Big Brother is definitely watching and listening...

[Alan H]

Latest post of the previous page:

EE, Vodafone and Three give police mobile call records at click of a mouse

Three of the UK’s four big mobile phone networks have made customers’ call records available at the click of a mouse to police forces through automated systems, a Guardian investigation has revealed.

EE, Vodafone and Three operate automated systems that hand over customer data “like a cash machine”,as one phone company employee described it.

Eric King, deputy director of Privacy International, a transparency watchdog, said: “If companies are providing communications data to law enforcement on automatic pilot, it’s as good as giving police direct access [to individual phone bills].”

O2, by contrast, is the only major phone network requiring staff to review all police information requests, the company said.

[Alan H]

Big Brother IS watching you. Don’t be complacent about surveillance

It may seem that the government’s ever-increasing spying is only going to affect terrorists. Don’t be so sure

[Alan H]

MPs 'alarmed' at police mugshot database

The Commons Science and Technology Committee said it was "alarmed" that police in England and Wales had collected the mugshots of innocent and guilty people alike.

Last month, BBC Newsnight revealed police were holding 18 million images to use with facial recognition tech.

The government said the technology had an "important role" but images had to be used "in accordance with the law".

Committee chairman Andrew Miller said the MPs were not opposed to the use of biometric technologies to combat crime.

"But we were alarmed to discover that the police have begun uploading custody photographs of people to the Police National Database and using facial recognition software without any regulatory oversight - some of the people had not even been charged."

[Alan H]

A simple guide to GCHQ's hacking powers

[Dave B]

Tut, tut

'Michael McIntyre' picture taken by Met Police helicopter team is posted on Twitter to outrage

Slappy wristy time coppers!

[Alan H]

Tut, tut

'Michael McIntyre' picture taken by Met Police helicopter team is posted on Twitter to outrage

Slappy wristy time coppers!

That really is unbelievable stupid. Whoever did that really isn't fit to be in charge of a toy camera never mind one in a helicopter.

[Alan H]

David Cameron will publish the financial details and viewing habits of all UK porn-watchers

That's not what he says, of course: he just says that all porn sites will have to gather and retain proof of identity (eg credit-card details) to ensure that their users are over 18 or they'll be blocked by the Great Firewall of Cameron -- but everything leaks.

There is exactly one gold standard for not leaking user data: not gathering or retaining it in the first place.

[Alan H]

Karma Police, how GCHQ tried to track every visible user on Internet

A new collection of GCHQ’s documents published by The Intercept reveals how the British Agency tried to track Web visits of “every visible user on Internet

The British spies targeted streams that included Islamic religious content in an effort to identify their Skype and social media accounts of the radicals. By 2009, the Karma Police program allowed the GCHQ to store over 1.1 trillion “events”, a term used to refer web browsing sessions. By 2010, the overall volume of collected data reached 30 billion records per day of Internet traffic metadata. According to another GCHQ document, by 2012 the volume grew to 50 billion per day.

[Alan H]

Police to be granted powers to view your internet history

Police are to get the power to view the web browsing history of everyone in the country.

Home Secretary Theresa May will announce the plans when she introduces the Government's new surveillance bill in the House of Commons on Wednesday.

The Telegraph understands the new powers for the police will form part of the new bill.

It would make it a legal requirement for communications companies to retain all the web browsing history of customers for 12 months in case the spy agencies or police need to access them.

Police would be able to access specific web addresses visited by customers.

The new powers would allow the police to seize details of the website and searches being made by people they wanted to investigate.

They will still need to apply for judicial approval to be able to access the content of the websites.

This just doesn't make sense: publicly accessible pages are, well, publicly accessible. Pages that are not are either protected by a login and/or encrypted. Some forums on TH require a login to view: would they be able to circumvent that? All pages are dynamic - ie they do not exist anywhere as an actual page but are 'served up' (ie created) only when they are requested by a browser. Would ISPs be required to hold a cache of every page anyone visits so they could be handed over to the police on receipt of a court order? What about encrypted pages such as your bank account and email? Your ISP does not have access to those pages so cannot store copies of them (encrypted on unencrypted).

Too many unanswered questions: is the Telegraph ignorant or Theresa May? Or both?

But who could possibly object to the police, security services and the HMRC having instant access to the url of every page you've accessed over the last year? What could possibly go wrong...

[Alan H]

Curiouser and curiouser: Theresa May says 'contentious' parts of web surveillance plan dropped

Police will be able to see websites people have visited but not the specific pages they have viewed without a warrant, under new government plans.

Shami Chakrabarti, director of the civil rights group Liberty, said: "It's a traditional Home Office dance first to ask for the most outrageous, even impractical powers, so that the smallest so-called "concessions" seem more reasonable."

[Dave B]

Curiouser and curiouser: Theresa May says 'contentious' parts of web surveillance plan dropped

Police will be able to see websites people have visited but not the specific pages they have viewed without a warrant, under new government plans.

Shami Chakrabarti, director of the civil rights group Liberty, said: "It's a traditional Home Office dance first to ask for the most outrageous, even impractical powers, so that the smallest so-called "concessions" seem more reasonable."

Can't argue with Shami on that last point and the Tories are past masters of the art!

[Alan H]

FUD from the Tories: The new Investigatory Powers Bill and the politics of ‘nodding-along’

So the Home Office has launched a proactive PR campaign, the results of which you will see already in many news titles even before the Bill is published. Journalists have been invited in for high-level background briefing (some have refused). Helpful access is being provided, there is selective leaking and queries promptly answered. If the Home Office could physically hand out trumpets this week to journalists so that the Bill could have a fanfare it would do so.

[Alan H]

New plan to torpedo UK's grab for everyone's browsing history

David Anderson QC, the UK's independent reviewer of terrorism legislation, said in his report on the Investigatory Powers Review (PDF) that the Home Office has provided him with this definition of the information that would be included in its definition of the "weblogs" it seeks to access:

Weblogs are a record of the interaction that a user of the internet has with other computers connected to the internet. This will include websites visited up to the first ‘/’ of its [url], but not a detailed record of all web pages that a user has accessed. This record will contain times of contacts and the addresses of the other computers or services with which contact occurred.

In other words, the government could see that you're visiting a porn site, for example, but not which flavor of kink you clicked on.

It was put another way by Graham Smith, an expert in IT law and partner at Bird & Bird, who told The Register that the police are reportedly seeking power that's equivalent to recording...

...every magazine you've read, but not which articles on which pages.

Then next year, up to the second /???

[Dave B]

New definition of "weblog" as well it seems. Always thought the list of sites accessed over time was called the user's "history".

Another case of the government employing people not fully in touch with the world the rest of us inhabit?

[Alan H]

New definition of "weblog" as well it seems. Always thought the list of sites accessed over time was called the user's "history".

Another case of the government employing people not fully in touch with the world the rest of us inhabit?

There will be differences on what you see as your browser history and what your ISP sees, possibly due to things such as re-directs: I would expect their 'weblog' to be a lot more than just the (simplified) list of pages you see in your browser's history.

Although different, here are just four lines taken from the raw access logs of TH:

Code: Select all

174.139.28.114 - - [02/Nov/2015:06:50:57 -0500] "GET /wp-login.php HTTP/1.0" 404 1603 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
162.158.102.214 - - [02/Nov/2015:06:50:59 -0500] "GET /phpBB3/viewtopic.php?f=15&t=655 HTTP/1.1" 200 73591 "http://www.thinkhumanism.com/phpBB3/viewtopic.php?f=15&t=655" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36"
162.158.102.214 - - [02/Nov/2015:06:51:01 -0500] "GET /phpBB3/ucp.php?mode=register&sid=49317692524338aa4fe816eed44d44a7 HTTP/1.1" 200 11111 "http://www.thinkhumanism.com/ucp.php?mode=register&sid=49317692524338aa4fe816eed44d44a7" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36"
162.158.102.214 - - [02/Nov/2015:06:51:07 -0500] "POST /phpBB3/ucp.php?mode=register HTTP/1.1" 200 60682 "http://www.thinkhumanism.com/phpBB3/ucp.php?mode=register&sid=49317692524338aa4fe816eed44d44a7" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36"

I imagine an ISP's logs will contain much much more. However, it looks like the Bill will only require the log to contain urls up to the first / so ISPs may have to create a new database or query to provide this (as well as having to store cast amounts of data for 12 months).

Note that this only contains the IP address of the machine/router that accessed a page, not the name of the person or anything that identifies him/her. Unless and until we have to provide individual access to the Internet, who actually pressed keys on a keyboard will never be known. For example, for Athena and I, there is no way for an ISP (or the police, etc) to know which one of us accessed any particular website recorded in the log.

We need to see what the text of the (as yet unpublished) Bill actually says, but I can't wait to see how they propose to get around the issues I outlined earlier.

[Dave B]

My point was that 99.99% of users seeing "weblog" would think of some person havingvtheir say about some sort of issue - not a record of which sites they accessed when.

Unless a common lexicon is used confusion reigns. Well, it often does in the area of these sort of badly thought out acts anyway!

[Alan H]

EX-MP Julian Huppert: The Investigatory Powers Bill is our chance to publicly set the rules around surveillance

It’s an important piece of legislation, with potentially huge impacts on our lives, in particular on the levels of privacy and security we can expect to have. However, since it will inevitably be somewhat technical, there is a real risk the debate will focus on grossly oversimplified claims and the invoking of terrorists, paedophiles and the like. From personal experience, the quality of real analysis of these issues in parliament is not anything like as high as is needed, with a great tendency for parliamentarians simply to give way to the demands made, however thin the evidence for them.

That would appear to extend to Theresa May and David 'call me Dave' Cameron.

[Alan H]

Theresa 'clueless' May and David 'call me Dave' Cameron, demonstrating their cluelessness yet again: Internet firms to be banned from offering unbreakable encryption under new laws

Measures in the Investigatory Powers Bill will place in law a requirement on tech firms and service providers to be able to provide unencrypted communications to the police or spy agencies if requested through a warrant.

Ministers have no plans to ban encryption services because they have an important role in the protection of legitimate online activity such as banking and personal data.

Well, that's not quite what Cameron claimed before.

[Alan H]

Investigatory Powers Bill: what's in it, and what does it mean?

Surveillance bill is a 'breath-taking attack' on internet security

[Alan H]

How and why M15 kept phone data spy programme secret

Home Secretary Theresa May has revealed the existence of an MI5 programme to collect vast amounts of data about UK phone calls - how and why was it kept secret?

MI5's bulk communications data programme was so secret that until recently its existence was tightly held even within the headquarters of the security service.

Officials were aware that it could be seen as overly intrusive - especially in the wake of revelations about a similar programme in the US - but they also believed the programme was valuable in finding terrorists.

The programme involved getting hold of phone communications data in bulk - not the content of phone calls but the details of which phones were connecting to other phones and when.

"It wasn't illegal in the sense that it wasn't outside of the law, it is just that the law was so broad - and the information so slight - that nobody knew it was happening," he said.

[Alan H]

Edward Snowden attacks UK government over investigatory powers bill

Edward Snowden has outlined his opposition to the British government’s investigatory powers bill, arguing that Conservative politicians were “taking notes on how to defend the indefensible”.

The former National Security Agency (NSA) whistleblower, whose disclosure of top-secret documents ultimately led to the home secretary, Theresa May, proposing the bill, made a series of tweets on Wednesday warning that the communications data covered by the legislation was “the activity log of your life”.

"I don't need privacy, I've nothing to hide" argues "I don't need free speech, I've nothing to say." Rights = Power

"It's only communications data" = "It's only a comprehensive record of your private activities." It's the activity log of your life.