European Court Of Justice Rules Against UK's Mass Surveillance Program

from the will-it-matter-after-brexit? dept

Over the summer, we noted that the Advocate General for the European Court of Justice had sort of punted on the issue of whether or not the UK's Data Retention and Investigatory Powers Bill (DRIPA) was actually legal. Thankfully, the final ruling is much clearer: "general and indiscriminate retention" of emails and other electronic communications is illegal in the EU according to the court. The only thing that is allowed is targeted interception, used to combat "serious crime."

This is a pretty big deal, as the original recommendation from the Advocate General had suggested that DRIPA might be found legal. Of course, DRIPA is in the process of being superseded by the even worse Investigatory Powers Bill, better known as the Snooper's Charter. If DRIPA violates the law, than the Snooper's Charter almost certainly does so at an even greater level. Of course, there is some irony in all of this, in that the case that came to the CJEU was brought by a Member of Parliament, David Davis, who is now the "Brexit Secretary," meaning that he's helping to organize the process by which the UK will be removed from the EU... such that it may not even matter what the EU's Court of Justice has to say on the matter.

The UK has also made it clear it's going to appeal the decision, meaning that it will get to drag this process out as long as possible, potentially until the Brexit process is completed, at which point the ruling will not matter.

Still, it should at least raise question in the UK about why their politicians are granting the government powers to snoop on every member of the public at a level that goes way beyond what is considered appropriate.

Filed Under: cjeu, data retention, david davis, drip, dripa, european court of justice, investigatory powers bill, ip bill, mass surveillance, snooper's charter, uk

Data Retention Rules Go Into Effect Down Under, But No One's Sure What's Going On

from the but-here's-how-to-avoid-them dept

As we reported earlier this year, Australia put in place a ridiculous data retention law that requires ISPs to store all sorts of information on users just in case the government would like to snoop through it. The main force behind the law, Attorney General George Brandis, is so clueless that he clearly did not understand the details when he was quizzed about it. Here's a brief excerpt from an interview he did last year:

Brandis: Well, what we'll be able... what the security agencies want to know... to be retained... is the... is the electronic address of the website that the web user is visiting.

Host: So it does tell you the website.

Brandis: Well... well... it tells you the address of the website.

Host: That's the website, isn't it? It tells you what website you've been to.

Brandis: Well, when... when you visit a website you... you know, people browse from one thing to the next and... and... that browsing history won't be retained or... or... or... there won't be any capacity to access that.

Host: Excuse my confusion here, but if you are retaining the web address, you are retaining the website, aren't you?

Brandis: Well... the... every website has an electronic address, right?

Host: And that's recorded.

Brandis: And... um... whether there's a connection... when a connection is made between one computer terminal and a web address, that fact and the time of the connection, and the duration of the connection, is what we mean by metadata, in that context.

Host: But... that is... telling you... where... I've been on the web.

Brandis: Well, it... it... it... it... it... it... it records what web... what at... what electronic web address has been accessed.

Host: I don't see the difference between that and what website I've visited.

Brandis: Well, when you go to a website, commonly, you will go from one web page to another, from one link to another to another, within that website. That's not what we're interested in.

As of the beginning of this week, that law is now in effect. And... it sounds like the implementation is going just about as cleanly as you might imagine given Brandis' statements above. A report from ITNews in Australia suggests that the Attorney General's office is a complete mess, and ISPs aren't at all sure what they're supposed to be doing right now. Yes, the law requires many to start collecting lots of information, but smaller ISPs can apply to the Attorney General for exemptions or extended timelines for implementation, and it appears many of them have (of course, the Attorney General's office refuses to reveal how many). ITNews surveyed a bunch of ISPs, with many saying they had sent in a "data retention implementation plan (DRIP)" that would allow them to delay implementation -- but the majority of them hadn't heard anything back, so they have no idea if their plan was accepted or not:

Around 58 percent of Comms Alliance survey respondents said they had submitted a DRIP to the AGD, while 23 percent more said they would soon. Just 19 percent said they had not.

However, a staggering 76 percent of those that had submitted a DRIP claimed they had not yet heard back from the AGD as to whether it had been approved.

A total of 9 percent had received approved DRIPs, and around 14 percent said final approval was still pending

Gee, it almost sounds like Brandis' office is dealing with a bit of information overload and doesn't know how to deal with it. Doesn't that seem like a great situation to now add much more data to? Meanwhile, this whole scheme -- of which there is no evidence that it will be even remotely useful -- is going to cost everyone hundreds of millions of dollars. The government is paying for some of it (meaning taxpayer funds) while expecting the rest to be covered by increasing ISP fees. In short: everyone in Australia now has to pay lots more money for an incompetent government agency to more easily spy on them. How nice.

It seems like the only sensible response has come from Senator Scott Ludlam, who fought hard against the data retention plan. He's now telling people to encrypt their data and to use VPNs and Tor to hide from the government.

Filed Under: australia, data retention, drip, george brandis, isps

Compliant UK Press Insist 'Thousands Of Lives At Risk' If Government Can't Spy On Citizens

from the oh-really-now? dept

Earlier today we wrote about how the UK's High Court determined that the Data Retention and Investigatory Powers (DRIP) Act that passed a year ago, allowing the government wide leverage to get access to citizens' private data, was a violation of privacy, because it did not have necessary limitations. The rule is still allowed to be used for the next nine months while the court asks Parliament to fix the law (or for the government to appeal the ruling, which it's doing). Cue frantic bogus FUD from the press stenographers in the UK. The Telegraph's "Security Editor" posted a story with this ridiculous (and wrong) headline: "Thousands of lives at risk after High Court rules snooping powers unlawful." There is, of course, nothing in the article to support the headline, because it's not even remotely true. Considering that the law stays in place for the time being even if it were true that this power to spy on citizens was necessary (which it's not), there would be no difference at all today. But the Telegraph has to come out with FUD so it quotes unnamed government officials going with the "but think of the children!" argument:

But police chiefs and the Home Office warned that would mean officers would no longer be able to use the data to help trace vulnerable people such as those at suicide risk or missing children

So they need to spy on you to save you. Talk about a paternalistic authoritarian bullshit. And, actually, the article seems to raise a lot more questions about abuse of DRIP than anything else:

The power was used in around 16,000 such cases last year to “prevent death or injury in an emergency situation”, the Home Office said.

Under the ruling, judges or an independent body will have to sign off every one of the 500,000-plus requests to access communications data each year.

First of all, 500,000 requests?!? What the hell are they searching? Second: 16,000 cases where this power was used to "prevent death or injury in an emergency situation" -- that's not even remotely believable. That's saying that law enforcement in the UK needed to snoop on citizens' private data more than 40 times every day to "prevent death or serious injury." Considering that the law only went into effect a year ago, did the number of deaths and serious injuries drop by a tremendous amount in the last 12 months, because surely there should be some evidence of that, right? Admittedly, the latest stats only go up to 2013, but if there had been a giant decrease in suicides, wouldn't someone be talking about that number, rather than the requests for information?

Instead, everyone's going on and on about how they're supposedly preventing suicides by spying on your:

Assistant Chief Constable Richard Berry, the National Police Chiefs’ Council lead on communications data, said: “A significant proportion of our acquisition of data relates to situations where life is at immediate risk and a significant proportion of those requests relate to non-crime enquiries, for example: tracing vulnerable and suicidal missing persons.”

Of course, even if this is true (which is unlikely), are they really arguing that they need a special data retention law to make this happen? Or that they can't bother to ask a judge first? In the US, we don't have a similar data retention law, and yet companies frequently work with law enforcement to help them locate missing persons. Why do you need a broad law with little oversight unless you're planning to abuse that power in a way that companies might push back on if they weren't required by law to comply?

Filed Under: data retention, drip, dripa, fud, lives in danger, suicide, uk

UK Data Retention Snooping Law Thrown Out One Year Later

from the now-let's-stop-the-repeats dept

Almost exactly a year ago, we wrote about how the UK Parliament rushed through a dangerous data retention bill, known as the Data Retention and Investigatory Powers Bill, or DRIP, with little debate. As soon as it became law, challenges were filed -- and now the UK's High Court has struck down the law. As you may also recall, the rush to pass DRIP was in response to an EU Court of Justice ruling that said widespread data retention violated privacy rules. And, rather than take the hint, the UK government used it as an excuse to try to just rewrite the rules to let them continue snooping on the public.

Not surprisingly, the current UK government (which has been looking to expand its snooping powers rather than limit them) has made it clear that it will appeal this ruling. Furthermore, the court is allowing the government until early next year to see if it can fix the law by itself:

The judges said that the first section of Dripa "does not lay down clear and precise rules providing for access to and use of communications data" and should be "disapplied".

But the judges said their order on disapplication should be suspended until after March 31 2016 "to give Parliament the opportunity to put matters right".

That's an interesting way of going about things: we see you've been violating the rights of the public for a year now, and so we'll give you another 9 months to do so and hope that during that time you'll figure out a way to maybe not violate the public's rights so much.

Filed Under: data retention, david cameron, drip, high court, privacy, snooper's charter, theresa may

As Feared, UK Data Retention Act Passed In Record Time; Fight Back Has Already Begun

from the democratic-banditry dept

It was just a week ago that Techdirt warned about a new "Snooper's Charter" that would be rammed through the British Parliament in record time. As feared, that has happened, and the Data Retention and Investigatory Powers Bill -- DRIP to its friends -- has received the Royal Assent and is now law in the UK. That's the bad news; the good news is that the fight back has already begun. Today, the UK's Open Rights Group (ORG) announced that it would be challenging DRIP in the courts:

Whilst Parliament swallowed Theresa May’s tired arguments that "terrorist plots will go undetected" and "these are powers and capabilities that exist today", she failed to make a compelling argument that holding everyone's data is necessary and proportionate. Frankly, the Government was evasive and duplicitous, and they were in a hurry to cover their tracks.

Tom Watson MP described the process as "democratic banditry, resonant of a rogue state. The people who put this shady deal together should be ashamed."

And the European Court's decision was very clear: blanket data retention is unlawful and violates the right to privacy.

The courts will have the final say on whether DRIP breaches human rights. And no matter what David Cameron believes, the UK has international obligations. The European Convention on Human Rights, the European Charter of Fundamental Rights and our own Human Rights Act -- all exist to defend our rights and are where we will be able to challenge DRIP.

And that's what we will do.

Although that's hugely welcome, it's not surprising: bringing these kinds of cases is very much why ORG was set up. The following, though, is unexpected:

As the controversial Data Retention and Investigation Powers Bill (DRIP) slips its way through the House of Commons and into the House of Lords, the outspoken boss of broadband ISP Andrews & Arnold (AAISP), Adrian Kennard, has promised to use "all practical legal means" in order to protect their customers from state sponsored Internet snooping.

Now, that may just be one ISP, but the example of iiNet in Australia, which has been fighting on behalf of its users there for years, shows what can be done. It would be nice if more UK ISPs did the same, but even if they don't, it's likely that others will join the fight against DRIP and its undemocratic passage through the UK Parliament, given the outrage this has caused -- in some quarters, at least.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data retention, drip, snooper's charter, uk

UK Leaders Look To Sneak Through Broad Data Retention Bill With No Debate

from the because-they-can dept

Remember last year when the UK loudly rejected an attempt by the government to create a "Snooper's Charter" that would give the government much more power to sniff through everyone's private data? This was the law David Cameron insisted was needed based on crime dramas he watches on TV (how do these people get elected?).

You may also recall that, earlier this year, the European Court of Justice found that the EU's Data Retention Directive was invalid as a breach of "the fundamental rights to respect for private life and to the protection of personal data." Just a few weeks ago, we noted that the UK government had told telcos to ignore that ruling and to carry on retaining people's data. It appears that telcos told the UK government to pound sand, and David Cameron and his friends are now using that as an opportunity to rush through a version of the Snooper's Charter, requiring internet companies to retain data.

Member of Parliament Tom Watson raised the alarm about this yesterday, detailing how the government was trying to rush through a broad bill in near secrecy:

If you look on Parliament’s web site tonight, you will not see the name, nor the text of the Bill to be considered.

None of your elected backbench MPs have been told what Bill is to be debated on Monday. It’s Wednesday evening. Tomorrow, MPs are on a ‘one line whip’ ie they can return to their constituencies this evening.

Imagine how outrageous it would be, if tomorrow, the government were to announce emergency legislation to an empty chamber. Imagine if that emergency legislation was to be introduced on Monday or Tuesday, with the intention of it slipping through the Commons and the Lords in a single day. Imagine if that Bill was the deeply controversial Data Retention Bill.

It’s a Bill that will override the views of judges who have seen how the mass collection of your data breaches the human rights of you and your family.

And that's what's happened so far. Early this morning, the draft of the bill was released, entitled the "Data Retention and Investigatory Powers Bill," or DRIP. Think of it as drip, drip, dripping away your privacy and civil liberties. As people reading through the bill have noted, it's quite clear that it goes much further than just dealing with the "fallout" from the European Court of Justice ruling. In particular it has this rather open ended clause that appears to give the government the power to effectively change the rules at will:

The Secretary of State may by regulations make further provision about the retention of relevant communications data.

The government is trying to calm people down about this by first setting up a "Privacy and Civil Liberties Oversight Board" (PCLOB) modeled after the PCLOB in the US, and will also include a "transparency" report. But the bigger claim they have is that this is just a "temporary" thing with a sunset provision:

The laws will expire in 2016, requiring fresh legislation after the election. The Regulation of Investigatory Powers Act will be reviewed between now and 2016 to make recommendations for how it could be reformed and updated. Lib Dems insist the new legislation does not represent an extension of existing surveillance powers or the introduction of the snooper's charter.

Except, if you've paid any attention at all, you know damn well that these sunset clauses almost never work. It's much, much more difficult to get rid of a bad law once it's in place. And when it comes to things like surveillance, every time the renewal period comes up, politicians go on a FUD rampage about how many people will die if the government can't keep searching through all your data.

Filed Under: data retention, david cameron, drip, eu court of justice, tom watson, uk