10 ms·

UK intelligence forced to reveal secret policy for mass surveillance

291 points by r0h1n 12y ago

viraptor 12y ago
> GCHQ is intercepting all communications - emails, text messages, and communications sent via “platforms” such as Facebook and Google – before determining whether they fall into the “internal” or “external” categories This should raise some interesting questions about the methods used considering all of that communication is going over TLS.
- corin_ 12y ago
  Secure technology doesn't prevent governments from getting the "platforms" to co-operate with them, as we saw with PRISM. I could be wrong, but surely it seems far more likely that they are providing GCHQ with the data rather than that GCHQ is cracking encrypted traffic.
  - viraptor 12y ago
    Maybe I'm being naive, but while I'm certain there are easy ways for GCHQ and others to obtain data of chosen people, I have a hard time believing Google would just give them all-you-can-eat data access with no restrictions or monitoring. Simply because they are big enough to be able to take their data elsewhere.
    - lnanek2 12y ago
      Why would you find that hard to believe? The NSA has been putting their own hardware in other people's data centers and requiring their SSL keys, for example. So it certainly happens in the US.
      - viraptor 12y ago
        Yes, but providers don't have much choice in that case. (also because the company has to follow local law) But with all available interconnects, there are many places in Europe where you could open a datacentre and not have to deal with GCHQ requests. It's not the case about every spy agency with every company - it's about specifically US companies like Facebook / Google and GCHQ.
- janthinidae 12y ago
  We all talk about using SSL everywhere protects people from NSA/GCHQ/... It may prevent script kiddies to use Firesheep but as far as I understand if the NSA/GCHQ has access to any key from any Root CA (which I highly assume) then it doesn't matter at all to the NSA/GCHQ what kind of encryption we use as they can do easily MITM attacks (anyone checking SHA1 from the certificates from a reliable source, whatever this means?). The same is true that at several companies I worked for, people had to install (or per automatic software update) a fake certificate to allow the proxy to spy on all traffic. In one case I tried to fight against it, but I was the only developer of the 80 developer which cared. Their reasoning was totally flawed (which I demonstrated, e.g. that it protects against viruses, which it didn't, as the proxy only checked the first few MiB) but despite that, it was signed by management etc. Maybe I made I mistake in my reasoning and I hope someone explains my why, but in my opinion SSL (despite the script kiddie example) is broken as long as we have to trust companies which we shouldn't trust at all.
  - 7952 12y ago
    Corporate IT departments tend to rely far too much on network level security like this. But if the users machine is compromised in some way network security is completely useless. Even if TLS was completely perfect there would still be vulnerabilities in software that could be attacked on-mass.
    - frameworkHeavy 12y ago
      Quick tip: En masse, pronounced with an "awww". It's French.
  - gizmo686 12y ago
    I think we are pretty safe against MITM attacks (for dragnat survallance). As a quick test, I am sure that many people on this site have access to very public facing, SSL enabled, servers. Try verifing that the public key your server sends is the same one that you get visiting your site. Even without concerns over government survallence, it is probably a good idea to check this occasionally.
- tptacek 12y ago
  Or, as has been in the case in many of these stories, the public policy vectors are reported roughly accurately, but the specifics and, most especially, the scope aren't. So you have thousands or tens of thousands of FISA directives for specific accounts sent to Google reported as "NSA has a shell on Google servers". It's probably the case that GCHQ simply doesn't collect "all" communications, and can't do much about cert-pinned TLS to Google Mail. (You know, since they got caught fiber tapping Google's UK data centers.)
  - andyjohnson0 12y ago
    Google doesn't have any data centres in the UK. http://www.google.com/about/datacenters/inside/locations/index.html http://www.google.com/about/datacenters/inside/locations/ind...
    - tptacek 12y ago
      Sorry, data center fiber connections, not data centers.
- mike_hearn 12y ago
  TLS all the time on these big websites is a very recent phenomenon, only being activated in the past couple of years. What's more, GCHQ were tapping internal traffic between Google datacenters which wasn't encrypted until Snowden, so TLS between customer and web server only slowed them down. I suspect nowadays they're finding it much harder, but in these documents they're being asked to explain their pre-existing policies which were developed when TLS and internal encryption were much less widely used.
SixSigma 12y ago
I didn't steal that money because I already spent it.
- tomp 12y ago
  I stole that money but I forgot that I stole it. Not a crime!
higherpurpose 12y ago
> The distinction between ‘internal’ and ‘external’ communications is crucial. Under the Regulation of Investigatory Powers Act (‘RIPA’), which regulates the surveillance powers of public bodies, ‘internal’ communications may only be intercepted under a warrant which relates to a specific individual or address. These warrants should only be granted where there is some suspicion of unlawful activity. However, an individual’s ‘external communications’ may be intercepted indiscriminately, even where there are no grounds to suspect any wrongdoing. This is another reason to force companies to hold local datacenters in major countries...or, if they prefer, put everything under end-to-end encryption, so it doesn't matter where they hold it. Only these 2 options should be given to the companies, otherwise no "foreigner" (in relation to where the data is kept) can trust them with their data. They decide which is less costly, but I'm hoping they choose the latter.
Nursie 12y ago
The political silence on this issue is indeed deafening. As was the press silence (other than the Guardian). The press in this country are far more interested in reality tv, political infighting, fanning flames about 'immigrants' and what the royals are up to. And I suspect it's because most of the public don't care either. There are people who would like privacy, who think that GCHQ should be accountable and then there are other people who are perfectly happy that someone is watching everything, everywhere, because that makes them feel safe, and of course they aren't doing anything wrong, so why should they care? And of course a large proportion of the population either aren't intelligent enough or aren't interested enough to understand what's going on. It makes me angry, but that's the world we live in.
- madaxe_again 12y ago
  Don't forget about "the muslim problem" and the "international islamic conspiracy". I'm sorry to Godwin the thread, but it's pertinent. The push on "british values" (nationalism) and "preventing non-violent extremism" (such doublespeak) and "combatting islam" is fucking terrifying to anyone even vaguely familiar with the events that preceded the holocaust and the second world war. The surveillance state we find ourselves under just makes it that much easier for atrocities to be committed and utterly hidden from view.
  - spingsprong 12y ago
    I suspect something much more mundane. Politicians love to shout about their successes. Only, this government hasn't really got any to shout about, so they're falling back to the old standby that all governments do in situations like this. Wave the flag and be proud to be British.
    - herghost 12y ago
      Sort of. The problem that the mainstream political parties have right now is that right-wing sentiment just scored high in the elections. They need a little bit of sabre-rattling and flag-waving to convince those on the left-most fringe of the newly-empowered right to come back towards the centre, and the only way they can do that is through winning the stupid, populist vote on simple issues again. That of course, coupled with the lack of real achievement from the current government, the ongoing and incredibly unpopular austerity cuts, and a long and drawn-out recovery that doesn't seem to be materialising for most people means that any way to make political hay right now needs to be grasped.
digitalengineer 12y ago
> The Government believes that, even when privacy violations happen, it is not an “active intrusion” because the analyst reading or listening to an individual’s communication will inevitably forget about it anyway. unbelievable! What if they're building a searchable database of every user, so as to have 'dirt' on someone when he 'becomes a threat' to their interests? (Like becoming a spokesman against this sort of thing or whatever the bureaucrats wantto do next year).
- dan_bk 12y ago
  When I read such things ("...because the analyst reading or listening to an individual’s communication will inevitably forget about it anyway."), it fills me with deep hate against those people. How dare they take us for such idiots?
jpgvm 12y ago
There can be no secret laws in a democracy. Else it's not a damn democracy.
- TeMPOraL 12y ago
  Since the secret laws are actually out there, what conclusion does this fact support?
  - lucastx 12y ago
    Maybe we don't actually have a democracy? You know, we have been watching, for more than a year now, story after story telling us that the Five Eyes intercept, filter and store a range of communications between allegedly criminals, mere suspects and whole populations. A tiny portion information is then used to "fight crime", while the rest sits there, waiting to be used for the economic and political interest of those nations, and to stop dissent and social movements -- even it the information is not used, the mere fact that somebody is watching works damn well to bring fear and distrust to potential unrest.
  - grkvlt 12y ago
    What 'secret laws' are you talking about? No such thing exists in the UK, at least. Is there not a similar process for creating legislation publicly in the USA?
    - collyw 12y ago
      The ones you don't know about because they are secret.
    - jpgvm 12y ago
      Many countries have secret laws unfortunately. The US is especially bad because they hide their secret laws behind a veil of "nation security" when they clearly have no requirement to do so. They legalise these secret laws through a secret court.. once again justified with "nation security". Mind you, a secret court whose judges are appointed by the executive. How are we meant to hold our elected representatives accountable when the goings on of these secret courts are not even open to them? How can this possibly be a democracy if we don't have the slightest say in what our executive does in our name? So no, we don't live in a democracy anymore. Long live congress and God bless America.
greggman 12y ago
You might find this debate from Intelligence Squared interesting on this topic. http://www.intelligencesquared.com/events/state-snooping-is-a-price-worth-paying-for-security/ http://www.intelligencesquared.com/events/state-snooping-is-...
csandreasen 12y ago
The section regarding external communications starts on page 37. The same document seems to contradict this article's premise: (from p.41) "Despite the fact that some UK to UK communications may be intercepted under section 8(4) warrants and that common uses of the internet by persons in the British Islands, such as a Google search, a Facebook post, or a "tweet" on Twitter, may entail the making of "external communications" for the purposes of Chapter I of RIPA, the section 8(4) regime as a whole is designed so as not to authorise the selection for examination of communications of this nature, except in the tightly constrained circumstances set out in section 16 of RIPA." Disclaimer: IANA-(British)-L
- justincormack 12y ago
  It goes on though to say that tweets are posted to a US platform, not an individual, so they all count as external. Only email from one person to another both in the UK is "internal" but they admit it will be collected anyway, but say they can't look at it.
  - csandreasen 12y ago
    Well, yeah - with regards to it being an "external" communication, they say that on p.37 (as I said in my post). The document starts talking about the differences between internal and external communications on p.37 and how a tweet that isn't directed to another British citizen is considered an external communication because the server is in the US. They then continue by saying on p.41 that even though that tweet is an external communication, they still aren't authorized to intercept it unless it's "necessary" under section RIPA 5(6)(a) and the tweet also isn't authorized for "selection for examination" unless it meets other criteria under RIPA section 16. The article is focusing on the fact that the tweet is an external communication and neglecting to mention that there are still additional restrictions on collecting external communications. What Charles Farr is saying in that document is a far cry from the article's wording: "By defining the use of ‘platforms’ such as Facebook, Twitter and Google as ‘external communications’, British residents are being deprived of the essential safeguards that would otherwise be applied to their communications - simply because they are using services that are based outside the UK." (After skimming through RIPA, though, I will concede that UK laws can be very obtuse. Section 16 gave me a headache - but that's an entirely different issue than the external communication argument)
BillFranklin 12y ago
The head of GCHQ last year during an inquiry: "If I asked my employees to spy on UK citizens they would walk out...they would quit their jobs" - Perhaps he should quit.
- pling 12y ago
  I worked in the defense industry. The employees don't give a shit if the pay cheque turns up. It doesn't matter if they're making guns, bombs or reading people's emails. Someone told them it was good and they're getting paid so screw it to ethics and morals.
ZenPro 12y ago
Disclaimer : I worked as an intelligence analyst. 1. I am not in favour of widespread, unaccountable surveillance of UK citizens. 2. During my time we disrupted a number of exceptionally serious terrorist operations.[1] [2] are public knowledge and there are a few others that are not open source at this time. 3. Neither I, nor any of my colleagues, were instructed to keep any files on individuals to be used as political leverage or "for dirt" at a later stage. That is really all I can add. I am not in favour of how far the needle has swung but but anyone not involved in the Intelligence Community is just simply fumbling around in the dark trying to say what does and what does not happen. The threat from Qutbism Islamic Fundamentalism (Wahhabi/Salafist inspired terrorism) is real and intelligence organisations work constantly to prevent attacks. If the threat warrants the level of perceived intrusion...I don't know. That is difficult to judge. Each citizens attitude to risk is different. The HN crowd are technologically-savvy, critical thinkers but our law enforcement and intelligence agencies also have a mandate to protect the elderly, the young and the incapacitated. Do you think my grandmother gives a fuck about your outrage at having your email read? All she cares about is that we don't return to the time of consistent bombing on the streets that plagued the troubles. In short; it's not all about you, your vote is worth exactly one other vote. [1]http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9994940/Jihadists-planned-to-attack-Luton-TA-base-using-remote-controlled-car-packed-with-explosives.html http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9... [2]http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_Muslim_soldier http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_M...
- Nursie 12y ago
  >> In short; it's not all about you, your vote is worth exactly one other vote. And how the hell am I supposed to know what I'm voting for? This is the problem. There has been no discussion. There is no mandate from the public at large, it's all secret programs, secret laws and secret trials. It's sick, and it's not democratic.
  - grkvlt 12y ago
    > secret laws Can you explain how a secret law could ever exist?
ZenPro 12y ago
Disclaimer : I worked as an intelligence analyst. 1. I am not in favour of widespread, unaccountable surveillance of UK citizens. 2. During my time we disrupted a number of exceptionally serious terrorist operations.[1] [2] are public knowledge and there are a few others that are not open source at this time. 3. Neither I, nor any of my colleagues, were instructed to keep any files on individuals to be used as political leverage or "for dirt" at a later stage. That is really all I can add. I am not in favour of how far the needle has swung but but anyone not involved in the Intelligence Community is just simply fumbling around in the dark trying to say what does and what does not happen. The threat from Qutbism Islamic Fundamentalism (Wahhabi/Salafist inspired terrorism) is real and intelligence organisations work constantly to prevent attacks. If the threat warrants the level of perceived intrusion...I don't know. That is difficult to judge. Each citizens attitude to risk is different. The HN crowd are technologically-savvy, critical thinkers but our law enforcement and intelligence agencies also have a mandate to protect the elderly, the young and the incapacitated. Do you think my grandmother gives a fuck about your outrage at having your email read? All she cares about is that we don't return to the time of consistent bombing on the streets that plagued the troubles. In short; it's not all about you, your vote is worth exactly one other vote. [1]http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9994940/Jihadists-planned-to-attack-Luton-TA-base-using-remote-controlled-car-packed-with-explosives.html http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9... [2]http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_Muslim_soldier http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_M...
deleted 12y ago
[deleted]
ZenPro 12y ago
I have just re-read this entire thread in its entirety and once again a potentially valuable debate about the limits of police and intelligence services have devolved into a stunningly naive rant centring around - > The Islamic Terrorist threat is made up > The Government is a homogenous entity that cannot be trusted. It is definitely not a disparate group of people and organisations trying to make an effective and functioning society. It is sinister > Intelligence services watch your children naked. Seriously - this is disturbingly dark. In nealty 10 years of service neither I or anyone I ever met in my employment ever saw a child naked. Honestly; that comment hints at real psychological problems. > Government oversight of communications travelling along copper wires is the same as pre-WW2 Nazi Germany > Assertions we live in a police state etc etc. Which is hilarious because I have been to actual police states and very few people assert online they live in a police state. You know, on account of that not being wise in an actual police state. I could go on but this is beyond absurd. Privacy concerns? Legitimate. Anything else? Hollywood-isation of actual intelligence work. 99% of it is seriously boring and no one gives a fuck what porn you watch. Bit busy trying to stop actual people getting killed.

291 points by r0h1n 12y ago

> GCHQ is intercepting all communications - emails, text messages, and communications sent via “platforms” such as Facebook and Google – before determining whether they fall into the “internal” or “external” categories This should raise some interesting questions about the methods used considering all of that communication is going over TLS.

corin_ 12y ago
Secure technology doesn't prevent governments from getting the "platforms" to co-operate with them, as we saw with PRISM. I could be wrong, but surely it seems far more likely that they are providing GCHQ with the data rather than that GCHQ is cracking encrypted traffic.
- viraptor 12y ago
  Maybe I'm being naive, but while I'm certain there are easy ways for GCHQ and others to obtain data of chosen people, I have a hard time believing Google would just give them all-you-can-eat data access with no restrictions or monitoring. Simply because they are big enough to be able to take their data elsewhere.
  - lnanek2 12y ago
    Why would you find that hard to believe? The NSA has been putting their own hardware in other people's data centers and requiring their SSL keys, for example. So it certainly happens in the US.
    - viraptor 12y ago
      Yes, but providers don't have much choice in that case. (also because the company has to follow local law) But with all available interconnects, there are many places in Europe where you could open a datacentre and not have to deal with GCHQ requests. It's not the case about every spy agency with every company - it's about specifically US companies like Facebook / Google and GCHQ.
janthinidae 12y ago
We all talk about using SSL everywhere protects people from NSA/GCHQ/... It may prevent script kiddies to use Firesheep but as far as I understand if the NSA/GCHQ has access to any key from any Root CA (which I highly assume) then it doesn't matter at all to the NSA/GCHQ what kind of encryption we use as they can do easily MITM attacks (anyone checking SHA1 from the certificates from a reliable source, whatever this means?). The same is true that at several companies I worked for, people had to install (or per automatic software update) a fake certificate to allow the proxy to spy on all traffic. In one case I tried to fight against it, but I was the only developer of the 80 developer which cared. Their reasoning was totally flawed (which I demonstrated, e.g. that it protects against viruses, which it didn't, as the proxy only checked the first few MiB) but despite that, it was signed by management etc. Maybe I made I mistake in my reasoning and I hope someone explains my why, but in my opinion SSL (despite the script kiddie example) is broken as long as we have to trust companies which we shouldn't trust at all.
- 7952 12y ago
  Corporate IT departments tend to rely far too much on network level security like this. But if the users machine is compromised in some way network security is completely useless. Even if TLS was completely perfect there would still be vulnerabilities in software that could be attacked on-mass.
  - frameworkHeavy 12y ago
    Quick tip: En masse, pronounced with an "awww". It's French.
- gizmo686 12y ago
  I think we are pretty safe against MITM attacks (for dragnat survallance). As a quick test, I am sure that many people on this site have access to very public facing, SSL enabled, servers. Try verifing that the public key your server sends is the same one that you get visiting your site. Even without concerns over government survallence, it is probably a good idea to check this occasionally.
tptacek 12y ago
Or, as has been in the case in many of these stories, the public policy vectors are reported roughly accurately, but the specifics and, most especially, the scope aren't. So you have thousands or tens of thousands of FISA directives for specific accounts sent to Google reported as "NSA has a shell on Google servers". It's probably the case that GCHQ simply doesn't collect "all" communications, and can't do much about cert-pinned TLS to Google Mail. (You know, since they got caught fiber tapping Google's UK data centers.)
- andyjohnson0 12y ago
  Google doesn't have any data centres in the UK. http://www.google.com/about/datacenters/inside/locations/index.html http://www.google.com/about/datacenters/inside/locations/ind...
  - tptacek 12y ago
    Sorry, data center fiber connections, not data centers.
mike_hearn 12y ago
TLS all the time on these big websites is a very recent phenomenon, only being activated in the past couple of years. What's more, GCHQ were tapping internal traffic between Google datacenters which wasn't encrypted until Snowden, so TLS between customer and web server only slowed them down. I suspect nowadays they're finding it much harder, but in these documents they're being asked to explain their pre-existing policies which were developed when TLS and internal encryption were much less widely used.

SixSigma 12y ago

I didn't steal that money because I already spent it.

tomp 12y ago
I stole that money but I forgot that I stole it. Not a crime!

higherpurpose 12y ago

> The distinction between ‘internal’ and ‘external’ communications is crucial. Under the Regulation of Investigatory Powers Act (‘RIPA’), which regulates the surveillance powers of public bodies, ‘internal’ communications may only be intercepted under a warrant which relates to a specific individual or address. These warrants should only be granted where there is some suspicion of unlawful activity. However, an individual’s ‘external communications’ may be intercepted indiscriminately, even where there are no grounds to suspect any wrongdoing. This is another reason to force companies to hold local datacenters in major countries...or, if they prefer, put everything under end-to-end encryption, so it doesn't matter where they hold it. Only these 2 options should be given to the companies, otherwise no "foreigner" (in relation to where the data is kept) can trust them with their data. They decide which is less costly, but I'm hoping they choose the latter.

Nursie 12y ago

The political silence on this issue is indeed deafening. As was the press silence (other than the Guardian). The press in this country are far more interested in reality tv, political infighting, fanning flames about 'immigrants' and what the royals are up to. And I suspect it's because most of the public don't care either. There are people who would like privacy, who think that GCHQ should be accountable and then there are other people who are perfectly happy that someone is watching everything, everywhere, because that makes them feel safe, and of course they aren't doing anything wrong, so why should they care? And of course a large proportion of the population either aren't intelligent enough or aren't interested enough to understand what's going on. It makes me angry, but that's the world we live in.

madaxe_again 12y ago
Don't forget about "the muslim problem" and the "international islamic conspiracy". I'm sorry to Godwin the thread, but it's pertinent. The push on "british values" (nationalism) and "preventing non-violent extremism" (such doublespeak) and "combatting islam" is fucking terrifying to anyone even vaguely familiar with the events that preceded the holocaust and the second world war. The surveillance state we find ourselves under just makes it that much easier for atrocities to be committed and utterly hidden from view.
- spingsprong 12y ago
  I suspect something much more mundane. Politicians love to shout about their successes. Only, this government hasn't really got any to shout about, so they're falling back to the old standby that all governments do in situations like this. Wave the flag and be proud to be British.
  - herghost 12y ago
    Sort of. The problem that the mainstream political parties have right now is that right-wing sentiment just scored high in the elections. They need a little bit of sabre-rattling and flag-waving to convince those on the left-most fringe of the newly-empowered right to come back towards the centre, and the only way they can do that is through winning the stupid, populist vote on simple issues again. That of course, coupled with the lack of real achievement from the current government, the ongoing and incredibly unpopular austerity cuts, and a long and drawn-out recovery that doesn't seem to be materialising for most people means that any way to make political hay right now needs to be grasped.

digitalengineer 12y ago

> The Government believes that, even when privacy violations happen, it is not an “active intrusion” because the analyst reading or listening to an individual’s communication will inevitably forget about it anyway. unbelievable! What if they're building a searchable database of every user, so as to have 'dirt' on someone when he 'becomes a threat' to their interests? (Like becoming a spokesman against this sort of thing or whatever the bureaucrats wantto do next year).

dan_bk 12y ago
When I read such things ("...because the analyst reading or listening to an individual’s communication will inevitably forget about it anyway."), it fills me with deep hate against those people. How dare they take us for such idiots?

jpgvm 12y ago

There can be no secret laws in a democracy. Else it's not a damn democracy.

TeMPOraL 12y ago
Since the secret laws are actually out there, what conclusion does this fact support?
- lucastx 12y ago
  Maybe we don't actually have a democracy? You know, we have been watching, for more than a year now, story after story telling us that the Five Eyes intercept, filter and store a range of communications between allegedly criminals, mere suspects and whole populations. A tiny portion information is then used to "fight crime", while the rest sits there, waiting to be used for the economic and political interest of those nations, and to stop dissent and social movements -- even it the information is not used, the mere fact that somebody is watching works damn well to bring fear and distrust to potential unrest.
- grkvlt 12y ago
  What 'secret laws' are you talking about? No such thing exists in the UK, at least. Is there not a similar process for creating legislation publicly in the USA?
  - collyw 12y ago
    The ones you don't know about because they are secret.
  - jpgvm 12y ago
    Many countries have secret laws unfortunately. The US is especially bad because they hide their secret laws behind a veil of "nation security" when they clearly have no requirement to do so. They legalise these secret laws through a secret court.. once again justified with "nation security". Mind you, a secret court whose judges are appointed by the executive. How are we meant to hold our elected representatives accountable when the goings on of these secret courts are not even open to them? How can this possibly be a democracy if we don't have the slightest say in what our executive does in our name? So no, we don't live in a democracy anymore. Long live congress and God bless America.

greggman 12y ago

You might find this debate from Intelligence Squared interesting on this topic. http://www.intelligencesquared.com/events/state-snooping-is-a-price-worth-paying-for-security/ http://www.intelligencesquared.com/events/state-snooping-is-...

csandreasen 12y ago

The section regarding external communications starts on page 37. The same document seems to contradict this article's premise: (from p.41) "Despite the fact that some UK to UK communications may be intercepted under section 8(4) warrants and that common uses of the internet by persons in the British Islands, such as a Google search, a Facebook post, or a "tweet" on Twitter, may entail the making of "external communications" for the purposes of Chapter I of RIPA, the section 8(4) regime as a whole is designed so as not to authorise the selection for examination of communications of this nature, except in the tightly constrained circumstances set out in section 16 of RIPA." Disclaimer: IANA-(British)-L

justincormack 12y ago
It goes on though to say that tweets are posted to a US platform, not an individual, so they all count as external. Only email from one person to another both in the UK is "internal" but they admit it will be collected anyway, but say they can't look at it.
- csandreasen 12y ago
  Well, yeah - with regards to it being an "external" communication, they say that on p.37 (as I said in my post). The document starts talking about the differences between internal and external communications on p.37 and how a tweet that isn't directed to another British citizen is considered an external communication because the server is in the US. They then continue by saying on p.41 that even though that tweet is an external communication, they still aren't authorized to intercept it unless it's "necessary" under section RIPA 5(6)(a) and the tweet also isn't authorized for "selection for examination" unless it meets other criteria under RIPA section 16. The article is focusing on the fact that the tweet is an external communication and neglecting to mention that there are still additional restrictions on collecting external communications. What Charles Farr is saying in that document is a far cry from the article's wording: "By defining the use of ‘platforms’ such as Facebook, Twitter and Google as ‘external communications’, British residents are being deprived of the essential safeguards that would otherwise be applied to their communications - simply because they are using services that are based outside the UK." (After skimming through RIPA, though, I will concede that UK laws can be very obtuse. Section 16 gave me a headache - but that's an entirely different issue than the external communication argument)

BillFranklin 12y ago

The head of GCHQ last year during an inquiry: "If I asked my employees to spy on UK citizens they would walk out...they would quit their jobs" - Perhaps he should quit.

pling 12y ago
I worked in the defense industry. The employees don't give a shit if the pay cheque turns up. It doesn't matter if they're making guns, bombs or reading people's emails. Someone told them it was good and they're getting paid so screw it to ethics and morals.

ZenPro 12y ago

Disclaimer : I worked as an intelligence analyst. 1. I am not in favour of widespread, unaccountable surveillance of UK citizens. 2. During my time we disrupted a number of exceptionally serious terrorist operations.[1] [2] are public knowledge and there are a few others that are not open source at this time. 3. Neither I, nor any of my colleagues, were instructed to keep any files on individuals to be used as political leverage or "for dirt" at a later stage. That is really all I can add. I am not in favour of how far the needle has swung but but anyone not involved in the Intelligence Community is just simply fumbling around in the dark trying to say what does and what does not happen. The threat from Qutbism Islamic Fundamentalism (Wahhabi/Salafist inspired terrorism) is real and intelligence organisations work constantly to prevent attacks. If the threat warrants the level of perceived intrusion...I don't know. That is difficult to judge. Each citizens attitude to risk is different. The HN crowd are technologically-savvy, critical thinkers but our law enforcement and intelligence agencies also have a mandate to protect the elderly, the young and the incapacitated. Do you think my grandmother gives a fuck about your outrage at having your email read? All she cares about is that we don't return to the time of consistent bombing on the streets that plagued the troubles. In short; it's not all about you, your vote is worth exactly one other vote. [1]http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9994940/Jihadists-planned-to-attack-Luton-TA-base-using-remote-controlled-car-packed-with-explosives.html http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/9... [2]http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_Muslim_soldier http://en.wikipedia.org/wiki/2007_plot_to_behead_a_British_M...

Nursie 12y ago
>> In short; it's not all about you, your vote is worth exactly one other vote. And how the hell am I supposed to know what I'm voting for? This is the problem. There has been no discussion. There is no mandate from the public at large, it's all secret programs, secret laws and secret trials. It's sick, and it's not democratic.
- grkvlt 12y ago
  > secret laws Can you explain how a secret law could ever exist?

ZenPro 12y ago

deleted 12y ago

[deleted]

ZenPro 12y ago

I have just re-read this entire thread in its entirety and once again a potentially valuable debate about the limits of police and intelligence services have devolved into a stunningly naive rant centring around - > The Islamic Terrorist threat is made up > The Government is a homogenous entity that cannot be trusted. It is definitely not a disparate group of people and organisations trying to make an effective and functioning society. It is sinister > Intelligence services watch your children naked. Seriously - this is disturbingly dark. In nealty 10 years of service neither I or anyone I ever met in my employment ever saw a child naked. Honestly; that comment hints at real psychological problems. > Government oversight of communications travelling along copper wires is the same as pre-WW2 Nazi Germany > Assertions we live in a police state etc etc. Which is hilarious because I have been to actual police states and very few people assert online they live in a police state. You know, on account of that not being wise in an actual police state. I could go on but this is beyond absurd. Privacy concerns? Legitimate. Anything else? Hollywood-isation of actual intelligence work. 99% of it is seriously boring and no one gives a fuck what porn you watch. Bit busy trying to stop actual people getting killed.