Feeds

Web snooping bill an 'odious shopping list of new gov powers'

Spooks 'looking for a pin, creating field of haystacks' says David Davis

High performance access to file storage

Tory backbencher David Davis has described the government's draft communications surveillance law as an "odious shopping list" of new powers demanded by the Home Office.

He told MPs and peers at a joint select committee hearing on Wednesday afternoon that UK spooks were "looking for a pin" but instead "creating a field of haystacks" by pushing through the proposals.

His comments came a day after senior officials told the committee that the Communications Data Bill, if approved by Parliament, will require the recording and storing of citizens' web activities in black boxes funded by taxpayers.

Tuesday's hearing focussed on the security services and other authorities arguing that companies which provide communications services should be able to legally retain more information on Brits to help, for example, the police crack murder cases.

Davis, however, expressed concerns about the evidence put forward by Charles Farr, who heads up the Office for Security and Counter-Terrorism, and others during that confab.

The MP also questioned the Home Office's extensive "shopping list" of "odious" reasons for needing access to retained data; the security arrangements for protecting the black boxes and their sensitive contents; how the technology will work; and who will access the records.

Davis was joined on the panel by privacy activists Nick Pickles of Big Brother Watch, Gus Hosein of Privacy International and Jim Killock of Open Rights Group, all of whom broadly agreed that a court-issued warrant-backed system would be more appropriate than the proposed warrantless web snooping.

Hosein raised a key point about Home Secretary Theresa May's proposals* by saying that up to now communications surveillance in the UK had always been about regulating access to telephone and web logs.

"Now it is about collection of information," he warned.

Hosein noted that the collection of data by ISPs through Deep Packet Inspection (DPI) probes - colloquially dubbed black boxes - had only been implemented on a national scale in China, Iran and Kazakhstan.

"The idea of a black box organised at a central level has not actually yet been done in a democratic country," he added.

Hosein also pointed out that if, by way of example, an order is placed against Google, then presumably the government is expecting that overseas company to retain communications data and subsequently disclose it on request.

He said that many communication service providers - which includes the likes of Google and Facebook - considered it a challenge to pinpoint which of its customers were based in the UK: many people can sign up to social networks, webmail and similar services without giving away their location and other personal information.

The notion of British taxpayers paying private companies to hoard communications data on behalf of the UK government was unpalatable, he added.

Further, Hosein questioned what might happen if an ISP is ordered by British spooks, police or indeed the taxman to install a DPI box containing technology of a certain specification that is kept secret from the telco.

The Privacy International man doubted that once such a probe was active on an ISP's network that those companies would then have any control over that gear.

Pickles also warned that, under the proposed law, protesters outside Parliament might, for example, be more easily rounded up and identified by police who could access the comms data sent between individuals in that area. ®

* A copy of the draft bill can be found here [PDF].

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.