GCHQ Boss Says Tech Companies, Government Should Work Together To Give The Government What It Wants

from the putting-the-'I'-back-in-'team' dept

The head of GCHQ has decided to make some belated overtures to the tech companies intelligence agencies have alienated over the past few years. With the UK's ever-evolving Investigatory Powers Act hanging around like an unwanted, hungover and extremely nosy houseguest, GCHQ Director Robert Hannigan says it's time for the government and tech companies to work together for the mutual betterment of both to give government agencies the access they're stopping just short of legislating into existence.

He starts by stating he doesn't want to ban encryption or demand backdoors…

“It should be possible for technical experts to sit down together and work out solutions,” he said. “I am not in favor of banning encryption. Nor am I asking for mandatory back doors. …

...before stating that backdoors would be a wonderful thing. They just might need to undergo rebranding.

"Not everything is a back door, still less a door which can be exploited outside a legal framework."

OH. You want those kinds of backdoors: the ones that can only be solely exploited within a legal framework. Sorry, we're fresh out. It's not that tech companies don't want to help, but even "technical experts" can't craft an exploitable "not a backdoor" that can only be exploited by whoever the government decides should be able to exploit it. ("Working together" or not, it will be the government that determines access, rather than the technical experts at tech companies who designed it.)

So, Hannigan doesn't want a backdoor. He wants another set of keys for the front door and is requesting that all parties work together to decide whether this set should be left in the mailbox or under the welcome mat. This skewed view likely comes from Hannigan's assumption that the many years of tech compnany cooperation intelligence and law enforcement agencies have enjoyed comes from a deep well of heartfelt goodwill, rather than numerous laws compelling them to do so.

Nonetheless, Hannigan—making just his second appearance in a public forum since taking the helm of GCHQ in 2014—said tech companies should work more closely with governments to try to come up with ways to give law enforcement what it wants. “The perception that there is nothing but conflict between governments and the tech industry is a caricature,” he said in his speech. “In reality, companies are routinely providing help within the law, and I want to acknowledge that today.”

It may have been less of a caricature pre-2013, but it was never simply about tech companies giving the government whatever it wanted whenever it asked for it. That's why the world's intelligence agencies are hoarding exploits, buying malware from shady merchants, and intercepting hardware shipments to add their own backdoors.

And so, yet another request goes out for cooperation in the ongoing search for an intelligence/law enforcement unicorn while War's "Why Can't We Be Friends?" plays in the background. Nothing's going to move forward until officials like Hannigan admit the thing they want (a safe backdoor) isn't something they can actually have -- at least not without a lot of collateral damage. If they can at least be honest enough to state they want it no matter how many problems it causes elsewhere, then maybe they'll be ready to move to the next level of discussion -- even if the "next level" means the discussion has reached its logical endpoint.

Filed Under: backdoors, encryption, gchq, robert hannigan, uk
Companies: apple

Sensing Public Support Waning, UK Fast Tracks Snooper's Charter

from the get-the-damn-thing-through-and-then-spy-on-everyone dept

For some time now, we've been covering the UK's plan -- led by Home Secretary Theresa May -- to pass a new Snooper's Charter that would increase surveillance powers greatly in the UK. There's been a growing amount of criticism of the plan in the UK, so rather than respond to it, May has simply moved to fast track the bill, officially called the Investigatory Powers Bill. The bill will officially be "published" today on March 1, and then will likely be voted on before the end of April.

Of course, this seems like standard operating procedures these days. Two years ago, the UK government did the same thing with its data retention bill. It's almost as if the UK government would prefer cutting off debate on these issues, and just rushing through much greater surveillance powers for the government.

Filed Under: investigatory powers bill, snooper's charter, theresa may, uk

Puritanical Facebook Censors Parody Publication, Makes Appeal Process A Threat

from the innocent-lambs dept

I have no idea why, but there seems to be a sudden influx of stories concerning Facebook patrolling its site and taking down content over rather puritanical standards of offense and vulgarity. The most recent examples of this have concerned a couple of pieces of artwork that the Facebook Decency Office deemed to be to risque, despite the fact that neither of the art pieces could reasonably be described as particularly pornographic. The most recent example of this kind of censorious brigade is less to do with scary, scary sex, and more to do with parody content that some might find vulgar.

It appears Viz, an outfit that is essentially an old-timey British take on The Onion, has had its Facebook page seized with little to no explanation.

The almost 40-year-old Viz, a parody of titles like Beano but with frequently risque language and humour, tweeted that Facebook has blocked its page. Ian Westwood, group managing director at parent Dennis Publishing, said that Facebook has not said what content violated its content rules.

“The question is what is, and isn’t acceptable to Facebook,” he said. “We have had that Facebook page for five years. We have had correspondence with them before about stuff they haven’t liked and we’ve taken it down. This time they have just blocked the page and won’t tell us what we’ve violated. We can appeal, but we don’t know what we would be appealing about, we put up a significant number of posts from the print brand to social media each day.”

Perhaps more strangely, while Facebook has informed Viz that it can appeal the unilateral blocking of its Facebook page, a loss in that appeal would result in a perma-ban.

The message from Facebook warned that if the publisher makes an unsuccessful appeal to have the page reinstated, it could face being permanently deleted.

Now, it should be noted that Viz uses language and subject matters that could certainly be considered much more crass compared with other parody outfits such as The Onion. It should also be noted that Viz is hilarious as well as useful in pointing out the absurdity of every day news and news publications. That's how parody works, after all. In fact, the publication has been tweeting out to members, as well as to Facebook, its concept work for updating its Facebook page, on which it has changed most of the imagery to puppies and kittens to try to appease the Facebook prude-patrol. This has had the effect of alerting those following Viz that Facebook has taken the page down, resulting in the appropriate backlash.

The idea that a social media site like Facebook would take down this kind of parody, ostensibly on the grounds of vulgarity, is silly in and of itself. It will, of course, only result in people pointing out just how much other vulgar content exists on the site and how haphazard the site appears to be in this kind of policing. But to do all of this without bothering to inform the victim of why the takedown has occurred and to then use the appeals process as a threat of perma-ban? C'mon.

Filed Under: censorship, parody, satire, takedowns, uk, viz
Companies: facebook, viz

UK's Pirate Site Blocklist Even More Pointless Than Previously Thought: HTTPS Defeats It

from the almost-too-easy dept

It will come as no surprise to sophisticated Internet users like Techdirt readers that the UK's attempts to block a growing list of "pirate" sites are easy to circumvent. But a post on TorrentFreak suggests that you don't even need to be a sophisticated Techdirt reader to do that:

While it's hard to stamp out piracy completely, the measures were supposed make it harder for UK Internet subscribers to access these sites.

However, a recent review of current blocking practices shows that several ISPs including Virgin Media, BT, EE and TalkTalk are failing. It turns out that many subscribers don't have to jump through technological hoops to circumvent the blockades, as many popular pirate sites are freely accessible on their regular connections.

With the help from several subscribers, TorrentFreak was able to confirm that the HTTPS versions of most blocked websites including The Pirate Bay, KickassTorrents, RARBG and Torrentz, are still freely accessible.

Apparently this has been known in certain circles for quite a while. Some pirate sites have even gone so far as to force users to connect using HTTPS to enable them to enjoy this further advantage of encryption. There's an interesting discussion in the comments on the TorrentFreak post as to when and why HTTPS connections can get around the court-mandated blocks, and what ISPs might try to do to close this gaping loophole. Even if they do, the other circumvention methods will remain.

The real point here is that the copyright industries are fighting a war they cannot win. That's not just stupid in itself, but doubly stupid, because there's a much better approach that they could take, as Techdirt has noted before: all they need to do to stop most people visiting pirate sites is to offer a good service at a fair price. Simple, really. Almost as simple as using HTTPS.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: copyright, encryption, filter, https, piracy, piracy list, site blocking, uk

UK Surveillance Oversight Board Says It's All Cool When GCHQ Hacks Basically Anyone

from the hack-away,-snoops dept

This isn't a huge surprise, but the UK's Investigatory Powers Tribunal -- which is a sort of extremely weak "oversight" board, charged with making sure that the GCHQ isn't violating the law, but with no real powers over GCHQ and a history of supporting its spying, has now said that the GCHQ's hacking of computers, networks and phones is perfectly fine.

This was in response to a challenge mounted by Privacy International. The IPT was not too concerned about GCHQ spying, and even said that it's fine even without naming specific targets:

Ruling says GCHQ hacking warrants need not name specific individuals - means OK to hack entire orgs/govts/companies: pic.twitter.com/HByqNOVq1l

— Ryan Gallagher (@rj_gallagher) February 12, 2016

As Privacy International has said in response, this appears to completely wipe out the idea that "general warrants" (i.e., not against named individuals/targets) are (and have been) unlawful:

“The IPT has decided that GCHQ can use ‘thematic warrants’, which means GCHQ can hack an entire class of property or persons, such as ‘all phones in Birmingham’.

“In doing so, it has upended a longstanding English common law principle that such general warrants are unlawful. Allowing governments to hack places the security and stability of the internet and the information we exchange on it at stake.”

This is an unfortunate decision, if not that surprising. But yet another reminder that perhaps the UK is a dangerous place for technology firms to do business these days.

Filed Under: gchq, general warrants, hacking, investigatory powers tribunal, ipt, mass surveillance, spying, surveillance, uk

UK Court Tells Online Mapping Company It's Not Illegal For Google To Also Offer Online Maps

from the it's-called-competition dept

It's still somewhat strange to me to see how badly some companies react to basic competition. Yes, sometimes that means companies lose, but it doesn't automatically make any and all competition unfair. An online map company, StreetMap.Eu sued Google a few years ago, claiming that Google's entrance into the online mapping world, and specifically including maps in search results, was unfair competition. However, the UK High Court has now, rightfully, rejected such a claim. The basis of the ruling seemed rather straightforward:

But the judge ruled that the introduction by Google of the new-style Maps OneBox in 2007 was "not reasonably likely appreciably to affect competition in the market for online maps".

The judge added that, in any event, Google's conduct was " objectively justified".

StreetMap's director Kate Sutton, however, is insisting that the company will appeal and says the whole thing is "unfair."

"The decision is unfair for small businesses," Sutton said, and added that StreetMap would attempt to appeal against the judgment, which found that Google's search dominance had not directly harmed competition in the UK's online mapping market.

I'm kind of curious what Sutton thinks is the appropriate remedy here: that no larger company should ever be allowed to offer services useful to consumers, which might somehow be "unfair" to smaller competitors? I'm a huge supporter of more competition in innovative services, but that should be driven by what's best for consumers, not what's best for small companies. Besides, plenty of small companies figure out how to innovate and take on large companies. The fact that her company has chosen not to do so is not Google's fault. Hell, Google itself, when it showed up entered a very crowded market and was laughed at for being such a small player in a market dominated by established companies. And what happened there?

Filed Under: antitrust, competition, consumer benefit, fairness, innovation, online maps, uk
Companies: google, streetmaps

UK Investigative Agencies Want To Be Able To Send Warrants To US Companies

from the lots-of-'solutions,'-all-of-them-terrible-in-different-ways dept

Because citizens are localized but their data isn't, things aren't going to get any less weird as time progresses. Or any less legally troublesome. Ellen Nakashima and Andrea Petersen of the Washington Post have seen a copy of a draft negotiating document between UK and US representatives that would allow MI5 (and presumably other agencies) to access data and communications held on US servers.

The transatlantic allies have quietly begun negotiations this month on an agreement that would enable the British government to serve wiretap orders directly on U.S. communication firms for live intercepts in criminal and national security investigations involving its own citizens. Britain would also be able to serve orders to obtain stored data, such as emails.

UK agencies would still be locked out of obtaining information or data on US persons and it would take legislation to actually make this access a reality, but it's apparently being considered, as UK officials feel this issue is standing in the way of investigations/counterterrorism efforts.

As it stands now, UK agencies must make formal diplomatic requests which rely on a Mutual Legal Assistance Treaty -- a process that can take months. That's not good enough, apparently. Everyone wants instant access, including UK agencies, and a strong streak of entitlement (the same entitlement guiding FBI director James Comey's one-sided "debate" on encryption) runs through the arguments for this expansion of the UK's legal powers.

“Why should they have to do that?” said the administration official. “Why can’t they investigate crimes in the U.K., involving U.K. nationals under their own laws, regardless of the fact that the data happens to be on a server overseas?”

Why indeed? Why comply with existing laws or territorial restrictions? After all, the FBI is working toward the same end, pushing for the right to hack servers located anywhere in the world when pursuing criminals.

Several issues need to be addressed before UK agencies can be granted permission to demand communications and data from US companies. For one thing, a warrant issued in the UK is not exactly the same thing as a warrant issued in the US. The legal standards may be similar, but they're still a long ways from identical.

The negotiating text was silent on the legal standard the British government must meet to obtain a wiretap order or a search warrant for stored data. Its system does not require a judge to approve search and wiretap warrants for surveillance based on probable cause, as is done in the United States. Instead, the home secretary, who oversees police and internal affairs, approves the warrant if that cabinet member finds that it is “necessary” for national security or to prevent serious crime and that it is “proportionate” to the intrusion.

Note the "silence" on the differences between the legal standards. It appears no one involved in this discussion is interested in digging into these disparities.

A second administration official said that U.S. officials have concluded that Britain “already [has] strong substantive and procedural protections for privacy.” He added: “They may not be word for word exactly what ours are, but they are equivalent in the sense of being robust protections.”

As a result, he said, Britain’s legal standards are not at issue in the talks. “We are not weighing into legal process standards in the U.K., no more than we would want the U.K. to weigh in on what our orders look like,” he said.

That's great. Both countries won't examine each other's legal standards because they don't want to upset the reciprocity implicit in the draft agreement. The UK can ask for stuff from US companies and vice versa, with neither country playing by the other country's rules. In between all of this are citizens of each respective countries, whose data and communications might be subjected to varying legal standards -- not based on where the data is held, but who's asking for it.

Of course, the alternatives are just as problematic. If an agreement like this fails to cohere, overseas governments will likely demand data and communications generated by their citizens be stored locally, where they would be subject only to local standards.

Then there's the question of what information these agencies already have access to, thanks to the surveillance partnership between the NSA and GCHQ. Although neither agency is supposed to be focused on domestic surveillance (although both participate in this to some extent), the NSA is allowed to "tip" domestic data to the FBI for law enforcement purposes. Presumably, GCHQ can do the same with MI5. The tipped info may not be as comprehensive as what could be obtained by approaching a provider directly, but it's certainly more than the black hole the current situation is being portrayed as. (Especially considering GCHQ already has permission to break into any computer system located anywhere in the world...)

No matter what conclusion the parties come to, legislation addressing it is likely still several months away, if it ever coheres at all. Congress -- despite its occasional lapses into terrorist-related idiocy -- is likely not interested in subjecting US companies to foreign laws, no matter the stated reason for doing so. But if it doesn't oblige the UK (and others who will jump on the all-access bandwagon), it's safe to assume the British government will move towards forcing US companies to set up local servers and segregating communications and data by country of origin.

Filed Under: surveillance, uk, us, warrants

UK Police Deny Misspelling Led To Investigation, Say It Was Other Schoolwork Instead

from the still-a-problem dept

We had just relayed a story via the BBC about an elementary school kid in the UK earning a visit to his home from the authorities after writing in an English assignment that he lived in a "terrorist house", when he reportedly was trying to say he lived in a "terraced house." The crux of this story was that the UK's Anti-Terrorism law, which requires that school teachers act as surveillance agents for the state in an attempt to weed out future-radicalized will-be-terrorists is a policy built for unintended chaos, given that teachers are neither trained nor properly equipped to fulfill this role. The resulting visit to the boy's home by the authorities from a misspelled word was billed as an example of this overreach by government.

But, as some in the comments pointed out, Lancashire police have pushed back on the BBC's story, saying that it wasn't the misspelled words that triggered the visit and ultimately resulted in the authorities determining there was no need for an investigation, but was instead other schoolwork the boy had done that triggered the visit and ultimately resulted in the authorities determining there was no need for an investigation.

In a statement, police and the county council said it was "untrue to suggest that this situation was brought about by a simple spelling mistake. The school and the police have acted responsibly and proportionately in looking into a number of potential concerns using a low-key, local approach," it said. "No concerns were identified and no further action was required by any agency."

For some reason, there are those that think this vindicates both law enforcement and the UK's law because police say the spelling error had nothing to do with any of this. I can't quite figure out the logic of those people, because this is still a story about a teacher using schoolwork to identify a Muslim boy possibly being dangerous that triggered a visit to the boy's home from the authorities. While the BBC has pulled its original post as a result of the pushback, the fundamentals of the story haven't really changed at all. We still have a scared child and an annoyed family stemming from law enforcement action built on the back of a teacher picking through the child's schoolwork. That isn't a sustainable model for combating terrorism, but it is a sustainable model for alienating an entire subsection of a nation's population.

Miqdaad Versi, assistant secretary-general of the Muslim Council of Britain, the UK's largest umbrella group for Islamic associations, said he was aware of dozens of cases similar to that of the schoolboy.

"There are huge concerns that individuals going about their daily life are being seen through the lens of security and are being seen as potential terrorists rather than students," he said. "This is a natural consequence of the extension of the 'Prevent Duty' to schools."

Regardless of the police pushback, which was extremely light on details, that hasn't changed.

Filed Under: children, homework, police, spelling, terrorist, uk

How The UK's Counter-Terrorism And Security Act Has Made Law Enforcement Into The Literal Grammar Police

from the if-you-sea-something-say-something dept

We've already talked a couple of times about the intersection with the UK's disastrous Counter-Terrorism and Security Act and its intersection with the country's educational system. As part of its effort to weed out terrorists, the UK tasked teachers with keeping a watchful eye on their students to try to identify those that would be radicalized in the future, a concept that sounds like something out of Airstrip One rather than England. Shortly thereafter it was discovered that a software package that teachers had been given to help with this was exploitable in the typically laughable ways. But the tech isn't the only shortfall here. As one would expect when you take a group of people whose profession has in absolutely no way prepared them to act as counter-terrorism psychologists and ask them to be just that, it turns out that the human intelligence portion of this insane equation is off by several integers as well.

Remember a time when someone would harp on you for something you'd written on the internet with spelling or syntax errors? Remember what you called those people? I call them grammar police. It turns out that the UK actually has grammar police.

A simple spelling mistake has led to a 10-year-old Muslim boy being interviewed by British police over suspected links to terrorism. The boy, who lives in Accrington in Lancashire, wrote in his primary school English class that he lived in a “terrorist house”. He meant to write “terraced house”.

His teachers did not realise it was a spelling error and instead reported the boy to the police, in accordance with the 2015 Counter-Terrorism and Security Act, which states that teachers are obliged to alert the authorities to any suspected terrorist behaviour. As a result, the child was interviewed on 7 December by police and the authorities examined a laptop found at his family home.

So, a situation that could have been resolved in thirty seconds with a conversation between the young man and his teacher instead devolved into police activity, with authorities actually traveling to the boy's terraced house to look at a laptop at what they thought might be a terrorist's house. This would be funny if it weren't so frustratingly sad. Keep in mind that this spelling mistake occurred in the child's English class. So, in other words, the very teacher tasked with teaching the boy how to spell properly involved the police in that boy's life because he wasn't spelling properly. One imagines that, assuming this is allowed to continue, the country had better make sure it has only the best and the brightest teaching children how to spell the native language, or else the police can expect to be quite busy.

A cousin of the boy, who has not been named to protect his identity, said his relatives initially thought it was a joke, but that the boy had been traumatised by the experience.

“You can imagine it happening to a 30-year-old man, but not to a young child,” she told the BBC. “If the teacher had any concerns it should have been about his spelling. They shouldn’t be putting a child through this. He’s now scared of writing, using his imagination.”

Let freedom ring, I guess. The freedom from having to think in a common sense manner, at least, as teachers under this law are incentivized into this kind of over-reaction. Putting any class of citizen under this kind of microscope is abhorrent in and of itself, but to do this to children? I had hoped the West was better than this, but now I'm not so sure.

Filed Under: overreaction, police, spelling error, terrorism, uk

What's The Difference Between 'Mass Surveillance' And 'Bulk Collection'? Does It Matter?

from the words,-words,-words dept

As numerous Techdirt stories make clear, the particular words used to describe something can make a big difference in how it is perceived. For example, intelligence agencies like to avoid the use of the bad-sounding "mass surveillance," with its Orwellian overtones, and prefer to talk about "bulk collection," which can be presented as some kind of cool big data project. No one is more vociferous in insisting that they are not engaged in mass surveillance, but merely bulk collection, than the UK's Home Secretary, Theresa May. She was pushing that line again last week, during a grilling by a UK Parliamentary committee about her proposed Snooper's Charter. As BBC News reported:

She said the security minister, John Hayes, had written to the committee of MPs and peers scrutinising the draft bill to give the reasons why the government did not want to reveal the kinds of data investigators were accessing.

She insisted the practice -- and the sweeping up by the security services of large quantities of internet traffic passing through the UK -- did not amount to "mass surveillance" as civil liberties campaigners claim.

"The UK does not undertake mass surveillance," she told the committee.

Given what we know that GCHQ is already doing, and adding in what the UK government says it wants to do, that seems an absurd thing to say. But Paul Bernal, Lecturer in Information Technology, Intellectual Property and Media Law at the UK's University of East Anglia, thinks that there is more to this than meets the eye:

Precisely what constitutes surveillance is far from agreed. In the context of the internet (and other digital data surveillance) there are, very broadly speaking, three stages: the gathering or collecting of data, the automated analysis of the data (including algorithmic filtering), and then the 'human' examination of the results of that analysis of filtering. This is where the difference lies: privacy advocates and others might argue that the 'surveillance' happens at the first stage -- when the data is gathered or collected -- while Theresa May, [former GCHQ director] David Omand and those who work for them would be more likely to argue that it happens at the third stage -- when human beings are involved.

If surveillance occurs through the act of gathering personal data on a large scale, then clearly what the UK government does (and wants to do more of) is mass surveillance. But if surveillance only takes place once a human operator looks at some of the gathered data, then Theresa May can plausibly argue that what the UK government is engaged in is not mass surveillance, because relatively little personal data is scrutinized in this way. So the question then becomes: at what point is it most appropriate to say that surveillance has occurred? Bernal offers a helpful analogy. What the UK government wants to do with the Snooper's Charter would be like:

installing a camera in every room of every house in the UK, turning that camera on, having the footage recorded and stored for a year -- but having police officers only look at limited amounts of the footage and only when they feel they really need to.

Does the surveillance happen when the cameras are installed? When they’re turned on? When the footage is stored? When it’s filtered? Or when the police officers actually look at it.

Most people would probably find the automated video recording of everything they did in the privacy of their own home intrusive, and clearly a form of surveillance, even if it was unlikely the footage would ever be seen by a human being. And in Europe, the question has already been settled by the courts:

Privacy invasion occurs when the camera is installed and the capability of looking at the footage is enabled. That’s been consistently shown by recent rulings at both the Court of Justice of the European Union and of the European Court of Human Rights. Whether it is called ‘surveillance’ or something else, it invades privacy -- which is a fundamental right. That doesn’t mean that it is automatically wrong -- but that the balancing act between the rights of privacy (and freedom of expression, of assembly and association etc that are protected by that privacy) and the need for 'security' needs to be considered at the gathering stage, and not just at the stage when people look at the data.

That's important, because it is precisely this issue that the courts will have to consider when the inevitable legal challenges are brought against the UK's Snooper's Charter once some version of it becomes law. In the end, whether the Home Secretary thinks what she is doing is mass surveillance or merely bulk collection is irrelevant -- the UK and EU courts will be the ones that decide whether it's allowed.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk collection, gchq, investigatory powers bill, mass surveillance, snooper's charter, spying, surveillance, theresa may, uk