 Meine Damen und Herren, herzlich willkommen zurück. Ich finde es erstaunlich, wenn Sie mir die Bemerkungen erlauben. Wir hatten für diesen Saal der 160 Plätze hat eine Überbruchung ungefähr um 100 Prozent. Um einigen mussten wir leider sagen, also es ist so voll, es wird kein Platz mehr sein. Ich freue mich sehr, dass mein Kollege Ben Scott aus seiner Sicht zu unserem Thema sprechen wird. Ben und ich haben uns kennengelernt beim Beitritt der Bundesregierung, der Bundesrepublik zur Freedom Online Coalition in Tunis. Nachdem mein Mandat ausgelaufen ist, haben wir uns getroffen und haben überlegt, was tun wir in einer Situation, in der eine Technologie, die wir beide für zukunftsbestimmend und für wesentlich für unsere beiden Länder halten, so unter massiven Beschuss steht, und was tun wir in einer Situation, in dem auch das transatlantische Verhältnis, was wir auch beide als wesentlich für unsere Länder betrachtet haben, so unter Beschuss ist. Was können wir tun, um zu einer Wiederherstellung von Vertrauen beizutragen und das Privacy-Projekt war das Ergebnis dieser Überlegungen. Deswegen freue ich mich sehr, Ben, auf deine Worte her. So, ich fange an mit eine Entschuldigung. Ich habe gedacht, dass ich doch diese ganze Vortrag auf Deutsch machen kann, aber leider geht es doch nicht und deswegen wechsel ich zu Englisch, aber ich verspreche, es ist besser so, weil ich sagen kann, weil was ich sagen will. So, ich hoffe, es ist nicht zu viel Konvenienz. Ich erinnere mich, dass ich darüber verspricht. Ich bin in Deutschland jetzt für 2,5 Jahre alt. Ich bin für zwölf Jahre in Deutschland geblieben und meine Kinder counten jetzt mehr Deutsch als Amerikaner. Ich habe die Snowden-Affäre von der perspektiven Perspektive von einem Amerikaner in Deutschland gearbeitet. Das hat meine Kritik von meinem eigenen Regierung und meine Analyse auf das, was Deutschland kann und sollte, um die Probleme vor uns zu lösen. Mit diesem Gespräch möchte ich drei Dinge machen. Zuerst möchte ich zurückkehren und darüber sprechen, wo wir in den Progressionen der Reform post-Snowden stehen. Ein kleiner Hintern, nicht sehr weit. Zuerst möchte ich darüber sprechen, was das große Problem ist. Zuerst möchte ich eine spezielle Agenda geben. Strategien für strategische Interventions in Politik haben wir das große Problem geblieben und helfen uns zu fixen, dass das Problem keine Progression gibt. Wenn wir nach 18 Monaten nach den ersten Snowden-Revelationen schauen, können wir einiges sehen. Zuerst haben wir einiges gesehen. Die Publikum-Autrage in Europa hat eine sehr seriöse Disruption zu transatlantischen Relationen. Eine heilige Debatte begann auf die Menschenrechte und die Civil-Liberation in einer digitalen Age. Es ist nicht nur in Brüssel und Berlin, sondern auch in Washington. Es hat auch für schnell Veränderungen in Law und Politik, von den Städten, von großen Sektionen in der Industrie und von politischen Leaders geblieben. Und noch einmal, obwohl das größte Schandal in modernen Intelligenz-History ist, 18 Monate lang sind es keine Veränderungen. Die Hälfte des Momentes ist fadend. Und Deutschland ist nun zwischen den nursten Ländern, die die USA und die UK noch öffentlichen Herausforderungen haben, zu verändern. Und sogar diese Herausforderungen sind jetzt weniger frekant. Die meisten Länder haben jetzt mit der NSA eine hohe Erkommendation gemacht. Und nicht nur eine europäische Landwirte hat versucht, um ihre eigenen Werte zu verabschieden. Und jetzt sehen wir, dass die limitierte Reformbille in Washington, die die NSA von amerikanischen Privilegien von der USA, verabschiedet hat, in der US-Präsidentin getötet wurde, in zwei Votos. Kein clear Prospekt für eine Rente. Warum ist das so? Warum haben wir so little Progress? Ich denke, für zwei wesentliche. Das ist ein sehr schwieriger Problem zu lösen. Und das zweite ist, dass die politischen Leaders die politischen Konsequenzen der Snowden-Affäre sehen. Und sie sind nicht so schlecht. Sie sind verabschiedet. Und diese verabschiedeten Konsequenzen sind die Konsequenzen, die die Konsequenzen sind, dass in der short-term, wir nichts tun müssen. Also, was ist die größte politische Konsequenzen von der Snowden-Affäre, in Deutschland, in Europa und in den USA? Was ist die größte politische und legalische Konsequenzen, die von der größten Skandle und der Intelligenz-Historie? Die größte Konsequenzen sind nichts. Bezüglich alles, das du heute Morgen hattest, alle großen Diskussionen über was kann passieren und warum ist es urgent, dass es passieren soll. Die größte Konsequenzen, die wir als Zitizen in der Post-Snowden-Ara in der USA haben, haben wir das große Zero, unless wir etwas tun. Das große Zero ist sehr frustrierend für die Anwesendungen des Menschenrechts und des Civilis. Das große Zero ist demoralisiert für die öffentliche Konfidanz in der demokratischen Regierung. Und trotzdem, dieser große Zero ist nicht besonders überrascht, als der reale Politik. Und wir müssen auch über diese Skandle und Problemen denken, nicht in dem Sinne von soforten Lösungen, sondern wie ein langes Spiel. Wir werden über die Menschenrechte und die Civilis in einer digitalen Welt für eine sehr lange Zeit sprechen. Und es ist jetzt unser Job, um die Presse zu halten und die strategischen Interventions in einem Prozess zu einer langen Reform zu bringen. Denn es gibt große Konsequenzen für das große Zero. Very serious consequences. They are not immediately visible, but these serious consequences will affect every single one of us over time. What is the message that we send to the average citizen when they see that no changes have resulted post Snowden? The message that we send them is that neither technology nor government are trustworthy. And the combination of technology and government should earn either their skepticism or their hostility. What does that distrust look like? How will it change the relationship between people and technology over time? How will affect the relationship between governments and their peoples? How will we evaluate the value of civil liberties and human rights standards when we ourselves in democratic countries do not uphold them? The full effect of the Snowden Affair in its early stages towards the Internet is still in its early stages, but I think those consequences are going to mount. And yet we can see in consumer behavior no evidence that that's happening. Why is it that most people have not changed their behavior towards technology despite the fact that they are now aware of a global surveillance machine? Why is it that people in fact they know these are blinking, beeping, tracking devices? Why is it that people still search the web and shop online and document their lives on social networks? And why is it that only a small fraction of people bother with end-to-end encryption technologies, even though they've been available for 20 years? As I see it, there are three possible reasons. Reason number one. I don't know about technology. I don't read the newspaper. I haven't paid attention. It's all passed me by. Second reason. I know that I'm being surveilled, but I don't care. In this category come people who have embraced the openness of the Internet as a platform of exhibition. In this category come people who are happy to trade security for liberty. And in this category of people come those who say when I balance the possibility of being surveilled one time in my life by the NSA versus the everyday use of technology, I'm going to take the latter. The third reason is I know what's happening. I care about it. But what can I do? I've given up. There's a recent poll done by the Pew Research Internet project that gives us some insights about how people fall into those categories. And the Pew study, which admittedly was a survey of Americans, a Pew study said 5% of Americans have never heard of the NSA affair. I don't know what cave they live in. But 91% agreed that consumers have lost control over how communication is collected online. And 80% agreed that people should be concerned about how government is monitoring their communications. What that tells me is that the vast majority of people fall into category 3. I know my data is being collected and surveilled. I don't like it, but I can't do anything about it. What we're watching is a serious transformation in what you might call the normative understanding of technology. And what is emerging is a normative cynicism. I understand the problem. I'm upset about it. I consider all the solutions futile. I can't take technology out of my life anymore. That's not realistic. And I also don't expect the government to stop surveillance projects that I think are illegitimate. So what can I do? I just go about my business. All of that normative cynicism are quite serious. Think about for a moment what was the normative understanding of technology three years ago during the Arab Spring. Newspaper said Twitter revolution. It was the heyday of cyber utopianism. The internet was the great liberatory technology. A decentralized platform of communication that empowered political movements and lowered barriers to entry into the world. Now this vision was flawed and exaggerated and ignored concerns about security that were made at the time. But that normative view was deeply held three years ago. Today we've seen a decisive shift. Today the normative view about the internet is that as a technology of social and political control an der obsidian view of the internet as a tool of manipulation. And while that dystopian vision is also exaggerated and ignores many of the positive things that technology brings to our lives or overshadows them, that normative cynicism is also deeply held. That is a massive shift to happen so fast. Three years. Attitudes have changed. The impact is not transacted on a daily basis. The impact does not mean I'm going to throw my phone in the trash when I get home tonight. The impact is systemic and changes my behavior over time in ways that we cannot yet measure. But we can hypothesize about what these changes will look like. We can be pretty sure that the failure to address the Snowden problem will result in a loss of faith or, shall I say, more of a loss of faith in democratic government. And that loss of public confidence in democratic legitimacy at home will translate into the loss of moral authority and credibility of democratic governance in the international community. Second hypothesis. People will begin to lose faith in technology. And while I may not give up the tools that I use today far too far integrated into my life, I may be more hesitant to adopt tomorrow's tools. And for those people who have not yet experienced the internet revolution, they will be walking through that door with a completely different attitude towards those technologies. That matters. That matters because it changes the dynamics of the internet and digital communications networks as a tool of soft power in the world. The utopian vision of the internet was powerful for a reason. It's because that decentralized network that puts billions of people in contact with information and communications technologies is a powerful social tool of progress and liberation. It is also a powerful tool of control and manipulation. It is a question of law and policy which one has the upper hand. Because cumulatively the power of the internet is not the Twitter revolution. It is not the creation of the next Google. The power of the internet is three, four, five billion people getting access to information and communications on a daily basis for the small things that they do every day. It's not on the front of the magazine. It's not counted in a GDP statistic. But it changes the world. And that is what we stand to lose with normative cynicism. So that's the bad news. The bad news is that the consequences of doing nothing as a result of the Snowden revelations are deeply, deeply worrying. But the good news is and I was very pleased at the discussions this morning the good news is that there is still a strong feeling that there are opportunities for reform. That there are opportunities to change things. And that there are corrective forces in Democratic self-government. But we have a window of opportunity to begin making these changes. And it won't last forever and we need to move now. We can't waste more time because no result is an unacceptable result. The normative cynicism that we see descending on the internet community is an unacceptable result. And I believe that most nations, Democratic nations will not only seek to change policy because it's the right thing to do and they will do it because it's in their interest to do it. We heard earlier that nations don't have allies, nations have interests. I think that's sadly true. But I think protecting an internet based on legitimate rules and standards of human rights and civil liberties is in the interest of most nations. And it is incredibly short-sighted to sacrifice that interest in exchange for business as usual in the shadow world of the intelligence community. Key question here is how will we regulate power on the internet? Whether you're a subscriber to the utopian view or the dystopian view of the internet, what we're really talking about is power through technology. Now the key to the Snowden debate, the key to the reform movement that will come out of it is about how we handle that power. And when we talk about power on the internet we're talking about trust. Do I trust that the internet has more to offer me than it does to take from me? But trust at the end of the day is really about legitimacy. Legitimacy is the core of the Snowden problem. Is the system of government that constrains and oversees the application of power on the internet legitimate? Do I believe it will constrain those things which harm my interests and encourage those things which benefit me? Legitimacy is the key to a successful alignment of political views in Germany for German policy on surveillance. Legitimacy is the key for an alignment of views in Europe and ultimately legitimacy is the key to a transatlantic solution. But it's a complicated problem for many reasons. One of the reasons is that as we heard this morning Americans and Europeans have very different understandings about power. In order to understand the NSA you have to understand American exceptionalism. There were many Americans who were appalled at the Snowden revelations who felt that the US government had gone too far. But at the same time they were also proud because the power and capability of American military is deeply ingrained in American nationalism. That contradiction is very difficult to understand in Europe and even more difficult to understand in Germany because Germany has its own exceptionalism. German exceptionalism is the mirror image of American exceptionalism. German exceptionalism is about controlling the application of government power. Limiting and constraining the application of hard power. And so that is why Germany and the United States are two opposite ends of the spectrum when it comes to democratic societies debating the relative legitimacy of surveillance policy. And yet this contradiction is not lethal. This contradiction is misleading because we are also dependent on one another. Europe is dependent on the hard power that American military and intelligence forces bring. That's a fact. Look what's happening in the Middle East right now. Europe is supporting the United States spending and military force on the ground in a fight against ISIS. But the United States needs the legitimacy that Europe brings to international affairs and foreign policy. We want that shared legitimacy and to get that shared legitimacy we have to have a dialogue about the control and constraints placed on that power. That's a relatively easy to see in the hard power applications of military forces. But the same thing is true in the application of digital power and that's what this debate is really about. How do we begin to modernize a common understanding of legitimacy in the application of digital power between democratic states, historic allies? Where does that begin? I think and again this echoes much of what we've heard today and what you heard today I think is notable to say is very new. It's the first event that I've been to where the conversation was not about the NSA but about German law. What can we do at the national level? Because this debate begins at the national level. We will authority to go to their neighbors and ask them to do something that you do not do yourself. Reform will begin here. Then it will go to the European level and only then can it come to the transatlantic level and I think these solutions will have to be based on common interests and not on a threat of collapsed relationship or economic exclusion. It's a difficult bridge to get across because for many the only and most important villain in the Snowden story is the NSA but the truth is more complicated. Consider what's happened in the Bundestags Inquiry Committee. The NSA has uncovered very few new facts about the NSA but it has uncovered a whole lot of new facts about the BND. My friend Georg Moskolo Brocken should have been a bomb in the middle of this debate and yet somehow it wasn't. We need to go back and pick that up again. The cooperation between the agencies is not an isolated incident. This is a 40-year planned operation. The laws governing surveillance in Germany and in other European states are not that different than the laws governing surveillance in the United States. The capacity and technological capability and budget that the Americans bring to the table is vastly different but the law the legitimacy of these operations is based on the same ideas. And if we want to change that at the transatlantic level we're going to have to change it here. That's why I think Germany should embrace its exceptionalism. Embrace the idea that Germany has perhaps the greatest amount of credibility in the world of any country when it comes to constraining the power of government. Barack Obama can talk all day about how he's not going to do the things that he could do and most people won't believe him. German leaders stand up and say that people believe it. That is powerful. That is a pathway to building legitimacy at the European level. And that could make Germany the Weltmeister of legitimacy when it comes to surveillance policy. But it's going to take time and we have to think about this as a long game. And if we ask the hard questions first we're not going to play very long. If the first question we ask is we want a no spy agreement and we want every country in the world starting with the United States to live up to its obligations under human rights law we won't get very far. That's what we've been doing for the last 18 months and it hasn't worked. Not that I'm ready to give up on human rights law or first principles but I think we need to begin the long game with a strategic intervention that asks the easy questions first. And maybe they aren't even that easy. I think we can't threaten or punish the United States into compliance with the European idea of civil liberties on the Internet. We have to persuade them that it is in their interest to do so. How do we do that? I think we start with a set of questions and some of them have come up already today. We start with a set of questions that will open the door to dialogue because there is a common interest in resolving them. In my company I have a lot of data. This is the question about if I am an American company and you are my customer and your data is stored on a server in Germany who can get access to that data? Right now American law says that any company with a headquarters in the United States incorporated into the United States is subject to US law and any server no matter where it is located in the world is in the technical custody of that company and therefore all data located on any of those servers no matter who it belongs to no matter where it is located is required for delivery to an intelligence agency or a law enforcement agency that has a court order. By the way, that same law in Germany the differences market difference American companies that are headquartered in the United States have about 90% of the data in the world. But if the situation was reversed it would be German law or French law or British law that was called into question. So we have a common interest in talking about territorial access to data because it is fundamentally about in the old days before the internet before Google and Facebook and Microsoft if the FBI wanted the phone records of a German citizen how would they go about getting that? First they would have to go to a US court and demonstrate evidence that they needed those phone records and they would get a document and that document would then be delivered to the German counterparts to a mutual legal assistance treaty and we have reason to believe that this individual who is your citizen is a criminal or is involved in criminal activity and 99% of the time when it comes to German-American relations that request would be honored German law enforcement would pass that request to the Deutsche Telekom and that data would be delivered back through the channel. The moment when the two governments discussed the evidence related to that data request was the moment that policy became legitimate because the presumption of the public is my government will not grant ridiculous requests for access to data from other governments and as a result those other governments won't ask wasn't that much more complicated than that but now the technology has changed and when the FBI wants access to the data of a German they don't need to go to Deutsche Telekom and as a result they don't need to go to the German government they can just go to Google or Facebook or Microsoft or any company that is headquartered in that country and it is not the fault of those companies that they are subject to those laws they are subject to American law in the same way that SAP is subject to German law in the same way that Alcatel is subject to French law we have a common interest in solving the legitimacy problem in the base of extraterritorial data access second strategic intervention also mentioned today industrial espionage it is one thing that unites the German government and the American government on questions of espionage both promise absolutely that they do not engage in industrial espionage well if nobody is engaged in it then they won't mind prohibiting it and they won't mind setting up institutional controls and oversight to make sure that it doesn't happen and that would also create a very nice international opportunity to challenge other countries to get out of the industrial espionage business third point in my strategic intervention list cryptography and certification the internet is built on a set of standards and certifications for hardware and software most of those standards and certifications at the technical level are built by quasi public institutions and private standard setting bodies dominated by American interests not for some conspiratorial reason but simply because that's where those standards were invented and that's where those companies existed and that's where the network was credibility of those standards and certifications is going down there's an opportunity now for someone else to step forward and say we have a little bit of technical know-how here and we can build standards and certifications for everybody to live up to and comply with that will give consumers and citizens more confidence in technology fourth point transparency and oversight we had a whole panel on it this morning so I won't belabor the point but parliamentary control should be more than four hours a month it's a clear and obvious opportunity to change things to give people more confidence in their interests in response to this problem these strategies may not sound terribly sexy certainly not as sexy as no spy but they might actually work and I'm worried right now that we're going to get the big zero if we don't start moving forward on questions that are answerable in the short term and that can force a dialogue and that can begin a process of engagement between countries who have a common interest in reestablishing legitimacy in connection technologies it's a long game we're going to be talking about this for the next decade or more we haven't made much progress so far it's time to change that thank you very much