Feeds

Web snooping bill an 'odious shopping list of new gov powers'

Spooks 'looking for a pin, creating field of haystacks' says David Davis

Internet Security Threat Report 2014

Tory backbencher David Davis has described the government's draft communications surveillance law as an "odious shopping list" of new powers demanded by the Home Office.

He told MPs and peers at a joint select committee hearing on Wednesday afternoon that UK spooks were "looking for a pin" but instead "creating a field of haystacks" by pushing through the proposals.

His comments came a day after senior officials told the committee that the Communications Data Bill, if approved by Parliament, will require the recording and storing of citizens' web activities in black boxes funded by taxpayers.

Tuesday's hearing focussed on the security services and other authorities arguing that companies which provide communications services should be able to legally retain more information on Brits to help, for example, the police crack murder cases.

Davis, however, expressed concerns about the evidence put forward by Charles Farr, who heads up the Office for Security and Counter-Terrorism, and others during that confab.

The MP also questioned the Home Office's extensive "shopping list" of "odious" reasons for needing access to retained data; the security arrangements for protecting the black boxes and their sensitive contents; how the technology will work; and who will access the records.

Davis was joined on the panel by privacy activists Nick Pickles of Big Brother Watch, Gus Hosein of Privacy International and Jim Killock of Open Rights Group, all of whom broadly agreed that a court-issued warrant-backed system would be more appropriate than the proposed warrantless web snooping.

Hosein raised a key point about Home Secretary Theresa May's proposals* by saying that up to now communications surveillance in the UK had always been about regulating access to telephone and web logs.

"Now it is about collection of information," he warned.

Hosein noted that the collection of data by ISPs through Deep Packet Inspection (DPI) probes - colloquially dubbed black boxes - had only been implemented on a national scale in China, Iran and Kazakhstan.

"The idea of a black box organised at a central level has not actually yet been done in a democratic country," he added.

Hosein also pointed out that if, by way of example, an order is placed against Google, then presumably the government is expecting that overseas company to retain communications data and subsequently disclose it on request.

He said that many communication service providers - which includes the likes of Google and Facebook - considered it a challenge to pinpoint which of its customers were based in the UK: many people can sign up to social networks, webmail and similar services without giving away their location and other personal information.

The notion of British taxpayers paying private companies to hoard communications data on behalf of the UK government was unpalatable, he added.

Further, Hosein questioned what might happen if an ISP is ordered by British spooks, police or indeed the taxman to install a DPI box containing technology of a certain specification that is kept secret from the telco.

The Privacy International man doubted that once such a probe was active on an ISP's network that those companies would then have any control over that gear.

Pickles also warned that, under the proposed law, protesters outside Parliament might, for example, be more easily rounded up and identified by police who could access the comms data sent between individuals in that area. ®

* A copy of the draft bill can be found here [PDF].

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
You dirty RAT! Hong Kong protesters infected by iOS, Android spyware
Did China fling remote access Trojan at Occupy Central?
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.