Improving the transparency of government requests for user data from ICT companies

Abstract

In 1968, the US Congress enacted a detailed list of requirements for transparency reporting of wiretaps but with subsequent surveillance statutes with minimal reporting requirements and rapidly evolving Internet technologies, the gap in surveillance transparency grew. The Snowden disclosures in 2013 provided a peek into the surveillance landscape and the central role of ICT companies in fostering it. While attempting to salvage their tarnished reputations and encourage public discussion, several companies began to see an incentive in publishing 'transparency reports', providing statistics on user data requested by the government. Since then, publishing these reports has become a norm in the industry but the reports provide little benefit in bridging the transparency gap. The varying formats, definitions and levels of granularity in the reports and the absence of a governance framework in the industry, prevent the reports from becoming useful tools for stakeholders wishing to inform policy decisions. In addition, new technologies, modern surveillance techniques, and evolving business models have created a set of transparency requirements that is markedly different from the initial set of requirements established under the US Wiretap Act. This thesis identifies the missing elements in the current transparency reports while providing a detailed list of necessary features. In addition, it uncovers the incentives that can be leveraged using available tools to encourage better reporting practices and suggests technical, legal and policy solutions so that transparency reporting may become a useful public policy tool rather than a ritualistic practice.