Friday, November 28, 2014

The computer says no - algorithmic auto-dialer credit card security?

An acquaintance was telling me they had their credit card refused recently when attempting to purchase a couple of items online.

Minutes later the phone rang. Lucky enough they were at home to receive the call. It was an automated dialer claiming to be from the bank that the credit card was issued by. The automated voice asked if they were the holder of the credit card.

They were the joint holder of the card but the auto-dialer was asking if they specifically were the other card holder...

If yes press 1, if no press... you get the picture.

No was pressed, called ended, card continued to be blocked.

Later in the evening the auto-dialer tried again. This time the other joint cardholder happened to be the one at home and answered the phone.

Are you Jo Soap? If yes press 1, if no...

Jo pressed 1.

On it went with verification questions -

  • Here's three years, we'd like you to pick the one you were born in
  • Enter the day and month of your birth
  • Confirm whether the following transactions or attempted transactions were at your instigation
There followed, in quick succession, details of 4 transactions using the credit card in the previous couple of weeks which they were asked to verify or disown. My acquaintance's partner verified and got an automated message to say the card would now be unblocked and could be used again.

Now I don't know about you but I have very little recollection of my precise credit card transactions of the past couple of weeks. There have been some fuel purchases but I couldn't tell you exactly how much - somewhere in the £50 to £60 ballpark. Anything online? When did I get that obscure maths book via Amazon? What about the trip to the dentist? Months ago surely? Christmas presents - not organised enough for that? Don't recall exactly?

At no point did Jo speak to a real person. The machine made the decision. What would have happened s/he had not been able or prepared to verify the listed items who knows, other than having the block on the card continue and the need to get into telephone tag hell with the credit card company, through one or other of their "help"-lines.

Can credit card or security folks familiar with current practices tell me if this is for real?

What happens, particularly at this busy time of the year, if someone under pressure on the phone cannot instantly remember or confirm the precise details of recent purchasing or attempted purchasing transactions?

What happens if the card is jointly held by two card holders and the person automatically dialed is not the card holder whose transactions are being doubted?

What happens if unbeknownst to one partner, another is arranging a surprise purchase?

What happens if one partner is overseas and has their card blocked and the one home alone is not allowed to verify and can't reasonably be expected to instantly verify attempted transactions?

What happens if the person automatically dialed doesn't recollect the full details of recent credit card transactions sufficiently confidently to verify the list the auto-dialer requires an instant response to?

Well in all these circumstances the card will inevitably be blocked and the card holder gets to experience pariah-hood, inconvenience, stress and embarrassment.

All because an algorithm didn't like the look of that transaction they were innocently attempting to expedite and treated them like a criminal.

Incidentally on the other end of the scale, what happens if in the thick of the pressure of this, er, security check, the card holder confirms/verifies a purchase on which there was an overcharging error by the retailer?

I'd guess the credit card company would highlight the cardholders mistake in refusing and responsibility if the error was later noticed...

So, Dear Mr credit card company,

If you'd like to do a security check that's fine. But running it via autonomous algorithms and auto-dialers absolutely does not cut-it.

Signals and algorithmic intelligence is all very fine and dandy, really useful indeed if appropriately deployed when it comes to security. However, when it comes to people there is no match for caring human intelligence.

Thursday, November 27, 2014

UK government seek to ban extremist speech in educational institutions

One of the little commented upon sections of the UK government's latest tough-on-terrorism proposed law, the Counter-Terrorism and Security Bill (HC Bill 127), is Section 21 General duties on specified authorities. This reads (or part thereof at least);

21 General duty on specified authorities

(1) A specified authority must, in the exercise of its functions, have due regard to
the need to prevent people from being drawn into terrorism.
(2) A specified authority is a person or body that is listed in Schedule 3.
(3) In the case of a specified authority listed in Schedule 3 in terms that refer to a
particular capacity that it has, the reference in subsection (1) to the authority’s
functions is to its functions when acting in that capacity.
The "specified authorities" as detailed in Schedule 3 of the Bill includes educational institutions -

"Education, child care etc

The governing body of an institution within the higher education sector
within the meaning of section 91(5) of the Further and Higher Education Act
A person with whom arrangements have been made for the provision of
education under section 19 of the Education Act 1996 or section 100 of the Education and Inspections Act 2006 (cases of illness, exclusion etc).
The proprietor of—
(a) a school that has been approved under section 342 of the Education
Act 1996,
(b) a maintained school within the meaning given by section 20(7) of the School Standards and Framework Act 1998,
(c) a maintained nursery school within the meaning given by section
22(9) of that Act,
(d) an independent school registered under section 158 of the Education
Act 2002,
(e) an independent educational institution registered under section
95(1) of the Education and Skills Act 2008, or
(f) an alternative provision Academy within the meaning given by
section 1C of that Act.
A person who is specified or nominated in a direction made in relation to the exercise of a local authority’s functions given by the Secretary of State under
section 497A of the Education Act 1996 (including that section as applied by
section 50 of the Children Act 2004 or section 15 of the Childcare Act 2006).
A person entered on a register kept by Her Majesty’s Chief Inspector of
Education, Children’s Services and Skills under Part 2 of the Care Standards Act 2000.
The governing body of a qualifying institution within the meaning given by
section 11 of the Higher Education Act 2004.
The provider of education or training—
(a) to which Chapter 3 of Part 8 of the Education and Inspections Act 2006 applies, and
(b) in respect of which funding is provided by, or under arrangements
made by, the Secretary of State or the Chief Executive of Skills
A person registered under Chapter 2, 2A, 3 or 3A of Part 3 of the Childcare Act 2006 or under section 20 of the Children and Families (Wales) Measure
2010 (nawm 1).
A body corporate with which a local authority has entered into
arrangements under Part 1 of the Children and Young Persons Act 2008.
The governing body of an educational establishment maintained by a local authority in Wales.
The governing body or proprietor of an institution (not otherwise listed) at
which more than 250 students, excluding students undertaking distance
learning courses, are undertaking courses in preparation for examinations
related to qualifications regulated by the Office of Qualifications and Examinations Regulation or the Welsh Assembly Government."
So all these bodies associated with education in some form
"must, in the exercise of its functions, have due regard to the need to prevent people from being drawn into terrorism."
Can anyone tell me what that actually means?

The good folk at the Guardian seem to think it will require universities, for example, to ban extremist speakers. The Bill doesn't actually say that but I guess might be interpreted as such.

Additionally the Bill, if enacted in its current form, would provide the Secretary of State with Henry VIII powers to amend schedule 3 - i.e. unilaterally decide if any other institutions should fall within the scope of the obligation to "have due regard to the need to prevent people from being drawn into terrorism."

Under section 21(4), however, parliamentarians are excused the duty to  "have due regard to the need to prevent people from being drawn into terrorism."

21 General duty on specified authorities

(4) Subsection (1) does not apply to the exercise of—
(a) a judicial function;
Counter-Terrorism and Security BillPage 14
(b) a function exercised on behalf of, or on the instructions of, a person
exercising a judicial function;
(c) a function in connection with proceedings in the House of Commons or
the House of Lords;
(d) a function in connection with proceedings in the Scottish Parliament;
(e) a function in connection with proceedings in the National Assembly for
No obligation, then, to stop introducing extremist, overreaching draconian police-state legal infrastructures, causing untold grief and havoc to us and future generations. Specks and planks in eyes come to mind, as does the notion that what we need is not another Counter-Terrorism and Security Bill (HC Bill 127) but, given the incumbent Home Secretary, a Counter Theresa-ism And Security Bill.

Sunday, November 02, 2014

Lessig interview with Snowden

Larry Lessig interviewed Edward Snowden last week. The video is up on YouTube.

Monday, October 27, 2014

Korea Copyright Commission and evidence based policy making

In early October I had an unexpected email from an economist at the Korea Copyright Commission, SangHee Yoo, requesting a meeting to discuss some work I did with Mark Rogers and Josh Tomalin for Consumer Focus four years ago, on the economic impact of consumer copyright exceptions.

I'm pleased to say I had the privilege of meeting SangHee and the Director of the Commission's Copyright Industry Research Team, Yong-Yeong, Lee, on Friday afternoon. As part of a whistle-stop six day business trip of Europe they came straight to Oxford after landing at Heathrow and I dropped them back to the bus station to catch the Heathrow express immediately afterwards.

With the aid of Oxford University student, John*, as official translator (though SangHee's English was excellent), we had a wide ranging discussion on the economics of copyright and the need for evidence based policy making in copyright and intellectual property more generally, including but not limited to -
  • Historical paucity of economic evidence in the whole area of intellectual property
  • Specifics of our Consumer Focus report
  • The Gowers' and Hargreaves' reviews of intellectual property policy in 2006 and 2011 for the UK government
  • 'The Economics of Copyright' paper Mark Rogers and I wrote for the World Economics journal, July-Sept 2005
  • The effectively perennial nature of copyright term
  • The effectiveness of incumbent copyright industries in engaging in regulatory capture
  • The tendency of busy generalist policymakers to turn to the 'experts' - i.e. incumbent industries - in this area
  • The periodic degree to which industry act against their own self interest e.g. trying to get the VCR banned in Sony v Universal, losing and subsequently making vast revenues on video cassette, DVD and BluRay sales; and suing the original Napster out of existence instead of doing a deal with the company ideally suited to facilitating leveraging incumbent music labels' control of physical distribution chains into the online world
  • The historic pattern of oligopolistic convergence/consolidation of the copyright and information industries
  • The need to engage all stakeholders - creators, economic agents (industries etc) and the public
  • The power of simple economic models using sound empirical evidence - mathematics used with integrity (rather than numbers quoted out of context or plucked out of thin air with an agenda) is the friend of all three generic sets of stakeholders in this arena
  • A Singapore researcher's report on evidence based policy which I was unfamiliar with
  • Some interesting empirical work done for the European Commission a couple of years ago
  • The complexity of IP policy making 
  • The difficulties for researchers in gathering sound empirical evidence, given the complexity and dynamics of the copyright and information industries and the fierce and selective control the traditional large entertainment and information industries exert over industry figures. So for example the fact that the Tolkien estate had to sue the movie industry for its share of the profits from the blockbuster Peter Jackson 'Lord of the Rings' film trilogy is just one of endless examples of the creative accounting practices at large in the movie business.
  • The recent introduction of new copyright exceptions in the UK for format shifting and parody based on years of work by Tony Clayton's team of economists at the IPO, the copyright team at the Department for Business and the campaigning of NGOs and academics
  • Complex ethical questions posed e.g. by human gene patenting
All in all it was a really engaging discussion.  It's humbling to have someone say they found work you have helped to produce useful (and I really only did help - Mark and Josh did most of the heavy lifting on that Consumer Focus report). It's even more so when they are prepared to travel a long way to explore the issues in more detail, face to face, having read that work.

Apparently SangHee's attention had been drawn to our Consumer Focus report by someone who had done a report on evidence based copyright policy for the European Commission. I made the assumption it was one of the folk who had produced the Statistical, ecosystems and competitiveness analysis of the media and content industries report in 2012. Glyn Moody did an accessible outline of the essence of the report at the time over at techdirt.

I gave Ms Yoo and Director Lee a copy of The Economics of Copyright which seems small compensation for such a long trip. I would like to thank them both for coming to see me and I hope they found the meeting at least somewhat productive.

It was very encouraging to learn first hand that the Korea Copyright Commission is keen on evidence based copyright policy making. That remains something of a rare trait amongst national and international intellectual property policymakers. It would be nice if the idea caught on.

*I'm sorry to say I didn't make an accurate note of John's full name but he was excellent and John, if you do happen across this post, do get in touch and I'll include your full name for the record.

Saturday, October 18, 2014

ISC round table

Following written a submission to the Intelligence and Security Committee's inquiry into privacy and security, I was invited to take part in a round table discussion with the Committee that took place earlier this week.

It did actually involve a round table or three to be precise. The members of the committee split themselves amongst the tables to explore the written evidence of a collection of people from academia, industry and NGOs.

At my table were Conservative MP, Dr Julian Lewis and Lord Butler, along with Caspar Bowden, Eric King of Privacy International and Andrew Watson. Dr Lewis came armed with print outs of our submissions with various parts underlined which he wanted to quiz us about in further detail.

Discussions were interesting and I came away slightly more positive than I had expected. I was impressed in particular at Lord Butler's capacity to grasp some of the key issues and ask insightful questions.

I've sent Dr Lewis and Lord Butler some follow up comments in an effort to clarify some of the points I made at the meeting.

"Dear Dr Lewis and Lord Butler,

Thank you for the opportunity to meet in the context of the ISC's inquiry into privacy and security.

If I may, I'd like to make an effort to further clarify two or three points I don't believe I articulated very clearly at the meeting.

On the question of the impossibility of securing giant databases, another way to look at it is to understand that information systems are socio-technical systems. They are made up not just of the technology but the organisational processes and people used to build, deploy and operate them. It's the giant information system as a whole that is impossible to secure. Generally computer scientists will tell you that these systems can have two of three key features - security, usability and scale - they can be secure and usable OR secure and scalable OR usable and scalable but never all three.

On the difference between information technology and information systems you can think of it as the difference between radar (information technology) and the British air defence system (information system) that was crucial to winning the Battle of Britain during the World War II. By 1939 Britain had created an integrated information system to collect the raw data on approaching enemy aircraft, from their chain of radar stations (IT) and (visuals from) the Observer Corps (human IT). This raw data was passed on (via the radio telephone and teleprinter networks) to Fighter Command Headquarters filter room and an integrated set of operations centres, where it was assessed, filtered, analysed and turned into useful information at varying levels. This then facilitated the scrambling of the right fighter squadrons and even more specific instructions to be radioed to the RAF pilots once in the air, to enable them to intercept their enemy at the earliest opportunity.

The Germans had better information technology (radar). The British had the better information system i.e. radar, human intelligence, signals intelligence, and an integrated, purpose-developed system, allowing the situation to be viewed holistically, as well as delivering the right information to the right users, at the right levels, in a useful format and in sufficient time to act on it.

Dr Lewis, you seemed a little offended by my characterisation of the data mining of the mass trawl of personal data collected by government as a "post hoc fishing expedition." I apologise if I offended you - that was never my intention.  My point essentially is that government has never had the power now at its disposal to peer into the intimate details of people's lives. The mass collection of data is in itself a fundamental problem in practice and in law.  Privacy as a check on government power represents a democratic requirement that limited government must have limited power to access our daily lives. An omniscient government is too powerful for rules, regulations or laws to restrain. There will progressively always be another public official who will be able to make a compelling case for access to the rich trove of information in a valuable giant government database. If the security services find it useful why shouldn't law enforcement or revenue officials or social security officials and so on. You have to take a look at the 14 year history of the Regulation of Investigatory Powers Act to see this kind of mission creep in this context.

It seems increasingly to be the belief amongst MPs that blanket data collection and retention is acceptable in law and that the only concern should be the subsequent access to that data. Assertions to this effect are simply wrong both in relation to more modern human rights law and also long standing English law.

The April European Court of Justice (ECJ) judgement restated the position clearly that mass indiscriminate data retention "constitutes in itself an interference with the rights guaranteed by Article 7 of the Charter." (Para 34 of the decision). Article 7 of the Charter of Fundamental rights, as you know, guarantees everyone “the right to respect for his or her private and family life, home and communications”. The European Court of Human Rights (ECtHR) laid down the same prohibition of blanket retention in the S. and Marper v UK case in December 2008.And I've already alluded, in my original submission, to the principles laid down in the Entick v Carrington case of 1765 with which this mass personal data collection is incompatible.

Please do not be misled into the erroneous belief that retention is acceptable and access is therefore the only problem. Underpinning any future regulatory framework in this area with such a fundamentally flawed assumption would be a big mistake on many levels. Both retention and access in and of themselves present serious article 7 and article 8 challenges, as the ECJ, the ECtHR and many other national courts have made clear.

On the question of whether ISPs have a moral obligation to cooperate with law enforcement, commerce doesn't do morals, only have bottom lines. Directors of business have a fiduciary duty to maximise return to shareholders. They only guaranteed way to get telecommunications companies to cooperate is to make it their legal duty. There is no reason why ISPs should not be required to cooperate, in relation to a court supervised warrant, regarding particular information relating to a specific individual about whom there is reasonable cause to harbour suspicion that they may be or have been involved in criminal activity.

Lord Butler, I very much commend your comment to the effect that the case for targeted rather than mass personal data signals intelligence collection seemed compelling. If that idea alone has come out of the Committee's consultation process then it will have been very worthwhile.

Thank you for taking the time to meet and I hope you found it useful. If you need any further clarification of the above points or I can provide any further assistance please let me know. I wish you all the best with your ongoing deliberations.



Paul Bernal was at one of the other tables, as was Suw Charman, though I was not familiar with other attendees.

The subsequent public session the committee held with the Home Secretary just depressed me again. We have a seriously long way to go in the UK before we start getting a rein on mass surveillance. The ISC is the prevailing key line of defense in Parliament against the worst excesses of this. Mrs May's appearance is yet another indication that they are desperately in need of more resources to perform their duties and in particular permanent and extensive independent technical expertise.

Update: Andrew Watson has asked me to point out that his submission and engagement with the ISC was purely in a personal capacity and the views were his and not those of his employer. My apologies to Andrew for any confusion caused in the original version of this post.

Monday, October 13, 2014

The umbrella man

I was reminded this morning of Errol Morris's exploration of the story behind the one man seen standing under an open black umbrella at the site of JFK's assassination.

The Umbrella Man from The New York Times - Video on Vimeo.

The man testified before a congressional committee in 1978 about why he was there that day holding his umbrella up - it was a protest at the appeasement policies of JFK's father Joseph Kennedy when he was ambassador to the court of St James in 1938-39. It was reference to Neville Chamberlain's umbrella. Morris thinks the testimony is "just whacky enough to be true" and he believes it is. Bottom line? You can never, on your own, think up all the non-sinister reasons for a peculiar fact.

Greenwald on why privacy matters

Glenn Greenwald gave talk at TED last week on why privacy matters.

Sunday, October 12, 2014

John Naughton interview with Edward Snowden

John Naughton interviewed Edward Snowden at the Observer Ideas event this afternoon.

The YouTube version of the video I originally embedded here is no longer showing the message "Please stand by. We're experiencing technical difficulties."

My notes on the interview below. These may be added to sporadically as and when I get time to type them up.

JN: In June 2013 the world was astonished by some dramatic revelations - first published in the Guardian which won a Pulitzer prize for the work, the first time a British newspaper has ever won a Pulitzer - via a trove of top secret documents released by a young geek, Edward Snowden, of the extent of GCHQ and NSA snooping. He's the most famous geek in history, the most hunted man on the planet and the most courageous geek that JN knows. He left a comfortable lifestyle in Hawaii, flew to Hong Kong where he met trusted journalists and then onto Moscow, en route to what he believed would be Latin America. At that point the US government revoked his passport effectively rendering him stateless in Russia.


They could have let him fly to Latin America and had some CIA operatives bundle him into a plane and render him to solitary confinement in New Mexico or Guantanamo or somewhere else.

Using Skype for the interview and audience need to be aware that the definition of technology is something that nearly works.

Having some problems connecting. Could be GCHQ or something else.

First question - what comes across in the leaked documents is the apparently close working relationship between the NSA and GCHQ. But computer security community refer to GCHQ as the "overseas franchise of the NSA". Is that an accurate characterisation of the relationship? Or is GCHQ a bigger player than we think and the documents might suggest?

At this point comms fail.

There's some back and forth and eventually they get partially restored - we can hear Snowden but he can't hear John's questions. So off screen, Guardian journalist, Carol Cadwalladr, types John Naughton's questions for Edward Snowden to read.

Eventually Snowden receives the question.

ES: Yes. GCHQ is a big player. There is an extraordinarily large and secret and unaccountable mass surveillance system in the US. But constitutional protections prohibit even the passing of laws that might enable these programs. Despite this it is happening in the US.

In the UK you don't have the same constitutional limits on the sort of laws that parliament can pass. We've seen the creation of a system of regulations where basically anything goes. GCHQ and other government spy agencies can do anything they want. There are no limits on their capabilities.

They collect everything that might be of interest to them - basically a 5 year backlog of all the activities of citizens of the UK e.g. through collections of their metadata records. Then they say we collected this information but we won't look at it. We'll protect it through some kind of policy protections, and limited rules. Though we'll watch all the time  we won't look at what we've gathered unless we go through a certain procedure.

Even if you believe that is reasonable -
it's not because that is not how rights work - you don't have to say why you deserve privacy - it's up to the government to justify it's intrusions into your rights - you don't have to justify why you need a right or it's not a right at all
- but even if you do think this is reasonable, these policy rules for access to that information are not uniformly applied.  It's basically open season...

GCHQ go much further than the NSA because they use unlawfully collected information to pursue basically criminal prosecutions. And they use this to share with other countries. They use intelligence powers for law enforcement purposes and that is dangerous.

Evidence is collected against us but we don't have the opportunity to challenge it in the courts. Judges are not aware where this evidence originates from. This undermines the system of laws and system of justice upon which we all rely.

JN: The other side of this coin are the commercial companies like Google. Yesterday you said some very hard things about Google, Facebook and Dropbox. Are you seriously suggesting people should avoid using services provided by these companies?

[At this point there is a delay and interference on the connection which prompts John to quip "this question is being parsed by someone in the intelligence community". That got a laugh]

ES: What I'm trying to say is not that they are the worst thing on planet earth. What I'm saying is that when we as consumers have a choice between 2 services, one hta tprotects your privacy and one actively hostile to privacy, we should support the one that supports our rights, the one that encodes it into their policies.

Facebook is one example where it is very difficult to find alternatives. Dropbox, however, is not. There are many many alternatives to Dropbox. Dropbox say they encrypt  your data  but they keep the key. So an government in the world from the US to the UK to China can request access to your files and Dropbox can provide it.

SpiderOak is a better alternative. They don't permit themselves that capability. Because if government is going to issue a warrant it should go to you, the person that has control of this information; not a corporation that can't bring the same challenges as you because they won't have standing - it is not their privacy being violated.

JN: The extent of public disquiet about what intelligence agencies are doing varies across the world. For example in the UK most people seem very relaxed about what the documents you released have revealed. If that is the case across the world then surely nothing much is going to happen despite the revealations?

ES: I don't think it is true that because the public reacts less strongly in one jurisdiction than another that there will necessarily be no change.  When I initially came out about this and talked to technologists and computer scientists about this problem there are broadly two tracts.

The first is political.

In our national legislatures we can push for reform, for increased respect for rights, a restoration of respect for rights that we've lost in the "terrorism era".

There are many countries around the world and not just the UK where we have this problem with public engagement. In the US uniformly every newspaper across the country reported on this scandal and they talked about why we need to change, what kind of reforms are needed and they debated where the line should be drawn.

In the UK we haven't seen that happen. Only one newspaper, The Guardian, did that. All the other papers - I don't know why, whether it is cultural because they felt they'd been cut out of the story or cut out of information sharing - didn't cover it. Or covered it in a hostile way that I think did a disservice to the public.

And even when legislatures push back with the notion it doesn't really matter what the public feels, we are the rulers, we will decide; if you have a problem with that vote us out; but we control the media so you're not going to do that either.

Political reform is a challenge in many places around the world but that's always been the case.

However, even if there is even only one part of the world - it can be Germany or the US or London - where we have a technical community that believes this is a real problem - mass surveillance & GCHQ strategy of amassing a haystack of human lives and sorting through it whenever they want trying to find needles - is contrary to the values we as a society hold, they can institute protections of a technical variety that enforce our rights in a way that's not dependent on national laws.

[RC: That's optimistic]

Because lets say in UK, supposing we pass robust new reforms that prevented infringement of rights of citizens of UK by intelligence agencies. Well that is not going to restrict Chinese government or governments of Latin America, US, Russia, Africa or other country or even France.

If things are not encoded or on a technical level; if they are not enforced at the level of systems rather than just words on a page they are not really going to be meaningful when all our systems are reliant on cross border international relations.

[RC: Problem with relying on this approach is not many people understand the technology well enough to be able to check if it is doing what it says its doing. Evoting being a case in point]

We need international solutions for global problems.

JN: I'd like to talk to you about technical stuff but I'm getting a lot of pressure form the audience to ask you about yourself. Here's a question someone's thrown at me - you were basically living in paradise in Hawaii, with pole dancer for a girlfriend. That's most people's dream life. Are you mad?  (John additionally quipped whilst waiting for the question to be relayed that it wasn't his idea of a dream life but there you go).

ES: You know... ah... ... [laughter from audience] ... I've had to make a lot of sacrifices. I risked my freedom. I lost my job. I lost my home. I haven't been able to relate to family the way I once did. And I can't return to my home country. That's .. a lot to give up. But my biggest fear when I did this was not what would happen to me. I didn't care what would happen to me. Because this is not about me. I'm simply the mechanism of revelation.

What matters is that in our times - this post 9/11 period, this post 7/7 period - we have seen the public increasingly lose rights again and again to a state structure, a security structure. It's becoming increasingly empowered. At the same time it's becoming increasingly secret.

So the big questions that go beyond surveillance into what kind of world do we want to live?

Do we want to live in a world where government make decisions for the whole of society behind closed doors without accountability to public opinion or to our shared laws?

When you ask me this I have to say no. The country that gave us the Magna Carta believes there are lines. There are limits that even the government must comply to.  And when government unchains itself from any kind of restrictions, when government says
the ends justify the means
we have transitioned from the point of a democratic liberal society into one that is more authoritarian.

And the question is - is this really something that officials can determine on their own. OR is that a decision for the public? And we can't make these decisions if we don't know about them.

All democratic societies are founded on the principle that the consent of the governed is from where all governments draw their legitimacy. An consent is not meaningful if it is not informed.

And that is the challenge we saw last year and that's why we've seen the strength of the response we've had today. And, ultimately, I think that's why things will change.

We are transitioning out of the terror era and recognising that younger people today are the beginning of a post terror generation that have different values and are not prepared to give up their rights without seeing that these programs are necessary; and that they respect the foundation of our societies.

JN: Are you surprised that we now know there is a second whistleblower? Have you started something that is going to roll?

ES: I'm not. No.

I think it was inevitable. You know people have called me. They've had this big debate. Am I a hero? Am I a traitor?

First up it doesn't matter. These issues are not about me. They're about us. And it doesn't matter what happens to me. Whether I'm loved by history or whether I disappear into a hole.

[RC: Hope that doesn't happen literally]

We should not say this person is a hero. WE should not praise the hero we should praise the act. Because I'm an ordinary person in extraordinary circumstances. This other person, whoever they are, it is extraordinarily courageous that after seeing the thing that comes to whistleblowers before in the US - people had their lives destroyed, their carreers destroyed, thrown in prison for 35 years, that this person would stand up and put their life on the line because they believe they have a civic duty that they hold more dear than their self interest.  And that is something - I don't care who the individual is; I don't care whether they are the deepest darkest criminal - that is something we should respect.  WE should value and promote. Everyone has a role to play in government, a role to play in our societies. And if you believe in something you have to stand for something.

JN: Edward Snowden, thank you very much and I hope you have a nice weekend.

[Uproarious round of applause from the audience]

JN: I'd just like to thank you all for your forebearance. Remember what I said about technology - if it doesn't quite work, that's what technology is.

[More loud applause as John walks off the stage]

Compare of the event [need to check] comes on and notes: One of the reasons Edward Snowden agreed to do his first interview at a UK event was John Naughton. In discussions with his people they cited John's writing and how perceptive he had been about technology and the way he has covered the Snowden revelations over the last year or so.

[RC: Entirely appropriate John's terrific work should be publicly acknowledged in this way]

Additionally Carole Cadwalladr was also crucial. She pursued Edward Snowden's people and was typing John's questions to Snowden off stage and both John and Carole are a huge part of the reason you heard him today.