19 ms·
UK government to monitor email and web use under new laws
- alexchamberlain 15y agoI have no problem with this if it's just GCHQ and they need a warrant to do it. The police shouldn't be able to do it, though I don't have a problem if they can request GCHQ to do it for them! They don't think they have time to go beyond terrorism.
- nkassis 15y agoI'm not one to wear a tinfoil hat but SOPA in the US, Bill C-30 in Canada, and the various laws in the EU can make one think there is some sort of conspiracy going on. It's simply intriguing how all these laws seem so similar.
- voodoochilo 15y agoto me all this stuff seems a bit overcoincidental, but i am tired of talking about. few months ago i joined the freedombox-project (http://wiki.debian.org/FreedomBox http://wiki.debian.org/FreedomBox) - now i vote by coding.
- ktizo 15y agovote by coding I like that. I been saying to hippy mates of mine for a while that while they have been trying to change the world through the application of drum circles and yurt building classes, the geeks have quietly been building in the open source movement, the only successful communist (with a very small c) system to successfully compete with capital on its own terms, and many are now setting their sights on using it for actual manufacture. If you don't like the world you see around you, at this point in history one of your best chances for empowerment is to learn some form of engineering and then apply it.
- voodoochilo 15y agofully agreed. sorry to correct you, but it's the "free software movement" or "FOSS" and it's not a communist system. not even with a small "c", because communist systems force you to share, FS allows you to share.
- adrianN 15y agoIt is my understanding that the GPL forces you to share your code under the same licence.
- deleted 15y ago[deleted]
- za 15y agoSharing is optional. The choice of license is not.
- seabee 15y agoI think the grandparent meant to suggest GPL is small-c communist.
- ktizo 15y agoIf you produce software within the framework of the free software movement then you are sharing it. What free software licence allows you not to share your source? The word communism can also describe systems that are mutual with consent, and most of the states that claim to be communist appear to be run by totalitarians who use the word and associated dogma to seize and hold power under the promise of equity in the future, so I am not sure there has ever been an actual communist state, by the terms of the philosophy. Personally, I'm a Groucho Marxist, so my main tenet is that I wouldn't want to join a club that would have someone like me as a member. ;)
- voodoochilo 15y agono no, i will not enter this discussion, because time flies like an arrow and fruit flies like a banana;) (btw. you can always take a FS, modify it and keep it completly to yourself, so all FS licenses allow you not to share)
- alan_cx 15y agoTired of talking about it. Terrible, but I know exactly what you mean. Its like being under siege. And I suppose that is the point. Those who oppose all these vile attacks on our basic freedoms will eventually be worn down and defeated. Unless a good majority of people get radical and stamp this out properly, and for every one world wide, this will creep and creep until the internet becomes nothing more than a sales portal.
- gumbo72 15y agoSpain was actually forced by the US to pass a SOPA-like law, according to wikileaks
- smallhands 15y agoone think there is some sort of conspiracy going on. It's simply intriguing how all these laws seem so similar. i alway wonder what makers of james bond can do with these facts clearly some people are no more comfortable with the power of the web
- JonnieCache 15y agoThat's not controversial. The US uses its economic and (indirectly) its military power to persuade or coerce other nations into enacting laws similar to its own. To some extent this is desirable: it makes life simpler in a global economy. Like everything government does, it gets taken too far. The ultimate example is drug policy. http://en.wikipedia.org/wiki/United_Nations_Commission_on_International_Trade_Law http://en.wikipedia.org/wiki/United_Nations_Commission_on_In... http://en.wikipedia.org/wiki/Harmonisation_of_law http://en.wikipedia.org/wiki/Harmonisation_of_law The US federal government does the same thing to the states: Under the Federal Aid Highway Act, a state with a minimum drinking age below 21 would be subjected to a ten percent decrease in its annual federal highway apportionment. http://en.wikipedia.org/wiki/National_Minimum_Drinking_Age_Act http://en.wikipedia.org/wiki/National_Minimum_Drinking_Age_A... Again, this really isn't controversial. It's the essence of international politics...
- J3L2404 15y agoUnless I am mistaken SOPA would not have given the government access to your browser history without a warrant.
- zerostar07 15y agoIt was bound to happen that the internet would be regulated, just like all other innovations and media before it. Once a technology becomes mainstream it is regulated, that's like a law. We are going to miss the open internet, but there will always be "ham radios" like Tor or other technologies in the future.
- sambeau 15y agoA warrant would still be needed to read emails, but this essentially will give the government access to your browser history.
- read_wharf 15y agoThe fact that two people have communicated is damaging enough, which is what this does. For the law under discussion in the UK, it seems that it's just formalizing practice. In the US this is covered under the Pen Register Act: https://en.wikipedia.org/wiki/Pen_register https://en.wikipedia.org/wiki/Pen_register. Essentially the fact that two people have communicated is not protected under our Constitution; only the content of that communication is protected. In that context, Congress passed the Pen Register Act, which requires law enforcement to get a warrant to monitor who calls who; the bar for these particular types of warrant is particularly low. The Patriot Act extends the concept of pen register and their required warrants to internet communication. The government specifically is required to get a warrant before it can ask an ISP, for example, to reveal who someone emails or what web sites they visit. For now, they need a warrant to know that you visited Amazon or your library's site, but they need a harder to get different warrant to know what books you've bought or checked out, or what you thought about those books when you emailed your friend. The fundamental problem with pen registers and the internet equivalents is that it brings people under government scrutiny that otherwise would have escaped notice. If person A is a person of interest, and the government is pen registering his communication, then that makes everyone on person A's communication list a person of interest. Now the government gets a warrant to pen register person B, someone who person A communicates with. That means that everyone that person B communicates with is now known to and watched by the government, even though they are not specifically the target of any investigation or warrant. Person A may be a drug dealer, person B may buy from person A, and I, person XYZ, may be a friend of person B, don't buy or use drugs, and don't know a thing about the relationship between person A and B. But now the Eye of the government has swung its gaze over to me. I could become collateral damage in, for example, a plea bargain negotiation. My house might be violently raided by law enforcement, merely because Person B visits me a lot; my child might have a gun pointed at his head, and my dog might be routinely killed merely for getting in the face of one of the law enforcement home invaders. This (the pen register) is a violation of my desire to not be scrutinized by the government, whether I've done nothing wrong or not, whether I have anything to hide or not. I in fact have done nothing wrong and have nothing to hide, and I still do not want the scrutiny of the government to fall on me. The government is in theory my servant, not my master. That relationship naturally gives me the right to expect the government to leave me alone.
- mooism2 15y agoIs this an April Fool's?
- tjoff 15y agoIs this a joke? I'm glad I don't live in the UK but pissed since they set an example others might be tempted to follow.
- objclxt 15y agoAs far as I'm aware this is fairly common. If you read the article, you'll see that the new legislation "would not allow GCHQ to access the content of emails, calls or messages without a warrant". Looking through your comments it looks like you're in Sweden: Sweden already has similar legislation via the FRA law, which authorises the Swedish government to wiretap all traffic entering the country. A lot of countries have similar arrangements: not all arrangements are backed by legislation. In many ways it is better to have this thing legislated: at least then it's out in the open. It's naive to think that large ISPs in countries without active legislation aren't linking intelligence agencies into their networks. The legislation in the UK is presumably intended to speed up the time from getting a warrant to putting the tap in place: I would imagine most large ISPs (BT, Virgin, etc) are already plugged into GCHQ, in the same way the NSA intercepts all AT&T traffic.
- hnhg 15y agoA friend is a network engineer who has worked on some big UK ISP projects and he says that all had a requirement to mirror traffic and make it available to an external undocumented point/body. It's just understood that it's the security services.
- kiiski 15y ago"In many ways it is better to have this thing legislated: at least then it's out in the open. It's naive to think that large ISPs in countries without active legislation aren't linking intelligence agencies into their networks." How about the other option: we make it strictly illegal for ISPs to cooperate with intelligence agencies (or anyone else asking for data) unless there's a warrant involved (and even then only to the extent of the warrant).
- tjoff 15y agoYes, I'm in Sweden and yes we have the FRA law. But there are huge differences between this and the FRA law. The FRA explicitly forbids FRA to intercept/process traffic that is meant to stay within the borders. Both laws are an insult to democracy but my take from this is that this is much worse and they have different intents. Why is it better to have this thing legislated? The argument that it is better to have laws like this because otherwise they will just do it anyway (illegally) just blows my mind. There are many advantages to having stuff like this unlegislated, without support from the law they can't actively act on the data, something that is far better than having the FRA-law. Especially when the intent of the law isn't to act on it but rather to observe. In other words that argument is of the lines that "since they already have the information (which they illegally intercepted), why wouldn't we want to give them the legal right to intercept that information so that they act on it as well?". How does that make any sense? Even with a warrant the data collected by FRA wouldn't be legal to use in a court if both parties (sender and receiver of a message/whatever) was in Sweden (regardless of whether the traffic took a detour across the border or not (too/from gmails servers for instance)).
- bootload 15y ago"... But it would enable intelligence officers to identify who an individual or group is in contact with, how often and for how long. ..." Cynical enough to think GCHQ do this already & the legislation allows for more favourable results.
- iuguy 15y agoThe legislation would permit information obtained in this way being used in legal processes. Currently if GCHQ were doing intercepts in this way it would be unlawful, and as such evidence obtained through such potential intercepts would be inadmissible in a court terrorism case for example.
- 46Bit 15y agoHence why they claim the evidence is too sensitive to receive any public hearing. Secret tribunals and the like.
- bootload 15y ago"... Currently if GCHQ were doing intercepts in this way it would be unlawful, and as such evidence obtained through such potential intercepts would be inadmissible in a court ..." True, but wouldn't the sources be covered under OSA and hence not disclosed?
- iuguy 15y agoNot if you're going to court. There's a whole secret inquest thing that's been going on, occasionally popping up in the news. The problem with relying upon intelligence for evidential purposes is that you can often expose the handlers, assets or sources involved in a public trial.
- bootload 15y ago"... The problem with relying upon intelligence for evidential purposes is that you can often expose the handlers, assets or sources involved in a public trial. ..." Excellent point.
- downx3 15y agoThis government keeps shooting itself in the foot. If only I was young enough to flee.
- mattvot 15y agoI think this will turn out alright. The article mentions a law prohibiting such surveillance without a warrant, and the fact that this is being covered by main stream media to start.
- Father 15y agoDoesn't this violate secrecy of correspondence and their own data protection act of '98? Terrorism seems to be the godwin for privacy debates regarding national security.
- objclxt 15y agoThe Data Protection Act gives the security services opt-outs on the basis of national security. This is to prevent you, for example, requesting all files that MI5 might have on you.
- deleted 15y ago[deleted]
- derda 15y agoIts a EU thing that is pushed from the commission to the individual countries. Germany implemented this a while ago but it was ruled unconstitutional by our constitutional court, so the law was repealed and all collected data was deleted (at least thats what they say). Now the government is facing fines from the EU for not implementing the law. Its awful that an institution of questionable democratic legitimation (EU commission) is forcing a democratic government to implement laws, that are against their constitution. The worst thing is, that the big political parties dont see anything wrong in this.
- blue1 15y agothere is a deep tug-of-war in this. The EU position is that European Law is higher level than any law of member states, including their constitutions. States, generally, say that EU law takes its very legitimation from the souce of national law and, consequently, cannot overrule it.
- philwelch 15y agoWe had this kind of conflict here in the US once. It didn't end well.
- spindritf 15y agoI wouldn't worry about that, here in Europe we have a long tradition and history of solving our problems in a conciliatory and, above all else, peaceful way.
- deleted 15y ago[deleted]
- Nitramp 15y agoWhich of the world wars do you mean?
- toyg 15y agoWas that ironic? Our "long tradition" is stretching for a whopping 65 years, not exactly like the century-plus example our American friends can vaunt.
- deleted 15y ago[deleted]
- hajrice 15y agoReading the headline, I instantly thought of George Orwell's 1984.
- hamoid 15y agoThe only way I would find this acceptable was if the government applied this to themselves. I want to be able to hear all their conversations, to know where they are, who they meet and talk to, who pays them money, how many bank accounts and properties they own. I'd like that accepting a job as a politician involved full transparency. If they were an example themselves then it might be easier to convince people about approving a law like this one.
- tjoff 15y agoPersonally I don't see how I could give up my privacy just because some/all politician(s) would. A lot of people don't even mind the absence of privacy, the key point is that that is a decision they can make for themselves. Even if everybody would gladly give away everything on facebook the moment you force them to do so you cross the line.
- pasbesoin 15y agoAs a rhetorical device, I agree. I've summed it up in the past as, "You first." I'd even be willing to argue it with respect simply to communication performed as part of their work. More and more "governance" seems to be too sensitive to allow people being governed to be aware of it.
- Jach 15y agoblah blah blah use PGP for emails blah blah in fact encrypt all the things blah blah "no it's too hard for Joe Public" blah then Joe gets what he deserves.
- 4ad 15y agoYou miss the whole point, it's about the implications of the legal frameworks which are put in place, not about how to hide from governments. The simple fact that you need to hide from the governments is indicative of a deep systemic problem. This is just a first step in making encryption illegal. Not like that's not the case already in some parts of the world, and it's not regulated heavily in other parts of the world.
- Jach 15y agoI don't think I missed the point, that point's pretty obvious. All of us on HN recognize that the legal frameworks of the US and the UK (and other countries) are screwed up, and we don't need this particular post to point that out. The looming totalitarianism manifests itself elsewhere with even more clarity. My point, admittedly facetiously expressed before, was an aside, and it is that hey, we know the government's screwed up, and it's not likely to get much better soon (especially on this particular issue) without a fundamental shift away from Big Government (and more debatable, a Massarchy implementation of government). In the meantime, there are technical solutions around it which we could implement en-masse today for the benefit of the masses instead of the localized solutions like GnuPG that us privileged nerds have--and it's worth reminding/letting be known by budding smarty-pantses that they too can communicate with other smarties securely if they want to. (I suspect any dangerous terrorists already do communicate securely and don't need reminding, but most terrorists are dumb and ineffectual in whatever their particular goals are so most probably don't.) If only Joe Public was educated about it and motivated to care and demand... Does a gmail-to-gmail message stay on Google's network alone? If not, they should encrypt everything behind the scenes before it leaves their network, just like how they've now been using https by default. It limits gov. snooping to subpoenaing the specific email provider to get the data off their servers rather than catching it in real-time as it passes through some network node. Also, I think that most probably gmail-to-hotmail or gmail-to-yahoo goes outside, so you can expand. Why can't Google, Microsoft, and Yahoo each agree to roll out an auto-PGP system where when an email is sent to one of the others, a handshake occurs first where a one-time public key is swapped from receiver to sender that's used to encrypt before sending, and the receiver will decrypt before presenting the decrypted email to the receiver user? (And to the receiving user's provider's content-scanners to display targeted ads.) With similar legal implications, the public could always demand regulations that require an auto-PGP protocol alongside a requirement of https (even though https isn't as secure as it could be). But that would be an instance of the government looking out for its people when the private companies aren't doing so, therefore it's not going to happen. It's hard to enforce any anti-encryption laws beyond monitoring for distribution of specific software and monitoring for users who encrypt almost everything. Basically you can only catch someone using encryption for almost everything by noticing that none of their data is understood by any of your software. If you only encrypt important things, well, a steg'd image once in a while isn't going to be detected (and there are other things you can do too).
- TazeTSchnitzel 15y agoAs a UK citizen, I now do not regret in the slightest forcing every single user of my website to use HTTPS. It costs maybe 10 or 20 dollars a year, your site runs no slower, and all your users get real privacy.
- 4ad 15y agoSorry to spoil it for you, but HTTPS provides no protection against MITM when the MITM is a nation state which can legitimately buy root keys from CAs (or become a CA themselves, if they are not already). For more info about the security theater revolving around SSL in the context of HTTP see this great talk: http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA
- Anderkent 15y agoWell, you can verify the certificate is the same when accessing the page via your connection and via tor. If they have different chains you stop trusting the root authority. This can be spoofed only if the nation state buys the master root keys (i.e. not just a key allowed to sign any domain, but the root key the provider uses to sign everything, so that the chain is exactly the same) from every certificate provider... At which point you're screwed whatever you do.
- uptown 15y agoWatch these two videos and tell me whether you think this is already happening in with US data ... most-likely transferred outside the country for the purpose of analysis beyond the nation's legal jurisdiction. http://www.youtube.com/watch?v=_ae0yED6gRA http://www.youtube.com/watch?v=_ae0yED6gRA http://www.youtube.com/watch?v=oYNXVgYhPOc http://www.youtube.com/watch?v=oYNXVgYhPOc
- MrTibbles 15y agoGeorge Orwell weeps in his grave.
- deleted 15y ago[deleted]
- adam-_- 15y agoWait, I had assumed this was an April Fools?
- J3L2404 15y agoNo politician in the US would even dare suggest this never mind try to get it passed as law. I really don't understand the politics. What constituency supports this?
- eurohacker 15y agoseems like UK royalty has had enough - the controlled democracy does not work well with free internet
- Tharkun 15y agoI hope we'll be getting rid of these april fools stories tomorrow?
- shingen 15y agoThe FBI, CIA and NSA already do this. Both domestically and internationally. American agencies have been reading UK email for years.