Can I prevent the National Security Agency from using my work?

Question

I am currently working on a research project in a subfield of computer/data science that concerns a topic whose research seems to have worrying correlations with the U.S. National Security Agency due to its potential to be used to track relationships people. In fact, many of the work I am referring to seems to be authored by current NSA engineers on academic journals.

Assuming I am willing to disclose the work (which, to be honest, is far from groundbreaking or useful) of my paper on such topic through an open license, say CC BY-NC-SA 3.0, does an easy way exist to prevent a particular entity - in this case the National Security Agency - from (mis)using parts of a scientific paper in their work with near-obvious moral implications? Let us assume, for the scope of this question, that such work will be written and released following legislation from the European Union.

I guess this would be quite complicated to do with legal validity, so my question aims to be more theoretical/ideological than related to any specific work.

Answer 1

No you cannot.

1. Copyright does not regulate use of information
2. Criminals and state actors operate under different rules.

There are different kinds of “IP”. Copyright is well-known, but does not cover ideas or methods. Copyright is more about protecting creative expression. Thus, copyright protects your paper as a literary work, but not any methods or techniques discussed in the work. For such protection, you'd need to apply for a patent.

The creative commons licenses derive their enforceability through copyright. They do not try to place additional restrictions on a creative work. Instead, the starting point is that all copyright-covered works are “all rights reserved” by default. CC licenses open this up a bit and offer public licenses under basic conditions like attribution, share-alike, or non-commercial limitations (which, again, only refers to actions like copying the document, not to actions like using information in the document).

Another problem in this scenario is that you're trying to prevent use by a national security agency. While (in a western context) these should operate under the rule of law and are bound by the laws of their country, they still have substantial privileges. If they deem your ideas relevant for national security, they will find a way to use those ideas regardless of whatever license you use (would be a great loophole for terrorists otherwise). This issue is similar to licenses that try to outlaw criminal use. That's extremely pointless because criminals (who by definition don't abide by all laws) are unlikely to value a copyright license more than the laws they break.

In principle it would be possible to create a contract that only gives permission to receive a copy of your paper if the recipient agrees to not use the information in that paper in a specific manner. This would use your position as a copyright holder as leverage to push through contractual conditions the other party might not like, similar to EULAs. However, contract law depends very much on the country – what counts as a contract in the EU might not count as a binding contract in the US. Even if so, discovering a contract breach and enforcing the contract against a spy agency might prove rather difficult. A paper with such a license would also be unpublishable in an academic context.

So what can we do? There are various “ethical” licenses that include field-of-use restrictions, but it's questionable whether they are even valid and enforceable. And they definitely no longer qualify as Open Source. Personally, I think that it's important to recognize problematic uses of sharing software and knowledge publicly, but also to recognize the good that can come from this. I hope that on balance, the good outweighs the bad. In some cases, it might be better to not publish stuff. However, publication of problematic techniques can also inform research into counter-measures. For example, I was recently able to use a repository with published attack code to verify that a security mitigation was effective.

Ultimately, this comes down to your personal ethics. But the decision is more about how and what you publish. We cannot really depend on copyright licenses to enforce ethical behavior.

Answer 2

Short answer

• Can you do this? Yes
• Will they abide by it? Quite possibly not
• Is it still worth doing? Maybe

Long answer

As someone who cares about a fair and just society, it's important to remember than a license is one of many tools in your tool box, so you need to ask:

a) How will this tool serve my goals?

b) What other tools would be better used and should I be using those instead / as well?

Is this technically possible?

Yes. But as others have pointed out, there are legal and practical challenges to this being effective.

Who do you want to exclude?

You may also want to consider the scope of this limitation. Are you specifically only concerned about the NSA using it?

What about regular law enforcement?

Sheriffs departments?

The KGB?

The Australian Signals Directorate (aka ASD, a kind of Australian version of the NSA)?

If you don't exclude the ASD, then are you happy with the NSA asking the ASD to use your work on their behalf to achieve the same end?

How does this tool serve my goals?

If the NSA doesn't want to abide by your terms, what will they do about it and what does that mean?

This could mean you mounting a court case, it could mean them lobbying law makers to change the laws, it could mean they just use it and don't tell anyone.

Whether or not these things work in themselves is not the only question. If you work with organisations that advocate for civil society rights, these actions give them tools to garner publicity and public support.

If law makers were to try and change law to make law enforcement agencies above certain laws, you can see how there's an opportunity to start a public conversation there.

What other tools are better used?

From what you've described, it sounds like your work does not substantively advance the field, in that case, maybe the NSA will already have the tools they need at their disposal.

In which case, the better protections against the misuse of such tools is to work with organisations in the field to influence public support for curtailing such operations.

At the end of the day, what the government institutions can and cannot do is governed by what society is willing to permit / tolerate. Working to build broad enough support to change that may ultimately be a more effective and long term way of preventing what you fear your tool will be used for (and the way you choose to license it and fight for that license may be a tactic in that

You might want to consider the trajectory of ideas like defund the police (which were around long before last year, but used political moments to advance support).

This thread discussing ethical licensing may be of interest on the technical aspects.

Answer 3

You could modify any license to add your personal exception; of course in licenses like GPL or BSD you would not be compatible with the original license but that is not an issue for you.
In general I saw a license against ALL military use, see “Open-source” licenses that explicitly prohibit military applications.
There are instances of blocking a particular entity or person, I think one of the biggest example is Black 3.0, that explicitly says:

Note: By adding this product to your cart you confirm that you are not Anish Kapoor, you are in no way affiliated to Anish Kapoor, you are not purchasing this item on behalf of Anish Kapoor or an associate of Anish Kapoor. To the best of your knowledge, information and belief this material will not make it's way into the hands of Anish Kapoor.

but I don't know how sound this would be in court, especially if it can be seen as blocking a particular race, gender, religion, age and probably some more.