GCHQ Boss Says Tech Companies, Government Should Work Together To Give The Government What It Wants

from the putting-the-'I'-back-in-'team' dept

The head of GCHQ has decided to make some belated overtures to the tech companies intelligence agencies have alienated over the past few years. With the UK's ever-evolving Investigatory Powers Act hanging around like an unwanted, hungover and extremely nosy houseguest, GCHQ Director Robert Hannigan says it's time for the government and tech companies to work together for the mutual betterment of both to give government agencies the access they're stopping just short of legislating into existence.

He starts by stating he doesn't want to ban encryption or demand backdoors…

“It should be possible for technical experts to sit down together and work out solutions,” he said. “I am not in favor of banning encryption. Nor am I asking for mandatory back doors. …

...before stating that backdoors would be a wonderful thing. They just might need to undergo rebranding.

"Not everything is a back door, still less a door which can be exploited outside a legal framework."

OH. You want those kinds of backdoors: the ones that can only be solely exploited within a legal framework. Sorry, we're fresh out. It's not that tech companies don't want to help, but even "technical experts" can't craft an exploitable "not a backdoor" that can only be exploited by whoever the government decides should be able to exploit it. ("Working together" or not, it will be the government that determines access, rather than the technical experts at tech companies who designed it.)

So, Hannigan doesn't want a backdoor. He wants another set of keys for the front door and is requesting that all parties work together to decide whether this set should be left in the mailbox or under the welcome mat. This skewed view likely comes from Hannigan's assumption that the many years of tech compnany cooperation intelligence and law enforcement agencies have enjoyed comes from a deep well of heartfelt goodwill, rather than numerous laws compelling them to do so.

Nonetheless, Hannigan—making just his second appearance in a public forum since taking the helm of GCHQ in 2014—said tech companies should work more closely with governments to try to come up with ways to give law enforcement what it wants. “The perception that there is nothing but conflict between governments and the tech industry is a caricature,” he said in his speech. “In reality, companies are routinely providing help within the law, and I want to acknowledge that today.”

It may have been less of a caricature pre-2013, but it was never simply about tech companies giving the government whatever it wanted whenever it asked for it. That's why the world's intelligence agencies are hoarding exploits, buying malware from shady merchants, and intercepting hardware shipments to add their own backdoors.

And so, yet another request goes out for cooperation in the ongoing search for an intelligence/law enforcement unicorn while War's "Why Can't We Be Friends?" plays in the background. Nothing's going to move forward until officials like Hannigan admit the thing they want (a safe backdoor) isn't something they can actually have -- at least not without a lot of collateral damage. If they can at least be honest enough to state they want it no matter how many problems it causes elsewhere, then maybe they'll be ready to move to the next level of discussion -- even if the "next level" means the discussion has reached its logical endpoint.

Filed Under: backdoors, encryption, gchq, robert hannigan, uk
Companies: apple

UK Surveillance Oversight Board Says It's All Cool When GCHQ Hacks Basically Anyone

from the hack-away,-snoops dept

This isn't a huge surprise, but the UK's Investigatory Powers Tribunal -- which is a sort of extremely weak "oversight" board, charged with making sure that the GCHQ isn't violating the law, but with no real powers over GCHQ and a history of supporting its spying, has now said that the GCHQ's hacking of computers, networks and phones is perfectly fine.

This was in response to a challenge mounted by Privacy International. The IPT was not too concerned about GCHQ spying, and even said that it's fine even without naming specific targets:

Ruling says GCHQ hacking warrants need not name specific individuals - means OK to hack entire orgs/govts/companies: pic.twitter.com/HByqNOVq1l

— Ryan Gallagher (@rj_gallagher) February 12, 2016

As Privacy International has said in response, this appears to completely wipe out the idea that "general warrants" (i.e., not against named individuals/targets) are (and have been) unlawful:

“The IPT has decided that GCHQ can use ‘thematic warrants’, which means GCHQ can hack an entire class of property or persons, such as ‘all phones in Birmingham’.

“In doing so, it has upended a longstanding English common law principle that such general warrants are unlawful. Allowing governments to hack places the security and stability of the internet and the information we exchange on it at stake.”

This is an unfortunate decision, if not that surprising. But yet another reminder that perhaps the UK is a dangerous place for technology firms to do business these days.

Filed Under: gchq, general warrants, hacking, investigatory powers tribunal, ipt, mass surveillance, spying, surveillance, uk

What's The Difference Between 'Mass Surveillance' And 'Bulk Collection'? Does It Matter?

from the words,-words,-words dept

As numerous Techdirt stories make clear, the particular words used to describe something can make a big difference in how it is perceived. For example, intelligence agencies like to avoid the use of the bad-sounding "mass surveillance," with its Orwellian overtones, and prefer to talk about "bulk collection," which can be presented as some kind of cool big data project. No one is more vociferous in insisting that they are not engaged in mass surveillance, but merely bulk collection, than the UK's Home Secretary, Theresa May. She was pushing that line again last week, during a grilling by a UK Parliamentary committee about her proposed Snooper's Charter. As BBC News reported:

She said the security minister, John Hayes, had written to the committee of MPs and peers scrutinising the draft bill to give the reasons why the government did not want to reveal the kinds of data investigators were accessing.

She insisted the practice -- and the sweeping up by the security services of large quantities of internet traffic passing through the UK -- did not amount to "mass surveillance" as civil liberties campaigners claim.

"The UK does not undertake mass surveillance," she told the committee.

Given what we know that GCHQ is already doing, and adding in what the UK government says it wants to do, that seems an absurd thing to say. But Paul Bernal, Lecturer in Information Technology, Intellectual Property and Media Law at the UK's University of East Anglia, thinks that there is more to this than meets the eye:

Precisely what constitutes surveillance is far from agreed. In the context of the internet (and other digital data surveillance) there are, very broadly speaking, three stages: the gathering or collecting of data, the automated analysis of the data (including algorithmic filtering), and then the 'human' examination of the results of that analysis of filtering. This is where the difference lies: privacy advocates and others might argue that the 'surveillance' happens at the first stage -- when the data is gathered or collected -- while Theresa May, [former GCHQ director] David Omand and those who work for them would be more likely to argue that it happens at the third stage -- when human beings are involved.

If surveillance occurs through the act of gathering personal data on a large scale, then clearly what the UK government does (and wants to do more of) is mass surveillance. But if surveillance only takes place once a human operator looks at some of the gathered data, then Theresa May can plausibly argue that what the UK government is engaged in is not mass surveillance, because relatively little personal data is scrutinized in this way. So the question then becomes: at what point is it most appropriate to say that surveillance has occurred? Bernal offers a helpful analogy. What the UK government wants to do with the Snooper's Charter would be like:

installing a camera in every room of every house in the UK, turning that camera on, having the footage recorded and stored for a year -- but having police officers only look at limited amounts of the footage and only when they feel they really need to.

Does the surveillance happen when the cameras are installed? When they’re turned on? When the footage is stored? When it’s filtered? Or when the police officers actually look at it.

Most people would probably find the automated video recording of everything they did in the privacy of their own home intrusive, and clearly a form of surveillance, even if it was unlikely the footage would ever be seen by a human being. And in Europe, the question has already been settled by the courts:

Privacy invasion occurs when the camera is installed and the capability of looking at the footage is enabled. That’s been consistently shown by recent rulings at both the Court of Justice of the European Union and of the European Court of Human Rights. Whether it is called ‘surveillance’ or something else, it invades privacy -- which is a fundamental right. That doesn’t mean that it is automatically wrong -- but that the balancing act between the rights of privacy (and freedom of expression, of assembly and association etc that are protected by that privacy) and the need for 'security' needs to be considered at the gathering stage, and not just at the stage when people look at the data.

That's important, because it is precisely this issue that the courts will have to consider when the inevitable legal challenges are brought against the UK's Snooper's Charter once some version of it becomes law. In the end, whether the Home Secretary thinks what she is doing is mass surveillance or merely bulk collection is irrelevant -- the UK and EU courts will be the ones that decide whether it's allowed.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk collection, gchq, investigatory powers bill, mass surveillance, snooper's charter, spying, surveillance, theresa may, uk

New Documents Show UK Intelligence Agencies Hacking Computers With Little To No Oversight

from the because-of-course-they-are dept

Privacy International, which has been engaged in legal challenges over GCHQ spying for the past few years, has obtained an oversight document as a result of its litigation. What they show is the agency's broad hacking powers and the reluctance of its oversight to condone these actions.

The Commissioner of the Intelligence Services was slow to respond to hacking. Many of the concerns the Commissioner raised in his 2014 report [published July 2015] are the subject of PI's legal complaint, including whether it is lawful to use broad "thematic warrants" to justify the hacking of people in the UK. The Commissioner questioned this practice in depth. He was concerned that current law "does not expressly allow for a class of authorisation", and therefore the warrants were too broad. As a result, the Commissioner was worried that the Secretary of State was unable to properly assess whether the warrant authorised activity was necessary and proportionate. [ibid, p18] This means that GCHQ could get a warrant in the UK to hack the computer of everyone in Birmingham with little meaningful oversight.

Broad warrants at home -- signed by someone who may not have had any idea exactly what they were authorizing. No warrants, for the most part, for extraterritorial hacking. Testimony on behalf of the GCHQ by its director of cyber-security points out that the Secretary of State (who handles surveillance warrants) is rarely consulted when the target is foreign. The only exceptions are if the GCHQ feels the target may be "sensitive" or "politically risky." Otherwise, the GCHQ grants itself permission to carry out these attacks.

Two other agencies that write their own hacking orders (MI5 and the Secret Intelligence Service) also do what they can to eliminate whatever minimal paper trail these actions might generate.

The Intelligence and Security Committee Report in March 2015 called MI5's and SIS's failure to keep accurate records of their overseas hacking activities "unacceptable", [ISC report, p.66] as it makes effective oversight impossible [Witness Statement of Ciaran Martin, 71L].

Arguably, the oversight was never "effective" to begin with. Privacy International's Caroline Wilson Palow points out that Parliament was never notified in the first place by these agencies about their hacking activities. The oversight of three intelligence agencies is pretty much limited to one guy (Sir Mark Waller) who engages in spot checks of warrants periodically. With none of the agencies feeling any particular urge to seek warrants for overseas surveillance, it does cut down on Waller's workload, but it doesn't do much to ensure they aren't abusing their (often) self-awarded privileges.

Filed Under: gchq, oversight, surveillance, uk
Companies: privacy international

UK Releases Snooping Bill, Attempts To Mislead Everyone

from the and-off-we-go dept

Earlier today we reported on a story in the Telegraph, claiming that the upcoming "Investigatory Powers Bill" in the UK would mandate encryption backdoors. The full draft of the bill has been released and the UK government is prattling on about how it doesn't "ban" encryption. But note the subtle difference in language here. No one expected a ban on encryption: they expected backdoors. The bill is actually stupidly vague on this point. Here's what the explanation says about "communication service providers in the UK and overseas."

First it notes that under RIPA (the Regulation of Investigatory Powers Act), "CSPs" are already required to maintain "the ability to remove any encryption applied by the CSP to whom the notice relates." In other words, the government is already claiming mandates to backdoor encryption, and then goes on to note:

The Investigatory Powers Bill will bring together these obligations in a single, comprehensive piece of legislation. It will provide an explicit obligation on CSPs to assist in giving effect to equipment interference warrants. Only intercepting agencies will have the ability to serve such warrants, which must be authorised by the Secretary of State. The draft Bill will not impose any additional requirements in relation to encryption over and above the existing obligations in RIPA.

The draft Bill will provide for the Secretary of State to require CSPs to maintain permanent capabilities relating to the powers under the draft Bill. This will replace the current obligation to maintain a permanent interception capability and will provide a clear basis in law for CSPs to maintain infrastructure and facilities to give effect to interception and other warrants.

The new power will also require CSPs to provide wider assistance to law enforcement and the security and intelligence agencies in the interests of national security. This will replace the general power of direction under the Telecommunications Act 1984. The new power will be subject to strict safeguards that will prevent it from being used to authorise any activity for the purpose of interference with privacy, such as authorising or requiring the disclosure of communications data.

So... is that mandating backdoors? It seems pretty likely that the government will use this combination of factors to do exactly that, but claiming that such backdoors are already required under RIPA -- and thus it's not "expanding" those powers, even as it also says that the new bill requires providing "wider assistance to law enforcement" and "intelligence agencies." The explanation does note that "overseas" companies may have some exceptions, but again it's vague. First it notes that "the draft Bill places the same obligations on all companies providing services to the UK or in control of communications systems in the UK" but then the vague exception: "the draft Bill will include explicit provision to take account of any potential conflict of laws that overseas companies may face."

Right. Clears everything up.

Meanwhile the draft bill has tons of other problematic language, including requirements for data retention for your web browsing history. Also, it broadens GCHQ's ability to hack into computers around the globe, with the innocuous sounding phrase "authorisations to interfere with property." Specifically with regards to the GCHQ, the bill states:

GCHQ can 'make use of' as well as 'monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material'. This clarifies that GCHQ may, in the performance of its functions, make use of communications services in the manner in which it was intended they would be used. This could be used for public communications as well as for investigative purposes.

Home Secretary Theresa May's introduction to the draft claims that:

Powers to intercept communications, acquire communications data and interfere with equipment are essential to tackle child sexual exploitation, to dismantle serious crime cartels, take drugs and guns off our streets and prevent terrorist attacks.

In fact, the draft is weirdly peppered with "case studies" about gangs, criminals, exploited children and more as if to scream out "WE'RE SPYING ON YOU FOR YOUR OWN GOOD AND THE CHILDREN, SO SUBMIT." This bill is not about protecting the public. It's about giving much more surveillance and spying power to the government. It's about fearmongering to get you to give up your privacy and safety so that the government can have more powers over the general public.

Filed Under: data retention, encryption, gchq, going dark, mass surveillance, snooper's charter, surveillance, uk

UK Politicians To Hold 'Emergency Debate' After Spy Tribunal Says GCHQ Is Permitted To Put Them Under Surveillance

from the blanket-surveillance-still-just-for-'little-people' dept

Now we can see what moves legislators to take swift action against domestic surveillance. It all depends on who's being targeted.

A long-held "gentleman's agreement" that GCHQ would not spy on members of Parliament (with an exigent circumstances exception, naturally) was found to be not legally-binding by the UK's surveillance oversight tribunal.

Today, a panel, headed by Mr Justice Burton, made declarations that the Wilson Doctrine applies only to targeted, and not incidental, interception of Parliamentary communications, but that it has no legal effect, save that in practice the Security and Intelligence Agencies must comply with their own guidance.

The Wilson doctrine, implemented by prime minister Harold Wilson in November 1966, lay down the policy of no tapping of the phones of MPs or members of the House of Lords, unless there is a major national emergency, and that any changes to the policy will be reported by the prime minister to Parliament.

Once the Parliament members discovered they too could be subjected to GCHQ's "blanket surveillance," they moved quickly.

MPs are to hold an emergency debate on the Wilson doctrine, amid fears the convention designed to prevent politicians' communications being spied upon is "dead".

[...]

Shadow Commons leader Chris Bryant led a successful application in the Commons for an emergency debate in response to Wednesday's judgment.

The debate has been allocated up to three hours on Monday, October 19.

When it's just the general public and foreign citizens of dozens of nations, politicians generally agree there's a "debate" to be had over dragnet surveillance. The debate then takes place with minimal input from those affected and tends to include large amounts of terrorist fear-mongering and quibbling over how much exactly national security agencies should be allowed to get away with. (As much as possible, usually. Especially when the fear-mongering side has the floor.)

When it's those up top discovering they, too, might be subject to the same surveillance they've inflicted on the rest of the nation (and foreigners who have been granted no rights whatsoever), they step all over themselves in their haste to "debate" the side of the issue that states they should continue to be excepted from the laws that apply to everyone else.

One MP even portrayed the special Parliament members-only surveillance exceptions to be essential for the continued representation of the public that was never included in the government's "gentleman's agreement" with its spy agency.

Mr Bryant said the judgment had resulted in an "ambiguity" which needed to be cleared up urgently, adding it had also cast doubt on the protections supposedly afforded by the convention.

Earlier, the Labour frontbencher told the Commons: "The right of members of this House to be able to represent their constituents without fear or favour is intrinsic to our democracy."

Right now, though, most of these legislators are only representing themselves. If their constituents can be subjected to both targeted and incidental collections, so should they. If they want the ability to advocate on behalf of the public without fear of someone reading their emails over their shoulder, the first thing they should do is expand this protection to constituents who are not currently under investigation or suspected of terrorist activity. Because as of right now, the only message this "emergency debate" sends is that the public's representatives wish to continue cloaking themselves in privilege and hypocrisy.

Filed Under: debate, gchq, parliament, privacy, surveillance, uk, wilson doctrine

GCHQ's Karma Police: Tracking And Profiling Every Web User, Every Website

from the this-is-what-you'll-get,-when-you-mess-with-us dept

One of the very first revelations from the Snowden leaks was a GCHQ program modestly entitled "Mastering the Internet." It was actually quite a good name, since it involved spying on vast swathes of the world's online activity by tapping into the many fiber optic cables carrying Internet traffic that entered and left the UK. The scale of the operation was colossal: the original Guardian article spoke of a theoretical intake of 21 petabytes every day. As the Guardian put it:

For the 2 billion users of the world wide web, Tempora represents a window on to their everyday lives, sucking up every form of communication from the fibre-optic cables that ring the world.

But the big question was: what exactly did GCHQ do with that huge amount of information? Two years later, we finally know, thanks to a new article in The Intercept, which provides details of another major GCHQ program called "Karma Police" -- the name of a song by Radiohead, with the repeated line "This is what you'll get, when you mess with us". A GCHQ document obtained by Snowden indicates that Karma Police goes back some years -- at least to 2008. It provides the following summary of the project's aims:

KARMA POLICE aims to correlate every user visible to passive SIGINT [signals intelligence] with every website they visit, hence providing either (a) a web browsing profile for every visible user on the internet, or (b) a user profile for every visible website on the internet.

Profiling every (visible) user, and every (visible) website seems insanely ambitious, especially back in 2008 when computer speeds and storage capacities were far lower than today. But the information that emerges from the new documents published by The Intercept suggests GCHQ really meant it -- and probably achieved it.

As of 2012, GCHQ was storing about 50 billion metadata records about online communications and Web browsing activity every day, with plans in place to boost capacity to 100 billion daily by the end of that year. The agency, under cover of secrecy, was working to create what it said would soon be the biggest government surveillance system anywhere in the world.

That's around 36 trillion metadata records gathered in 2012 alone -- and it's probably even higher now. As Techdirt has covered previously, intelligence agencies like to say this is "just" metadata -- skating over the fact that metadata is actually much more revealing than traditional content because it is much easier to combine and analyze. An important document released by The Intercept with this story tells us exactly what GCHQ considers to be metadata, and what it says is content. It's called the "Content-Metadata Matrix," and reveals that as far as GCHQ is concerned, "authentication data to a communcations service: login ID, userid, password" are all considered to be metadata, which means GCHQ believes it can legally swipe and store them. Of course, intercepting your login credentials is a good example of why GCHQ's line that it's "only metadata" is ridiculous: doing so gives them access to everything you have and do on that service.

Login ID, userid and password all considered to be "metadata"

The trillions of metadata records are stored in a huge repository called "Black Hole." In August 2009, 41 percent of Black Hole's holdings concerned web browsing histories. The rest included a wide range of other online services: email, instant messenger records, search engine queries, social media, and data about the use of tools providing anonymity online. GCHQ has developed software to analyze these other kinds of metadata in various ways:

SOCIAL ANTHROPOID, which is used to analyze metadata on emails, instant messenger chats, social media connections and conversations, plus “telephony” metadata about phone calls, cell phone locations, text and multimedia messages; MEMORY HOLE, which logs queries entered into search engines and associates each search with an IP address; MARBLED GECKO, which sifts through details about searches people have entered into Google Maps and Google Earth; and INFINITE MONKEYS, which analyzes data about the usage of online bulletin boards and forums.

In order to connect these different kinds of Internet activity with individuals, GCHQ makes great use of information stored in cookies:

A top-secret GCHQ document from March 2009 reveals the agency has targeted a range of popular websites as part of an effort to covertly collect cookies on a massive scale. It shows a sample search in which the agency was extracting data from cookies containing information about people's visits to the adult website YouPorn, search engines Yahoo and Google, and the Reuters news website.

Other websites listed as "sources" of cookies in the 2009 document are Hotmail, YouTube, Facebook, Reddit, WordPress, Amazon, and sites operated by the broadcasters CNN, BBC, and the U.K.'s Channel 4.

Clearly the above activities allow incredibly-detailed pictures of an individual's online activities to be built up, not least their porn-viewing habits. One tool designed to "provide a near real-time diarisation of any IP address" is called, rather appropriately, Samuel Pepys, after the famous 17th-century English diarist.

The extraordinary scale of GCHQ's spying on "every visible user" raises key questions about its legality. According to The Intercept story:

In 2010, GCHQ noted that what amounted to "25 percent of all Internet traffic" was transiting the U.K. through some 1,600 different cables. The agency said that it could "survey the majority of the 1,600" and "select the most valuable to switch into our processing systems."

Much of that traffic will be from UK citizens when they access global services like Google or Facebook, which GCHQ has admitted it defines as "external platforms," and which is thus completely stripped of what few safeguards UK law offers against this kind of intrusive surveillance by GCHQ.

This means that it is certain that many -- perhaps millions -- of UK citizens have been profiled by GCHQ using these newly-revealed programs, without any kind of warrant or authorization being given or even sought. The information stored in the Black Hole respository, and analyzed with tools like Samuel Pepys, provides unprecedented insights into the minutiae of their daily lives -- which websites they visit, which search terms they enter, who they contact by email or message on social networks. Within that material, there is likely to be a host of intimate facts that could prove highly damaging to the individual's career or relationships if revealed -- perfect blackmail material, in other words. Thanks to other Snowden documents, we know that the NSA had plans to use this kind of information in precisely this way. It would be naive to think it would never be used domestically, too.

It's frustrating that it has taken over two years for these latest GCHQ documents to be published, since they reveal that the scale of British online surveillance and analysis is even worse than the first Snowden documents indicated, bad as they were. They prove that the current calls for additional spying powers in the Snooper's Charter are even more outrageous than we thought, since the UK authorities already track and store British citizens' online moves in great detail.

When Edward Snowden handed over his amazing trove of documents to journalists to release as they thought best, he also placed a huge responsibility on their shoulders to do so as expeditiously as possible. If, as seems likely, there are yet more important revelations about the scale of US and UK spying to come, it is imperative that they are published as soon as possible to help the fight against those countries' continuing attempts to bolster mass surveillance and weaken our freedoms.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: collect it all, gchq, karma police, logins, mass surveillance, metadata, passwords, social media, surveillance, uk

Amnesty International Told That GCHQ Spied On Its Communications

from the because-of-course-it-did dept

Amnesty International has been heavily engaged in fights against mass surveillance, recognizing that many of the people it communicates with need an expectation of privacy in their communications with the group. Last year, Ed Snowden revealed that the NSA specifically spied on Amnesty International and other human rights organizations. And, while Amnesty International was unable to gain standing by the US Supreme Court, since it couldn't prove that the NSA had spied on its communications, the story appears to be somewhat different over in the UK.

Last year a legal challenge was filed in the UK via the Investigatory Powers Tribunal (IPT) concerning Amnesty International. And now, the group has been informed that, yes, it was spied on by GCHQ in the UK.

In a shocking revelation, the UK’s Investigatory Powers Tribunal (IPT) today notified Amnesty International that UK government agencies had spied on the organization by intercepting, accessing and storing its communications.

In an email sent today, the Tribunal informed Amnesty International its 22 June ruling had mistakenly identified one of two NGOs which it found had been subjected to unlawful surveillance by the UK government. Today’s communication makes clear that it was actually Amnesty International Ltd, and not the Egyptian Initiative for Personal Rights (EIPR) that was spied on in addition to the Legal Resources Centre in South Africa.

As you may recall, a little over a week ago, the IPT had ruled that the GCHQ had erred in holding onto emails too long -- but had named that Egyptian organization as the one whose emails were held. However, that's now been corrected to Amnesty International.

The actual email sent by the IPT basically says that GCHQ told them that the IPT made a mistake. What you won't see anywhere is an apology from GCHQ. Amnesty is rightfully incensed about the whole thing:

“How can we be expected to carry out our crucial work around the world if human rights defenders and victims of abuses can now credibly believe their confidential correspondence with us is likely to end up in the hands of governments?

“The revelation that the UK government has been spying on Amnesty International highlights the gross inadequacies in the UK’s surveillance legislation. If they hadn’t stored our communications for longer than they were allowed to by internal guidelines, we would never even have known. What’s worse, this would have been considered perfectly lawful.”

Both issues raised here are significant. The only reason Amnesty now knows about this is because GCHQ held onto the emails too long. If it had done its usual purge, then the IPT likely would never have revealed that, and Amnesty's communications would have continued to go on being compromised without anyone knowing.

Filed Under: amnesty international, gchq, ipt, secrecy, surveillance, uk
Companies: amnesty international

GCHQ Asked Court To Let It Infringe On Anti-Virus Copyrights... For National Security

from the nothing-is-intact dept

National security apparently means "securing" the nation at the expense of citizens' security. New Snowden documents published by The Intercept show massive amounts of dicking around in the coding of popular anti-virus software by the NSA and GCHQ. The list of antivirus products not affected would be much, much shorter than a list of those that have been.

Much of what listed here involves the NSA and GCHQ monitoring threats reported to these antivirus makers (by intercepting email messages, naturally), obviously in hopes of finding something temporarily exploitable. But in other cases, the efforts went much, much deeper. The GCHQ obtained a warrant to reverse engineer Kapersky products because it felt the company's software was "obstructing" its hacking attempts.

“Personal security products such as the Russian anti-virus software Kaspersky continue to pose a challenge to GCHQ’s CNE [Computer Network Exploitation] capability and SRE is essential in order to be able to exploit such software and to prevent detection of our activities,” the warrant renewal request said. “Examination of Kaspersky and other such products continues.” The warrant renewal request also states that GCHQ reverse engineers anti-virus programs to assess their fitness for use by government agencies.

Not only did the GCHQ seek permission to tear apart a legitimate security product for its own ends, but it also asked for an exception to UK copyright law in order to do so.

GCHQ’s success as an intelligence agency is founded on technical knowledge and creativity. In particular this may involve modifying commercially available software to enable interception, decryption and other related tasks, or “reverse engineering” software (this means to convert it from machine readable code into the original format, which is then comprehensible to a person). These actions, and others necessary to understand how the software works, may represent an infringement of copyright. The interference may also be contrary to, or inconsistent with, the provisions of any licensing agreement between GCHQ and the owners of the rights in the software.

Recognizing this could potentially cause a problem if its efforts were discovered, GCHQ explicitly asked that it be granted permission to engage in copyright infringement in the name of national security.

There is a risk that in the unlikely event of a challenge by the copyright owner or licensor, the Courts would, in the absence of a legal authorisation, hold that such activity was unlawful and amounted to a copyright infringement or breach of contract. The purpose of this warrant is to provide authorisation for all continuing activities which involve interference with copyright or licensed software, but which cannot be said to fall within any other specific authorisation held by GCHQ and which are done without the permission of the owner.

In other words, GCHQ doesn't have specific authorization to violate copyrights or licensing agreements, but for this particular effort, the warrant would act as a blanket permission slip to engage in this illegal activity. And, in doing so, it stretched an intelligence law to cover its violation of intellectual property laws.

GCHQ obtained a warrant for reverse engineering under a section of British intelligence law that does not explicitly authorize — and had apparently never been used to authorize — the sort of copyright infringement GCHQ believed was necessary to conduct such activity.

The spy agency instead relied on the Intelligence Services Commissioner to let it use a law pertaining only to property and “wireless telegraphy,” a law that had never been applied to intellectual property, according to GCHQ’s own warrant renewal application. Eric King, deputy director of U.K. surveillance watchdog Privacy International said, after being shown documents related to the warrant, “The secret reinterpretation of powers, in entirely novel ways, that have not been tested in adversarial court processes, is everything that is wrong with how GCHQ is using their legal powers.”

On top of that, the type of warrant it obtained was only to be used for foreign surveillance, but supporting documentation notes GCHQ would also be performing its reverse engineering to support "police operations" and the domestically-focused National Technical Assistance Centre.

When it comes to national security efforts, laws just don't apply, it would appear. The NSA and GCHQ's efforts are completely indistinguishable from those of cybercriminals. While these agencies may have "good" on their side -- at least in terms of not wishing specific harm to non-targets -- the end result is the same: a less secure computing world.

Filed Under: anti-virus, copyright, gchq, infringement, national security, reverse engineering
Companies: kaspersky

GCHQ Dinged For Illegally Holding Onto Human Rights Groups Emails Too Long, Not For Collecting Them In The First Place

from the that's-not-right dept

Following on a ruling nearly two months ago, where the UK's Investigatory Powers Tribunal -- for the very first time -- found that GCHQ had broken the law with its surveillance of client/attorney communications, now the IPT has ruled against GCHQ again. The IPT says that GCHQ held emails of human rights activists for too long -- but found that the initial collection of those emails was no problem at all.

In respect of the Third Claimant (The Egyptian Initiative for Personal Rights), the Tribunal has found that email communications of the Third Claimant were lawfully and proportionately intercepted and accessed, pursuant to s.8(4) of RIPA. However, the time limit for retention permitted under the internal policies of GCHQ, the intercepting agency, was overlooked in regard to the product of that interception, such that it was retained for materially longer than permitted under those policies.

So, no problem spying on human rights organizations -- just make sure you delete the emails within the allotted timeframe. And, of course, the court concludes that this is a pretty minor violation, given that there's no evidence anyone actually looked at the data after they should have destroyed it:

We are satisfied however that the product was not accessed after the expiry of the relevant retention time limit, and the breach can thus be characterised as technical...

Still, it notes, even a technical breach is a breach and thus slaps GCHQ on the wrist. This seems like pretty weak sauce all around, but at the very least, the IPT is finally recognizing that GCHQ isn't following the law at times. It's not nearly enough, and the level of oversight is laughable. And, of course, none of these breaches, technical or otherwise, likely would have come to light at all without Ed Snowden.

Filed Under: emails, gchq, human rights, investigatory powers tribunal, ipt, privacy