Cyber Statecraft and the Issues of Personal Privacy
In early 2019 I wrote about state surveillance and how different countries approach it. This subject is an ethical and constitutional minefield that we will have to grapple with for the foreseeable future. In the meantime, observing how countries respond to COVID-19 provides interesting insights into their surveillance capabilities. Strong surveillance implies that a state has significant amount of data on its citizens and complex IT infrastructure. To simplify, this allows the state to analyze the data using artificial intelligence, drawing patterns of past behavior and models predicting future behavior. It follows that contact tracing, which is critical to successfully limiting the transmission of coronavirus, should be more effective in countries with strong surveillance. To date, we have seen relative success in the containment of the disease across developed Asian countries, specifically China, South Korea and Singapore. At the same time, Europe and US haven’t done as well. You can read my article from 2019 below for some insights into this puzzle.
Personal data, privacy and cybersecurity were talked about extensively in Davos last week. In the current state of the world, governments can use troves of personal information to fuel state surveillance and authoritarianism or develop projects for the benefit of people.
China’s social credit system, for example, has been in the news quite often recently. The project is part terrifying, part fascinating. Fascinating from the perspective of government’s vision and ability to design a system of incentivizing good behavior interlinked across multiple facets of life. Terrifying as a major government intervention into private life and abuse of personal privacy, if there was any left in China. By 2020, Chinese government aims to analyse everyone’s behavior across multiple categories from your shopping patterns to what you say on social media. They do take things even further though by looking at your social connections and their behavior. It would be slightly less intrusive if the Chinese government just kept that information to themselves. Instead, they will issue everyone with a score and make that score public for everyone else to see. The system is currently being tested by over 30 local governments as well Tencent and Alibaba, and it works. Imagine the look on your friends’ faces when they find out you are bad company. What about your girlfriend? This score, a single number, will determine which job you get, your mortgage or personal loan rate, which school you or your kids can go to and your level of access to the outside world, among other things. I do hope that this system will incorporate some type of dispute resolution agency – otherwise, the fate of most human beings will be in the virtual hands of an algorithm and, of course, the Communist Party of China. This social credit experiment can create a perpetual tiered society with no upward mobility. And maybe that’s an ultimate goal. To give Xi Jinping some credit, the government did outline the rules of the game. Sort of. Now it’s up to each individual to decide how they want to play this one.
In all honesty, we shouldn’t have expected anything else from China. It was a bit surprising to hear Xi Jinping talk about globalisation at Davos last year where he outlined China’s global leadership ambition to fill the vacuum left by the US. While money talks, China’s track record on human rights, free speech and political freedom will make it an unlikely leader of the Western world.
There are multiple reasons why the Chinese experiment is unlikely to be replicated anywhere else. First is the significant ownership of the economy and most industries by the government through State Owned Enterprises (SOEs). Chinese SOEs accounted for 15% of the Fortune Global 500 in 2014 and in 2013, they represented 96% of China’s top ten firms. Second is the depth of talent and skills that China possesses in the areas of technology, artificial intelligence and all things cyber – both in the public and private sector. Third, and probably the most critical, is the political regime and the power of the Communist Party of China. It doesn’t hurt that Xi Jinping is widely considered the most powerful Chinese leader since Mao.
No other country in the world can claim the combination of these 3 factors. In terms of state ownership of the economy UAE, Russia, Indonesia and Malaysia are next in line with India slightly behind. From this list, Russia can definitely pull off a social credit system but with its Cold War mentality and intelligence background of its political elite, it has very different methods for keeping its citizens under control. The Deep State doesn’t need social credit.
India, however, is an interesting case. They actually are currently trying to push through their own human profiling system called Aadhaar. The government, of course, insists that Aadhaar is an identification tool aka Social Security in the US. India is no China though and the scheme was swiftly challenged in court for violating personal privacy and making India a surveillance state. There are currently 26 petitions before the Supreme Court challenging the scheme’s legality.
This brings us to a very exciting project in technological statecraft in the European Union. What makes it exciting is that it works and can be scaled across the union in due course. Not sure how many of you even heard of Estonia, but this country of 1.3 million people managed to design a fully functional digital society. All of the traditional services from voting to education, justice, health care and taxes, are linked to government’s data platform, X-Road. The beauty is that the information is not stored on X-road but lives, encrypted, on local servers. It operates through an ID card secured by a PIN and a digital signature. Digital security and integrity of the system are maintained by a blockchain technology called K.S.I. making tampering with records immediately noticeable, regardless of the source. But the most fascinating element of the Estonian system is that each individual owns their information and can grant or deny access to it. Finnish recently started using X-Road and there’s some evidence that data can be linked across borders.
Cyber statecraft is, unfortunately, a necessary evil. We can only hope that more countries will opt for the Estonian model of digital empowerment rather than the Chinese model of digital suppression.