System can't keep its secrets

Gwynne Dyer Photo/File

Over the past two weeks we have seen the following computer system crashes: A three-hour network shutdown on August 22 that paralysed the Nasdaq stock exchange, crippled others and caused a one-third drop in the daily total of shares traded on American exchanges, a blackout of Apple's iCloud that lasted for 11 hours for some customers, a trading glitch in the Goldman Sachs computer on August 20 that resulted in a large number of erroneous stock and options trades and cost the firm up to $100 million, a shutdown of Amazon's North American retail site on August 19 that lasted almost an hour and resulted in an estimated $2 million in lost sales and a four-minute global outage of Google's services, including email, YouTube and its core search engine that led to an 40 per cent drop in global internet traffic.

Last month, in another part of the forest, we had the director of the US National Security Agency, General Keith Alexander, admitting that he still did not know exactly which files whistle-blower Edward Snowden had downloaded and taken with him when he fled the country two months before.

This may explain something quite puzzling which happened last week. A Brazilian citizen, David Miranda, was changing planes in London when he was stopped by British police under the Terrorism Act, questioned for nine hours and then released - but the police kept his computer, two pen drives, an external hard drive and various other electronic items.

Miranda is the partner of Guardian journalist Glenn Greenwald, who has been working on Snowden's documents.

It's less puzzling if you assume that the NSA asked for the operation (of course it did), and that its goal was actually to find out just how much Snowden knows and can prove. What it tells the rest of us is that the NSA is not really in control of its own data.

If Snowden can take it away with him, so can others.

There are 850,000 potential "others" - Americans with top secret clearance and access to the data.

What the NSA has built is a system that is too big to monitor properly, let alone fully control.

The system's official purposes are bad enough, but it cannot even know the full range of illegitimate private actions that it permits. It is inherent in the very size of the system and the number of people who have access to it. Which brings us back to Nasdaq, Apple, Goldman Sachs et al. If it can be done, it will be done. Algorithms will be written for automated trading at speeds measured in fractions of a microsecond, and the competition will have to follow suit. It will become possible to store immense amounts of data in a virtual "cloud", and the cloud will take shape.

It will become theoretically possible to listen in on every conversation in the world and the surveillance systems to do it will be built.

Every step onward increases the scale and complexity of the systems until they are too big and complex for any one person to understand. They will run without supervision.

If you give hundreds of thousands of people access to the system, your secrets will not stay secret for long.

The volume of data moving on the internet and private networks is expanding very fast at the moment and the system design is just not keeping up.

Given time, it may be possible to catch up on that front, if the rate of expansion eventually slows. But it will be much harder, maybe impossible, to build leak-proof surveillance systems.