers (ISPs)

ISPs employ various methods to track and collect data about their users' internet usage. One common technique is IP address tracking, where they assign IP addresses to devices to monitor the source and destination of data packets. This enables them to identify the approximate geographic location of a device and track online activities. Additionally, they log patterns, including connection and disconnection times, URLs visited, and the duration spent on each site. This information provides insights into browsing habits and interests.

Another method used by ISPs is deep packet inspection (DPI), which involves analyzing the content of data packets transmitted over the network. DPI allows ISPs to identify specific types of content or activities, such as peer-to-peer file sharing. They can then enforce policies, such as bandwidth throttling or blocking access to certain websites. ISPs also track metadata associated with app usage, including timestamps, IP addresses, and port numbers, to gain additional context about application usage and user behaviour.

ISPs may also monitor search queries conducted through search engines, using the data for targeted advertising or other purposes. Even private browsing modes like Incognito or Private Browsing cannot hide users' activities from their ISPs, as the traffic still passes through their servers. Additionally, ISPs can retain records of internet activity even if users delete their browsing history locally.

ISPs track data usage to manage network resources effectively and ensure fair distribution of bandwidth among users. They analyze application protocols to differentiate between web browsing, streaming, file sharing, and gaming applications. By tracking connection patterns, ISPs can detect potential security threats, such as a sudden increase in connections or unusual traffic patterns.

While ISPs collect and use data for various purposes, including network management and compliance with regulations, they also share this data with governments. Data-retention laws require ISPs to store data for specified periods, which government agencies can access through legal requests, intelligence-gathering efforts, or surveillance programs. This sharing of information between ISPs and governments has raised concerns about privacy violations and threats to freedom of speech and basic human rights.

Surveillance programs

One notable example of a government surveillance program is the PRISM program operated by the United States National Security Agency (NSA). PRISM is a clandestine national security electronic surveillance program that targets customers of participating corporations, both inside and outside the United States. Similarly, the X-Keyscore system is used by the NSA to search and analyze internet data about foreign nationals.

In addition to these international programs, many countries have their own domestic surveillance initiatives. For instance, the Central Monitoring System (CMS) in India enables the government to listen to phone conversations, intercept emails, text messages, and monitor social media posts and Google searches. Meanwhile, the Golden Shield Project, also known as the "Great Firewall of China", is a censorship and surveillance project operated by the Chinese government to monitor and restrict internet usage within the country.

Data retention laws

• Name and address of the subscriber
• Subscription identifier
• Time and duration of online sessions
• Device type and model
• Websites and web services accessed
• Calls made and received online
• Emails sent and received

In some countries, such as Russia, data retention laws also cover the content of communications and internet traffic.

• Australia: The Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 mandates that mobile carriers and ISPs retain their customers' communications metadata for three years.
• France: Telecom operators and hosting providers must retain data such as users' IP addresses, location data, numbers called, and the time and duration of calls for up to a year.
• Germany: The latest version of Section 113b of the German Telecommunications Act requires telecom companies to retain location data for four weeks and other traffic data for ten weeks.
• Italy: After the 2017 provisions in Article 132 of the Italian Data Protection Code, CSPs must retain all traffic data for all subscribers for six years.
• Russia: The Yarovaya Law 2016 imposes extreme and blanket data retention requirements on telecom companies and ISPs. Service providers must retain voice recordings for six months and metadata for three years.
• Spain: Telecom operators and ISPs are obligated to indiscriminately retain bulk traffic and location data for up to two years.
• United Kingdom: The Investigatory Powers Act 2016, also known as the Snoopers' Charter, grants government authorities unlimited surveillance powers.
• United States: The Stored Communications Act (SCA) and The Electronic Communication Transactional Records Act allow the government to access the data that telecom operators and ISPs collect voluntarily or for business needs.

Intelligence-gathering efforts

Intelligence agencies, such as the FBI, CIA, and NSA, employ advanced surveillance technologies to monitor individuals worldwide. They engage in electronic eavesdropping, reading messages, listening to phone calls, and gathering contact information. Additionally, they conduct hacking operations and purchase large amounts of personal data from data brokers.

The Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333 provide broad authority for intelligence agencies to conduct surveillance. FISA allows agencies to obtain wiretaps, collect phone call information, perform physical searches, and require companies to disclose data. The act also enables the collection of information from US citizens related to investigations involving non-citizens. Executive Order 12333, signed by President Ronald Reagan, authorises the NSA to engage in broad surveillance of Americans and foreign citizens, including the mass collection of telephone calls and internet data.

Intelligence agencies often engage in mass surveillance, monitoring a large portion of the population instead of specific targets. This practice raises concerns as it makes it easier to abuse data, harder for individuals to know they are being targeted, and leaves people unable to opt out of surveillance.

Social media monitoring is a significant aspect of intelligence-gathering efforts. Platforms like Facebook, Instagram, and Twitter have become essential means of communication and sources of information. Agencies such as the FBI, DHS, and the State Department routinely monitor social media to gather intelligence, detect threats, and support investigations. This monitoring includes analysing public posts, direct messages, and private online communications.

The use of private contractors for social media surveillance raises concerns about transparency and accountability. These contractors are not subject to the same legal constraints or freedom of information laws as government agencies, making it challenging to oversee their activities.

Social media monitoring

Governments monitor internet usage through various methods, including data collection from internet service providers (ISPs) and the use of surveillance programs. While the former is often governed by data-retention laws that require ISPs to store user data for a specified period, the latter provides governments with direct or indirect access to ISP networks.

In the United States, the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the State Department are the three agencies that use social media the most for monitoring purposes. Other agencies, such as the Drug Enforcement Administration, the U.S. Postal Service, and the Internal Revenue Service, also engage in social media monitoring to varying degrees. These agencies use social media for investigations, threat detection, situational awareness, and immigration and travel screening.

The use of automated tools and advancements in artificial intelligence (AI) and pattern analytics have enabled governments to monitor billions of social media accounts in real time. This mass surveillance is not limited to authoritarian regimes but is also practiced in Western countries like the United States and the United Kingdom. For example, in the UK, the government has monitored nearly 9,000 activists from different political spectrums using geolocation tracking and sentiment analysis of data scraped from social media platforms.

The Biden administration has been criticized for expanding programs that monitor social media posts of non-citizens to decide who can live, study, or stay in the United States. The Department of Homeland Security's (DHS) Visa Lifecycle Vetting Program and Continuous Immigration Vetting Program have been identified as tools to monitor the social media activities of non-citizens for immigration and vetting purposes.

Social media surveillance has been deemed ineffective and lacking in empirical support due to the sheer volume of information and the potential for misinterpretation of online messages, especially across different languages and cultures. Additionally, it infringes on the rights of individuals, including freedom of speech and the right to live without constant government scrutiny.

Frequently asked questions