December 2014
Underestimating Risk in the Surveillance Debate
James Andrew Lewis
Executive Summary
Americans are reluctant to accept terrorism is part of their daily lives, but attacks have been planned or
attempted against American targets (usually airliners or urban areas) almost every year since 9/11. Europe faces
even greater risk, given the thousands of European Union citizens who will return hardened and radicalized
from fighting in Syria and Iraq.
The threat of attack is easy to exaggerate, but that does not mean it is nonexistent. Australia’s then-attorney
general said in August 2013 that communications surveillance had stopped four “mass casualty events” since
2008. The constant planning and preparation for attack by terrorist groups is not apparent to the public. The
dilemma in assessing risk is that it is discontinuous. There can be long periods with no noticeable activity, only
to have the apparent calm explode.
The debate over how to reform communications surveillance has discounted this risk. Communications
surveillance is an essential law enforcement and intelligence tool. There is no replacement for it. Some
suggestions for alternative approaches to surveillance, such as the idea that the National Security Agency (NSA)
only track known or suspected terrorists, reflect wishful thinking, as it is the unknown terrorist who will inflict
the greatest harm.
The Evolution of Privacy
Some of the unhappiness created by the Edward Snowden leaks reflects the unspoken recognition that online
privacy has changed irrevocably. The precipitous decline in privacy since the Internet was commercialized is the
elephant in the room we ignore in the surveillance debate. America’s privacy laws are both limited in scope and
out of date. Although a majority of Americans believe privacy laws are inadequate, the surveillance debate has
not led to a useful discussion of privacy in the context of changed technologies and consumer preferences.
Technology is more intrusive as companies pursue revenue growth by harvesting user data. Tracking online
behavior is a preferred business model. On average, there are 16 hidden tracking programs on every website.
The growing market for “big data” to predict consumer behavior and target advertising will further change
privacy.
Judging by their behavior, Internet users are willing to exchange private data for online services. A survey in a
major European country found a majority of Internet users disapproved of Google out of privacy concerns, but
more than 80 percent used Google as their search engine. The disconnect between consumer statements and
behavior reduces the chances of legislating better protections.
We have global rules for finance and air travel, and it is time to create rules for privacy, but governments alone
cannot set these rules, nor can a single region impose them. Rules also need to be reciprocal. NSA bears the
brunt of criticism, but its actions are far from unique. All nations conduct some kind of communications
