NSA Spying Creates a New Data Haven Industry. Government Stimulus at Work!
Last month, I wrote that Americans might soon "say goodbye to the U.S.-dominated Internet" after Ladar Levison, the owner of encrypted email provider Lavabit, closed his company rather than cooperate with government snoops and warned, "I would _strongly_ recommend against anyone trusting their private data to a company with physical ties to the United States." Revelations about NSA spying—and legal pressures on American companies to not only surrender data but to tailor their systems for easy tapping—create an opening for foreign companies to market privacy-friendly services beyond the reach of U.S. law. Now comes word that "Countries are competing to be the Cayman Islands of data privacy," and the result could be not only privacy as a saleable commodity, but a balkanized Internet.
For the Wall Street Journal, Elizabeth Dwoskin and Frances Robinson write:
The U.S. National Security Agency has acknowledged collecting email data about Americans through phone and Internet companies. Silicon Valley companies have said that they don't give the government unfettered access to user data but that they are barred from disclosing details.
Fueled by the controversy, countries are seeking to use data-privacy laws as a competitive advantage—a way to boost domestic companies that long have sought an edge over Google, Microsoft Corp. and other U.S. tech giants.
"Countries are competing to be the Cayman Islands of data privacy," says Daniel Castro, a senior analyst at the Information Technology and Innovation Foundation, a nonpartisan Washington, D.C., think tank that receives funding from the tech industry.
While establishing these islands of privacy might make for good marketing, the initiatives face hurdles. Laws demanding that data be stored in-country can give domestic Internet-service providers a boost but also could raise their customers' costs.
Much of the government-level rending of garments and promises of better protection from those nosy Americans is so much crap. Brazilian President Dilma Rousseff may publicly stomp her feet about NSA spying while her country's lawmakers move to require that data about their constituents be stored on servers in Brazil, but Dwoskin and Robinson caution, "Some countries pushing domestic hosting—Brazil, for example—don't protect the privacy of citizens' Internet data, so consumers wouldn't be safe from their own governments' eyes." And German email providers may tout an spy-resistant encrypted service, but SpiegelOnline reports that the country's BND has snooping envy and is already in bed with the NSA. France's DGSE and Britain's GCHQ are even worse, subject, in some ways, to fewer legal restraints than their U.S. counterparts. Le Monde describes the DGSE's efforts as "outside the law, and beyond any proper supervision."
But that doesn't mean there's no value in such privacy-based competition. In Germany, news of cooperation with the NSA has proven wildly controversial. That's unlikely to end domestic surveillance, but it could well limit data-sharing with other countries. Germans may or may not find that encouraging, but it could well be good news for people elsewhere more concerned about sheltering their data from domestic prying eyes than from the BND. Germans may then be content to host their data elsewhere, beyond the BND's grasp.
And many other countries lack the resources to engage in widespread surveillance—and are learning that investment can be attracted by touting their countries as data havens. It's a lot cheaper, and potentially more profitable, to run a marketing campaign and not spy than to try to compete with the NSA.
How profitable could it be? The Information Technology & Innovation Foundation, a D.C.-based tech policy think tank, estimates that "the U.S. cloud computing industry stands to lose $22 to $35 billion over the next three years" because of customers looking to host their information beyond the NSA's reach.
That could mean enormous opportunity not just for cloud hosting services, but for communications companies, encryption firms and the like. The more credible their promises of being resistant to surveillance, the better chance they have of luring customers from the competition—including large, profitable, but vulnerable American firms.
The danger in the reaction to NSA revelation comes, as usual, from the political sector. Many politicians in Brazil, Europe and elsewhere see an opportunity to require that data on their citizens be stored locally. That might keep the NSA at bay, but it's no shield from their own snoops—and certainly driven more by efforts to jump-start local would-be Googles than by concerns over privacy.
Even if many of the cries of outrage and promises of legal protection for privacy are bogus, the market for legitimate protection will drive efforts to provide the same. If estimates of the money at stake are correct, it's going to be very tempting for some jurisdictions to set themselves up as true data havens.
