9 ms·

Tech firms seek to frustrate internet history log law

205 points by jsingleton 10y ago

oliverjudge 10y ago
The scariest line was this: "Terrorists and serious criminals will always seek to avoid detection." The fact that in the public eye they're going to be claiming they are doing this under terrorism, will give a lot of weight with non-technical people.
- iamben 10y ago
  Right. It makes no sense. "Let's bring in a law that logs everyone not seeking to avoid detection." Any serious criminal/terrorist will use a VPN, disposable phones with end to end encrypted messaging, or pen and paper. Any criminal/terrorist that doesn't take these measures shouldn't be a problem to prevent in the firstplace.
  - noja 10y ago
    So where is the conversation about that? If this measure will not catch the very people it is intending to catch, what is its purpose?
    - hashtagMERKY 10y ago
      I can't work out the purpose. It feels scary and Orwellian but I don't know why they want to collect all this data. Who benefits? In a totalitarian regime it makes sense because you can use it to prevent political opposition. But in this case, it's a democratic government that can easily be voted out. It doesn't help anyone cling to power. Maybe I'm over-thinking, but I can't work out the point.
      - wu-ikkyu 10y ago
        >it's a democratic government that can easily be voted out. The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected. >It doesn't help anyone cling to power. On the contrary, it is human nature to do so.
        schlowmo 10y ago
        > The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected. Exactly what I was going to reply. There is no need for any conspiracy theories to acknowledge that in almost any democratic states of these days "states within a state" exist when it comes to surveilance and intelligence services. While political function owners come and go with each election, those organisations seem to be more structural conservative following agendas which reach beyond any legislative period.
      - laumars 10y ago
        The point is the legislations are written by people who are often technologically inept and from a political culture of placing their own opinions above the advice of the experts. You also see the same nonsensical policies on other topics like global warming, gun control (in the US), the war on drugs, and weird alternative treatments available on the NHS.
      - Xophmeister 10y ago
        A publicity stunt so, come the next election, said government can leverage what the masses might see as a good/harmless idea. The minority of people who know better won't be statistically significant when it comes to the polls.
      - Kepler-125c 10y ago
        Democracies can fail, for example the recent rise of Erdogan. Asshats in power want democracy to fail because when it does they will be the ones in power.
    - matt4077 10y ago
      Even if only for tactical reasons, it's better to treat this as a well-intentioned mistake, and not as a vast conspiracy to round up dissenters etc. Taking that point of view, the argument is that there's a subset of criminals that are stupid, or make mistakes. For people who've bought into the "nothing-to-hide" mindset, even a tiny chance to catch a few criminals is enough, because there's precisely zero on the other side. So the task is: a clearly articulated argument for why privacy is important. I'm not saying someone should leak all the porn-URLs visited from Parliament, but it wouldn't hurt. Although some PG13 reasons may be even more helpful with the conservative crowd: "Prime witness in mafia trial killed after location revealed in log leak"... The "rounding up dissenters" argument should still be in there – as "we're creating tools that a less benevolent government could exploit." C.f.: Trump/muslims, the Dutch (Danish?) burning their register of Jews
    - stevetrewick 10y ago
      To make you censor yourself so they don't have to. Same deal with the porn one. There was a piece by Alec Muffet not so long ago discussing the consultation process for age verification. All those involved knew that the headline group (teenagers) the law was supposed to protect were by far the most likely to circumvent the measures, so any such system is essentially not fit for its stated purpose. Even if the intent is to play well with the authoritarian and/or socially conservative portions of the electorate, the effect will still be self censorship. My SO and I both have to undergo enhanced disclosure and barring service checks on a regular basis for our jobs, one of which is in education. The UK Department of Education just effectively prevented Milo from speaking at his old school 'because extremism'. So how should I be feeling right now about following links from Reddit or other forums discussing US electoral politics that might lead to Breitbart? What if there's another situation like Sad Puppies vs the Hugos and I'm trying to get a picture of what's going on and I click on a link to find a Vox Day equivalent? Did I just endanger one of our prospects for future employment? Hard to say. Will using a VPN service get us tagged as 'something to hide' and affect our eligibility to work with children and vulnerable adults? Don't know. Worth betting someone's career on?
    - Kepler-125c 10y ago
      They're not looking for actual terrorists or criminals. They're looking for people like Occupy Wall Street protesters, who actually pose a threat (ie. redistribution of wealth) to those in power. Then as soon as they do something like pirate a movie, they can be thrown in jail (ie politically neutered).
  - cobbzilla 10y ago
    something about this reminds me of "common-sense firearm safety laws"
  - josephg 10y ago
    Yeah the weird thing is, despite being easy to circumvent these sort of measures are often very effective! So long as using a VPN requires any baseline of knowledge, technical skill and effort, I expect 90%+ of criminals won't do it. I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. Think about it - any criminal can learn lockpicking today via the internet, but few do. Why? Because if you're capable of investing time and energy into honing a skill, you may as well do something above board. Don't break and enter - become a locksmith instead. Don't manage a team of criminals - become a manager at a company. It pays better. Its less risky. There's more services and social support available. You won't go to jail. You can have friends who aren't criminals. And because of that the people who are left committing the vast majority of crime do so in part because they're not good at long term planning. Which is something law enforcement takes complete advantage of. So, almost no petty criminals are going to know about VPNs. They aren't going to commit to a monthly subscription to a VPN provider. They won't set up a PP2P tunnel on their phone and laptop. Why? Again because if they knew to do that sort of stuff they could probably hold down a stable job in low level tech support. Obviously there's exceptions to this, but the bread and butter of law enforcement isn't bank heists. Its someone who's drunk. Its someone who smashed a window and stole some money because they want to get high. Or stole a phone out of someone's hand and ran off with it. Or went out with the boys to beat someone up "who had it coming". When the (then) Australian minister for communication introduced record keeping laws for ISPs he told people they can bypass it a number of ways. Lots of people were confused by that - but it makes sense. The aim isn't to record data from us, or from our community. They don't care about taxpayers who are gainfully employed. The point is to make it easier to catch that asshole who beat up his girlfriend then bragged about it to his friends on facebook. And as a result, probably the most annoying thing we can do for law enforcement is introduce apps like Signal and the TOR browser. Stuff that makes it dead simple for anyone to maintain their privacy - you just have to use a different messenger. (Edit: Re-watched the interview where Turnbull described how to bypass the retention bill and he wasn't as enthusiastic as I remember.)
    - CPLX 10y ago
      > I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. This is an odd comment. Clearly the mechanism you describe is correct, but there's literally nothing accidental about it at all. The entire stated purpose of the criminal justice system is to create a set of incentives sufficient to ensure this calculus applies.
  - csydas 10y ago
    Well, if memory serves, for the most part haven't most terrorist attacks been coordinated over either completely open channels or over non-technical channels? If I remember correctly, the Bin Laden operations were orchestrated via sneakernet, the more recent attacks in France were orchestrated with check-out aisle cell phones. The technical difficulties law enforcement faces with terrorism and crime isn't that criminals are upping the ante with complex and difficult to penetrate technology; it's that they're methods are a needle in a haystack, ubiquitous devices and protocols that apparently law enforcement is just having difficulty filtering. Remembering back to a lecture I attended from an officer explaining the technological issues used in modern harassment and abuse cases, often times stalking would be achieved by purchasing a check-out aisle cellphone with a cheap plan, registering it with family tracking from the provider, then putting the phone into Do Not Disturb and hiding it in the victim's car or day bag, using the tracking to get an idea of where the victim went. Sneakernets and system abuses like this are clever enough certainly, but they're not high-tech solutions for criminal activities. Most of the time just looking at a person's facebook account is enough to get the information you need to do something malicious to them or their property, and terrorists seem well aware of the ease by which they can operate in plaintext or on just normal phone calls. I don't recall any stories about terrorists using an IRC channel, for example, they're just using what they'd normally use. Most of the surveillance security actions strike me as purely theatre - there's a difficult problem and a convenient scape goat, so rather than do the hard work, law enforcement and governments rely on a scapegoat. Unscrupulous tech vendors abuse law enforcement/government's lack of knowledge and pressure from the public to sell security snake-oil, promising them the answer to keep the people safe. There probably is a good future where technology does help stop terrorists and criminals, but right now, they're not doing anything special or unique, just different than we're expecting, and apparently that's more than enough.
    - iamatworknow 10y ago
      I remember after the Paris attacks hearing about how messages could be sent via game console networks, or even non-verbally in the online multiplayer games themselves. http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-paris-isis-terrorists-used-ps4-to-plan-attacks/ http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-pa...
  - da1 10y ago
    > Any serious criminal/terrorist will use a VPN Or just plain old stenography in very public forums. Basically impossible to detect.
    - JorgeGT 10y ago
      This is correct. Every serious criminal won't use a VPN or other obvious crypto, because this paints a big target on your back signalling you want to hide something. A serious adversary will, as you say, use a pre-arranged innocent vocabulary that is virtually impossible to detect, or just communicate face-to-face or via written notes delivered by a messenger. Oh and by the way, remember to buy lettuce today ;) ;)
      - da1 10y ago
        > Oh and by the way, remember to buy lettuce today ;) Raymond Shaw is the kindest, bravest, warmest, most wonderful human being I' ve ever known...
  - SixSigma 10y ago
    I guess that is true to a first approximation but exceptions perhaps prove the rule https://magazine.atavist.com/the-mastermind https://magazine.atavist.com/the-mastermind
- userbinator 10y ago
  Drugs, child porn (sometimes even adult porn), and terrorism seem to be the most-used arguments for authoritarianism. Unfortunately they are also quite convincing in the "you have nothing to hide" sense.
  - manarth 10y ago
    "sometimes even adult porn" Which is also currently up for discussion: "UK to censor online videos of 'non-conventional' sex acts" https://www.theguardian.com/technology/2016/nov/23/censor-non-conventional-sex-acts-online-internet-pornography https://www.theguardian.com/technology/2016/nov/23/censor-no...
    - deleted 10y ago
      [deleted]
- ptero 10y ago
  To me, even bigger problem is a general fact that a large majority of people easily agree to restrict liberties (some of them hard won) because "terrorists can also do this". A more defensible argument would be "outlaw X if a fraction of law abiding citizens snagged would be tiny". I would be curious though how big a majority would still support the logic that "we should restrict/track any X if X helps terrorists", if the question were to be posed cleanly (i.e., without scaremongering examples on the same page). If the problem is presentation, not internal beliefs the pendulum may swing back sooner rather than later.
- JoeAltmaier 10y ago
  Terrorists also have mothers, and eat apple pie. This is not about terrorists; this is about frustrated law enforcement who seek to break privacy to facilitate their efforts. When we see it that way, we see the emotional rhetoric for what it is - scaremongering to make enforcement simpler.
- deleted 10y ago
  [deleted]
- anigbrowl 10y ago
  That's true, but on the other hand their assertion is also true - terrorists (both political and paramilitary) do attempt to exploit the infrastructure of an open society, and government (qua public agency) does have a legitimate interest in frustrating some kinds of criminal traffic. You try running a government and explaining to people that the price of liberty is putting up with a certain level of terrorism and child porn every year. You won't stay in power long if you do. (Mind, I'm not endorsing this new law, which I think is awful. I'm just taking issue with your objection to the political reasoning, and saying that it's self-defeating.)
Razengan 10y ago
Won't these attempts to "frustrate" just result in even more draconian laws?
MWil 10y ago
One option is to hide your internet history, the other is to automate it (including signing up for and logging in to sites you don't necessarily visit) so that your machine is logging 24/7 and your small portion gets lost in the haystack
- mike-cardwell 10y ago
  Your "fake" traffic would have to very closely match your non-fake traffic otherwise it could be easily filtered out. And I'm not just talking about User-Agent headers.
- onion2k 10y ago
  Logging discovers who visited a specific "bad website" - the fact there might be 10,000 "good websites" in your history is essentially irrelevant. If you visited the bad one then you'll get flagged as a user of the "bad website".
- buro9 10y ago
  > your small portion gets lost in the haystack This is not a good security method in this day and age. It is cheap to watch and alert on everything.
  - Kepler-125c 10y ago
    This is not true, for instance say you're an oppressive government and have a method to decrypt encryption type X (https, E2E encryption or what-have-you). There's only so many times you can use your decryption alg for evil purposes before someone leaks that you have it. Https is infinitely better than http, E2E encryption is infinitely better than nothing.
Terr_ 10y ago
Can they amend their ToS so that anybody in the legislature or their immediate families has their account activity published publicly? :P
stevetrewick 10y ago
"To ensure they do not succeed, we do not comment publicly on the methods or capabilities available to the security and intelligence agencies." Oh but you don't need to, because it's obvious. All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it. If I don't or can't comply then I will be - by definition - a criminal and potentially a terror suspect. Which is why 'just use a VPN' is not really a satisfactory response to this kind of legislative landscape. Just doing so paints a target on you. Which is not to say I don't appreciate the VPN providers stepping up, the more VPN users there are the more expensive it is to persecute them individually.
- cesarb 10y ago
  > All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it. If the VPN connection uses ephemeral keys (IIRC, at least IPSEC, SSH, and TLS 1.3 always use ephemeral keys, while older TLS uses them when possible), by then it's too late: the keys are gone.
  - CydeWeys 10y ago
    You can imagine someone being locked up for this though. If you are required by law to decrypt your data, and you chose technology that does not allow this, then that's on you. To use an analogy, if you choose to ride a bike that doesn't have lights, and then get pulled over for riding without lights, the lack of lights is not a defense because you were required to have them in order to be on the road at night.
    - JustSomeNobody 10y ago
      I can see one of those situations where you get held indefinitely because they obviously cannot charge you but don't want to let you go to a) prove a point and b) hopefully let the law "catch up" to this situation.
      - pbhjpbhj 10y ago
semi-extrinsic 10y ago
The thing I don't get about the UK is that they have very pervasive surveillance set up both online and in the real world, yet anyone can buy a mobile phone and a prepaid SIM at some random Tesco's and pay with cash without giving their name or ID. Why do they keep allowing this? Other countries have always required presenting ID to buy a SIM. It's a surveillance measure that's presumably quite effective, but also far less invasive than this law and others.
- pjc50 10y ago
  Surveillance isn't particularly rational or consistent, sadly.
- Symbiote 10y ago
  The UK rejected requiring identity to purchase a phone since that just means criminals steal a phone, when they know they'll need good anonymity.
throwaway1974 10y ago
A majority wont care since it has nothing to do with Britain got Talent or Goglebox A minority will be pushed to use proxies and vpn's which will flag them for closer examination Everything is going according to plan so...
- Kepler-125c 10y ago
  Don't give up... the internet will always fight back one way or another. Maybe you can be a part of that.
verytrivial 10y ago
The problem with these systems is regardless of the efficacy, they are incredibly difficult to dismantle and easy to re-purpose with the stroke of a pen. And these "tech-savvy" people are dreaming if they think that access to VPN services from the UK will remain legal in the UK, esp. after a naughty person or two is shown to have used one to commission a crime. It won't happen quickly, but #include frog_boiling.h.
- yAnonymous 10y ago
  VPN isn't even that good of a protection anymore when all countries the traffic goes through log it and cooperate. VPN providers would have to introduce a random delay for their users, otherwise looking at all the exact times along the way gives a pretty good idea who accesses what.
  - Sean1708 10y ago
    Not if your VPN is outside the UK surely?
    - AsyncAwait 10y ago
      If things like the TPP are signed, doesn't really matter if you're in the UK or one of the signature countries, which is almost all of them.
- dmoo 10y ago
  So I guess using opera as your browser with its free vpn will be a problem http://www.opera.com/computer/features/free-vpn http://www.opera.com/computer/features/free-vpn
- SixSigma 10y ago
  Even frogs get out of the water when it starts to get hot.
shp0ngle 10y ago
The most scary thing for me is that both political left and political right is nowadays for increasing surveillance - and there is no one in opposition. Except probably for Pirate parties, which are mostly irrelevant.
- throwaway7767 10y ago
  > The most scary thing for me is that both political left and political right is nowadays for increasing surveillance Right, because like many important but sparsely discussed issues this one doesn't fit into the left-right distinction. Unfortunately there are still many voters who like to compress the issues down to a single scalar value so they can place themselves on some easy-to-understand axis. Break away from it. State involvement in economic policy is only one of many issues to consider when voting for a government.
- Symbiote 10y ago
  The Liberal Democrats are against surveillance, and are the third biggest party in the UK.
  - MarchHare 10y ago
    The SNP are the third biggest UK party.
    - dagw 10y ago
      Or UKIP, if you consider the popular vote (to echo the current US situation) edit: The Lib Dems are probably the 3rd largest party if you include local council seats
      - MarchHare 10y ago
        Yeah, one and two are obviously tory/labour, after that it gets confusing.
  - zigzigzag 10y ago
wotstowaway 10y ago
In fact, it's already possibly (and easy) to obtain the un-anonymized browsing history of millions of people. I was part of a (journalistic) team that got their hands on a free sample from a company that offers "website traffic analytics", and which uses browser extensions as well as mobile apps as their main surveillance tools. The data set contained the complete browsing history of almost 3 million German Internet users, and except for a few popular sites (like Facebook), no URL cleaning/anonymization was performed at all. So here we have a single provider that is able to capture the browser traffic of 5 % of the population already, and is ready to disseminate this data to anyone who can pay the price (even giving out months of data for free). As there are dozens more companies that collect data using a variety of ways, it wouldn't be surprising to me if you could stitch these individual data sets together to get the traffic of > 50 % of all Internet users, without having any central point of data collection. So although the government is a real threat to citizens privacy, unregulated private actors are much more dangerous in my opinion.
- pmlnr 10y ago
  > So although the government is a real threat to citizens privacy That's not privacy which is under threat any more. Say you visit a website of random content in January. Website goes out of business, someone else buys the domain and puts flagged content on it in September. Now... how do you prove you were visiting a different site? Trigger an archive.org call on each and every site I visit? Dig up domain name changes? I've been dealing with DNS for 10+ years and I have no idea how to dig up historical domain owners, especially not with the hide options. This goes way, way beyond privacy issues.
  - wotstowaway 10y ago
    Concerning historical domain data, there are several vendors (e.g. Domaintools) that provide this kind of information, and domain registrar information usually contains the registration date for the domain, so proving it was a different site is possible. You're absolutely right though that it's highly problematic if we use automated tools to analyze this kind of data, as many people can end up in the wrong category due to either flawed analysis methods or faulty data. Again I'd say that currently the greater threat comes from private companies that will use this data to build "shady" rating systems which will affect the daily lives of many people, without giving these people a chance to verify or oppose the data being used against them.
elcct 10y ago
> The Investigatory Powers Bill provides law enforcement and the security and intelligence agencies with the powers they need to protect the UK and its citizens from terrorists and serious criminals. But how it is going to protect the UK from funny criminals?
elcct 10y ago
Apart from VPNs I can see the rise of plugins like this: https://cs.nyu.edu/trackmenot/ https://cs.nyu.edu/trackmenot/ Purpose of such tools is to add noise and obfuscate the traffic.
chinathrow 10y ago
The storage vendors must have a hell of a party these days.
helmi22 10y ago
kami dari http://tokocendolism.com http://tokocendolism.com sebuah tempat jual online ayam petarung dari mual proses peternakan ayam bangkok ayam petarung mulai menetas. kemudian proses perawatan anak ayam petarung yang kami pelihara rawat dan setelah menginjak menjadi ayam petarung remaja.
typeiierror 10y ago
Brian K. Vaughan's comic Private Eye [1] foreshadows what might happen if this dataset is breached. The premise is the digital cloud "bursts" - all private data is suddenly dumped and searchable - forcing people to completely abandon their identities and assume new ones - changing their name, appearance, re-starting their careers, etc. When you consider this in the context of technologies like Voco [2] and Face2Face [3] that can fabricate a speech or make a fake "hot mic" video from a public figure, it makes you wonder if we'll ever be able to prove things are __true__ in the future, and what the value of our identity is if it can be shattered beyond repair due to negligence from a third party. What do we do then? How do you cryptographically sign yourself? [1] http://panelsyndicate.com/comics/tpeye http://panelsyndicate.com/comics/tpeye [2] http://www.bbc.com/news/technology-37899902 http://www.bbc.com/news/technology-37899902 [3] http://www.graphics.stanford.edu/~niessner/thies2016face.html http://www.graphics.stanford.edu/~niessner/thies2016face.htm...
- vslira 10y ago
  > How do you cryptographically sign yourself? Now that's a problem whose solution deserves a unicorn valuation
zmmmmm 10y ago
The logical end point, if you think it through, is scary for technology. There will be a battle for a time where legislators play cat and mouse with technology and privacy companies. But as each new hole appears, they'll invent new laws to close them off. This wouldn't be so bad except for the problem that encryption is math and short of making math illegal there will always be a hole. Factor in steganography and it just gets worse. But this doesn't mean that technology wins. Rather, it makes the loss even worse, because it means the laws will ultimately have to be defined in reverse - rather than outlawing encryption, they will have to outlaw inability to decrypt. That is, it will be the end user's responsibility to ensure that authorities can decode data you transmit. Transmission of undecryptable data will be a crime, in and of itself. Apart from the obvious dystopian consequences, this will impact progress in technology tremendously - suddenly it won't be possible to just invent a new data format or protocol any more. Doing so will put you at extreme risk of being interpreted as sending unauthorised encrypted data. So data formats will have to be registered - to send data in a new format you will first have to register a codec with the government and probably yourself have to be licensed. This will have a severe chilling effect on innovation. Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. It's a depressing picture but given the trends of late I don't really see it going any other way. Only some extreme swing back towards individual rights over rights of the state will change its direction. But terrorism seems to have set in as a permanent tool for governments to grind away at individual rights.
- SomeStupidPoint 10y ago
  The US has at least one mechanism against that: the first amendment. Content and format are both matters of speech, so the choice of format and the decision to broadcast noise as a statement are both protected. I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.
  - jasonkostempski 10y ago
    I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.
anexprogrammer 10y ago
Is it too late to return 2016? It's clearly defective. How long until... "Anexprogrammer was clearly a suspect individual. He used A&A, a UK ISP, widely considered sympathetic to terrorism under the thin guise of blogging about preserving privacy. The ISP has even provided information on how their users may circumvent the law and expressed the opinion it was a bad idea! It gets steadily worse, Anexprogrammer often used a VPN, from an overseas company who made a feature of logging nothing, another technique widely used by terrorists to evade our beloved leader's protections. He even admitted to viewing online pornography, illegal in the UK, where performers appeared to be actually enjoying themselves. He was also suspected of being a believer in climate change and is known to have signed a petition against fracking. The 20 year maximum security sentence for illegal circumvention of logging is considered lenient." May the "one bad actor" that goes in there and gets the entire database please dump the histories of the politicians asap?
- pinum 10y ago
  The MPs themselves are exempted from the IP bill. (Although it's safe to assume GCHQ is still collecting everything on them.)
  - anexprogrammer 10y ago
    I should try and act surprised. Think it's fairly certain plenty of them will end up in Sky's logging anyway. Backbenchers minor enough to be thrown under the bus though. We need a response a bit more substantive than just joining Liberty or OpenRights.
  - Sean1708 10y ago
    Please tell me you're joking?!
- falcolas 10y ago
  You're just missing Tor for the "suspicious character" trifecta.
Sean1708 10y ago
> "Terrorists and serious criminals will always seek to avoid detection. You mean like by using completely unencrypted SMS to plan terror attacks[0]. Also, "world-leading" my arse. [0]: https://www.techdirt.com/articles/20151118/08474732854/after-endless-demonization-encryption-police-find-paris-attackers-coordinated-via-unencrypted-sms.shtml https://www.techdirt.com/articles/20151118/08474732854/after...
- Kepler-125c 10y ago
  They're not looking for actual terrorists, otherwise the SMS's would have triggered a response. They're looking for people like Occupy Wall Street protesters, who actually pose a threat (ie. redistribution of wealth) to those in power.
balabaster 10y ago
Pardon my extreme language but Fuck! How on earth do bills like this come to pass without uproar widespread enough to quash it. Shit like this seriously makes me want to give up on the internet and walk away from it despite it having been my lifeline and the foundation of my income since I was in my teens almost 30 years ago.
- zigzigzag 10y ago
  The reason such bills get proposed and passed is because, broadly speaking, they are popular with the electorate or at least not unpopular. The reason they are not unpopular, the root problem, is because the downsides are perceived as theoretical and in the future whereas the upsides are seen as real and in the present. Put simply the arguments against look like this: Oppose this bill because the government COULD abuse it and PROBABLY will abuse it in future i.e. it's all vague arguments about probabilities, and the arguments for it look like this: Support this bill because it WILL help the fight against terrorists and paedos right now For better or worse the British government has a relatively high level of trust amongst the British people. There is no British constitution and we can now see how a minority of the population is trying to convince Parliament to override the results of an actual referendum on the grounds that people are too stupid to rule themselves, so must be dictated to by small enclaves of their betters. That attitude is widespread, even if it is kind of dumb - MPs are just ordinary people too, after all, it's not like there's any filter on them beyond voting. But given that the governmental "elite" imposing its own morality and wisdom on the majority is practically a sexual turn-on for non-trivial numbers of voters, this kind of thing shouldn't surprise us. We can and probably should argue that this trust is misplaced. There's plenty of evidence of that, along with the fact that surveillance is invariably paired with secrecy so it's hard for people to judge whether the government can be trusted to begin with. But that's why such bills happen. The solution is probably not VPNs. Ultimately in a fight between internet technologists and lawmakers, sufficiently determined lawmakers will always win: China proves this. The UK's lawmakers may not be sufficiently determined but if they are the only solution is to continue making the argument to the electorate that the government cannot be trusted with such powers, and that they won't help fight terrorists and paedos anyway. Pointing out that Trump now controls the NSA might be a good start.
theandrewbailey 10y ago
How is this surveillance system supposed to work? Logging DNS requests? How feasible would it be to get everyone to look up every domain on the Internet and DDOS this surveillance system?
- lucaspiller 10y ago
  The introductory presentation (linked from the article) suggests what should be logged: - customer ID - start and end times of the 'event' - source IP address and port (the port is used to avoid a NAT at the ISP level) - destination IP address and port - volume of data transferred in each direction - name of internet service connected to - the URL https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/504192/Operational_Case_for_the_Retention_of_Internet_Connection_Records_-_IP_Bill_introduction.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... There is a sample provided on the next page, which dumbs it down enough so that it sounds rather compelling.
  - elcct 10y ago
    Looking at the document (ANNEX C for example) one could guess they are going to log entire request body...
- tehmaco 10y ago
  There doesn't seem to be a technical definition of an 'Internet Connection Record', but from the factsheet[1], they: "are records of the internet services that have been accessed by a device. They would include, for example, a record of the fact that a smartphone had accessed a particular social media website at a particular time." and: "ICRs do not provide a full internet browsing history. The ICRs do not reveal every web page that a person visited or any action carried out on that web page." How this will work in practice is anyones guess at the moment - every time I think of something short of logging every packet header sent/received in the UK (which leads to a staggering amount of data needing to be logged), I think of things that would slip though (and therefore wouldn't fulfil the first statement)... [1] https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473745/Factsheet-Internet_Connection_Records.pdf https://www.gov.uk/government/uploads/system/uploads/attachm...
matchagaucho 10y ago
Features like "You are currently logged in from 5 different devices" are event log-driven. Unfortunately, this level of security and consumer protection is only found in top-tier online services. Service providers can spin this "compliance" measure into a "benefit" for their customers/users. The net result, more users will disable or report rogue sessions.
coldcode 10y ago
Assuming you can't block a VPN connection since business use them, how would this work? I assume at some point you simply ban HTTPS or non-public connections, or require government certs to be the only ones used (I think Turkey or some similar country is looking at this) so MITM can be done. Of course once you stick your foot into security, all the bad folks out there will take advantage, and their goes your financial industry and more. It's a stupid idea all around but the dolts in charge seem to either not care or don't understand. Also calling all of your citizens terrorists is a nice touch.
- SixSigma 10y ago
  Ironically I access my VPN to the UK so I can access geo-restriced UK websites while I am out of the country. Blocking it would indeed mandate blocking HTTPS, my OpenVPN piggybacks on port 143 on my UK server (though I guess DPI could spot it too).
a3n 10y ago
> "Terrorists and serious criminals will always seek to avoid detection." So, if you don't want the government to see your thoughts, you're a criminal.
- Qwertious 10y ago
  No, that's confusing A->B with B->A. All dogs are mammals, but not all mammals are dogs.
arca_vorago 10y ago
Having visited England recently, despite the surveillance engine being prepped in the US, the contrast of the extent and the lack of rights and legal means in the UK to protect the people from bad laws like this was palpable. So look at it this way, at least you don't live there. If we keep headed in the same direction though it won't be long before we forget all the reasons for the American Revolution and let the globalists convince us to rejoin the empire cough the commonwealth again. Of course, any American who advocates for such a thing is traitorous, and should have the full weight of the law brought down on them. I don't know, maybe I'm crazy and I'm the only one who thinks oaths mean anything these days. I will say this though, beware the Rhodesians and their round tables.
- CoryG89 10y ago
  Seems doubtful that the founding fathers and revolutionists thought their "oaths" to the crown meant much either. I don't want to join any empire, but I would advocate for globalism, which I don't believe is the same thing as imperialism. I guess I may just be one of those treacherous Americans though.
  - arca_vorago 10y ago
    The monarchy had repeatedly violated the patriots (uncodified) constitutional rights, their common law rights, and their natural rights. The legal debate became the American Revolution, and America won. Furthermore, many of the sons of liberty had never signed or taken oaths of allegiance to the monarchy. Some of them did take oaths of allegiance though, so you actually touch upon a very interesting subject that I think would be worth having a more nuanced conversation about. So thanks for spurring me to think further on the matter. So far, the main thing I can think of is that part of the oaths of allegiance include duty, not just to the monarch but to the laws which create that monarch, therefor I find the view of the The European Court of Human Rights retrospectively insightful in that it ruled that the oath of allegiance to a reigning monarch is "reasonably viewed as an affirmation of loyalty to the constitutional principles which support... the workings of representative democracy in the respondent State." Now, if you want to advocate against the constitution, as long as it is just speech, that is legal (as long as you are simply a citizen and haven't taken an oath), but I would agree it is treacherous, but not traitorous or treasonous. The second speech becomes action, particularly to assist a foreign entity in that venture though, it does become treason. I highly disagree with the sedition laws which violate the first amendment and have been so harshly abused even in the modern era, so I am ignoring those for the sake of conversation. You said you "don't want to join any empire, but I would advocate for globalism, which I don't believe is the same thing as imperialism." I would simply say I think you are wrong and provably so on this point, in that the current trend of globalism is indeed an imperial globalism. That being said, I will admit that I have often had the conversation about the utopic version of globalism, but it is important to differentiate between that imagined ideal which I think you might be referring to, and the reality of the current global geo-political movement of globalism (which is quite different from the economic fact of globalism, which I don't think is up for dispute). If you want, I am willing to expand on the more technical reasons I think that current global is imperial globalism. I wish I could edit my gp comment, because I was obviously wrong to say : "Of course, any American who advocates for such a thing is traitorous, "
tn13 10y ago
Bullies are cowards. That lesson from school is generally true for bullies in real world too. Government is just that coward bully. True that US government's tyranny has been rise year on year under leadership of presidents of all political stripes and yet it has meant zilch for either their political goals states good objectives. All the recent wars by US government have been massive and spectacular failures, fight against terrorism has only created far more threats, people's approval of drug legalization is all time high, gays are safest they have ever been and it is easiest to get almost any kind of gun illegally than in past. Politicians are very eager to control you life but they are so incompetent with that power that eventually it would not matter. The only problem I see that increasing government spending which will slow down US economy.
- dehugger 10y ago
  You know this article is about the UK, not the US, right? By and large I agree with you, but its not the United States that passed this into law.
0xCMP 10y ago
"Terrorists and serious criminals will always seek to avoid detection." And normal people too, assholes.

205 points by jsingleton 10y ago

The scariest line was this: "Terrorists and serious criminals will always seek to avoid detection." The fact that in the public eye they're going to be claiming they are doing this under terrorism, will give a lot of weight with non-technical people.

iamben 10y ago
Right. It makes no sense. "Let's bring in a law that logs everyone not seeking to avoid detection." Any serious criminal/terrorist will use a VPN, disposable phones with end to end encrypted messaging, or pen and paper. Any criminal/terrorist that doesn't take these measures shouldn't be a problem to prevent in the firstplace.
- noja 10y ago
  So where is the conversation about that? If this measure will not catch the very people it is intending to catch, what is its purpose?
  - hashtagMERKY 10y ago
    I can't work out the purpose. It feels scary and Orwellian but I don't know why they want to collect all this data. Who benefits? In a totalitarian regime it makes sense because you can use it to prevent political opposition. But in this case, it's a democratic government that can easily be voted out. It doesn't help anyone cling to power. Maybe I'm over-thinking, but I can't work out the point.
    - wu-ikkyu 10y ago
      >it's a democratic government that can easily be voted out. The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected. >It doesn't help anyone cling to power. On the contrary, it is human nature to do so.
      - schlowmo 10y ago
        > The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected. Exactly what I was going to reply. There is no need for any conspiracy theories to acknowledge that in almost any democratic states of these days "states within a state" exist when it comes to surveilance and intelligence services. While political function owners come and go with each election, those organisations seem to be more structural conservative following agendas which reach beyond any legislative period.
    - laumars 10y ago
      The point is the legislations are written by people who are often technologically inept and from a political culture of placing their own opinions above the advice of the experts. You also see the same nonsensical policies on other topics like global warming, gun control (in the US), the war on drugs, and weird alternative treatments available on the NHS.
    - Xophmeister 10y ago
      A publicity stunt so, come the next election, said government can leverage what the masses might see as a good/harmless idea. The minority of people who know better won't be statistically significant when it comes to the polls.
    - Kepler-125c 10y ago
      Democracies can fail, for example the recent rise of Erdogan. Asshats in power want democracy to fail because when it does they will be the ones in power.
  - matt4077 10y ago
    Even if only for tactical reasons, it's better to treat this as a well-intentioned mistake, and not as a vast conspiracy to round up dissenters etc. Taking that point of view, the argument is that there's a subset of criminals that are stupid, or make mistakes. For people who've bought into the "nothing-to-hide" mindset, even a tiny chance to catch a few criminals is enough, because there's precisely zero on the other side. So the task is: a clearly articulated argument for why privacy is important. I'm not saying someone should leak all the porn-URLs visited from Parliament, but it wouldn't hurt. Although some PG13 reasons may be even more helpful with the conservative crowd: "Prime witness in mafia trial killed after location revealed in log leak"... The "rounding up dissenters" argument should still be in there – as "we're creating tools that a less benevolent government could exploit." C.f.: Trump/muslims, the Dutch (Danish?) burning their register of Jews
  - stevetrewick 10y ago
    To make you censor yourself so they don't have to. Same deal with the porn one. There was a piece by Alec Muffet not so long ago discussing the consultation process for age verification. All those involved knew that the headline group (teenagers) the law was supposed to protect were by far the most likely to circumvent the measures, so any such system is essentially not fit for its stated purpose. Even if the intent is to play well with the authoritarian and/or socially conservative portions of the electorate, the effect will still be self censorship. My SO and I both have to undergo enhanced disclosure and barring service checks on a regular basis for our jobs, one of which is in education. The UK Department of Education just effectively prevented Milo from speaking at his old school 'because extremism'. So how should I be feeling right now about following links from Reddit or other forums discussing US electoral politics that might lead to Breitbart? What if there's another situation like Sad Puppies vs the Hugos and I'm trying to get a picture of what's going on and I click on a link to find a Vox Day equivalent? Did I just endanger one of our prospects for future employment? Hard to say. Will using a VPN service get us tagged as 'something to hide' and affect our eligibility to work with children and vulnerable adults? Don't know. Worth betting someone's career on?
  - Kepler-125c 10y ago
    They're not looking for actual terrorists or criminals. They're looking for people like Occupy Wall Street protesters, who actually pose a threat (ie. redistribution of wealth) to those in power. Then as soon as they do something like pirate a movie, they can be thrown in jail (ie politically neutered).
- cobbzilla 10y ago
  something about this reminds me of "common-sense firearm safety laws"
- josephg 10y ago
  Yeah the weird thing is, despite being easy to circumvent these sort of measures are often very effective! So long as using a VPN requires any baseline of knowledge, technical skill and effort, I expect 90%+ of criminals won't do it. I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. Think about it - any criminal can learn lockpicking today via the internet, but few do. Why? Because if you're capable of investing time and energy into honing a skill, you may as well do something above board. Don't break and enter - become a locksmith instead. Don't manage a team of criminals - become a manager at a company. It pays better. Its less risky. There's more services and social support available. You won't go to jail. You can have friends who aren't criminals. And because of that the people who are left committing the vast majority of crime do so in part because they're not good at long term planning. Which is something law enforcement takes complete advantage of. So, almost no petty criminals are going to know about VPNs. They aren't going to commit to a monthly subscription to a VPN provider. They won't set up a PP2P tunnel on their phone and laptop. Why? Again because if they knew to do that sort of stuff they could probably hold down a stable job in low level tech support. Obviously there's exceptions to this, but the bread and butter of law enforcement isn't bank heists. Its someone who's drunk. Its someone who smashed a window and stole some money because they want to get high. Or stole a phone out of someone's hand and ran off with it. Or went out with the boys to beat someone up "who had it coming". When the (then) Australian minister for communication introduced record keeping laws for ISPs he told people they can bypass it a number of ways. Lots of people were confused by that - but it makes sense. The aim isn't to record data from us, or from our community. They don't care about taxpayers who are gainfully employed. The point is to make it easier to catch that asshole who beat up his girlfriend then bragged about it to his friends on facebook. And as a result, probably the most annoying thing we can do for law enforcement is introduce apps like Signal and the TOR browser. Stuff that makes it dead simple for anyone to maintain their privacy - you just have to use a different messenger. (Edit: Re-watched the interview where Turnbull described how to bypass the retention bill and he wasn't as enthusiastic as I remember.)
  - CPLX 10y ago
    > I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. This is an odd comment. Clearly the mechanism you describe is correct, but there's literally nothing accidental about it at all. The entire stated purpose of the criminal justice system is to create a set of incentives sufficient to ensure this calculus applies.
- csydas 10y ago
  Well, if memory serves, for the most part haven't most terrorist attacks been coordinated over either completely open channels or over non-technical channels? If I remember correctly, the Bin Laden operations were orchestrated via sneakernet, the more recent attacks in France were orchestrated with check-out aisle cell phones. The technical difficulties law enforcement faces with terrorism and crime isn't that criminals are upping the ante with complex and difficult to penetrate technology; it's that they're methods are a needle in a haystack, ubiquitous devices and protocols that apparently law enforcement is just having difficulty filtering. Remembering back to a lecture I attended from an officer explaining the technological issues used in modern harassment and abuse cases, often times stalking would be achieved by purchasing a check-out aisle cellphone with a cheap plan, registering it with family tracking from the provider, then putting the phone into Do Not Disturb and hiding it in the victim's car or day bag, using the tracking to get an idea of where the victim went. Sneakernets and system abuses like this are clever enough certainly, but they're not high-tech solutions for criminal activities. Most of the time just looking at a person's facebook account is enough to get the information you need to do something malicious to them or their property, and terrorists seem well aware of the ease by which they can operate in plaintext or on just normal phone calls. I don't recall any stories about terrorists using an IRC channel, for example, they're just using what they'd normally use. Most of the surveillance security actions strike me as purely theatre - there's a difficult problem and a convenient scape goat, so rather than do the hard work, law enforcement and governments rely on a scapegoat. Unscrupulous tech vendors abuse law enforcement/government's lack of knowledge and pressure from the public to sell security snake-oil, promising them the answer to keep the people safe. There probably is a good future where technology does help stop terrorists and criminals, but right now, they're not doing anything special or unique, just different than we're expecting, and apparently that's more than enough.
  - iamatworknow 10y ago
    I remember after the Paris attacks hearing about how messages could be sent via game console networks, or even non-verbally in the online multiplayer games themselves. http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-paris-isis-terrorists-used-ps4-to-plan-attacks/ http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-pa...
- da1 10y ago
  > Any serious criminal/terrorist will use a VPN Or just plain old stenography in very public forums. Basically impossible to detect.
  - JorgeGT 10y ago
    This is correct. Every serious criminal won't use a VPN or other obvious crypto, because this paints a big target on your back signalling you want to hide something. A serious adversary will, as you say, use a pre-arranged innocent vocabulary that is virtually impossible to detect, or just communicate face-to-face or via written notes delivered by a messenger. Oh and by the way, remember to buy lettuce today ;) ;)
    - da1 10y ago
      > Oh and by the way, remember to buy lettuce today ;) Raymond Shaw is the kindest, bravest, warmest, most wonderful human being I' ve ever known...
- SixSigma 10y ago
  I guess that is true to a first approximation but exceptions perhaps prove the rule https://magazine.atavist.com/the-mastermind https://magazine.atavist.com/the-mastermind
userbinator 10y ago
Drugs, child porn (sometimes even adult porn), and terrorism seem to be the most-used arguments for authoritarianism. Unfortunately they are also quite convincing in the "you have nothing to hide" sense.
- manarth 10y ago
  "sometimes even adult porn" Which is also currently up for discussion: "UK to censor online videos of 'non-conventional' sex acts" https://www.theguardian.com/technology/2016/nov/23/censor-non-conventional-sex-acts-online-internet-pornography https://www.theguardian.com/technology/2016/nov/23/censor-no...
  - deleted 10y ago
    [deleted]
ptero 10y ago
To me, even bigger problem is a general fact that a large majority of people easily agree to restrict liberties (some of them hard won) because "terrorists can also do this". A more defensible argument would be "outlaw X if a fraction of law abiding citizens snagged would be tiny". I would be curious though how big a majority would still support the logic that "we should restrict/track any X if X helps terrorists", if the question were to be posed cleanly (i.e., without scaremongering examples on the same page). If the problem is presentation, not internal beliefs the pendulum may swing back sooner rather than later.
JoeAltmaier 10y ago
Terrorists also have mothers, and eat apple pie. This is not about terrorists; this is about frustrated law enforcement who seek to break privacy to facilitate their efforts. When we see it that way, we see the emotional rhetoric for what it is - scaremongering to make enforcement simpler.
deleted 10y ago
[deleted]
anigbrowl 10y ago
That's true, but on the other hand their assertion is also true - terrorists (both political and paramilitary) do attempt to exploit the infrastructure of an open society, and government (qua public agency) does have a legitimate interest in frustrating some kinds of criminal traffic. You try running a government and explaining to people that the price of liberty is putting up with a certain level of terrorism and child porn every year. You won't stay in power long if you do. (Mind, I'm not endorsing this new law, which I think is awful. I'm just taking issue with your objection to the political reasoning, and saying that it's self-defeating.)

Razengan 10y ago

Won't these attempts to "frustrate" just result in even more draconian laws?

MWil 10y ago

One option is to hide your internet history, the other is to automate it (including signing up for and logging in to sites you don't necessarily visit) so that your machine is logging 24/7 and your small portion gets lost in the haystack

mike-cardwell 10y ago
Your "fake" traffic would have to very closely match your non-fake traffic otherwise it could be easily filtered out. And I'm not just talking about User-Agent headers.
onion2k 10y ago
Logging discovers who visited a specific "bad website" - the fact there might be 10,000 "good websites" in your history is essentially irrelevant. If you visited the bad one then you'll get flagged as a user of the "bad website".
buro9 10y ago
> your small portion gets lost in the haystack This is not a good security method in this day and age. It is cheap to watch and alert on everything.
- Kepler-125c 10y ago
  This is not true, for instance say you're an oppressive government and have a method to decrypt encryption type X (https, E2E encryption or what-have-you). There's only so many times you can use your decryption alg for evil purposes before someone leaks that you have it. Https is infinitely better than http, E2E encryption is infinitely better than nothing.

Terr_ 10y ago

Can they amend their ToS so that anybody in the legislature or their immediate families has their account activity published publicly? :P

stevetrewick 10y ago

"To ensure they do not succeed, we do not comment publicly on the methods or capabilities available to the security and intelligence agencies." Oh but you don't need to, because it's obvious. All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it. If I don't or can't comply then I will be - by definition - a criminal and potentially a terror suspect. Which is why 'just use a VPN' is not really a satisfactory response to this kind of legislative landscape. Just doing so paints a target on you. Which is not to say I don't appreciate the VPN providers stepping up, the more VPN users there are the more expensive it is to persecute them individually.

cesarb 10y ago
> All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it. If the VPN connection uses ephemeral keys (IIRC, at least IPSEC, SSH, and TLS 1.3 always use ephemeral keys, while older TLS uses them when possible), by then it's too late: the keys are gone.
- CydeWeys 10y ago
  You can imagine someone being locked up for this though. If you are required by law to decrypt your data, and you chose technology that does not allow this, then that's on you. To use an analogy, if you choose to ride a bike that doesn't have lights, and then get pulled over for riding without lights, the lack of lights is not a defense because you were required to have them in order to be on the road at night.
  - JustSomeNobody 10y ago
    I can see one of those situations where you get held indefinitely because they obviously cannot charge you but don't want to let you go to a) prove a point and b) hopefully let the law "catch up" to this situation.
    - pbhjpbhj 10y ago

semi-extrinsic 10y ago

The thing I don't get about the UK is that they have very pervasive surveillance set up both online and in the real world, yet anyone can buy a mobile phone and a prepaid SIM at some random Tesco's and pay with cash without giving their name or ID. Why do they keep allowing this? Other countries have always required presenting ID to buy a SIM. It's a surveillance measure that's presumably quite effective, but also far less invasive than this law and others.

pjc50 10y ago
Surveillance isn't particularly rational or consistent, sadly.
Symbiote 10y ago
The UK rejected requiring identity to purchase a phone since that just means criminals steal a phone, when they know they'll need good anonymity.

throwaway1974 10y ago

A majority wont care since it has nothing to do with Britain got Talent or Goglebox A minority will be pushed to use proxies and vpn's which will flag them for closer examination Everything is going according to plan so...

Kepler-125c 10y ago
Don't give up... the internet will always fight back one way or another. Maybe you can be a part of that.

verytrivial 10y ago

The problem with these systems is regardless of the efficacy, they are incredibly difficult to dismantle and easy to re-purpose with the stroke of a pen. And these "tech-savvy" people are dreaming if they think that access to VPN services from the UK will remain legal in the UK, esp. after a naughty person or two is shown to have used one to commission a crime. It won't happen quickly, but #include frog_boiling.h.

yAnonymous 10y ago
VPN isn't even that good of a protection anymore when all countries the traffic goes through log it and cooperate. VPN providers would have to introduce a random delay for their users, otherwise looking at all the exact times along the way gives a pretty good idea who accesses what.
- Sean1708 10y ago
  Not if your VPN is outside the UK surely?
  - AsyncAwait 10y ago
    If things like the TPP are signed, doesn't really matter if you're in the UK or one of the signature countries, which is almost all of them.
dmoo 10y ago
So I guess using opera as your browser with its free vpn will be a problem http://www.opera.com/computer/features/free-vpn http://www.opera.com/computer/features/free-vpn
SixSigma 10y ago
Even frogs get out of the water when it starts to get hot.

shp0ngle 10y ago

The most scary thing for me is that both political left and political right is nowadays for increasing surveillance - and there is no one in opposition. Except probably for Pirate parties, which are mostly irrelevant.

throwaway7767 10y ago
> The most scary thing for me is that both political left and political right is nowadays for increasing surveillance Right, because like many important but sparsely discussed issues this one doesn't fit into the left-right distinction. Unfortunately there are still many voters who like to compress the issues down to a single scalar value so they can place themselves on some easy-to-understand axis. Break away from it. State involvement in economic policy is only one of many issues to consider when voting for a government.
Symbiote 10y ago
The Liberal Democrats are against surveillance, and are the third biggest party in the UK.
- MarchHare 10y ago
  The SNP are the third biggest UK party.
  - dagw 10y ago
    Or UKIP, if you consider the popular vote (to echo the current US situation) edit: The Lib Dems are probably the 3rd largest party if you include local council seats
    - MarchHare 10y ago
      Yeah, one and two are obviously tory/labour, after that it gets confusing.
- zigzigzag 10y ago

wotstowaway 10y ago

In fact, it's already possibly (and easy) to obtain the un-anonymized browsing history of millions of people. I was part of a (journalistic) team that got their hands on a free sample from a company that offers "website traffic analytics", and which uses browser extensions as well as mobile apps as their main surveillance tools. The data set contained the complete browsing history of almost 3 million German Internet users, and except for a few popular sites (like Facebook), no URL cleaning/anonymization was performed at all. So here we have a single provider that is able to capture the browser traffic of 5 % of the population already, and is ready to disseminate this data to anyone who can pay the price (even giving out months of data for free). As there are dozens more companies that collect data using a variety of ways, it wouldn't be surprising to me if you could stitch these individual data sets together to get the traffic of > 50 % of all Internet users, without having any central point of data collection. So although the government is a real threat to citizens privacy, unregulated private actors are much more dangerous in my opinion.

pmlnr 10y ago
> So although the government is a real threat to citizens privacy That's not privacy which is under threat any more. Say you visit a website of random content in January. Website goes out of business, someone else buys the domain and puts flagged content on it in September. Now... how do you prove you were visiting a different site? Trigger an archive.org call on each and every site I visit? Dig up domain name changes? I've been dealing with DNS for 10+ years and I have no idea how to dig up historical domain owners, especially not with the hide options. This goes way, way beyond privacy issues.
- wotstowaway 10y ago
  Concerning historical domain data, there are several vendors (e.g. Domaintools) that provide this kind of information, and domain registrar information usually contains the registration date for the domain, so proving it was a different site is possible. You're absolutely right though that it's highly problematic if we use automated tools to analyze this kind of data, as many people can end up in the wrong category due to either flawed analysis methods or faulty data. Again I'd say that currently the greater threat comes from private companies that will use this data to build "shady" rating systems which will affect the daily lives of many people, without giving these people a chance to verify or oppose the data being used against them.

elcct 10y ago

> The Investigatory Powers Bill provides law enforcement and the security and intelligence agencies with the powers they need to protect the UK and its citizens from terrorists and serious criminals. But how it is going to protect the UK from funny criminals?

elcct 10y ago

Apart from VPNs I can see the rise of plugins like this: https://cs.nyu.edu/trackmenot/ https://cs.nyu.edu/trackmenot/ Purpose of such tools is to add noise and obfuscate the traffic.

chinathrow 10y ago

The storage vendors must have a hell of a party these days.

helmi22 10y ago

kami dari http://tokocendolism.com http://tokocendolism.com sebuah tempat jual online ayam petarung dari mual proses peternakan ayam bangkok ayam petarung mulai menetas. kemudian proses perawatan anak ayam petarung yang kami pelihara rawat dan setelah menginjak menjadi ayam petarung remaja.

typeiierror 10y ago

Brian K. Vaughan's comic Private Eye [1] foreshadows what might happen if this dataset is breached. The premise is the digital cloud "bursts" - all private data is suddenly dumped and searchable - forcing people to completely abandon their identities and assume new ones - changing their name, appearance, re-starting their careers, etc. When you consider this in the context of technologies like Voco [2] and Face2Face [3] that can fabricate a speech or make a fake "hot mic" video from a public figure, it makes you wonder if we'll ever be able to prove things are __true__ in the future, and what the value of our identity is if it can be shattered beyond repair due to negligence from a third party. What do we do then? How do you cryptographically sign yourself? [1] http://panelsyndicate.com/comics/tpeye http://panelsyndicate.com/comics/tpeye [2] http://www.bbc.com/news/technology-37899902 http://www.bbc.com/news/technology-37899902 [3] http://www.graphics.stanford.edu/~niessner/thies2016face.html http://www.graphics.stanford.edu/~niessner/thies2016face.htm...

vslira 10y ago
> How do you cryptographically sign yourself? Now that's a problem whose solution deserves a unicorn valuation

zmmmmm 10y ago

The logical end point, if you think it through, is scary for technology. There will be a battle for a time where legislators play cat and mouse with technology and privacy companies. But as each new hole appears, they'll invent new laws to close them off. This wouldn't be so bad except for the problem that encryption is math and short of making math illegal there will always be a hole. Factor in steganography and it just gets worse. But this doesn't mean that technology wins. Rather, it makes the loss even worse, because it means the laws will ultimately have to be defined in reverse - rather than outlawing encryption, they will have to outlaw inability to decrypt. That is, it will be the end user's responsibility to ensure that authorities can decode data you transmit. Transmission of undecryptable data will be a crime, in and of itself. Apart from the obvious dystopian consequences, this will impact progress in technology tremendously - suddenly it won't be possible to just invent a new data format or protocol any more. Doing so will put you at extreme risk of being interpreted as sending unauthorised encrypted data. So data formats will have to be registered - to send data in a new format you will first have to register a codec with the government and probably yourself have to be licensed. This will have a severe chilling effect on innovation. Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. It's a depressing picture but given the trends of late I don't really see it going any other way. Only some extreme swing back towards individual rights over rights of the state will change its direction. But terrorism seems to have set in as a permanent tool for governments to grind away at individual rights.

SomeStupidPoint 10y ago
The US has at least one mechanism against that: the first amendment. Content and format are both matters of speech, so the choice of format and the decision to broadcast noise as a statement are both protected. I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.
- jasonkostempski 10y ago
  I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.

anexprogrammer 10y ago

Is it too late to return 2016? It's clearly defective. How long until... "Anexprogrammer was clearly a suspect individual. He used A&A, a UK ISP, widely considered sympathetic to terrorism under the thin guise of blogging about preserving privacy. The ISP has even provided information on how their users may circumvent the law and expressed the opinion it was a bad idea! It gets steadily worse, Anexprogrammer often used a VPN, from an overseas company who made a feature of logging nothing, another technique widely used by terrorists to evade our beloved leader's protections. He even admitted to viewing online pornography, illegal in the UK, where performers appeared to be actually enjoying themselves. He was also suspected of being a believer in climate change and is known to have signed a petition against fracking. The 20 year maximum security sentence for illegal circumvention of logging is considered lenient." May the "one bad actor" that goes in there and gets the entire database please dump the histories of the politicians asap?

pinum 10y ago
The MPs themselves are exempted from the IP bill. (Although it's safe to assume GCHQ is still collecting everything on them.)
- anexprogrammer 10y ago
  I should try and act surprised. Think it's fairly certain plenty of them will end up in Sky's logging anyway. Backbenchers minor enough to be thrown under the bus though. We need a response a bit more substantive than just joining Liberty or OpenRights.
- Sean1708 10y ago
  Please tell me you're joking?!
falcolas 10y ago
You're just missing Tor for the "suspicious character" trifecta.

Sean1708 10y ago

> "Terrorists and serious criminals will always seek to avoid detection. You mean like by using completely unencrypted SMS to plan terror attacks[0]. Also, "world-leading" my arse. [0]: https://www.techdirt.com/articles/20151118/08474732854/after-endless-demonization-encryption-police-find-paris-attackers-coordinated-via-unencrypted-sms.shtml https://www.techdirt.com/articles/20151118/08474732854/after...

Kepler-125c 10y ago
They're not looking for actual terrorists, otherwise the SMS's would have triggered a response. They're looking for people like Occupy Wall Street protesters, who actually pose a threat (ie. redistribution of wealth) to those in power.

balabaster 10y ago

Pardon my extreme language but Fuck! How on earth do bills like this come to pass without uproar widespread enough to quash it. Shit like this seriously makes me want to give up on the internet and walk away from it despite it having been my lifeline and the foundation of my income since I was in my teens almost 30 years ago.

zigzigzag 10y ago
The reason such bills get proposed and passed is because, broadly speaking, they are popular with the electorate or at least not unpopular. The reason they are not unpopular, the root problem, is because the downsides are perceived as theoretical and in the future whereas the upsides are seen as real and in the present. Put simply the arguments against look like this: Oppose this bill because the government COULD abuse it and PROBABLY will abuse it in future i.e. it's all vague arguments about probabilities, and the arguments for it look like this: Support this bill because it WILL help the fight against terrorists and paedos right now For better or worse the British government has a relatively high level of trust amongst the British people. There is no British constitution and we can now see how a minority of the population is trying to convince Parliament to override the results of an actual referendum on the grounds that people are too stupid to rule themselves, so must be dictated to by small enclaves of their betters. That attitude is widespread, even if it is kind of dumb - MPs are just ordinary people too, after all, it's not like there's any filter on them beyond voting. But given that the governmental "elite" imposing its own morality and wisdom on the majority is practically a sexual turn-on for non-trivial numbers of voters, this kind of thing shouldn't surprise us. We can and probably should argue that this trust is misplaced. There's plenty of evidence of that, along with the fact that surveillance is invariably paired with secrecy so it's hard for people to judge whether the government can be trusted to begin with. But that's why such bills happen. The solution is probably not VPNs. Ultimately in a fight between internet technologists and lawmakers, sufficiently determined lawmakers will always win: China proves this. The UK's lawmakers may not be sufficiently determined but if they are the only solution is to continue making the argument to the electorate that the government cannot be trusted with such powers, and that they won't help fight terrorists and paedos anyway. Pointing out that Trump now controls the NSA might be a good start.

theandrewbailey 10y ago

How is this surveillance system supposed to work? Logging DNS requests? How feasible would it be to get everyone to look up every domain on the Internet and DDOS this surveillance system?

lucaspiller 10y ago
The introductory presentation (linked from the article) suggests what should be logged: - customer ID - start and end times of the 'event' - source IP address and port (the port is used to avoid a NAT at the ISP level) - destination IP address and port - volume of data transferred in each direction - name of internet service connected to - the URL https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/504192/Operational_Case_for_the_Retention_of_Internet_Connection_Records_-_IP_Bill_introduction.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... There is a sample provided on the next page, which dumbs it down enough so that it sounds rather compelling.
- elcct 10y ago
  Looking at the document (ANNEX C for example) one could guess they are going to log entire request body...
tehmaco 10y ago
There doesn't seem to be a technical definition of an 'Internet Connection Record', but from the factsheet[1], they: "are records of the internet services that have been accessed by a device. They would include, for example, a record of the fact that a smartphone had accessed a particular social media website at a particular time." and: "ICRs do not provide a full internet browsing history. The ICRs do not reveal every web page that a person visited or any action carried out on that web page." How this will work in practice is anyones guess at the moment - every time I think of something short of logging every packet header sent/received in the UK (which leads to a staggering amount of data needing to be logged), I think of things that would slip though (and therefore wouldn't fulfil the first statement)... [1] https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473745/Factsheet-Internet_Connection_Records.pdf https://www.gov.uk/government/uploads/system/uploads/attachm...

matchagaucho 10y ago

Features like "You are currently logged in from 5 different devices" are event log-driven. Unfortunately, this level of security and consumer protection is only found in top-tier online services. Service providers can spin this "compliance" measure into a "benefit" for their customers/users. The net result, more users will disable or report rogue sessions.

coldcode 10y ago

Assuming you can't block a VPN connection since business use them, how would this work? I assume at some point you simply ban HTTPS or non-public connections, or require government certs to be the only ones used (I think Turkey or some similar country is looking at this) so MITM can be done. Of course once you stick your foot into security, all the bad folks out there will take advantage, and their goes your financial industry and more. It's a stupid idea all around but the dolts in charge seem to either not care or don't understand. Also calling all of your citizens terrorists is a nice touch.

SixSigma 10y ago
Ironically I access my VPN to the UK so I can access geo-restriced UK websites while I am out of the country. Blocking it would indeed mandate blocking HTTPS, my OpenVPN piggybacks on port 143 on my UK server (though I guess DPI could spot it too).

a3n 10y ago

> "Terrorists and serious criminals will always seek to avoid detection." So, if you don't want the government to see your thoughts, you're a criminal.

Qwertious 10y ago
No, that's confusing A->B with B->A. All dogs are mammals, but not all mammals are dogs.

arca_vorago 10y ago

Having visited England recently, despite the surveillance engine being prepped in the US, the contrast of the extent and the lack of rights and legal means in the UK to protect the people from bad laws like this was palpable. So look at it this way, at least you don't live there. If we keep headed in the same direction though it won't be long before we forget all the reasons for the American Revolution and let the globalists convince us to rejoin the empire cough the commonwealth again. Of course, any American who advocates for such a thing is traitorous, and should have the full weight of the law brought down on them. I don't know, maybe I'm crazy and I'm the only one who thinks oaths mean anything these days. I will say this though, beware the Rhodesians and their round tables.

CoryG89 10y ago
Seems doubtful that the founding fathers and revolutionists thought their "oaths" to the crown meant much either. I don't want to join any empire, but I would advocate for globalism, which I don't believe is the same thing as imperialism. I guess I may just be one of those treacherous Americans though.
- arca_vorago 10y ago
  The monarchy had repeatedly violated the patriots (uncodified) constitutional rights, their common law rights, and their natural rights. The legal debate became the American Revolution, and America won. Furthermore, many of the sons of liberty had never signed or taken oaths of allegiance to the monarchy. Some of them did take oaths of allegiance though, so you actually touch upon a very interesting subject that I think would be worth having a more nuanced conversation about. So thanks for spurring me to think further on the matter. So far, the main thing I can think of is that part of the oaths of allegiance include duty, not just to the monarch but to the laws which create that monarch, therefor I find the view of the The European Court of Human Rights retrospectively insightful in that it ruled that the oath of allegiance to a reigning monarch is "reasonably viewed as an affirmation of loyalty to the constitutional principles which support... the workings of representative democracy in the respondent State." Now, if you want to advocate against the constitution, as long as it is just speech, that is legal (as long as you are simply a citizen and haven't taken an oath), but I would agree it is treacherous, but not traitorous or treasonous. The second speech becomes action, particularly to assist a foreign entity in that venture though, it does become treason. I highly disagree with the sedition laws which violate the first amendment and have been so harshly abused even in the modern era, so I am ignoring those for the sake of conversation. You said you "don't want to join any empire, but I would advocate for globalism, which I don't believe is the same thing as imperialism." I would simply say I think you are wrong and provably so on this point, in that the current trend of globalism is indeed an imperial globalism. That being said, I will admit that I have often had the conversation about the utopic version of globalism, but it is important to differentiate between that imagined ideal which I think you might be referring to, and the reality of the current global geo-political movement of globalism (which is quite different from the economic fact of globalism, which I don't think is up for dispute). If you want, I am willing to expand on the more technical reasons I think that current global is imperial globalism. I wish I could edit my gp comment, because I was obviously wrong to say : "Of course, any American who advocates for such a thing is traitorous, "

tn13 10y ago

Bullies are cowards. That lesson from school is generally true for bullies in real world too. Government is just that coward bully. True that US government's tyranny has been rise year on year under leadership of presidents of all political stripes and yet it has meant zilch for either their political goals states good objectives. All the recent wars by US government have been massive and spectacular failures, fight against terrorism has only created far more threats, people's approval of drug legalization is all time high, gays are safest they have ever been and it is easiest to get almost any kind of gun illegally than in past. Politicians are very eager to control you life but they are so incompetent with that power that eventually it would not matter. The only problem I see that increasing government spending which will slow down US economy.

dehugger 10y ago
You know this article is about the UK, not the US, right? By and large I agree with you, but its not the United States that passed this into law.

0xCMP 10y ago

"Terrorists and serious criminals will always seek to avoid detection." And normal people too, assholes.