Setting out plans to monitor all Internet use in the UK

http://www.bbc.co.uk/news/uk-politics-18434112

by iProject • 14 years ago

74 46 14 years ago

bbc.co.uk

jgrahamc• 14 years ago

If you want to understand the state of state surveillance technology and thinking in the UK then I highly recommend Henry Porter's novel "The Dying Light".

http://www.amazon.co.uk/The-Dying-Light-Henry-Porter/dp/0752...

Although it's a novel, it's written by a well-known journalist with an interest in civil rights and liberty: http://en.wikipedia.org/wiki/Henry_Porter_(journalist)

voidr• 14 years ago

> But senior Tory David Davis said it was "incredibly intrusive" and would only "catch the innocent and incompetent".

I think this sums it up, this data will be of little help for stopping crime, but it would be of great help for corrupt officials to do evil not to mention the risks involved with storing this data.

DanBC3• 14 years ago

Officials have already shown that they are happy to overstep what regular people consider to be acceptable. And that was a generous line. People in the UK are on the whole accepting of privacy invasions.

Announcing this during the McPherson inquiry (where various people (including police officers) have shown they're happy to break criminal law to obtain, buy, and sell information) means they're going to have a hard time getting it passed.

gouranga2• 14 years ago

Actually, we're not that happy about it.

Unfortunately those who probably would care are too busy consuming the noise of the numerous wars, inquiries, showbiz, celebrity dross, royal banality, Olympic bleugh and regurgitating it all over Facebook.

Lockyy2• 14 years ago

"The only people who will avoid this are the actual criminals, because there are ways around this - you use an internet cafe, you hack into somebody's wi-fi, you use what's called proxy servers, and they are just the easy ways."

It's sad that it's shocking for a politician to be able to actually list ways that this sort of system can be worked around.

scott_w• 14 years ago

I'm also disappointed that the Lib Dem ministers are so easily placated by "warrants must be approved by the Home Office", and not a judge. This shows an unnerving readiness to erode the separation between legislature and the judiciary.

Given that another Conservative minister claimed, under oath, that he doesn't know what "quasi-judicial" means (he was appointed that exact role), I don't have much hope that the home secretary will apply legal advice before handing out warrants.

kamjam3• 14 years ago

Looks like our Government is finally coming up with a plan to compete with Facebook for who has the most data on their "citizens" :-p

revjx• 14 years ago

A lot of websites now offer SSL by default, or as an option - is this more of an obstacle or can ISPs use some sort of MITM technique to defeat the SSL for snooping purposes?

Forgive my ignorance, I'm very curious about this as a UK citizen.

Udo• 14 years ago

They can MITM SSL/TLS if they manage to forge the certificates in question, or on both endpoints by having a snooping backdoor in place on either the server or the client. Other than that there are no known weaknesses in the encryption websites use but there is a multitude of things that can and do go wrong without anybody noticing.

majke2• 14 years ago

SSL does encrypt the traffic, but requested domain name is still transferred in plain text during the SSL handshake. I guess for tracking purposes remote IP and domain name would are more than enough.

rmc• 14 years ago

They can MITM attack SSL only if they have root/superuser access to your computer. They'd have to install a new SSL root cert. Or ISPs can put up a fake cert and hope that people ignore/click through the warnings (which lots do). Or if they have a contact with a corrupt SSL root cert signer, they could get their own fake cert signed.

4ad2• 14 years ago

Businesses (and governments) can legitimately buy root keys that allow MITMing any SSL connection or they could just be a CA themselves (any CA can MITM the whole internet).

Here's the best talk I know of this subject: BlackHat USA 2011: SSL And The Future Of Authenticity: http://www.youtube.com/watch?v=Z7Wl2FW2TcA

andyjohnson02• 14 years ago

I find this hard to believe.

"Businesses (and governments) can legitimately buy root keys that allow MITMing any SSL connection"

A business can buy their own SSL keys, but to MITM any SLL connection those keys would have to be trusted and installed at both ends of the connection and used to generate the SSL session key.

"any CA can MITM the whole internet"

Again, the CA's keys would have to be trusted and installed by the communicating parties.

Or have I misunderstood your point?

gouranga2• 14 years ago

And as usual the criminals are going to find another way.

I await more "the terrorists are coming" and "think of the children" legislation.

However, we have one thing on our side: government IT incompetence. They have managed to screw every major IT project up in the last 20 years, so this will go the same way :)

BitMastro2• 14 years ago

Unfortunately this is a double edged sword. Their incompetence also caused the a lot of trouble like in this example http://beusergroup.co.uk/index.php?id=695 where they proxied file sharing sites thus forbidding access.

ElliotH• 14 years ago

http://bigbrotherwatch.org.uk/files/CCDP/CCDP_Briefing13June... has some good information on the counter arguments to this bill. (Some of the media seems to be printing the Home Office briefing with only a little mention of critics).

If UK people are interested in helping stop this then the Open Rights Group is running training days on this topic: http://www.openrightsgroup.org/events/2012/censorship-and-su...

nicholassmith3• 14 years ago

It's so trivial to work around this that I'm stunned they're even bothering to implement it. As we've heard over various stories recently terrorist groups were doing such varied things as steganography, if they've managed to work out how to do that I'm sure they've sussed VPNs, anonymous proxies and disposable network points.

Pointless and makes my life as a British citizen more awkward as I'll having to put all my network traffic off through something rather than leaving it as a nice, simple internet connection.

kamjam3• 14 years ago

If you are routing your traffic through VPN and anon proxies or use Tor then you must be a terrorist!

Totally retarded, but I bet they will look at your traffic harder if you did this, even though I have nothing to hide...

Interesting read from something that was posted on HN yesterday: http://news.ycombinator.com/item?id=4105485

mike-cardwell2• 14 years ago

My understanding is that they need a warrant to look at the log of your traffic. Presumably they'd need to look at the log of your traffic in order to see if you're using a VPN or Tor.

So what you're suggesting means they'd need to look at your traffic without a warrant in order to determine if they need a warrant to look at your traffic.

[edit] Also, presumably they can already get a warrant to tap your traffic. All this new legislation means is that they can look at historic traffic too?

Don't get me wrong. I am British, and I do think it's fucking disgusting. But don't forget, it's just a proposal.

[edit2] I was wrong. It seems they wont need a warrant to see who you're talking to. Just a warrant to see what you're saying. So yes, I guess they'll be able to tell that you're using a VPN without getting a warrant first.

nicholassmith3• 14 years ago

That was one of the more interesting parts to come out, the clever word politik of saying 'only terrorists, paedos or criminals would dare to be upset about this'. So ordinary man thinks "I'm neither of those 3, rummage away".

blibble• 14 years ago

when the percentages of people that use these kinds of technologies are low then yes, it's a big sign to the spooks that "LOOK AT ME, I'M PROBABLY DOING SOMETHING INTERESTING"

... this is the reason several people I know don't use PGP signed/encryted email.

BitMastro2• 14 years ago

It is not a simple internet connection already. http://en.wikipedia.org/wiki/Cleanfeed_(content_blocking_sys... and http://en.wikipedia.org/wiki/WebMinder

lumberjack• 14 years ago

Note that this is a recurring theme. Two possible explanations:

1. It's trivial for you. Is it as trivial or convenient for the average Joe? Tor is slower and more restricted in terms of multimedia and VPNs and other proxy/routing services cost money and while not hard to implement, are still beyond the grasp of the average citizen. Of course this immediately prompts the question of whether this is intended as a security measure at all since only the average citizen will be affected.

2. I suspect that this is more about legislative precedence than it is about actual implementation. Governments are forever forcing new surveillance measures. The common people ignore them and the techies resolve to bypass them technically. But the politically harm is already done. Before we know it there will be hundreds of these laws and measures passed and when we finally realize it, it will be very hard to persuade the bureaucrats that implemented them in the first place to remove them.

pauljburke• 14 years ago

1. It's trivial for you.

I used to think like this until a recent conversation between 2 cousins on facebook concerning the nautically naughty bay.. I had a bit of a shock seeing one of my "knuckle dragging, mouth breathing" (my words) relatives spouting on about VPNs etc. and getting it mostly right. I suspect if it's a choice between not accessing certain sites and learning you'll be surprised at how quickly people will learn.

nicholassmith3• 14 years ago

Okay true, trivially for me is not trivial for all. However, VPNs are already familiar to a large group of users who've used them for business, including a lot of straight forward guides on the internet. If you can work out how to follow the instructions you're sorted.

batista• 14 years ago

>It's so trivial to work around this that I'm stunned they're even bothering to implement it.

This does not matter one iota. People have been spied upon for ages with things that are even more trivial to work around.

Also, that it's trivial to some means nothing, if it's not trivial for others, or if they are not bothered. Can you guarantee that your grandmother or friend will also "work around" this --and other such measures? You don't really believe that they can get information about you only from YOUR system?

Lastly, even if its trivial to bypass and useless, it raises the Overton Window. Society accepts that --already an unthinkable level of surveillance 2-3 decades ago--, and they'll come up with something more intrusive next time.

Plus, they make the laws. If they can get away with that one, they could also get away with outlawing "working around it", and all related tools.

In that case, they don't even need to "break" Tor to get people. They can execute some warrant search to your house (for whatever reason), or even a routine laptop search at the airport, and arrest them if they see such a tool MERELY installed on it.

majke2• 14 years ago

  [...] the government would be able to request any service 
  provider to keep data about internet usage, although 
  initially it will involve about a dozen firms including
  BT, Virgin and Sky.

I guess that includes VPN services (like HMA, who are based in UK).

_b8r0• 14 years ago

There are two parts to the plans for Internet intercept support in the UK, the police and the security services. The police use is primarily for the purposes of stopping crime. The purposes for the security services are opaque and unlimited as long as they are for 'lawful purposes' - i.e. anything under the Intelligence Act 1994.

When opposing this it's important to understand the remits of the two organisations and that one is nominally accountable to the public, while one isn't.

DanBC3• 14 years ago

The secret security services supposedly have a lot of oversight at all levels; including politicians, which in theory are accountable to the public.

(http://www.gchq.gov.uk/AboutUs/Pages/index.aspx)

I agree that's suboptimal.

I am much less worried about letting GCHQ trawl my traffic data than I am letting my local council noodle around in it. Mostly because GCHQ probably already do it - they certainly have the capability, but also because local councils have shown themselves to be corrupt and "data-leaky".

I'm not bothered about my traffic data being trawled. I oppose this bill because it's stupid - the people who have to keep data are not clearly defined; hiding some of that data is trivial for criminals; keeping that data is an unreasonable burden on some (but not all?) ISPs; etc etc.

It's frustrating that there are some really clueful politicians and advisors, yet governments keep pumping out really stupid laws about computers and networking.

Paul_S• 14 years ago

For all you people who are not phased by it and think it's OK and harmless: you do realise it's your own tax money they are senselessly wasting here right? A lot of money. For nothing.

mibbitier• 14 years ago

There's a lot of bigger wastes of public money TBH. Like the Leveson enquiry.

ukgent2• 14 years ago

Lets add my 2 centz

I dont consider myself any form of hacker, I dont think i do anything illegal on the interweb. However i am very for privacy on the internet and against goverment monitoring.

When SOPA and CISPA etc all came about my first port of call was to get off gmail and on to my own webserver on a VPS. 2 weeks ago i deicded it was time to create my own elite anon proxy using squid. Took a few days of tinkering (sidenote did you know that google can get your IP via user_agent header? took me ages to work out why all the sites but google were getting my VPS IP and yet google could see right passed it and get my orignal IP)

now I am posting to this topic using said proxy. I can bet that once all these systems go live I will be one of the first pulled up as a terroist. I have VPNs to 2 countries, and 2 machines route out over those, i have very little standard traffic going via my ISP, and i use external DNS (currently in the process of setting up my own bind server).

I am even in the process of setting up my own jabber server (what did google rename it to xxmp?) and using that as a replacement for MSN/Skype interaction thing with my friends.

All of the above will classify me as a terroist under the UKs ever watchful eyes, I think now I am going to route my proxy in to tor for extra funz

capnrefsmmat• 14 years ago

User agent headers don't include IP addresses. Are you sure Squid isn't setting the X_FORWARDED_FOR header and revealing your IP to every site you visit which is clever enough to look?

http://www.squid-cache.org/Doc/config/forwarded_for/

Nick_C• 14 years ago

For a lighter weight (and easier to set up) forwarding proxy that can be easily configured as anonymous, try tinyproxy.

b1tr0t• 14 years ago

Anyone else catch the irony that this is the same nation that passed an absurd "cookie law" in the name of protecting people's online privacy?

http://www.theregister.co.uk/2012/05/26/eprivacy_cookie_comp...

As I understand it they backed away from the stronger restrictions at the last minute... but still, the very idea of a surveillance nation like the UK "protecting" people by blocking third party cookies would be hilarious if it wasn't also tragic. Very generously they've said they won't prosecute offenders... probably... unless they don't like you... or have a political axe to grind... or you're the wrong ethnicity...

mike-cardwell2• 14 years ago

There is no irony, because they are completely different things.

You think that if a government decides that its citizens should be granted extra privacy protections from corporations and individuals, then it's only right that they grant the same protections from law enforcement?

I guess it's also ironic that my government prevents McDonalds from locking me up, but will lock me up themselves if I commit a crime?

mayneack• 14 years ago

Anyone here know enough about UK politics to know how likely it is that this will pass?

GoodIntentions• 14 years ago

Brought to you by the same crowd that passed the "cookie law" that requires user opt in for any cookies - even if it is storing something as trivial as a session ID for the duration of one visit.

These legislators seem to be regulating what they do no understand.

voodoochilo• 14 years ago

"...The police and security services are concerned that criminals and terrorists are increasingly evading detection by using social media and online gaming sites to communicate with each other..."

of course they do - because the terrorists and the criminals have the brains and the survival instinct of a peanutbutter sandwich!

jimworm• 14 years ago

My next startup's business plan, using £5000 of seed money to make £1B:

£2500 to bribe a young woman at a high-profile company to accuse their upper management of sexual harassment.

£2500 to bribe the cop for access to all of the company's data.

Sell to interested parties.

Repeat.

Setting out plans to monitor all Internet use in the UK

Related Stories