Sunday, 15 November 2015

This is not new, and it does not work

The Danes have tried this - and it did not work.

http://techpresident.com/news/wegov/23918/denmark-government-will-not-allow-ordinary-citizens-have-digital-privacy

Basically, they have had this level of mass surveillance for a long time, and it has not helped at all. It is clear that this level of monitoring of citizens does not meet the objectives stated, and this example should be considered carefully by the UK while debating the Draft Investigatory Powers Bill.

(Thanks to Jesper Lund on twitter for pointing me to that article)

I also have to question some of the examples - Theresa May talked of an example of an abducted child and how it is crazy that if there was communications by phone or text before that, it could help investigation, but not if by social media. The proposed bill would show, for example, that the entire household has people connected to Facebook all day, or twitter, etc. It would not show which computers or even phones (on WiFi) in the house were connected, or if the child had any accounts on social media. The police would have to ask parents for details and then ask social media sites for details. The Internet Connection Records would not actually help with that.

However, given the extent that computers communicate behind the scenes, and the fact that a whole house will normally share the same IP address*, and that there may be unknown users on WiFi from the house, and DNS relays in daft routers, and viruses, and Tor, and so on, it is clear that apparent "Internet Connection Records" may be unrelated to individuals in the house. There is massive scope for misdirection. That is before anyone considers legally poisoning the database with deliberate bogus connections.

* Typically share a single IPv4 with NAT on the router which is not logged, or have an IPv6 prefix with privacy addressing meaning you cannot attribute a connection to a device.

Someone else pointed out that surveillance only really works when the people being spied on don't know it. If criminals know that all Internet connections are logged, they can be more careful with what they do - perhaps even reverting to paper! This leaves only the innocent having their privacy invaded for no real benefit - just look at the example of Denmark and learn from that lesson!

It is also worth looking at France which does a lot of surveillance as well - it clearly did not help, and I feel sorry for those that lost their lives due to the action of criminals.

Someone actually asked if I was arguing from a cost/complexity point of view as an ISP, or from a privacy and moral point of view. To some extent it is both, but as an ISP, if the government gave us a retention order, they would pretty much have to pay us to make that happen (though there is some debate on the extent of cost recovery). So from that point of view it is not really an issue - indeed, as we make routers and firewalls we have the scope to make a killing selling kit to provide the monitoring solutions to companies even. We aren't doing that! The issue really is that I think it is wrong to treat the population as criminals, and disproportionally spend public money reacting to terrorism and giving in to the terror in the way we do. We need to consider this like any other crime and tackle it sensibly and not with knee-jerk headline-grabbing "something must be done" crap. I hope that makes my views a bit clearer...

P.S. There is one thing that perhaps Theresa May has not considered. After an attack it is very bad PR for government and intelligence agencies if you can say "But they had them under surveillance and still did nothing to prevent this". Once you have everyone under surveillance, people can always say that after every incident.

8 comments:

  1. Then there's Carrier Grade NAT (CGN/LSN). Known to cause 'proof' issues. (RFC7021 s3.4, RFC6269 s13.1 ).

    ReplyDelete
    Replies
    1. They actually want to log the CGNAT translations too from what I can tell. Even so, they think IP and port are good enough - we have systems for some NAT64 stuff that overuse the same IP and port at the same time and quite quickly, so exact time, and IPs and ports of both ends are needed.

      Delete
  2. I love the way the linked article says "when you log on to the Internet" as if that's a meaningful concept.

    ReplyDelete
  3. Does this mean there's an advantage to NAT? If I was using IPv6 to carry out evil criminal mastermind activities, everyone could tell that it was happening from my actual laptop, which while not proving it was me is definitely getting closer -- but if I was using horrible legacy IPv6 NATted up the wazoo, I'd have more plausible deniability!

    (sorry, the devil made me say it)

    ReplyDelete
    Replies
    1. Most IPv6 uses privacy addresses so you change IP all the time with no log.

      Delete
    2. Apologies if this sounds naive but I've never fully understood IPv6 addresses. Does that mean that even if the government forced A&A to keep these logs that the Retention Order would require, it would be impossible, at least when IPv6 that most of us have was being used to connect to a site?

      Delete
    3. it would be impossible to track to a specific device, just the line, line IPv4 and NAT

      Delete
  4. 'After an attack it is very bad PR for government and intelligence agencies if you can say "But they had them under surveillance and still did nothing to prevent this".'

    That one's very easy for the government to wriggle out of. They just couldn't do ENOUGH surveillance due to pesky legal restrictions imposed by yellow-bellied liberals!

    Or, as the credulous authoritarians are already suggesting, the blame lies with people like Edward Snowden for letting the terrorists KNOW they are under surveillance, so they can evade detection.

    So, as always, the only possible solution is more surveillance, more power to the government, and more secrecy on the part of the authorities. If there are fewer terrorist attacks, this proves that the policies are working. If there are more attacks, it proves that the policies don't go far enough.

    ReplyDelete