What laws in the jungle?

SPYING typically involves stealing secrets by lying and cheating. How then should law-governed states deal with this lawless branch of government? Technology is making old rules increasingly inadequate (see article). Modern life leaves abundant electronic clues, which businesses already exploit for profit. Intelligence agencies can and should use such data to monitor terrorists, criminals and spies, as well as hostile states.

But the advent of big data is blurring old definitions. Simply collecting and analysing the “metadata”—the outward details of communications, but not their content—reveals much about an individual. It is ever-harder to distinguish information involving foreigners (usually fair game) and a country’s own people (whose privacy should usually be protected). A lack of public trust compounds the problem. Spooks may shrug at the naivety and suspicion displayed in the reaction to revelations by Edward Snowden, who worked at America’s National Security Agency (NSA). But the public pays the bills. Spymasters need to rebuild public trust. That requires tighter oversight.

Take the haystack to find the needle

The case for intelligence is as powerful as ever. Democracies are stronger when they are properly defended from internal and external threats. True, spying on allies can backfire (see article). But allies that publicly protest about America’s eavesdropping also know how dependent they are on the intelligence provided by America’s mighty agencies. Having squawked loudly about allegations of American snooping, Germany now grudgingly acknowledges the plusses. Effective intelligence work requires the wholesale collecting, warehousing and sifting of electronic information for patterns and clues. No law-governed state would accept no-go areas in the real world; they should not be tolerated online either.

But the deeper the intrusion by the state, the stronger should be the safeguards. National preferences vary: France, notoriously tolerant of its spies, has just approved a new law giving them sweeping powers. Elected politicians must set clear rules about what information can be collected and how it should be handled—and be held accountable for their decisions. When computers detect suspicious activity, judges should decide whether further investigation is justified. As with a warrant to search a suspect’s home, agencies should have to have a warrant to search a suspect’s data.

Even so, the potential for errors is high. What happens if, say, a foreigner is placed on a no-fly list because a computer draws a mistaken inference? A country may deny visas to people on a hunch, but it should not be able to ruin their lives. Those on no-fly lists need some route to speedy redress.

In general, the model is America’s mix of judicial, political and legislative oversight. Britain, for instance, could adopt America’s practice of getting judges, not politicians, to approve serious intrusion into citizens’ privacy.

But even America’s system needs work. Lawmakers lack a proper sanction against spooks who obstruct or mislead them. They should have the right to pass a career-killing no-confidence vote in a senior official. The NSA, the main signals-intelligence organisation, should be led by suits, not uniforms.

And spies cannot have everything. America’s FBI wants a new law forcing firms running encrypted messaging services to store, and if necessary hand over, code-cracking keys. But that would be ineffective: users would switch to foreign providers. It might also be dangerous. American officialdom’s record on protecting sensitive data is dire. A breach in the Office of Personnel Management (OPM) led to hackers (probably Chinese) stealing information on at least 20m federal employees. America’s spookdom is bloated. Agencies overlap murkily with private firms. An incompetent contractor was the source of the OPM breach; Mr Snowden was a contractor, too.

There is a natural limit to how much secret work can be revealed in public. Intelligence oversight will always be imperfect. But that is grounds for prudence, not paranoia.