On Internet, Brazil is beating US at its own game

U.S. National Security Agency documents from 2012 revealed this month by Glenn Greenwald show that the intelligence agency recorded email and telephone calls of Brazilian and Mexican heads of state as well as the Brazilian state oil producer Petrobras and other energy, financial and diplomatic targets. It is unsurprising that a national intelligence agency would attempt to gather such information, and it can be argued that it was, however overzealously, doing the job American taxpayers are paying for. But it is also a disappointing, though illuminating, commentary on the state of the Internet that it was successful.

In response to the revelations, on Tuesday Brazilian President Dilma Rousseff announced measures to protect the privacy of Brazil's citizens from NSA spying:

• Increase domestic Internet bandwidth production
• Increase international Internet connectivity
• Encourage domestic content production
• Encourage use of domestically produced network equipment

Rousseff could make these significant announcements not because of any government resolution or investment but because they are, by and large, successful existing Brazilian private-sector initiatives that have been under way for many years. Only those who haven't been paying attention to Brazil's phenomenal Internet development mistook the announcement for news; it was opportunistic spin on what Brazil has already been successfully doing for most of the past decade.

Nor is Brazil's plan a repudiation of the United States. Brazil is following the path of Internet development that has been proven in the U.S. and is advocated by the U.S. State Department. What's interesting about Brazil is not that it's defying the United States' under-the-table agenda but that it's doing so by executing moves from the U.S.'s above-the-table playbook so masterfully.

The NSA is able to record conversations not because it has suborned people or placed advanced spying equipment in Brazil and Mexico but because those countries -- and many others -- depend on communication routes and infrastructure in the United States, where the NSA's eavesdropping capability predominates.

The Internet's detractors often claim that the U.S. government has structured it in its own favor in order to somehow retain disproportionate control of the Internet, despite the fact that the Internet has been international for 40 years. Some of these claims of skullduggery have merit, and many others are fanciful paranoia -- but all of them are insignificant and beside the point.

Here is why: The Internet is almost entirely composed of private commercial networks. Despite the self-aggrandizing assertions of governments, the Internet is driven by private-sector commercial decisions rather than national policies. Governments may attempt to incentivize or punish through regulation, but they cannot compel the private sector to invest, and that private-sector investment is how the Internet is built. The residual centrality of the United States is a result of the combined momentum of many companies competing to build Internet infrastructure there over several decades, but that centrality is waning as those companies expand to global markets and encounter new competitors arising internationally. Studies by both Telegeography and Packet Clearing House (where I am executive director) show that Europe has surpassed the United States in many measures of Internet bandwidth production and centrality of routing and that the percentage rate of growth in Latin America is currently outstripping any other region, thanks largely to Brazil's efforts.

The first point of Rousseff's four-point plan illustrates this growth. In 2004 the Comitê Gestor da Internet no Brasil, or CGI, the primary Internet governance organization in Brazil, began sending delegations to inspect the policies and operations of successful Internet exchange points (IXPs) -- the locations where Internet bandwidth is produced -- around the world. The CGI then established an aggressive program of IXP construction, taking Brazil from a single IXP in 2004 to 23 today, second only to the United States in the number and distribution of IXPs. (By comparison, half of all countries produce no Internet bandwidth domestically at all.)

By investigating and following international best practices rigorously, Brazil has created more new sites of Internet bandwidth production faster than any other country and today produces more than three-quarters of Latin America's bandwidth. As a result, Brazil has had a 77 percent year-over-year increase in Internet bandwidth production, compared with U.S. growth of 10 percent in the past year. In absolute numbers, this puts Brazil in seventh place globally, just behind the United States.

By any measure, then, Brazil is on a clear trajectory to outstrip the United States, using the norms and best practices that the United States developed and advocates. Rousseff's declaration that Brazil will build its own IXPs and produce its own Internet bandwidth is no idle prediction; it's a statement of established fact. This energetically entrepreneurial industrial development has already begun to produce the independence and autonomy that Rousseff seeks for Brazil's citizens. Although other building blocks are necessary, this is a key one.

Rousseff's second point, increasing international Internet connectivity, consists of at least three independent areas of development. The first of these is the intercontinental undersea fiber cables that link Brazil to the United States, Africa and Europe:

• The South Atlantic Express, SAex, under way since 2010 and expected to be operational in 2014, is a consortium cable system majority-funded by the Bank of China with significant participation from Brazil's Oi. It is expected to provide 24 terabits per second (tbps) of capacity between Brazil and South Africa at a cost of approximately $800 million.
• WASACE, a competing consortium cable system announced in 2011 and also scheduled for completion in 2014, connects Brazil with South Africa as well and touches down in the United States, Angola and Nigeria too, at 40 tbps.
• In December 2011, Telebras contracted for a private 24,000-kilometer cable connecting Brazil to the United States and Angola, also scheduled for 2014 delivery. The capacity of the cable was not announced. It is anticipated to cost $900 million when complete.
• In March 2012, the BRICS cable was announced for late 2015 delivery, linking Brazil with the United States, South Africa, India, China and Russia, at 12.8 tbps and a cost of approximately $1 billion.
• Also in March 2012, the Seabras-1 cable was announced for 2014 delivery, providing an additional 32 tbps of capacity between Brazil and the United States.

These five new cable systems join six existing cable systems connecting Brazil with its Latin American and Caribbean neighbors, the United States, Africa and Europe. All are private-sector efforts, and all have been in the works for a year and a half or more. By giving Brazil the ability to exchange traffic directly with other fast-growing markets in the Southern Hemisphere and their BRIC cohort -- China, Russia and India -- these cables provide higher capacity, lower latency and lower cost paths that don't cross United States territory. Although they'll likely be tapped eventually, that won't diminish any of the other value they provide, and at least they'll make the NSA work for its pay.

The second area of development is Brazilian-owned satellites. A joint venture of Telebras and the Brazilian aerospace giant Embraer has contracted with French-Italian Thales Alenia to build Brazil's first "Geostationary Defense and Strategic Communications satellite," scheduled for launch in 2016 at a cost of $650 million, followed by a transfer of technology intended to allow Embraer and the Brazilian space agency AEB to launch planned additional satellites independently in 2022 and 2026. While operating its own satellites will not protect Brazilian communications against eavesdropping (only strong cryptography will help it there), that will give Brazil a much greater degree of autonomy by reducing its current dependency on satellite bandwidth -- provided by Mexico's Star One at a cost of some $30 million annually -- while making it cost effective to provide more than 1,800 isolated rural communities with communications services for the first time. The Brazilian space agency's 2011 strategy document noted that "40 geostationary telecommunications satellites, all foreign, are operating in the country, using satellites manufactured abroad. We need to increase our country's participation in the manufacturing."

The third and less documented area of development consists of private overland fiber cable systems linking Brazil to each of its South American neighbors. These follow a pattern similar to Brazilian private-sector investment in undersea cables but on a much smaller scale. This is particularly important with regard to the landlocked countries of Paraguay and Bolivia. With no independent access to the undersea international cable systems, they depend entirely on this form of transitive connectivity through their coastal neighbors. Because these overland cables will lie exclusively within the sovereign territories of their respective users, it's much less likely that they will be tapped than their undersea equivalents. They are thus likely to provide effectively private communication channels between Brazil and its neighboring countries.

Regardless of where the cables run, users' Internet traffic and stored data are not private if users select services that are provided from jurisdictions that do not respect their privacy. For instance, if a Brazilian user has a Hotmail email address and uses the Google-owned Orkut social-networking site, her email and social-network data are stored on servers in the United States and are thereby accessible to the NSA. Encouraging the formation and use of domestic alternatives allows Brazilian users' communications to remain on Brazilian domestic infrastructure and their data to reside on hard disks in data centers in Sao Paulo and Rio de Janeiro rather than Redmond, Wash., and Portland, Ore.

Users follow the fickle winds of fad, however, and it is notoriously difficult for unhip governments to attract the attention of youth. So it may be difficult for the Brazilian government to pick a winner in the domestic social-networking space and promote its success. More likely, continuing to decrease the cost of domestic Internet traffic routing through infrastructural initiatives like IXPs and fiber-optic cable systems will create a strong economic incentive for all content providers, foreign and domestic, to host Brazilian users' data within Brazil and thus within Brazilian regulatory jurisdiction. This appears to be where the Brazilian government is heading: toward a common understanding with the European Union on data privacy, harmonizing with its standards of protection for users' personally identifiable information, or PII. Brazil hopes to compel companies that provide services to Brazilians to do so from servers in Brazil -- which would subject them to Brazilian privacy regulation.

The president's office has asked Correios, the Brazilian public postal service, to provide an encrypted email system to the public at no cost by next year. This comes less than a year after the postal service shuttered CorreiosNet, its prior hosted email offering. Coincidentally, the U.S. Postal Service operated the first such publicly hosted email system, E-COM, from 1982 to 1985, though with little success. Government-operated email systems can, however, succeed; the French Minitel system was wildly popular, serving 25 million people for 34 years. The proposed Brazilian system has the distinct advantage of being free, so it may succeed. If executed well, it could employ strong encryption, potentially with Brazilian governmental key-escrow, which would allow Brazilian law enforcement access but effectively deny access to foreign intelligence agencies.

Perhaps the most controversial portion of the Brazilian plan is to encourage private-sector network operators in Brazil, whether foreign or domestic, to use only Brazilian-designed and -produced telecommunication equipment in their networks. This is intended to address the fear that "back doors" will come installed in equipment sourced internationally, making it vulnerable to wiretapping by foreign intelligence agencies. This same precaution has led some countries to ban the use of Chinese-produced Huawei and ZTE gear from sensitive networks, but it also seems to penalize products from Cisco and Juniper that have not shown similar vulnerabilities.

The near-term winners from any such policy are likely to be Datacom and Padtec (based in Rio Grande do Sul and Sao Paulo, respectively), which are the current suppliers of networking equipment for Brazilian government networks. This is likely to backfire in the long term, however, when those manufacturers try to grow beyond the Brazilian domestic market.

Like the satellite-development deal, this policy follows Brazil's well-established pattern of using high tariffs to displace foreign imports with domestic products. This strategy has worked brilliantly for Brazil in the past in the automotive and aerospace sectors and has been notably successful for many Asian economies. Nevertheless, stratospheric import tariffs on high-tech electronics have failed to jump-start a Brazilian electronics industry and have created substantial friction with international computer and networking-equipment producers.

Unlike the automotive and aerospace industries, computer-networking and information technologies scale with the network effect: Their value is partly determined by their relationship with other technology products and their users. Such products are entirely dependent on seamless interoperability between them and equipment made by different companies. So if Datacom and Padtec profit from Brazilian governmental protectionism in the near term, they will pay the price in the long term when they try to expand into international markets, since they will face the suspicion of other governments that the reason the Brazilian government favors them is that they incorporate unique Brazilian back doors. In other words, this form of protectionism leads to the problems that Huawei and ZTE face today.

In Brazil, as these plans unfold, more communication will remain within the country, creating a virtuous cycle with domestic content that is faster and cheaper while remaining more private. Brazilian users' data will increasingly be subject to Brazilian governmental inspection only, not to both the Brazilian and U.S. governments. This is not speculative; it has been a clear trend for nearly a decade.

As always, users who want to protect their privacy should consider storing data themselves, rather than in cloud servers where it may be accessible by intelligence services, and should consider employing strong encryption through standards like Pretty Good Privacy (PGP), with the longest encryption key lengths they have the patience for. As the cost of processing power lowers over time, intelligence agencies will be able to decrypt more and more recorded communications retroactively; the longer your encryption keys, the more years you have before your secrets are not just yours anymore.

Despite the clear benefits of these developments for Brazilians, their government's statements have been shrilly and incorrectly branded as extreme and decried as Soviet socialism by some U.S. media. This is largely due to a misimpression that what Brazil is doing is cutting itself off from the Internet or balkanizing the Internet -- when in reality, it's building more Internet faster. Critics fail to understand that the path Brazil is taking was blazed in the United States. While Brazil may engage in aggressive rhetoric, its actions are sound. This may be the opposite of the United States' approach, which wallpapers over the NSA's damaging actions with the eminently reasonable diplomatic gestures of the State Department.