U.S. Cloud Services Companies Are Paying Dearly for NSA Leaks

Edward Snowden spoke during a simulcast conversation during the South by Southwest in early March.

Edward Snowden spoke during a simulcast conversation during the South by Southwest in early March. Jack Plunkett/Invision/AP

The agency could consider economic impacts of its practices.

Edward Snowden’s leaks about National Security Agency surveillance practices have had a profound effect on the U.S. cloud computing industry.  Experts disagree on the long-term harm to U.S. companies, but recent projections are for $22 billion or more in lost revenue over the next three years.  The harm comes largely from backlash over the perceived complicity of U.S. technology companies with NSA operations.  That U.S. companies will suffer harm this significant as a result of U.S. government activities raises important questions about U.S. decision-making.  In particular, have economic issues, including the competitiveness of U.S. industry and the health of the Internet economy received enough attention in decisions about surveillance?  The answer appears to be no.

The key problem is the lack of an established process for economic input at the level of most day-to-day surveillance decisions.  There is such a process for high-level national security decisions.  In the Obama administration the process is set out in Presidential Policy Directive 1 (PPD-1), which provides a relatively formal mechanism for senior government officials considering national security matters.  It is not always clean – there can be informal discussions and side meetings that feed into decision making – but, on the whole, it works.  And although national security concerns predominate, if there is an issue with economic implications,  officials from the White House, Treasury Department, Commerce Department and other agencies can air their concerns and be sure the President will hear them.

But this process applies only to policy, strategy, and operational issues that make their way to the White House for decision.  This will sometimes include surveillance policy, but it does not, nor should it, include decisions on all technical or operational matters.  These decisions – many of which have great potential economic significance, such as how to implement NSA authority, what technology to employ, what targets to choose – are made at the NSA.

The challenge, then, is how to ensure consideration of economic concerns at the operational level.  Unlike the consideration of privacy issues, which is now built into NSA decision making, there is no established process for economic input.  And the NSA itself does not have deep institutional expertise on U.S. competitiveness issues.  One reason for this may be the long-standing U.S. policy that we will not engage in “economic espionage.” That is, U.S. intelligence agencies may collect economic information, but they will not share that information with U.S. companies for commercial or competitiveness purposes.  Therefore, NSA has had little incentive to develop a deep understanding of economic and competitiveness concerns.

In addition, the kind of harm to cloud industry competitiveness that we are seeing now arose only when the public became aware of the ways in which NSA interacts with technology companies.  The competitive standing of the technology industry would have been unaffected as long as NSA’s practices remained secret.  Rightly or wrongly, it seems likely, that NSA never contemplated a leak on the Snowden scale and did not weigh heavily the risk of such exposure in its surveillance decision making.

As mentioned above, it is different for privacy issues.  Privacy concerns are no more a natural subject of expertise for those in the intelligence community than economic issues.  But privacy is explicitly and consistently a part of surveillance decision making at every level.  People can (and do) disagree with the results of some of this decision making, but they cannot seriously dispute that privacy is integral to the surveillance conversation at NSA.  This did not happen naturally or quickly.  It began after the wrenching revelations of privacy abuses in the 1970s and the passage of the Foreign Intelligence Surveillance Act.  It has developed since as internal oversight at NSA has increased in sophistication, as has oversight from the Justice Department and, later, the Office of the Director of National Intelligence.  It will no doubt continue to evolve post-Snowden.

The wrenching experience of the Snowden revelations and their effect on the Internet economy and the competitiveness of a key U.S. industry should provide the same kind of spur.  NSA must now assume that some portion of its operations will leak.  The impact of those operations on the realities of the Internet and cloud economy has to be part of the internal debate when making surveillance decisions.  There are plenty of challenges to doing this.  For one thing, the U.S. technology industry is diffuse and there may be no one, inside or out of the U.S. government who can fully and coherently articulate its concerns.  But some basic issues – like the fact that appearing to be a tool of U.S. intelligence is bad for business – are fairly clear.  NSA must increase its own expertise on these matters and, perhaps, find a way to include cleared representatives from U.S. economic agencies in its day-to-day surveillance discussions.  In any event, NSA decision making will have to adjust to include greater sensitivity to these economic concerns. 

Mary DeRosa was deputy assistant and deputy counsel to the president and National Security Council Legal Advisor in the Barack Obama administration.  She is currently a senior adviser to The Chertoff Group and a distinguished professor from practice at Georgetown Law School. 

NEXT STORY: Give Us 3 Minutes of Your Time

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.