21 ms·

Britain passed the “most extreme surveillance law ever passed in a democracy”

651 points by eeZah7Ux 10y ago

ajeet_dhaliwal 10y ago
When this was originally proposed I thought it would never get passed because it sounded like something right out of 1984. Amazing. I thought the ridiculous 'Agree to this cookie' nonsense was stupid but this is now just very creepy. National database for keylogging next?
- waqf 10y ago
  Don't worry, the 'Agree to this cookie' thing is an EU directive. So that's what the UK is currently destroying their economy in order to be free from.
  - deleted 10y ago
    [deleted]
- Symbiote 10y ago
  'Agree to the cookie' has the opposite intention: it's warning you that a company (often Google) is tracking your behaviour online.
necessity 10y ago
Brazil has passed that a few years ago as part of Marco Civil - 1 year period too, which can be extended per request from the authorities: >Art. 13. Na provisão de conexão à internet, cabe ao administrador de sistema autônomo respectivo o dever de manter os registros de conexão, sob sigilo, em ambiente controlado e de segurança, pelo prazo de 1 (um) ano, nos termos do regulamento. It demands the storage for 1 year of "connection access registers", defined as: >VIII - registros de acesso a aplicações de internet: o conjunto de informações referentes à data e hora de uso de uma determinada aplicação de internet a partir de um determinado endereço IP. I.e. user IP, access data, and info on the accessed website/application.
- marcosdumay 10y ago
  It's similar, but a little less bad than this UK one. - It requires ISPs to identify their clients, and site administrators to keep log of access. Thus, no party must keep a complete identifiable log. The police must join the pieces every time they use the data. - It has no provision for the government forcing companies into disclosing user's data. Brazilian law has no "decrypt data on demand" requirement. It's only about access logs. - There's no provision for the government hacking into people's computers (although that may exist on some other law I don't know about). Anyway, it's a bad law. If it was evenly enforced, it would forbid a lot of services people use in Brazil.
- oscargrouch 10y ago
  Its not the same thing, as in Brazil the investigation forces will need to get a warrant from a judge to have access to that data. Exactly the same way it happens for phone records or private bank accounts. This data is protected by law, and is considered private.. so only a judge, in a ongoing investigation, when asked by police forces, when investiganting crimes for instance, can grant access to this data. As i understand from what i read in the article, the UK government has direct access to that data, so the privacy of its citizens is not respected or granted by the rule of law.
  - necessity 10y ago
    They do not need a warrant, read Article 11.
    - oscargrouch 10y ago
      It says exactly the opposite of what you are trying to imply. >Article 11. In any operation of collection, storage, custody and treatment of records, personal data or communications by connection providers and internet applications in which at least one of these acts occurs in the national territory, shall be obligatorily respected the legislation and the rights to privacy, the protection of personal data and the confidentiality of private communications and records. http://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm http://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/...
WordyMcWordface 10y ago
I will just leave this here: https://www.privateinternetaccess.com https://www.privateinternetaccess.com
- cjrp 10y ago
  Until VPNs become illegal...
  - noir_lord 10y ago
    That would be a very hard fight for them since enforcing it without fundamentally breaking the way the internet works would be very expensive to a lot of very wealthy companies and sadly in this 'democracy' the people with the money are heard the loudest.
    - eeZah7Ux 10y ago
      > That would be a very hard fight Not at all. It's enough to point the finger at commercial VPN providers and claim the the users are doing suspicious things including filesharing, and encourage ISPs to block VPN providers by address block. Many ISPs would love to do that because they want to inspect cleartext traffic and sell metadata. Of course corporate VPNs would be left untouched. There.
      - noir_lord 10y ago
        > It's enough to point the finger at commercial VPN providers and claim the the users are doing suspicious things. The problem there is we live in a containerised world, how would they stop someone running a 'recipe' that creates a VPN on something like AWS/Digital Ocean and uses that as the VPN exit point. The only way to deal with that is to have a central licensing authority for VPN's where you have to hand over the keys, that's going to be a massive and expensive fight for them.
        eeZah7Ux 10y ago
jfindley 10y ago
Oddly I can't find any other sources reporting this. I'd have expected it to show up in at least one other place else (e.g. BBC news for example). I'm not trying to imply that it's not accurate, I'm just confused by the lack of info. And the article doesn't really reference anything other than other zdnet articles, so it's really hard to tell exactly what form of the act got passed - did all the really controversial stuff actually make it in?
- EvilTerran 10y ago
  Here's the Open Rights Group (a UK group who aspire to emulate the EFF) on the latest development - note in particular the link at the bottom of the article, to their "campaign hub" on the bill: https://www.openrightsgroup.org/press/releases/2016/ipb-will-reach-beyond-the-uk https://www.openrightsgroup.org/press/releases/2016/ipb-will... And, for what it's worth, a brief report from The Register: http://www.theregister.co.uk/2016/11/16/british_pols_sign_off_on_surveillance_law/ http://www.theregister.co.uk/2016/11/16/british_pols_sign_of...
- eth0up 10y ago
  And another from techcrunch: https://techcrunch.com/2016/11/17/uk-parliament-rubberstamps-mass-surveillance-law/ https://techcrunch.com/2016/11/17/uk-parliament-rubberstamps...
- Accacin 10y ago
  Quite old, but there was an article on the BBC: http://www.bbc.co.uk/news/uk-34713435 http://www.bbc.co.uk/news/uk-34713435
- webwanderings 10y ago
  http://www.publications.parliament.uk/pa/bills/lbill/2016-2017/0066/17066.pdf http://www.publications.parliament.uk/pa/bills/lbill/2016-20...
- karmacoda 10y ago
  The BBC is dodgy. That might sound like blasphemy, but year after year I'm increasingly aware of blatant bias, omissions, misrepresentations. The BBC is not to be trusted.
s_kilk 10y ago
> Despite the uproar, the government's opposition failed to scrutinize any significant amendments and abstained from the final vote. Killock said recently that the opposition Labour party spent its time "simply failing to hold the government to account". What the hell is the point of the Labour party these days? They are absolutely not an effective opposition. Worthless bastards, one and all.
- tremon 10y ago
  Yes, that's the correct response, blame Labour for all of this.
  - GordonS 10y ago
    I didn't read it as blaming Labour, but rather stating a fact - they have done nothing to challenge this bill.
- krona 10y ago
  The value of the £ has been the official opposition since Brexit.
  - rsync 10y ago
    "The value of the £ has been the official opposition since Brexit." I wonder if you realize that a declining value of the pound is likely to be positive for the British economy ? It's not certain, but very likely ... In fact, it might even be considered a feature of BREXIT.
    - slgeorge 10y ago
      The reduction of the exchange rate is unlikely to actually help the UK. Have a look at some of the academic research, while business leaders and politicians believe that a reduced exchange rate helps exporters there's not that much evidence for it. Also, even if it does help exporters from the perspective of average voters costs and inflation will go up - which they may not have thought through.
rubberstamp 10y ago
Will the citizens allow it to be passed if they knew about it via some news source? Of course "news" now a days is about kardarshians or justin beiber than about things that requires serious attention. This may have hardly got tiny little square cm area in newspapers or 30 seconds air time. Thus sinks democracy. People who are informed are way less in number than non-informed people, but all get to vote thus diluting the vote of well informed people(whose size smaller and smaller as quality of news sources declines). I think there needs to be a law that punishes false information, but at the same time protects journalism.
- pjc50 10y ago
  Quite a lot of them would be in favour of it as a means of "fighting terrorism". It's not so much what is reported as how it's spun. The really big thing is the "internet connection record": every TCP connection you make is supposed to be logged by the ISP: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/530556/Internet_Connection_Records_factsheet.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... (just look at that list of justifications. Of course! It's about catching paedos! The all purpose justification for everything.) Besides, it's been buried under the bigger politics news of the moment - Trump and the continuing mystery of Brexit.
  - rubberstamp 10y ago
    its all misuse of language. a spade should be called spade. Here is a situation, the people staying in their own country and fighting against outside forces. Who is real terrorist? Those outside forces that have no business being there in the first place are the ones doing real terrorizing. The war on terrorism is just a double speak. Its war for profits for political and monetary gains. If as much as 10% of the energy and money spent for all this nonsense was actually used to fight poverty and improve infrastructure and research, we would've been technologically advanced to year 2100 already!
    - TeMPOraL 10y ago
      I accepted long time ago I will never be let into the US because of those HN comments, so... If you regularly kill civilians at random with high explosives, with no way for them to even know something bad will happen, to the point you instill in them the fear of a clear blue sky, isn't that terrorism? Hello drone strikes in Pakistan...
l3m0ndr0p 10y ago
Not true. The USA, a Republic, has something worse. The surveillance policy is secret & the ISPs in the USA are already providing access to every bit of data that travels through our wires and wireless. Any 3 letter agency has unlimited access to this information & it doesn't require approval, only when they get caught. Plus the companies now have immunity from being prosecuted.
deleted 10y ago
[deleted]
Johnny555 10y ago
I hope the ISP's add a separate line item to internet bills for all of the costs to implement this system so people can see how much this is costing them.
hx87 10y ago
How difficult would it be to swamp the monitoring system with noise?
- pmlnr 10y ago
  That's what I'm thinking as well. I only need to do a crawler, doing HEAD requests only, piping into /dev/null, in theory.
  - vsgxvhdxh 10y ago
    So all your head requests get filtered out when the db gets queried. Leaving all your gets and posts etc. Also better hope your crawler doesn't hit any illegal sites (there are loads according to UK law).
    - DanBC 10y ago
      > (there are loads according to UK law). No, there really aren't.
fierarul 10y ago
How is this any different from the EU Data Retention Directive we've had for a decade already? Somebody should make a "feature matrix" and explain this.
- hoodunit 10y ago
  Are you referring to the Data Retention Directive [1], which was invalidated in 2014? Or are there still other EU-wide laws on data retention? [1]: https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive
  - fierarul 10y ago
    I wasn't aware it was invalidated. Of course, once each member state implemented this directive into national law and I don't believe the national laws immediately became void. For example, a quick google shows that just last month the Constitutional Court in Romania declared the Big Brother law doesn't infringe on the constitutional rights so data retention continues. All data is kept for 3 years.
deleted 10y ago
[deleted]
88e282102ae2e5b 10y ago
It will be interesting to see the response when this data is hacked and the browsing histories of the politicians who passed it are released to the public.
- anigbrowl 10y ago
  Coming into possession of such information will soon be a crime in and of itself.
- coldcode 10y ago
  This will be highly effective, provided release this can still be done in a controlled internet.
- olegkikin 10y ago
  It doesn't even need to be hacked. Sooner or later some politician will get that info on his/her opponent, it's inevitable. And, compared to your average person, a politician has a lot more at stake.
datamoshr 10y ago
As a UK resident, this irks me beyond belief. It's a sickening invasion of human rights[1]. To echo u/rubberstamps sentiments, it's such that there's been little to no coverage of this in the media. But it's the same everywhere, introduce an encroaching bill, have uproar from those with the heads screwed on (the minority). Let it grow a little stale in the publics eye and keep reintroducing with slight alterations it until it passes into law. There's a definite sense of helplessness and hopelessness when approaching the subject with the public. Even within IT there's a sense of 'who cares'. I had a conversation about it just last weekend. I asked for my roommates phone so I could look at all his emails, sms, etc. He gave it to me and said he doesn't care. How do those who want to maintain privacy reach out to people and let them know it's not OK? Because this is not OK. Anyway - off to study journalism. [1] - https://www.liberty-human-rights.org.uk/human-rights/privacy https://www.liberty-human-rights.org.uk/human-rights/privacy
- pmlnr 10y ago
  This summarizes all what I could not forge into words.
  - datamoshr 10y ago
    Glad I could help, more than anything this was me getting the sense of helplessness of my chest!
- JustSomeNobody 10y ago
  > But it's the same everywhere, introduce an encroaching bill, have uproar from those with the heads screwed on (the minority). Let it grow a little stale in the publics eye and keep reintroducing with slight alterations it until it passes into law. So, is this the mere-exposure effect in practice? Or is there another psychological effect at play here?
  - hfsktr 10y ago
    I think it's that the government[0] can repeatedly propose the bill and wear down the public's will to fight it. They[0] don't appear to lose any/much standing from continuous proposals and people become apathetic towards continued fighting. [0]whoever that may mean
DannyB2 10y ago
It sickens me that Britain passed the most extreme surveillance law ever. America is supposed to be number 1 at everything. C'mon congress, get on the ball! Don't let America be out done by Britain.
- derrickdirge 10y ago
  #MAGA
- coldcode 10y ago
  We prefer to do it outside the public eye. Why have laws when you can do it in secret?
- mindcrime 10y ago
  In America,the government doesn't need a law to conduct extreme surveillance. They just do it and don't give a shit what the public think.
JustSomeNobody 10y ago
Soo... What is the UK government so scared of that they need to do this?
- atom_enger 10y ago
  Political opposition and dissent.
- rublev 10y ago
  Assuming these decisions are bred out of any sort of 'necessity' is assuming sincerity from the government.
- anigbrowl 10y ago
  The people. You're now in a political cold war where one half of the population is effectively held hostage by the other. Democracy is already over for all practical purposes.
- bostik 10y ago
  The same thing every government is. A peasant revolt.
- bbcbasic 10y ago
  I'll be generous. Probably to catch more criminals, and to police more cost effectively. Doesn't mean this is right.
- ionised 10y ago
  The British people.
fatdog 10y ago
The new Prime Minister Theresa May does not hold any principles that would place limits on the powers of the government. She was a well known "champion of the snoopers charter," (wiki) when she was home secretary. There is a british tendency to be overbearing authoritarians that provides fuel to their various secession movements. Britain is unlikely to maintain its current borders for many years after Brexit.
- pmlnr 10y ago
  > does not hold any principles that would place limits on the powers of the government This is why opposition exists. If only the were doing their job, instead of fighting amongst themselves.
- pbhjpbhj 10y ago
  >There is a british tendency to be overbearing authoritarians It's not IMO a British tendency but instead a tendency of the British upper classes as they feel they are superior in every way to the lower classes and so deserve superior rights and freedoms .. and once the EU is out of the way they'll be able to get rid of the convention on human rights and return things to their former glory. Next year I hear May is going to bring in a child tax where if you have more than one child and don't sell the extra ones in to serfdom you have to pay an additional 50% income tax on income up to the first £32k. /s
nikon 10y ago
Wow, didn't realise it had made it this far let alone being passed today. Does this law cover non-residential IP traffic? I would like to set up a VPN but would prefer to be recognised as being physically located in the U.K. while browsing Google and Netfix.
anondon 10y ago
What is the easiest way to explain to the average citizen that the "Nothing to hide, nothing to fear" argument is not a good reason to let the Government keep tabs on your online activities? Most people don't give any thought to online privacy that it truly scares me.
- jakobdabo 10y ago
  "Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." - Edward Snowden
  - masmullin 10y ago
    That argument isn't good enough, unfortunately. As many people will respond with "well, yeah, I don't have anything important to say."
    - xorxornop 10y ago
      The fact that they can't even think that they might want to be able to say "I value my human rights" at some point is severely worrying. Bunch of philosophical zombies. If they're anything other than white skinned, blue eyed, blonde haired, heterosexual, male, centrist-politically leaning (or one of the other few extremely simplistic predefined options - analogy: the block-shapes-through-the-board children's game) - history called. It's got some advice to give - but, of course, barely anyone is listening. (except the government. No, they're listening plenty... just not to history - they're too busy listening to the sound of hubris!)
      - wallace_f 10y ago
        But everybody is equal!
- lubesGordi 10y ago
  My counter to this argument is I ask "Who decides what you should hide?" The answer is the government, which is not always on your side or right or ethical. I think (hope) people in the US will get this argument now more that Trump has been elected.
atom_enger 10y ago
If we can't fight them in the courts then we fight them where we are comfortable. Now more than ever we need to start outpacing the law using technology. We've done this before and we can do it again. Bits move faster than bureaucracy :)
deleted 10y ago
[deleted]
erjjones 10y ago
The first thing that comes to mind here is that data is only good if it is quality data... dirty data isn't good or reliable. Coming up with a way to dirty the data from our IPs (i.e. a program that randomly hits domains via multiple browsers that everyone just runs as a background service)
- smellf 10y ago
  Just run a tor exit node. Problem solved, sort of.
  - dx034 10y ago
    Until you're being questioned in connection with child porn. I'm glad that tor exists but the crimes that some people commit with it make it impossible for me to run an exit node. There are things I don't even want to be remotely be associated with.
- bahjoite 10y ago
  I think this too and am considering running a web crawler full time. If enough people were willing to do this we could create a massive distributed index to rival google's.
- TeMPOraL 10y ago
  Not that simple. Unless you get some prodigies involved in this, the government will be able to apply more math at filtering the noise that we'll be able to throw at generating it.
katkattac 10y ago
This is just crazy. It like anyone could be a criminal, so let's treat everyone like one? Feels like a huge invasion of basic human rights. Alas, I feel like the US isn't far behind. It feels like this will be the norm soon enough.
dx034 10y ago
As a UK resident: I know that I can only avoid logging traffic by using a vpn. But the domain logging part bothers me the most. Does anyone here know how they will do it? Could I just use another dns server? Or will they intercept http header? If I'm not mistaken, they could still extract the domain names from https traffic but no exact history? Anyway, a reason more to use https everywhere, reduces sharply what they can see.
- jwtadvice 10y ago
  VPN has been thoroughly defeated. China, UK and US state law enforcement monitor VPN use. (Snowden documents, for example, revealed that VPN traffic can be readily decrypted.) ISPs and police will use every mechanism including DNS, HTTP, IP addresses, CRL behavior, ad tracking markers embedded in pages and more to determine your browsing behavior and history. The best way to defend yourself against this is to lie down and comply.
  - thomasahle 10y ago
    Do you have a link to the "VPN has been defeated" documents? Didn't Snowden say exactly, that the only thing to trust is strong encryption? > ISPs and police will use every mechanism including DNS, HTTP, IP addresses Surely VPN will protect you from all of that? My main concern is police/isp's logging all VPN traffic, and then when they want to use some of it, they subpoena your VPN provider for the keys. Though, maybe forward security fixes this? They could also secretly force every provider to log everything at all time? But surely there are enough providers that some would have leaked it?
    - jwtadvice 10y ago
      I was going to write up a dossier, but found one created by Der Speigel here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Yes, trust strong encryption. VPN isn't strong encryption. Or rather, VPN is not necessarily strong encryption as most of the VPN standards and implementations have either been backdoored or weren't designed for strength against state actors.
_coldfire 10y ago
Who exactly is going to pay for this? The govt or ISP/consumer? And if as another comment suggested, what happens if there's a concerted effort of spamming the system? How much data are they actually willing to hold? People aren't so apathetic on issues when told they have to pay more.
ablation 10y ago
As other people have said, there are a few steps you can take to protect yourself in the near to medium term future: 1) Use Signal 2) Use Tor 3) Use a VPN 4) Reduce your digital footprint - especially if you use social media What was once paranoid fantasy now just seems like prudence. What a time to be alive, eh?
- jwtadvice 10y ago
  1) Signal does not and can not protect information about who you are in contact with, when you contact or are contacted by them, and how long your conversation is. 2) Tor has been both infiltrated organizationally, academically broken, and is occupied by police on most of its exit nodes. This without the operational burden it puts on users. Tor is 'just okay' at protecting users, and should never be used alone. 3) Use a VPN you can trust. Most VPN (especially cheap and free services) are monitored by state police. 4) To add here, try not to have your pictures and locations uploaded online and do not carry a cell phone. I want to add to the list: 5) Do NOT be a target. This is the opposite rule of the usual "if you have nothing to hide": DO NOT have anything to hide. Your opponents in the game of 'hide' are intelligence agencies and state police. It's much better that you comply and focus on narrow interesting technical problems than social or civil rights - as being outspoken and interested about the latter makes you a target.
  - ablation 10y ago
    Good points, and an interesting addition too.
  - bahjoite 10y ago
    5) is probably the most depressing thing I've read for some time. We should all make the effort to do exactly the opposite.
  - bbcbasic 10y ago
    Disagree with 5. You just need to know a target not be one. And by know that means ever have sent an email. The plumber you contacted last year for example. When he gets investigated you are on the list. Avoiding working on social or civil rights? Seriously? So just let things get worse but I'm all right jack? 4 is the best but unfortunately following this makes one marginalized in this society. Being contactable is almost expected. Is the citizens band still a thing?
jwtadvice 10y ago
Outsourcing to companies what its intelligence agencies have been doing for decades. https://en.wikipedia.org/wiki/Karma_Police_(surveillance_program) https://en.wikipedia.org/wiki/Karma_Police_(surveillance_pro...
ohstopitu 10y ago
I know this is not a great solution, but wouldn't a week long ban on UK IP addresses by major websites (Google, Facebook etc.) raise awareness? (or a redirect to a page describing why this law is the issue)
- bbcbasic 10y ago
  Share holders ain't gonna love that
aaroninsf 10y ago
Blofeld is happy, at least.
deleted 10y ago
[deleted]
jv22222 10y ago
Is it possible to confidently bypass this intrusion of privacy using vpn's or some other system?
junto 10y ago
So the British government is just rubber stamping what they had already been doing in secret and technically illegally for the last twenty years. I can't wait till they get hacked and someone dumps every parliamentary minister and lord's dubious Google searches for the public to see.
- nthcolumn 10y ago
  It was illegal until they brought in retroactive legislation in the middle of the night making it legal for them to hack. What's the point in having laws? Most politicians want these intrusive powers in spite of them being against the ECHR Act. Nobody to vote for or dare you vote at all?
- jodrellblank 10y ago
  ISP and mobile phone company 'Three' has 6 million customer database records compromised same day as this story. http://www.bbc.co.uk/news/business-38022309 http://www.bbc.co.uk/news/business-38022309 You probably won't have to wait long. Although it won't actually reveal search content, only that they went to Google.com (and maybe that their browser tried to preload content from the top search result domains?)
- deleted 10y ago
  [deleted]
module0000 10y ago
Protect your privacy with a VPN, either run your own or use one of the available providers. It's a shame you need to do this, but that's just the state of things. Run your own with OpenVPN: https://openvpn.net https://openvpn.net VPN providers(not affiliated, just ones myself or colleagues use): https://www.expressvpn.com https://www.expressvpn.com https://www.goldenfrog.com/vyprvpn https://www.goldenfrog.com/vyprvpn https://nordvpn.com https://nordvpn.com
- JumpCrisscross 10y ago
  What is your view of Private Internet Access [1] in terms of their claims of "zero knowledge" privacy? [1] https://www.privateinternetaccess.com https://www.privateinternetaccess.com
- TomAnthony 10y ago
  If you run your own VPN will they not just log traffic from the endpoint (if in the UK) then tie it to you with billing records?
  - pfista 10y ago
    Depends where you're running your VPN. If you're running it on a server in the US they might not have access to that information.
    - uabstraction 10y ago
      Skip the US. Our surveillance agencies are in bed, and American VPN providers can be strong-armed with an NSL. Use a VPN incorporated and with exit points in a more neutral/second-world country.
- mcorrand 10y ago
  Second that! Vultr offers OpenVPN as a one click app, it's super easy to get it running on a $5 vps.
- jwtadvice 10y ago
shmerl 10y ago
Why are people in UK tolerating this?
- josscrowcroft 10y ago
  https://en.wikipedia.org/wiki/Learned_helplessness https://en.wikipedia.org/wiki/Learned_helplessness
vixen99 10y ago
Let's fervently hope we won't see a demonstration of how to organize a devastating terrorist attack in the UK without using a single telephone or internet connection.
sleavey 10y ago
After I heard this was likely to get passed, I set up a VPN on my server based in France. I now funnel my traffic through this VPN, so now all web connections are end-to-end encrypted and not subject to UK ISP logging. I suggest to everyone who is capable of setting up and running a server to do something like this.
posterboy 10y ago
The "extremest", one could say.
macawfish 10y ago
It's time for user-friendly p2p, local internets.
- setq 10y ago
  packet amateur radio
bootload 10y ago
This is bad news for Brits. One problem I see is the storage. If the ISP stores this information it makes their users open to hacking of personal data. A bigger problem than the phone hacking scandal. [0] The title is inaccurate. Australia introduced storage of Internet usage logs (metadata) at ISP providers for two years in 2015. [1],[2] [0] http://www.telegraph.co.uk/news/2016/11/17/three-mobile-cyber-hack--six-million-customers-private-data-at-r/ http://www.telegraph.co.uk/news/2016/11/17/three-mobile-cybe... [1] https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia#Mandatory_data_retention https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia... [2] https://en.wikipedia.org/wiki/Telecommunications_(Interception_and_Access)_Amendment_(Data_Retention)_Act_2015 https://en.wikipedia.org/wiki/Telecommunications_(Intercepti...
StillBored 10y ago
So, they just codified what they have been doing for the past decade. Much like the E911/etc bill here in the US, apparently ones use of technology removes _ALL_ pretenses of privacy.
daveheq 10y ago
What do you do when your leaders go against the will of the people? You get new leaders. When they do t again? Try again? When they just keep doing it? Then what?
- jodrellblank 10y ago
  What do you do if this is the will of the people?
coo1k 10y ago
Since people are mentioning VPN, be aware which server you use. You might want to stay away from servers in 14 eyes countries. https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes.2C_14_Eyes.2C_and_other_.22third_parties.22 https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes.2C_14_E... Few useful resources when deciding between VPNs 1. That one privacy guy - https://thatoneprivacysite.net/vpn-comparison-chart/ https://thatoneprivacysite.net/vpn-comparison-chart/ 2. https://www.privacytools.io/ https://www.privacytools.io/
RRRA 10y ago
The whole planet is descending into fascism, put in place by the old generation who doesn't understand technology while the new one is too busy inventing the next toilet sharing app. I guess everyone will enjoy this last century...
koga-ninja 10y ago
The way I read the story, this law which was passed is Modifying surveillance laws, rather than completely Oppressing people with something new. What can the average British subject do? I know they Do not have the funds nor the legal and political Acumen to do anything about it.
joggery 10y ago
Isn't this sort of thing inevitable? I mean, the more technology advances the easier and cheaper it becomes to build terrorist devices or WMDs. Therefore society, in order to protect itself, has to be vigilant about how the relevant knowledge disseminates. An analogy might be an individual guarding against suicidal thoughts. More interesting to me is how to create mechanisms to control who gets access to the data and under what circumstances. I think in the UK we have a pretty bad record of local councils and other busybodies using snooping powers not intended for them.
MrBra 10y ago
What are the most effective measures a British citizen could take right now to escape this surveillance?
jasonszhao 10y ago
This leads me to consider that although ISPs previously weren't forced to collect users' browsing history, they had the legal right to. The only difference the bill does is to share the power corporations had with the government.
joantune 10y ago
BTW, these would totally be incompatible with EU privacy shield laws. Enjoy your 'deregulated' post Brexit state
bigbugbag 10y ago
What a sensationalist title, I was expecting a comparison with other surveillance law in others countries and the result to be something outrageous. Turns out it's just sensationalism and it ends up being the kind of surveillance that has been enacted around the world in the last few years, mandatory ISP data retention has been active for 10 years in France[1]. It was even a European directive, directive 2006/24/EC or data retention directive[2], for all members of the European Union from 2006 to 2014 when it was invalidated through the Court of Justice of European Union. Interestingly this directive came into existence while the Uk had the presidency of EU in 2005. >According to the directive, member states will have to store citizens' telecommunications data for a minimum of 6 months and at most 24 months. Why is zdnet trying to put this UK law as if it was something out of the ordinary ? Switzerland[3], Canada's bill C-51[4], Germany[5], Australia[6], Italy[7], and more [8] (Estonia, Greece, Spain, Hungary, Latvia, Lithuania, Luxembourg, Malta, Portugal, Ireland) all have mandatory data retention law. Then again none of those are actual democracies (the closest being switzerland) and that's pretty much the reason these laws made to spy on citizens are possible. [1]:https://en.wikipedia.org/wiki/Law_on_the_fight_against_terrorism https://en.wikipedia.org/wiki/Law_on_the_fight_against_terro... [2]: https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive [3]: http://www.bbc.com/news/world-europe-37465853 http://www.bbc.com/news/world-europe-37465853 [4]: https://en.wikipedia.org/wiki/Anti-terrorism_Act,_2015 https://en.wikipedia.org/wiki/Anti-terrorism_Act,_2015 [5]: https://www.huntonprivacyblog.com/2015/10/16/german-parliament-adopts-data-retention-law-with-localization-requirement/ https://www.huntonprivacyblog.com/2015/10/16/german-parliame... [6]: https://en.wikipedia.org/wiki/Telecommunications_(Interception_and_Access)_Amendment_(Data_Retention)_Act_2015 https://en.wikipedia.org/wiki/Telecommunications_(Intercepti... [7]: https://edri.org/edrigramnumber3-16italy/ https://edri.org/edrigramnumber3-16italy/ [8]: https://www.purevpn.com/blog/data-retention-laws-by-countries/ https://www.purevpn.com/blog/data-retention-laws-by-countrie...
- fdkz 10y ago
  > Why is zdnet trying to put this UK law as if it was something out of the ordinary ? Because the 2006/24/EC data retention directive [1] didn't say anything about browsing history and even then was invalidated by the Court of Justice of European Union. The new UK law however: "The law will force internet providers to record every internet customer's top-level web history in real-time for up to a year, which can be accessed by numerous government departments; force companies to decrypt data on demand -- though the government has never been that clear on exactly how it forces foreign firms to do that; and even disclose any new security features in products before they launch." [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:105:0054:0063:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2... (read "Article 5" "Categories of data to be retained")
Fifer82 10y ago
Is there a way that I can browse privately or just not at all any more?

651 points by eeZah7Ux 10y ago

When this was originally proposed I thought it would never get passed because it sounded like something right out of 1984. Amazing. I thought the ridiculous 'Agree to this cookie' nonsense was stupid but this is now just very creepy. National database for keylogging next?

waqf 10y ago
Don't worry, the 'Agree to this cookie' thing is an EU directive. So that's what the UK is currently destroying their economy in order to be free from.
- deleted 10y ago
  [deleted]
Symbiote 10y ago
'Agree to the cookie' has the opposite intention: it's warning you that a company (often Google) is tracking your behaviour online.

necessity 10y ago

Brazil has passed that a few years ago as part of Marco Civil - 1 year period too, which can be extended per request from the authorities: >Art. 13. Na provisão de conexão à internet, cabe ao administrador de sistema autônomo respectivo o dever de manter os registros de conexão, sob sigilo, em ambiente controlado e de segurança, pelo prazo de 1 (um) ano, nos termos do regulamento. It demands the storage for 1 year of "connection access registers", defined as: >VIII - registros de acesso a aplicações de internet: o conjunto de informações referentes à data e hora de uso de uma determinada aplicação de internet a partir de um determinado endereço IP. I.e. user IP, access data, and info on the accessed website/application.

marcosdumay 10y ago
It's similar, but a little less bad than this UK one. - It requires ISPs to identify their clients, and site administrators to keep log of access. Thus, no party must keep a complete identifiable log. The police must join the pieces every time they use the data. - It has no provision for the government forcing companies into disclosing user's data. Brazilian law has no "decrypt data on demand" requirement. It's only about access logs. - There's no provision for the government hacking into people's computers (although that may exist on some other law I don't know about). Anyway, it's a bad law. If it was evenly enforced, it would forbid a lot of services people use in Brazil.
oscargrouch 10y ago
Its not the same thing, as in Brazil the investigation forces will need to get a warrant from a judge to have access to that data. Exactly the same way it happens for phone records or private bank accounts. This data is protected by law, and is considered private.. so only a judge, in a ongoing investigation, when asked by police forces, when investiganting crimes for instance, can grant access to this data. As i understand from what i read in the article, the UK government has direct access to that data, so the privacy of its citizens is not respected or granted by the rule of law.
- necessity 10y ago
  They do not need a warrant, read Article 11.
  - oscargrouch 10y ago
    It says exactly the opposite of what you are trying to imply. >Article 11. In any operation of collection, storage, custody and treatment of records, personal data or communications by connection providers and internet applications in which at least one of these acts occurs in the national territory, shall be obligatorily respected the legislation and the rights to privacy, the protection of personal data and the confidentiality of private communications and records. http://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/l12965.htm http://www.planalto.gov.br/ccivil_03/_ato2011-2014/2014/lei/...

WordyMcWordface 10y ago

I will just leave this here: https://www.privateinternetaccess.com https://www.privateinternetaccess.com

cjrp 10y ago
Until VPNs become illegal...
- noir_lord 10y ago
  That would be a very hard fight for them since enforcing it without fundamentally breaking the way the internet works would be very expensive to a lot of very wealthy companies and sadly in this 'democracy' the people with the money are heard the loudest.
  - eeZah7Ux 10y ago
    > That would be a very hard fight Not at all. It's enough to point the finger at commercial VPN providers and claim the the users are doing suspicious things including filesharing, and encourage ISPs to block VPN providers by address block. Many ISPs would love to do that because they want to inspect cleartext traffic and sell metadata. Of course corporate VPNs would be left untouched. There.
    - noir_lord 10y ago
      > It's enough to point the finger at commercial VPN providers and claim the the users are doing suspicious things. The problem there is we live in a containerised world, how would they stop someone running a 'recipe' that creates a VPN on something like AWS/Digital Ocean and uses that as the VPN exit point. The only way to deal with that is to have a central licensing authority for VPN's where you have to hand over the keys, that's going to be a massive and expensive fight for them.
      - eeZah7Ux 10y ago

jfindley 10y ago

Oddly I can't find any other sources reporting this. I'd have expected it to show up in at least one other place else (e.g. BBC news for example). I'm not trying to imply that it's not accurate, I'm just confused by the lack of info. And the article doesn't really reference anything other than other zdnet articles, so it's really hard to tell exactly what form of the act got passed - did all the really controversial stuff actually make it in?

EvilTerran 10y ago
Here's the Open Rights Group (a UK group who aspire to emulate the EFF) on the latest development - note in particular the link at the bottom of the article, to their "campaign hub" on the bill: https://www.openrightsgroup.org/press/releases/2016/ipb-will-reach-beyond-the-uk https://www.openrightsgroup.org/press/releases/2016/ipb-will... And, for what it's worth, a brief report from The Register: http://www.theregister.co.uk/2016/11/16/british_pols_sign_off_on_surveillance_law/ http://www.theregister.co.uk/2016/11/16/british_pols_sign_of...
eth0up 10y ago
And another from techcrunch: https://techcrunch.com/2016/11/17/uk-parliament-rubberstamps-mass-surveillance-law/ https://techcrunch.com/2016/11/17/uk-parliament-rubberstamps...
Accacin 10y ago
Quite old, but there was an article on the BBC: http://www.bbc.co.uk/news/uk-34713435 http://www.bbc.co.uk/news/uk-34713435
webwanderings 10y ago
http://www.publications.parliament.uk/pa/bills/lbill/2016-2017/0066/17066.pdf http://www.publications.parliament.uk/pa/bills/lbill/2016-20...
karmacoda 10y ago
The BBC is dodgy. That might sound like blasphemy, but year after year I'm increasingly aware of blatant bias, omissions, misrepresentations. The BBC is not to be trusted.

s_kilk 10y ago

> Despite the uproar, the government's opposition failed to scrutinize any significant amendments and abstained from the final vote. Killock said recently that the opposition Labour party spent its time "simply failing to hold the government to account". What the hell is the point of the Labour party these days? They are absolutely not an effective opposition. Worthless bastards, one and all.

tremon 10y ago
Yes, that's the correct response, blame Labour for all of this.
- GordonS 10y ago
  I didn't read it as blaming Labour, but rather stating a fact - they have done nothing to challenge this bill.
krona 10y ago
The value of the £ has been the official opposition since Brexit.
- rsync 10y ago
  "The value of the £ has been the official opposition since Brexit." I wonder if you realize that a declining value of the pound is likely to be positive for the British economy ? It's not certain, but very likely ... In fact, it might even be considered a feature of BREXIT.
  - slgeorge 10y ago
    The reduction of the exchange rate is unlikely to actually help the UK. Have a look at some of the academic research, while business leaders and politicians believe that a reduced exchange rate helps exporters there's not that much evidence for it. Also, even if it does help exporters from the perspective of average voters costs and inflation will go up - which they may not have thought through.

rubberstamp 10y ago

Will the citizens allow it to be passed if they knew about it via some news source? Of course "news" now a days is about kardarshians or justin beiber than about things that requires serious attention. This may have hardly got tiny little square cm area in newspapers or 30 seconds air time. Thus sinks democracy. People who are informed are way less in number than non-informed people, but all get to vote thus diluting the vote of well informed people(whose size smaller and smaller as quality of news sources declines). I think there needs to be a law that punishes false information, but at the same time protects journalism.

pjc50 10y ago
Quite a lot of them would be in favour of it as a means of "fighting terrorism". It's not so much what is reported as how it's spun. The really big thing is the "internet connection record": every TCP connection you make is supposed to be logged by the ISP: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/530556/Internet_Connection_Records_factsheet.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... (just look at that list of justifications. Of course! It's about catching paedos! The all purpose justification for everything.) Besides, it's been buried under the bigger politics news of the moment - Trump and the continuing mystery of Brexit.
- rubberstamp 10y ago
  its all misuse of language. a spade should be called spade. Here is a situation, the people staying in their own country and fighting against outside forces. Who is real terrorist? Those outside forces that have no business being there in the first place are the ones doing real terrorizing. The war on terrorism is just a double speak. Its war for profits for political and monetary gains. If as much as 10% of the energy and money spent for all this nonsense was actually used to fight poverty and improve infrastructure and research, we would've been technologically advanced to year 2100 already!
  - TeMPOraL 10y ago
    I accepted long time ago I will never be let into the US because of those HN comments, so... If you regularly kill civilians at random with high explosives, with no way for them to even know something bad will happen, to the point you instill in them the fear of a clear blue sky, isn't that terrorism? Hello drone strikes in Pakistan...

l3m0ndr0p 10y ago

Not true. The USA, a Republic, has something worse. The surveillance policy is secret & the ISPs in the USA are already providing access to every bit of data that travels through our wires and wireless. Any 3 letter agency has unlimited access to this information & it doesn't require approval, only when they get caught. Plus the companies now have immunity from being prosecuted.

deleted 10y ago

[deleted]

Johnny555 10y ago

I hope the ISP's add a separate line item to internet bills for all of the costs to implement this system so people can see how much this is costing them.

hx87 10y ago

How difficult would it be to swamp the monitoring system with noise?

pmlnr 10y ago
That's what I'm thinking as well. I only need to do a crawler, doing HEAD requests only, piping into /dev/null, in theory.
- vsgxvhdxh 10y ago
  So all your head requests get filtered out when the db gets queried. Leaving all your gets and posts etc. Also better hope your crawler doesn't hit any illegal sites (there are loads according to UK law).
  - DanBC 10y ago
    > (there are loads according to UK law). No, there really aren't.

fierarul 10y ago

How is this any different from the EU Data Retention Directive we've had for a decade already? Somebody should make a "feature matrix" and explain this.

hoodunit 10y ago
Are you referring to the Data Retention Directive [1], which was invalidated in 2014? Or are there still other EU-wide laws on data retention? [1]: https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive
- fierarul 10y ago
  I wasn't aware it was invalidated. Of course, once each member state implemented this directive into national law and I don't believe the national laws immediately became void. For example, a quick google shows that just last month the Constitutional Court in Romania declared the Big Brother law doesn't infringe on the constitutional rights so data retention continues. All data is kept for 3 years.

deleted 10y ago

[deleted]

88e282102ae2e5b 10y ago

It will be interesting to see the response when this data is hacked and the browsing histories of the politicians who passed it are released to the public.

anigbrowl 10y ago
Coming into possession of such information will soon be a crime in and of itself.
coldcode 10y ago
This will be highly effective, provided release this can still be done in a controlled internet.
olegkikin 10y ago
It doesn't even need to be hacked. Sooner or later some politician will get that info on his/her opponent, it's inevitable. And, compared to your average person, a politician has a lot more at stake.

datamoshr 10y ago

As a UK resident, this irks me beyond belief. It's a sickening invasion of human rights[1]. To echo u/rubberstamps sentiments, it's such that there's been little to no coverage of this in the media. But it's the same everywhere, introduce an encroaching bill, have uproar from those with the heads screwed on (the minority). Let it grow a little stale in the publics eye and keep reintroducing with slight alterations it until it passes into law. There's a definite sense of helplessness and hopelessness when approaching the subject with the public. Even within IT there's a sense of 'who cares'. I had a conversation about it just last weekend. I asked for my roommates phone so I could look at all his emails, sms, etc. He gave it to me and said he doesn't care. How do those who want to maintain privacy reach out to people and let them know it's not OK? Because this is not OK. Anyway - off to study journalism. [1] - https://www.liberty-human-rights.org.uk/human-rights/privacy https://www.liberty-human-rights.org.uk/human-rights/privacy

pmlnr 10y ago
This summarizes all what I could not forge into words.
- datamoshr 10y ago
  Glad I could help, more than anything this was me getting the sense of helplessness of my chest!
JustSomeNobody 10y ago
> But it's the same everywhere, introduce an encroaching bill, have uproar from those with the heads screwed on (the minority). Let it grow a little stale in the publics eye and keep reintroducing with slight alterations it until it passes into law. So, is this the mere-exposure effect in practice? Or is there another psychological effect at play here?
- hfsktr 10y ago
  I think it's that the government[0] can repeatedly propose the bill and wear down the public's will to fight it. They[0] don't appear to lose any/much standing from continuous proposals and people become apathetic towards continued fighting. [0]whoever that may mean

DannyB2 10y ago

It sickens me that Britain passed the most extreme surveillance law ever. America is supposed to be number 1 at everything. C'mon congress, get on the ball! Don't let America be out done by Britain.

derrickdirge 10y ago
#MAGA
coldcode 10y ago
We prefer to do it outside the public eye. Why have laws when you can do it in secret?
mindcrime 10y ago
In America,the government doesn't need a law to conduct extreme surveillance. They just do it and don't give a shit what the public think.

JustSomeNobody 10y ago

Soo... What is the UK government so scared of that they need to do this?

atom_enger 10y ago
Political opposition and dissent.
rublev 10y ago
Assuming these decisions are bred out of any sort of 'necessity' is assuming sincerity from the government.
anigbrowl 10y ago
The people. You're now in a political cold war where one half of the population is effectively held hostage by the other. Democracy is already over for all practical purposes.
bostik 10y ago
The same thing every government is. A peasant revolt.
bbcbasic 10y ago
I'll be generous. Probably to catch more criminals, and to police more cost effectively. Doesn't mean this is right.
ionised 10y ago
The British people.

fatdog 10y ago

The new Prime Minister Theresa May does not hold any principles that would place limits on the powers of the government. She was a well known "champion of the snoopers charter," (wiki) when she was home secretary. There is a british tendency to be overbearing authoritarians that provides fuel to their various secession movements. Britain is unlikely to maintain its current borders for many years after Brexit.

pmlnr 10y ago
> does not hold any principles that would place limits on the powers of the government This is why opposition exists. If only the were doing their job, instead of fighting amongst themselves.
pbhjpbhj 10y ago
>There is a british tendency to be overbearing authoritarians It's not IMO a British tendency but instead a tendency of the British upper classes as they feel they are superior in every way to the lower classes and so deserve superior rights and freedoms .. and once the EU is out of the way they'll be able to get rid of the convention on human rights and return things to their former glory. Next year I hear May is going to bring in a child tax where if you have more than one child and don't sell the extra ones in to serfdom you have to pay an additional 50% income tax on income up to the first £32k. /s

nikon 10y ago

Wow, didn't realise it had made it this far let alone being passed today. Does this law cover non-residential IP traffic? I would like to set up a VPN but would prefer to be recognised as being physically located in the U.K. while browsing Google and Netfix.

anondon 10y ago

What is the easiest way to explain to the average citizen that the "Nothing to hide, nothing to fear" argument is not a good reason to let the Government keep tabs on your online activities? Most people don't give any thought to online privacy that it truly scares me.

jakobdabo 10y ago
"Arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say." - Edward Snowden
- masmullin 10y ago
  That argument isn't good enough, unfortunately. As many people will respond with "well, yeah, I don't have anything important to say."
  - xorxornop 10y ago
    The fact that they can't even think that they might want to be able to say "I value my human rights" at some point is severely worrying. Bunch of philosophical zombies. If they're anything other than white skinned, blue eyed, blonde haired, heterosexual, male, centrist-politically leaning (or one of the other few extremely simplistic predefined options - analogy: the block-shapes-through-the-board children's game) - history called. It's got some advice to give - but, of course, barely anyone is listening. (except the government. No, they're listening plenty... just not to history - they're too busy listening to the sound of hubris!)
    - wallace_f 10y ago
      But everybody is equal!
lubesGordi 10y ago
My counter to this argument is I ask "Who decides what you should hide?" The answer is the government, which is not always on your side or right or ethical. I think (hope) people in the US will get this argument now more that Trump has been elected.

atom_enger 10y ago

If we can't fight them in the courts then we fight them where we are comfortable. Now more than ever we need to start outpacing the law using technology. We've done this before and we can do it again. Bits move faster than bureaucracy :)

deleted 10y ago

[deleted]

erjjones 10y ago

The first thing that comes to mind here is that data is only good if it is quality data... dirty data isn't good or reliable. Coming up with a way to dirty the data from our IPs (i.e. a program that randomly hits domains via multiple browsers that everyone just runs as a background service)

smellf 10y ago
Just run a tor exit node. Problem solved, sort of.
- dx034 10y ago
  Until you're being questioned in connection with child porn. I'm glad that tor exists but the crimes that some people commit with it make it impossible for me to run an exit node. There are things I don't even want to be remotely be associated with.
bahjoite 10y ago
I think this too and am considering running a web crawler full time. If enough people were willing to do this we could create a massive distributed index to rival google's.
TeMPOraL 10y ago
Not that simple. Unless you get some prodigies involved in this, the government will be able to apply more math at filtering the noise that we'll be able to throw at generating it.

katkattac 10y ago

This is just crazy. It like anyone could be a criminal, so let's treat everyone like one? Feels like a huge invasion of basic human rights. Alas, I feel like the US isn't far behind. It feels like this will be the norm soon enough.

dx034 10y ago

As a UK resident: I know that I can only avoid logging traffic by using a vpn. But the domain logging part bothers me the most. Does anyone here know how they will do it? Could I just use another dns server? Or will they intercept http header? If I'm not mistaken, they could still extract the domain names from https traffic but no exact history? Anyway, a reason more to use https everywhere, reduces sharply what they can see.

jwtadvice 10y ago
VPN has been thoroughly defeated. China, UK and US state law enforcement monitor VPN use. (Snowden documents, for example, revealed that VPN traffic can be readily decrypted.) ISPs and police will use every mechanism including DNS, HTTP, IP addresses, CRL behavior, ad tracking markers embedded in pages and more to determine your browsing behavior and history. The best way to defend yourself against this is to lie down and comply.
- thomasahle 10y ago
  Do you have a link to the "VPN has been defeated" documents? Didn't Snowden say exactly, that the only thing to trust is strong encryption? > ISPs and police will use every mechanism including DNS, HTTP, IP addresses Surely VPN will protect you from all of that? My main concern is police/isp's logging all VPN traffic, and then when they want to use some of it, they subpoena your VPN provider for the keys. Though, maybe forward security fixes this? They could also secretly force every provider to log everything at all time? But surely there are enough providers that some would have leaked it?
  - jwtadvice 10y ago
    I was going to write up a dossier, but found one created by Der Speigel here: http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html http://www.spiegel.de/international/world/nsa-documents-atta... Yes, trust strong encryption. VPN isn't strong encryption. Or rather, VPN is not necessarily strong encryption as most of the VPN standards and implementations have either been backdoored or weren't designed for strength against state actors.

_coldfire 10y ago

Who exactly is going to pay for this? The govt or ISP/consumer? And if as another comment suggested, what happens if there's a concerted effort of spamming the system? How much data are they actually willing to hold? People aren't so apathetic on issues when told they have to pay more.

ablation 10y ago

As other people have said, there are a few steps you can take to protect yourself in the near to medium term future: 1) Use Signal 2) Use Tor 3) Use a VPN 4) Reduce your digital footprint - especially if you use social media What was once paranoid fantasy now just seems like prudence. What a time to be alive, eh?

jwtadvice 10y ago
1) Signal does not and can not protect information about who you are in contact with, when you contact or are contacted by them, and how long your conversation is. 2) Tor has been both infiltrated organizationally, academically broken, and is occupied by police on most of its exit nodes. This without the operational burden it puts on users. Tor is 'just okay' at protecting users, and should never be used alone. 3) Use a VPN you can trust. Most VPN (especially cheap and free services) are monitored by state police. 4) To add here, try not to have your pictures and locations uploaded online and do not carry a cell phone. I want to add to the list: 5) Do NOT be a target. This is the opposite rule of the usual "if you have nothing to hide": DO NOT have anything to hide. Your opponents in the game of 'hide' are intelligence agencies and state police. It's much better that you comply and focus on narrow interesting technical problems than social or civil rights - as being outspoken and interested about the latter makes you a target.
- ablation 10y ago
  Good points, and an interesting addition too.
- bahjoite 10y ago
  5) is probably the most depressing thing I've read for some time. We should all make the effort to do exactly the opposite.
- bbcbasic 10y ago
  Disagree with 5. You just need to know a target not be one. And by know that means ever have sent an email. The plumber you contacted last year for example. When he gets investigated you are on the list. Avoiding working on social or civil rights? Seriously? So just let things get worse but I'm all right jack? 4 is the best but unfortunately following this makes one marginalized in this society. Being contactable is almost expected. Is the citizens band still a thing?

jwtadvice 10y ago

Outsourcing to companies what its intelligence agencies have been doing for decades. https://en.wikipedia.org/wiki/Karma_Police_(surveillance_program) https://en.wikipedia.org/wiki/Karma_Police_(surveillance_pro...

ohstopitu 10y ago

I know this is not a great solution, but wouldn't a week long ban on UK IP addresses by major websites (Google, Facebook etc.) raise awareness? (or a redirect to a page describing why this law is the issue)

bbcbasic 10y ago
Share holders ain't gonna love that

aaroninsf 10y ago

Blofeld is happy, at least.

deleted 10y ago

[deleted]

jv22222 10y ago

Is it possible to confidently bypass this intrusion of privacy using vpn's or some other system?

junto 10y ago

So the British government is just rubber stamping what they had already been doing in secret and technically illegally for the last twenty years. I can't wait till they get hacked and someone dumps every parliamentary minister and lord's dubious Google searches for the public to see.

nthcolumn 10y ago
It was illegal until they brought in retroactive legislation in the middle of the night making it legal for them to hack. What's the point in having laws? Most politicians want these intrusive powers in spite of them being against the ECHR Act. Nobody to vote for or dare you vote at all?
jodrellblank 10y ago
ISP and mobile phone company 'Three' has 6 million customer database records compromised same day as this story. http://www.bbc.co.uk/news/business-38022309 http://www.bbc.co.uk/news/business-38022309 You probably won't have to wait long. Although it won't actually reveal search content, only that they went to Google.com (and maybe that their browser tried to preload content from the top search result domains?)
deleted 10y ago
[deleted]

module0000 10y ago

Protect your privacy with a VPN, either run your own or use one of the available providers. It's a shame you need to do this, but that's just the state of things. Run your own with OpenVPN: https://openvpn.net https://openvpn.net VPN providers(not affiliated, just ones myself or colleagues use): https://www.expressvpn.com https://www.expressvpn.com https://www.goldenfrog.com/vyprvpn https://www.goldenfrog.com/vyprvpn https://nordvpn.com https://nordvpn.com

JumpCrisscross 10y ago
What is your view of Private Internet Access [1] in terms of their claims of "zero knowledge" privacy? [1] https://www.privateinternetaccess.com https://www.privateinternetaccess.com
TomAnthony 10y ago
If you run your own VPN will they not just log traffic from the endpoint (if in the UK) then tie it to you with billing records?
- pfista 10y ago
  Depends where you're running your VPN. If you're running it on a server in the US they might not have access to that information.
  - uabstraction 10y ago
    Skip the US. Our surveillance agencies are in bed, and American VPN providers can be strong-armed with an NSL. Use a VPN incorporated and with exit points in a more neutral/second-world country.
mcorrand 10y ago
Second that! Vultr offers OpenVPN as a one click app, it's super easy to get it running on a $5 vps.
jwtadvice 10y ago

shmerl 10y ago

Why are people in UK tolerating this?

josscrowcroft 10y ago
https://en.wikipedia.org/wiki/Learned_helplessness https://en.wikipedia.org/wiki/Learned_helplessness

vixen99 10y ago

Let's fervently hope we won't see a demonstration of how to organize a devastating terrorist attack in the UK without using a single telephone or internet connection.

sleavey 10y ago

After I heard this was likely to get passed, I set up a VPN on my server based in France. I now funnel my traffic through this VPN, so now all web connections are end-to-end encrypted and not subject to UK ISP logging. I suggest to everyone who is capable of setting up and running a server to do something like this.

posterboy 10y ago

The "extremest", one could say.

macawfish 10y ago

It's time for user-friendly p2p, local internets.

setq 10y ago
packet amateur radio

bootload 10y ago

This is bad news for Brits. One problem I see is the storage. If the ISP stores this information it makes their users open to hacking of personal data. A bigger problem than the phone hacking scandal. [0] The title is inaccurate. Australia introduced storage of Internet usage logs (metadata) at ISP providers for two years in 2015. [1],[2] [0] http://www.telegraph.co.uk/news/2016/11/17/three-mobile-cyber-hack--six-million-customers-private-data-at-r/ http://www.telegraph.co.uk/news/2016/11/17/three-mobile-cybe... [1] https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia#Mandatory_data_retention https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia... [2] https://en.wikipedia.org/wiki/Telecommunications_(Interception_and_Access)_Amendment_(Data_Retention)_Act_2015 https://en.wikipedia.org/wiki/Telecommunications_(Intercepti...

StillBored 10y ago

So, they just codified what they have been doing for the past decade. Much like the E911/etc bill here in the US, apparently ones use of technology removes _ALL_ pretenses of privacy.

daveheq 10y ago

What do you do when your leaders go against the will of the people? You get new leaders. When they do t again? Try again? When they just keep doing it? Then what?

jodrellblank 10y ago
What do you do if this is the will of the people?

coo1k 10y ago

Since people are mentioning VPN, be aware which server you use. You might want to stay away from servers in 14 eyes countries. https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes.2C_14_Eyes.2C_and_other_.22third_parties.22 https://en.wikipedia.org/wiki/UKUSA_Agreement#9_Eyes.2C_14_E... Few useful resources when deciding between VPNs 1. That one privacy guy - https://thatoneprivacysite.net/vpn-comparison-chart/ https://thatoneprivacysite.net/vpn-comparison-chart/ 2. https://www.privacytools.io/ https://www.privacytools.io/

RRRA 10y ago

The whole planet is descending into fascism, put in place by the old generation who doesn't understand technology while the new one is too busy inventing the next toilet sharing app. I guess everyone will enjoy this last century...

koga-ninja 10y ago

The way I read the story, this law which was passed is Modifying surveillance laws, rather than completely Oppressing people with something new. What can the average British subject do? I know they Do not have the funds nor the legal and political Acumen to do anything about it.

joggery 10y ago

Isn't this sort of thing inevitable? I mean, the more technology advances the easier and cheaper it becomes to build terrorist devices or WMDs. Therefore society, in order to protect itself, has to be vigilant about how the relevant knowledge disseminates. An analogy might be an individual guarding against suicidal thoughts. More interesting to me is how to create mechanisms to control who gets access to the data and under what circumstances. I think in the UK we have a pretty bad record of local councils and other busybodies using snooping powers not intended for them.

MrBra 10y ago

What are the most effective measures a British citizen could take right now to escape this surveillance?

jasonszhao 10y ago

This leads me to consider that although ISPs previously weren't forced to collect users' browsing history, they had the legal right to. The only difference the bill does is to share the power corporations had with the government.

joantune 10y ago

BTW, these would totally be incompatible with EU privacy shield laws. Enjoy your 'deregulated' post Brexit state

bigbugbag 10y ago

What a sensationalist title, I was expecting a comparison with other surveillance law in others countries and the result to be something outrageous. Turns out it's just sensationalism and it ends up being the kind of surveillance that has been enacted around the world in the last few years, mandatory ISP data retention has been active for 10 years in France[1]. It was even a European directive, directive 2006/24/EC or data retention directive[2], for all members of the European Union from 2006 to 2014 when it was invalidated through the Court of Justice of European Union. Interestingly this directive came into existence while the Uk had the presidency of EU in 2005. >According to the directive, member states will have to store citizens' telecommunications data for a minimum of 6 months and at most 24 months. Why is zdnet trying to put this UK law as if it was something out of the ordinary ? Switzerland[3], Canada's bill C-51[4], Germany[5], Australia[6], Italy[7], and more [8] (Estonia, Greece, Spain, Hungary, Latvia, Lithuania, Luxembourg, Malta, Portugal, Ireland) all have mandatory data retention law. Then again none of those are actual democracies (the closest being switzerland) and that's pretty much the reason these laws made to spy on citizens are possible. [1]:https://en.wikipedia.org/wiki/Law_on_the_fight_against_terrorism https://en.wikipedia.org/wiki/Law_on_the_fight_against_terro... [2]: https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive [3]: http://www.bbc.com/news/world-europe-37465853 http://www.bbc.com/news/world-europe-37465853 [4]: https://en.wikipedia.org/wiki/Anti-terrorism_Act,_2015 https://en.wikipedia.org/wiki/Anti-terrorism_Act,_2015 [5]: https://www.huntonprivacyblog.com/2015/10/16/german-parliament-adopts-data-retention-law-with-localization-requirement/ https://www.huntonprivacyblog.com/2015/10/16/german-parliame... [6]: https://en.wikipedia.org/wiki/Telecommunications_(Interception_and_Access)_Amendment_(Data_Retention)_Act_2015 https://en.wikipedia.org/wiki/Telecommunications_(Intercepti... [7]: https://edri.org/edrigramnumber3-16italy/ https://edri.org/edrigramnumber3-16italy/ [8]: https://www.purevpn.com/blog/data-retention-laws-by-countries/ https://www.purevpn.com/blog/data-retention-laws-by-countrie...

fdkz 10y ago
> Why is zdnet trying to put this UK law as if it was something out of the ordinary ? Because the 2006/24/EC data retention directive [1] didn't say anything about browsing history and even then was invalidated by the Court of Justice of European Union. The new UK law however: "The law will force internet providers to record every internet customer's top-level web history in real-time for up to a year, which can be accessed by numerous government departments; force companies to decrypt data on demand -- though the government has never been that clear on exactly how it forces foreign firms to do that; and even disclose any new security features in products before they launch." [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:105:0054:0063:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2... (read "Article 5" "Categories of data to be retained")

Fifer82 10y ago

Is there a way that I can browse privately or just not at all any more?