Your device will know things about your surroundings that you have no way of knowing on your own: where people are, who they are and what their virtual profiles contain. Today, users already share their iTunes libraries with strangers over Wi-Fi networks, and in the future, they’ll be able to share much more. In places like Yemen, where socially conservative norms limit many teenagers’ ability to socialize with the opposite sex, young people may elect to hide their personal information on peer-to-peer networks when at home or at the mosque—who knows who could be looking?—but reveal it when in public parks and cafés, and at parties.
Yet P2P technology is a limited replacement for the richness and convenience of the Internet, despite its myriad advantages. We often need stored and searchable records of our activities and communications, particularly if we want to share something or refer to it later. And, unfortunately, not even P2P communications are a perfect shield against infiltration and monitoring. If authorities (or criminal organizations) can identify one side of a conversation they can usually find the other party as well. This is true for messaging, voice-over-Internet-protocol (VoIP) calls—meaning phone calls over the Internet (e.g., Google Voice and Skype) and video chats. Users assume they are safe, but unless the exchange is encrypted, anyone with access to intermediate parts of the network can listen in. For instance, the owner of a Wi-Fi hot spot can listen to any unencrypted conversations of users connected to the hot spot. One of the most insidious forms of cyber attack that P2P users can encounter is known as a “man-in-the-middle” attack, a form of active eavesdropping. In this situation a third-party attacker inserts himself between two participants in a conversation and automatically relays messages between them, without either participant realizing it. This third party acts like an invisible intermediary, having tricked each participant into believing that the attacker is actually the other party of the conversation. So as the conversation occurs (whether through text, voice or video), that third-party attacker can sit back and watch, occasionally siphoning off information and storing it elsewhere. (Or, more maliciously, the attacker could insert false information into the conversation.) Man-in-the-middle attacks occur in all protocols, not just peer-to-peer, yet they seem all the more malicious in P2P communications simply because people using those platforms believe they are secure.
And even the protection that encryption offers isn’t a sure bet, especially given some of the checks that will still exist in the physical realm. In the United States, the FBI and some lawmakers have already hinted at introducing bills that would force communications services like BlackBerry and Skype to comply with wiretap orders from law-enforcement officials, introducing message-interception capabilities or providing keys that enable authorities to unscramble encrypted messages.
P2P networking has a history of challenging governments, especially around copyright issues for democracies (e.g., Napster, Pirate Bay) and political dissent for autocracies (e.g., Tor). In the United States, the pioneer of P2P file sharing, Napster, was shut down in 2001 by an injunction demanding that the company prevent all trading of copyrighted material on its network. (Napster told a district court that it was capable of blocking the transfer of 99.4 percent of copyrighted material, but the court said that wasn’t good enough.) In Saudi Arabia and Iran, religious police have found it extremely difficult to prevent young people from using Bluetooth-enabled phones to call and text complete strangers within range, oftentimes for the purpose of flirting, but also for close-proximity coordination between protesters. Unless all mobile devices in the country are confiscated (a task the secret police realize is impossible), the flirtatious Saudi and Iranian youth have at least one small edge on their state-sponsored babysitters.
BlackBerry mobile devices offer both encrypted communication and telephone services, and the unique encryption they offer users has led many governments to target them directly. In 2009, the United Arab Emirates’ partially state-owned telecom Etisalat sent nearly 150,000 of its BlackBerry users a prompt for a required update for “service enhancements.” These enhancements were actually spyware that allowed unauthorized access to private information stored on users’ phones. (When this became public knowledge, the maker of BlackBerry, RIM, distanced itself from Etisalat and told users how to remove the software.) Just a year later, the U.A.E. and its neighbor Saudi Arabia both called for bans on BlackBerry phones altogether, citing the country’s encryption protocol. India chimed in as well, giving RIM an ultimatum to provide access to encrypted communications or see its services suspended. (In all three countries, the ban was averted.)
Repressive states will display little hesitation in their attempts to ban or gain control of P2P communications. Democratic states will have to act more deliberately. We already have a prominent example of this in the August 2011 riots in the United Kingdom. British protesters rallied to demand justice for twenty-nine-year-old Mark Duggan, who had been shot and killed by British police in Tottenham. Several days later the crowds turned violent, setting fire to local shops, police cars and a bus. Violence and looting spread across the country over subsequent nights, eventually reaching Birmingham, Bristol and other cities. The riots resulted in five deaths, an estimated £300 million ($475 million) in property damage and a great deal of public confusion. The scale of the disorder across the country—as well as the speed with which it spread—caught the police and government wholly off guard, and communication tools like Twitter, Facebook and particularly BlackBerry were singled out as a major operational factor in the spread of the riots. While the riots were occurring, the MP for Tottenham called on BlackBerry to suspend its messaging service during night hours to stop the rioters from communicating. When the violence had subsided, the British prime minister, David Cameron, told Parliament he was considering blocking these services altogether in certain situations, particularly “when we know [people] are plotting violence, disorder and criminality.” His goal, he said, was to “give the police the technology to trace people on Twitter or BBM, or close it down.” (After meeting with industry representatives, Cameron said industry cooperation with law enforcement was sufficient.)
The examples of the U.A.E. and the U.K. illustrate real concern on the part of governments, but it is important to clarify that this concern has been about encryption and social networking. In the future, however, communication will also take place on mobile P2P networks, meaning that citizens will be able to network without having to rely on the Internet (this was not the case in the U.A.E. and the U.K.). It stands to reason that every state, from the least democratic to the most, may fight the growth of device-to-device communication. Governments will claim that without restrictions or loopholes for special circumstances, capturing criminals and terrorists (among other legitimate police activities) and prosecuting them will become more difficult, planning and executing crimes will be easier and a person’s ability to publish slanderous, false or other harmful information in the public sphere without accountability will improve. Democratic governments will fear uncontrollable libel and leaking, autocracies internal dissent. But if illegal activity is the primary concern for governments, the real challenge will be the combination of virtual currency with anonymous networks that hide the physical location of services. For example, criminals are already selling illegal drugs on the Tor network in exchange for Bitcoins (a virtual currency), avoiding cash and banks altogether. Copyright infringers will use the same networks.