Can Europe go its own way on data privacy?

The BBC have an interesting article that suggests that the German Chancellor Angela Merkel is trying to make a "cordoned-off portion of the internet".

In her weekly podcast to the German nation, Ms Merkel floated the plan to ensure European data stays on European networks. 

She suggested this required beefing up Europe's data networks and implementing policies and technologies to limit how much data crosses the Atlantic.

Her proposals have been prompted by revelations by whistleblower Edward Snowden about the extent of US spying.

The BBC did ask me for comments, thanks, but it is hard to try and explain the level of bat-shit insanity going on here in just a few quotes.

How the Internet already works

Let's start with a few simple lessons on the basics - how the Internet works.

For a start you have ISPs (Internet Service Providers). These can be large or small, and can even be part of international companies. They are usually nationally based, certainly in the UK. These are the people that connect the individual homes and businesses to the Internet.

Smaller ISPs will often make use of national carriers to connect from homes and offices to their network. Larger ISPs will have their own national networks.

Either way, these ISPs interconnect in various ways - often at peering points (like LINX and LONAP in London).

There are then transit providers - these are like the ISPs for ISPs. They operate global networks and interconnect lots of ISPs all over the world. They do not usually deal directly with individuals or businesses, but will do for large companies. They interconnect with each other and connect to their customers (usually ISPs).

This means that each ISP will have connections not only to other ISPs but to one or more transit providers.

For a packet to go from one house to another, even next door, it will usually travel some way. If the houses are on different ISPs it will have to go as far an interconnect between the ISPs. Even on the same ISP the packet will typically travel to a major node in their network and back. It is not uncommon for traffic in the UK to go via London, for example. This is largely down to the way the back-haul carriers like BT and TalkTalk offer services to ISPs via hub connections.

If the ISPs in question do not interconnect directly, then the traffic will go to a transit provider and then to the other ISP. If they do not have at transit provider in common then it will go via more than one. It is technically possible for the transit providers to only interconnect in a different country - but this would be unusual these days and normally only if there is a fault.

In practice, traffic from one place in a country to another in the same country would not leave that country. Traffic from one country in Europe going to another in Europe is unlikely to leave Europe.

This is largely for commercial and technical reason, but it cannot be guaranteed. There is a chance that some will go via the US, and this is more likely if there is a fault of some sort. It is certainly not normal and means that a cordoned off EU Internet is really not necessary - the US do not see the traffic normally. It also means that if we stopped traffic accidentally going via the US we would break the very back-up routing that makes the Internet work when there are faults.

People dealing with US companies and webs sites in the US

Of course this idea also makes no sense as people will routinely deal with companies in the US and access US web sites and services. Unless the Chancellor is suggesting actually unplugging the EU from the US and banning people from dealing with US web sites, then her proposals do nothing to help against the risk of snooping by the NSA in such cases.

Bear in mind that we regularly deal with US owned companies even when they have equipment in the EU. If any of these are in bed with the NSA the fact that they are within the EU Internet does not stop them sending data to the NSA.

We can't sensibly ban people from dealing with US companies.

Is there a real solution?

The question really is about what we can do to remove the threat of snooping by the NSA. Locking ourselves in a closed room is not the answer, so what is?

The answer is something we already know well - encryption. Most of us are familiar with the idea of a secure web site for when we access our bank, for example. This encrypts the data. There are ways to encrypt email in the same way, and these could be encouraged and supported by governments.

It may mean a few technical improvements to help people with key management and the like, but with some education and support a government could encourage much greater use of encryption for web pages, email and general Internet access.

When you use encryption you make it so that only you, and the other end, can see what you are doing. This raises some issues in itself.

Do you trust the far end?

A big issue here is how do you trust the far end. What if they are a US owned company or in the US anyway - they could be passing data to the far end anyway. Establishing trust is one of the biggest challenges with encryption systems. Just look at the list of Certificate Authorities in your browser. You have seriously trusted your browser supplier to give you a sensible list and you are trusting all of those companies you have never heard of in that CA list to authenticate people with which you deal via secure web sites. Scary!

There is always meta data!

Another big issue is that even when encrypted there is meta data - the information saying who you communicated with, and even subject lines in some cases. That data is an invaluable source of privacy invasion when collected on everyone. A lot of people use email provided by US companies, and use cloud services and all of these could be subject to snooping.

This comes down to trust again, and you would need better EU based and national services that people can use with the trust that they need.

The FaceBook problem

There is also the fact that people are often giving out lots of personal data freely. Creating more social networking sites is not easy - and nobody would join an EU version of FaceBook instead of the real thing where all of their mates are. This is a case where people freely agree to terms and conditions allowing their personal data to be used. As long as this happens, we will have to accept that a lot of privacy is lost and even that, for a lot of people, there is no longer any absolute concept of privacy as something they need in their lives.

The Chancellor needs to think carefully what is her objective, then consider whether that is a sensible and achievable objective before suggesting solutions.