PRISM as a Security Apparatus?

celerymoldwarpSecurity

Dec 3, 2013 (3 years and 8 months ago)

63 views

PRISM as a Security Apparatus?
Marcin Koziej
index nr 214011
marcin@koziej.info
1 Introduction
In this article I will try to approach the global surveillance system code-
named “PRISM” froma perspective of some of Michel Foucault’s theoretical
models.
We live in interesting times,and for me PRISM revelations,and their
expected,yet sudden disclosure is a paramount event.It draws it’s impor-
tance from the importance of modern electronic media,which became an
ubiquitous and almost intrinsic part of human and his society.One could
object,that this subject is just constrained to wealthy,western societies,to
which I can answer in two ways:first,although the future is not distributed
evenly [1],it’s gaining more and more ground every day.Even societies,
where internet access per capita amounts to around 10%,indicate 70% mo-
bile phone usage.They are,on a daily basis,a part of the global network
of devices computing and transmitting information.They are in fact more
and more societies of human-computers hybrids.
When Edward Snowden started leaking secret documents during late
spring of 2013,the public received a proof of existence and a description of
PRISM,global electronic surveillance system,designed,built and executed
by National Security Agency of United States of America.The news were
terrifying and peculiar at the same time.Firstly,the scope and scale of
the system is unbelievable and impressive.The NSA and their partners
managed to encompass something seemingly unlimited,to underpin the
very fabric of the Internet,to disprove what was Net’s greatest attribute:
distribution and autonomy escaping permanent observation and control.
Secondly,the reach of PRISM is not only broad,it’s deep.Amounts
of data and meta-data gathered in secret data banks seem preposterous,
1
and methods of their acquisition are so comprehensive,they put even the
savvy IT professionals into the sphere of uncertainty.The back doors to
information might be planted as deep as in encryption algorithms,and those
who planted them in international standards seem to be always a few steps
ahead of everybody else.Thirdly,what follows from all above,Snowden’s
news concern everybody.Interestingly,not everybody became concerned.
One of the schemes,models or narratives that stimulate public debate
about american intelligence system is the All Observing,the Panopticon.
The famous architectonic artefact of Bentham reshaped into a disciplinary
apparatus of power by Michel Foucault,perhaps partly due to it’s catchy
name,became a PRISM’s moniker among some of the disputants.I will
argue that this model does not fit to what PRISM is.I will also try to
find it’s better theoretical approximation in notion of Security Apparatus,
concept elaborated on by Foucault in a series of lectures published in a book
“Security,Territory,Population”.
Espionage aimed at other governments isn’t something novel,and will
not be reflected upon.I choose the social subject of my enquiry to be
ordinary person,spying on whom PRISM excels at.The goal of applying
these models to a surveillance systemof a society of cyborgs is to understand
it better,not to coerce it’s description or reinterpret it to fit Foucault’s
vision.A better understanding of this amazing apparatus and a social
condition it operates in could open way for philosophical,political and
ethical approaches to this problem.Also note,that throughout the text
I will use the term subjects as in “subject to surveillance”,meaning ones
under surveillance,and not ones who perform it.
2 The Panopticon,Discipline and Security Appa-
ratuses
The theoretical model of Panopticon was proposed by Foucault in “Disci-
pline and Punish.The Birth of the Prison”,as one of the mechanisms of
disciplinary power.In his later book,“Security,Territory,Population”,the
concept of Security Apparatus is introduced,which adds to a list of theoret-
ical tools comprising Biopolitics.The later does not deprecate the former.
They both have different characteristics,goals and modes of operation,and
an ability to cooperate.
2
The Panopticon or “panopticism” became a first choice theory for ap-
proaching the problem of surveillance,and this can be seen in proposed
identity:PRISMis a Surveillance System,that in turn is an implementation
of Panopticon.Beyond the most basic,metaphorical level,this statement
is flawed.The characteristics of PRISM do not match those of Panopticon,
and what is more,PRISM isn’t even a purely disciplinary mechanism.The
offending category,misleading us into accepting this identity is surveillance.
It’s broad enough to overlap both foucaultian categories and intelligence
system in question.To dismantle this equation,a step by step analysis of
PRISM and foucaultian power mechanisms is necessary.
I will start with pointing out the major inconsistencies in identification
described above.Having that negative argumentation covered,I’ll try to
point out which aspects of disciplinary devices and security apparatuses fit
PRISM.
3 PRISM is hardly a Panopticon
Main mismatches between PRISMand Panopticon is architecture,the objec-
tives and sub/objects of [their] operation,and their impact on those sub/ob-
jects.
Firstly,Panopticon’s architecture,or spatial structure is by definition
confined.Michel Foucault took ideas embodied in Jeremy’s Benthamproject
of prison and expanded their application to other institutions of discipline,
like schools,factories and hospitals.Consequently Panopticon operates
within a divided space,constrained by controlled borders,barriers for sub-
jects moving in or out.PRISM has different structure:it taps telecommu-
nication infrastructure,and from it draws it’s architecture and design.I am
thinking mainly about Internet,but considering also the mobile telephone
infrastructure,which blends with the Internet,as well as “intelligent city”
devices,like personal ID monitoring in public transport and CCTV cam-
eras.Such infrastructure is partly distributed and partly centralized.When
the information flows form a network,its surveillance must be coextensive.
In the skeleton of the network,the so called backbone,information flows
through bottlenecks,critical nodes which can be targeted individually.
I owe the reader a more specific description of how this technology works.
The tapping of the second kind is based on agreements with institutional or
3
commercial entities controlling the critical nodes:Internet Service Providers
of “Tier 1”,or intercontinental and international network,as well as of con-
sumer internet service;operators of various communication and data stor-
age technologies,like Google (gmail),Facebook (social network),Dropbox
(file hosting) as well as lesser known,national or local companies;mobile
phone and public transport operators.When information is stored in or
flows through single,centralized place,it’s easily tapped.The second kind
of information is not directly accessible this way,because of its distributed
or encrypted character.It is accessed by means of hacking into individual
devices,be it computers of mobile phones,crippling encryption methods
through influence in standards organizations,or planting rogue nodes in
peer-to-peer networks like Tor [2].
How this architecture relates to walled structure of Panopticon?Surveil-
lance devices of PRISM are more akin to sewers running beneath the city
streets.Such space for surveillance is not organized by delineation or restric-
tion,the surveillance devices rather grow into the infrastructure supporting
modern life and communication,subtly penetrating it,and trying to remain
invisible.They are parallel and ubiquitous.
The second point follows fromthe first.Panopticon is designed to gather
and keep it’s inmates inside,isolating them from external world and from
one another.On the contrary,the surveillance of communication creeps
in to places where information is produced,transmitted and consumed.It
doesn’t create any barriers for it’s subjects,because that would be counter-
productive:the proliferation of movement in and out of observed space (if
there still is any outside),along with inner communication between subjects
is in the best interest of those who observe.An even stronger formulation is
possible:The inmates aspire do get in,overcoming possible barriers.They
are not taken into custody,they buy in.They buy an iPhone,they regis-
ter an account,they apply for a free service.There are many motives in
play,including gaining of something valuable,convenience,or profiting from
network effect of many participating individuals [3].It’s worth to mention,
that neither of these goals is “being observed”,but this comes free of charge.
Whereas Panopticon constrains the movement and communication,PRISM
leaves its natural flow as intact as possible.
4
Thirdly,the objective of panoptic institution is to impose rules of com-
pliance to a certain norm.In Foucault’s own words,“Disciplinary normal-
ization consists first of all in positing a model,an optimal model that is
constructed in terms of a certain result,and the operation of disciplinary
normalization consists in trying to get people,movements,and actions to
conform to this model,the normal being precisely that which can conform
to this norm,and the abnormal that which is incapable of conforming to the
norm.” [4] The subject of normalization process is a group,some multiplicity
chosen according to the objective [5].Mentally sick are to be cured,children
are to be taught and criminals made socially adapted.In this regard,global
surveillance systems is antipodal.It collects all information about anyone
it has within its reach,without any norm or objective concerning specific
individuals or multiplicities.Its working is seemingly autotelic:collect as
much information as possible,because it might be useful in the future.I’m
not stating here that running this kind of surveillance operation is aimless.
PRISM of course has it’s goals,of which national security is an easy one
to point out.These goals,however,have nothing to do with a particular
subject who is being spied on.
The fourth point deals with impact the Panopticon has on the subjected.
The peculiarity of Panopticon lies in the information asymmetry it creates.
Its inmates are objects of information for the guards,who themselves are
not visible.Only the central,architectonic element of the structure can be
seen,yet the prisoners can never be certain,if they are watched,or not,they
are oblivious of the guards’ presence.The consequence of this mechanism
is internalization of the guard,the subject policing himself in accordance to
an imposed norm or model.This disciplinary effect is probably what’s most
interesting about this theory.Again,we won’t find this kind of dynamics in
PRISM.Like the guards,those who eavesdrop cannot be seen.Contrariwise,
the guard tower itself cannot be seen,which disables the process of norm
internalization.To become undetected,NSA follows two principles.Firstly,
it aims to minimize the possibility of being detected.Secondly,it tries to
make its actions deniable [6].This way,the surveilled are not only unaware
the apparatus,they’re not even able to prove its existence.
5
4 PRISM is more akin to security apparatus
In “Security,Territory,Population” Michel Foucault introduces a concept
of a Security Apparatus,as one of the “modulations” of mechanism of
power.Other two,which precede it,are legislation and discipline.However,
ordering of these mechanisms doesn’t mean they exclude each other.As
a word “modulation” suggests,they can overlap with different intensity
throughout history.In the previous section I criticized the identification of
PRISMand Panopticon not as a premise for assertion that PRISMis not at
all a disciplinary mechanism.As I will argue shortly,it also is.Nevertheless
it’s a device with a much stronger security apparatus “modulation”.What’s
more,it also has a legislative aspect,analysis of which would answer such
questions as “What formal and de facto legal frameworks PRISM system
assumes or produces?” and would be very interesting.Unfortunately,that
problematic would extend much beyond the scope of this article.
Foucault’s starting point for describing apparatus of security is that the
phenomena on which power is oriented are “inserted...within a series of
probable events” [7].Such conceptualization implies a considerable shift in
perspective:the security apparatus operates under a statistical paradigm.
It’s subjects are not a multitude anymore,they are the population - a notion
referring not only to real people living in some space,but abstractly to any
set of entities,concerning which a statistical inferences are to be drawn.
Through these lenses,power sees it’s subject as a whole consisting of
everybody and nobody in particular.Each member of population matters
only as much as she or he is a carrier of statistical distribution.Based on
local measurements or “cases”,which can be events of illegal activity or indi-
vidual sicknesses,the probabilities of these events are assigned to population
members as risks.This analysis can trade off simplicity for accuracy.When
additional factors are taken under consideration,a distribution of risk can
be calculated for each age group,area,profession and so forth [8].
In what ways is PRISM characterized by this model?From what is
known,one of the strategic NSA tools,nicknamed X-Keyscore,collects
“nearly everything a user does on the internet” [9],and this applies to
all users.The sheer size of data accessible to NSA,stored in their own
data centers or at participating companies,like Google or Microsoft,is
gargantuan.Hence it’s clearly visible that it made its subject of the whole
6
population of internet users.If we count mobile users in,this assertion can
be broadened to users of any electronic communication technology.
In general terms,the goals of NSA are “to defend the nation and to
protect US and allied troops abroad” [10],so to avoid various events doing
harmto US citizens and forces in,as I suppose,the context of war on terror.
To achieve this,NSA needs to find a needle of relevant information in a huge
haystack,and it does this through data mining,which is exactly statistical
analysis of data.For instance,it creates various profiles which are made
up of probabilities:what is a probability of somebody from Egypt to be a
terrorist?What about a similar correlation with his age or number of web
queries about weapons?
We could point out a difficulty:it seems that security apparatus,even
though interested in the whole population,focuses on particular cases and
based on themperforms its statistical calculations.It doesn’t have to observe
all and every of its members.On the contrary,PRISM does exactly that.
Isn’t it,then,more similar to Panopticon,where each prisoner is closely
observed?It isn’t.Firstly,by simply collecting data about everybody,
they aren’t already observed.There is no capacity to observe everybody
in particular,except in aggregated,statistical way.Secondly,when we
take Foucault’s example statistical categories,the subsets the population
is divided in by them are quite self evident.Given a risk distribution for
different territories,we just need to look at the map to see relevant subsets of
population.When we correlate risk with age,we need a census,which is an
index mapping citizens to their ages.Since categories used in distribution of
risk of someone planning a terrorist attack are so complicated,the indexes
mapping unobvious traits (like facts from browsing history) to person need
to be very extensive.Hence tapping all the population is a condition for
grasping the population in statistical paradigm which apparatus of security
operates in.On the other hand,making databases,indexes and lists is
clearly a technique of disciplinary mechanism of power,and I think this
argumentation shows howmuch apparatus of security needs it for performing
its calculations.
I already described the spatial structure of PRISM,but apparatus of se-
curity brings on another,temporal dimension.Foucault writes:“...security
7
will try to plan a milieu in terms of events or series of events or possible ele-
ments,of series that will have to be regulated within a multivalent and trans-
formable framework.The specific space of security refers then to a series of
possible events;it refers to the temporal and the uncertain,which have to be
inserted within a given space” [11].In PRISM,the series of atrocious events
and unwelcome elements would be attacks on citizens and terrorists or so
called self-radicalized individuals [12].Their possible appearance constitutes
the uncertainty that security apparatus of NSA tries to tackle.Because the
opponent described this way is infiltrating and co-existing with the popula-
tion,this problem is very similar to one described by Foucault:regulating
negative “circulations” within an eighteenth century city which opens itself
up,causing an influx of “beggars,vagrants,delinquents,criminals,thieves,
murderers” [13] as a side effect.Similarly to city’s development,the key-
word is “planning”.Unlike disciplinary devices,built anew to accommodate
it’s inmates,security apparatus regulates living population existing in some
space and time,maximizing the positive and minimizing the negative flows.
Foucault characterizes this place or environment,already in place and al-
ways “pragmatically structuring” its inhabitants,as a “milieu”.Its causal
characteristic is crucial:“the milieu is a certain number of combined,overall
effects bearing on all who live in it.” [14] In milieu one can distinguish series
of chained causes and effects,knowledge of which give a foundation for prob-
abilistic models used by security apparatus.If we know the probabilities of
outcomes given the circumstances or current state of milieu,we can predict
them in the future.This preemptive logic is what drives PRISM’s insatiable
data acquisition.
The regulatory impact of PRISM is of course not done by surveillance,
which tries to be as subtle and undetectable as possible.Instead,it’s
performed by institutions of law enforcement,controls,etc.Yet it is the
time reigning capability of PRISM that drives this effort.For example,
Ross WilliamUlbricht also known as “Dread Pirate Roberts”,the operator of
black market website Silk Road,was arrested as a result of “extensive search
of the internet” [14].The investigators found out that he was interested in
anonymity and digital currency technologies (in that case,Tor and Bitcoin)
from his past internet forum posts.The two events separated by time:
expressing interest in shady technologies and committing a crime are exactly
a kind of “series of events or possible elements” the apparatus of security is
8
interested in.According to a similar principle,oriented toward the future,
NSA’s data mining algorithms can predict a probability of citizen becoming a
criminal.The probabilistic models the security apparatus produces contains
variables or blanks,against which every citizen and every milieu can be tried.
When these blanks are filled out by flood of data provided by electronic
communication,a statistical landscape of future events appears.
5 Summary and ending remarks
I covered several characteristics of two mechanisms of power described by
Michel Foucault,panoptical discipline and apparatus of security,and com-
pared them with global surveillance system of American National Security
Agency.I’ve compared their spatial and temporal architecture,their sub-
jects,goals and mode of operation.I argued that the model of Panopticon in
many aspects does not describe PRISM very well,and that it should rather
be considered an apparatus of security.I have also pointed out,that some
characteristics of disciplinary modes of operation are necessary for statistical
logic of security apparatus,namely that of building population databases,
because only they can provide data for probabilistic inferences performed
by such mechanism of power.
I would like to end with a remark proposing a follow up in domain
of practical philosophy.Perhaps the false identification of PRISM and
Panopticon makes the task of judging it such a difficult one.When one
wants to argue against unjustified surveillance on a global scale,arguments
portraying it as a repressive discipline seem to be impotent.Might this be,
because PRISMis not such a device?People do not feel confined,pressured
and controlled by PRISM,because they really aren’t.If that is the case,
practical philosophy should build its critique on a basis of apparatus of
security instead.
6 Footnotes
[1] To refer to William Gibsons famous quote “The future is already
here – it’s just not very evenly distributed.”
9
[2] Tor – free software and an open network that helps you defend against
traffic analysis,a form of network surveillance that threatens personal free-
domand privacy,confidential business activities and relationships,and state
security.
[3] This point is influenced by Zygmunt Baumans and David Lyon research
on surveillance.In Bauman’s book,Liquid Fear,he writes:“Today’s Big
Brother is not about keeping people in and making them stick to the line,
but about kicking people out and making sure that when they are kicked
out that they will duly go and won’t come back.”
[4] Michel Foucault,Security,Territory,Population,Lectures at the Collège
de France,1977-78,s.85,Palgrave Macmillan,2009
[5] Michel Foucault,ibidem,s.26
[6] Bruce Schneider:Defending Against Crypto Backdoors https://www.
schneier.com/blog/archives/2013/10/defending_again_1.html
[7] Michel Foucault,ibidem,s.20
[8] Michel Foucault,ibidem,s.89
[9] XKeyscore:NSA tool collects ’nearly everything a user does
on the internet’,http://www.theguardian.com/world/2013/jul/31/
nsa-top-secret-program-online-data
[10] National Security Agency,Press Statement on 30 July 2013,http:
//www.nsa.gov/public_info/press_room/2013/30_July_2013.shtml
[11] Michel Foucault,ibidem,s.35 STP
[12] “One of the dangers that we now face are self-radicalized individuals
who are already here in the United States —in some cases,may not be part
of any kind of network,but because of whatever warped,twisted ideas they
may have,may decide to carry out an attack” – Barack Obama,talking
about 2013 Boston bombing.
[13] Michel Foucault,ibidem,s.34
[13] Michel Foucault,ibidem,s.36
[14] How the feds took down the Dread Pirate
Roberts http://arstechnica.com/tech-policy/2013/10/
how-the-feds-took-down-the-dread-pirate-roberts/
10