Crypto backdoors, the overuse of opaque algorithms, turning companies into law enforcement agencies, and online attacks on critical infrastructure have all been attacked by the Global Commission on Internet Governance in a new report published on Wednesday.The body, which was set up in 2014 by UK-based Chatham House and the Canadian Centre for International Governance Innovation, has presented its 140-page-long One Internet report to provide “high-level, strategic advice and recommendations to policy makers, private industry, the technical community, and other stakeholders interested in maintaining a healthy Internet.”
It comes out in favour of strict legal controls on the aggregation of personal metadata, net neutrality, open standards, and the mandatory public reporting of high-threshold data breaches.
Along the way, it offers opinions on areas such as the sharing economy, blockchains, the Internet of Things, IPv6, and DNSSEC.
The Global Commission was chaired by Carl Bildt, and consists of 29 members drawn from various fields and from around the world, including policy and government, academia, and civil society.
On the hot topic of crypto, the report says: “Governments should not compromise or require third parties to weaken or compromise encryption standards, for example, through hidden ‘backdoors’ into the technology as such efforts would weaken the overall security of digital data flows and transactions.”
It also recognises that the aggregation of metadata poses particular challenges: “Legal thresholds for lawfully authorised access to communications data must be redefined to ensure that the aggregated collection of metadata—such as an individual’s full browsing history—are treated with the same respect for privacy as access to the actual content of a communication, and should only be made under judicial authority.”
Also on the subject of privacy, the report calls for “Greater respect for the privacy of foreign citizens’ data,” which it believes would weaken calls for data localisation. However, it rather optimistically goes on: “One example of this is the 2016 move by the United States and Europe to negotiate new Privacy Shield principles to replace the now defunct Safe Harbour Framework.” As Ars has reported, it looks increasingly likely that the Privacy Shield framework will not provide enough respect for EU citizens’ data, and that it will therefore be thrown out by the Court of Justice of the European Union in due course.
One novel aspect of the digital world discussed at some length by the report concerns the increasing use of algorithms:
The impact of algorithms on people’s lives is becoming more and more significant.
The code that operates and governs the digital economy, access to information and other online activities is increasingly used to make decisions for us and about us.
Algorithms written by corporations that operate online can decide what content receives attention and what gets ignored or censored.
Algorithms are not necessarily neutral: they incorporate built-in values and serve business models that can lead to unintended biases, discrimination or economic harm.
While many people are familiar with the role of algorithms in online searches or the curation of social media timelines, their role is expanding into areas such as hiring and finance.
Employers, for example, can now access not only the type of information contained in traditional resumes, but also personal and reputational information regarding job seekers and employees.
These are data-driven insights that could be used to reduce job discrimination or to introduce new forms of it.
The increasing use of algorithms across society comes with considerable risks that the underlying data and algorithms could lead to unexpected false results, in particular when the algorithms are used for automated decision making.
The Global Commission is worried that “Most of these algorithms are proprietary—leaving them immune from public scrutiny, transparency, and accountability.
This can have chilling effects on individual rights and democracy, by impacting human behaviour and opinion, and by limiting our ability to access the full range of content available to us online.” However, its solution is uncharacteristically weak: it merely suggests that “governments, private sector representatives, civil society, and technologists need to come to together to study their effects.”
Another area where the report is concerned about the power of companies is as private enforcers of the law.
The commission writes: “Private actors should not become the enforcement arm of governments.
Any special or secret agreements between governments and private actors to restrict or limit access to Internet content, or to limit access to communication should be made transparent.
Illegal public-private cooperation should be terminated.” It also believes that network operators and Internet companies should not be held liable for any illegal use of their services.
One topic where the report excels concerns what it insists on calling “cyberwar” and “cyber attacks,” apparently unaware that “cyber” went out of fashion in the 1990s. Recognising the difficulties of legislating on what is a global and largely uncontrollable problem, the report offers an interesting alternative approach: “Governments should shift their efforts from trying to develop treaties that limit cyber weapons, as they cannot be verified and flounder on the issue of the indivisibility of offensive and defensive code.
Instead, negotiations between governments should focus on agreeing to restrict the list of legitimate targets that can be targeted by cyber attacks.”
In addition: “Consistent with the recognition that parts of the Internet constitute a global public good, the commission urges member states of the United Nations to agree not to use cyber weapons against core infrastructure of the Internet.”
As these practical suggestions indicate, the “One Internet” report has the great merit of being unafraid of tackling extremely thorny issues that lack obvious or easy solutions. Overuse of the prefix “cyber” aside, it’s a valuable contribution to many of the key debates currently underway in the digital world.
This post originated on Ars Technica UK