Canaries

Some more thoughts on warrant canaries... Thanks for the various comments.

We are the good guys, honest

First off, I want to be clear. The attitude I have, and therefore the company (A&A) has, to blanket surveillance is that it is wrong. It should not be allowed. We need to take all possible and practical steps against it. Targeted surveillance against know suspects with proper controls is another matter.

I hope that is clear, and the fact I have gone to the bother of speaking directly to parliamentary committees on this helps explain some of my resolve in this.

Am I a martyr ?

No, sorry. I will not go to jail over this. I have a family to support, and I have a lot of staff that have families to support. So there are limits.

But I am not beyond considering every possible loophole and edge case we, or my lawyers, can come up with to help defend these principles.

What can A&A do?

We can explain our principles, and we can try and help people understand how to circumvent all sorts of monitoring and snooping as much as possible to ensure people get respect for their basic human rights related to privacy.

We can, of course, try and appeal or defend any such orders if we get them, and we will.

What about the canary? Does it help?

The way the law is worded now, there are various parts with various gagging orders. Some parts are a tad tame, civil enforcement. No, I am not a martyr, but would I go for challenging it in civil courts, maybe. Hard to say, and at the end of the day that would not really help. This is the real point here, but we cannot risk criminal laws even for the "tame" parts of the IPA by invoking the Official Secrets Act. So even that may be a problem.

You cannot trust what anyone says with the law as it is. It is not really acceptable for a democratic society, in my view. It is not a matter that law "compels you to lie", but that by not lying you may be breaking the law. If you see what I mean. No, don't lie as that is fraud, and no, don't not lie as that is breaking a gagging order, catch 22. Pick your crime?!

What is important is that everyone assumes there is snooping and monitoring. I am sure that getting BT Wholesale or TalkTalk Business to deep packet inspect our PPP traffic is against the law, sorry. The Home Office do not agree. In a civilised society this would have a chance to be decided by a court, but in a world with secret orders and gagging requirements, it will never get tested.

So if you do trust us (and why not) you may already be snooped on in the back-haul network, so take measures to protect yourself.

If you take such measures, you don't need to trust us, and so we don't need to be on the spot with a canary!

What about the canary going forward?

I am formulating a plan here...

First off, I put anything canary related in one place, make one page with a clear signed and dated statement and link to that. It states what we do not have (any order under IPA) and is dated and signed, and ideally states when or if we plan to update the statement.

That fits well with what we have now, and puts in one place. It removes the "ask me on irc or in person" and so on.

Cunning plan?

My lawyer pondered this and may be regretting it now - but if the warrant canary covers many things nobody knows the discontinuation of the canary is because of reason X and as such that cannot be seen as disclosing reason X.

So a canary could say, for example :-

1. I have a beard
2. My dog, Lilly, is still alive
3. We have never had an intercept capability order at A&A under IPA
4. We have never had a data retention order at A&A under IPA

And when we stop making such statements, all you know is one of those things is no longer true.

By stopping, we are not breaching a gagging order, obviously, especially if I happen to have shaved.

Sadly, any "cunning plan" like this is almost certainly a bad idea, sorry.

Simpler plan?

A simpler plan is just set a date, e.g 2020, from which we no longer make any statement about IPA orders.

Banning end-to-end encryption

This is more of a rant, sorry.

The Investigatory Powers Act has some wording in it which may, or may not, be an attempt to ban people providing end-to-end encryption services. The Register article assumes the worst, and others have said, sensibly, that maybe they are reading too much in to it.

We are talking about WhatsApp, signal, iMessage, and all sorts of commonly used and secure applications which many normal, non criminal, citizens choose as a platform with which to communicate.

The whole thing of encryption applied "by the telco or on their behalf" is the unclear area, and when the telco might be "WhatsApp" does that ban them from offering end-to-end encryption as part of the app?

It is unclear.

Now for the bit that pisses me off here, sorry.

The government created this wording in the bill that resulted in this Act. There were asked if they intended the wording to ban end-to-end encryption services. They basically refused to give a straight answer. Lord Strasburger tried to get an answer.

At the end of the day there is no reason for this ambiguous wording in the Act. If the government had made the intention clear - ban it or not ban it - then the wording could have been made clearer.

The result of this is ...

• Parliament did not actually decide if to ban or not ban end-to-end encryption as they did not have the details of the government intention - they were left to guess from the wording, which seems to be deliberately unclear.
• Now it is an Act, the government can interpret as they wanted to in the first place, or as future governments may choose to, which is possible even worse.
• The Act allows for gagging orders so nobody will know what they have "interpreted" and it will be hard to challenge it (and the big telcos may not try).

This is not the way to run a county or make laws! The government should have been clear as to whether they wanted to ban end-to-end encryption apps/systems up front when the bill was debated in parliament.

If they do, then that could have been debated, and maybe even decided that it is a bad idea. It is a bad idea, TBH, as criminals can always do this anyway, so the only people you expose are normal non-criminal citizens.

If they do not, then that could have been made clear in the wording and not allowed creative interpretation by this government or future governments.

Why do we allow laws to be made in this way - the process was positively underhand!

I really hope the whole things gets reviewed or repealed soon.

P.S. Just to be clear - there are plenty of cases of laws trying to cover the possible future we cannot envisage - when this was made law applications like WhatsApp and signal and iMessage existed, so they could have addressed this clearly. Simply not being able to guess the future is more excusable.

Is end to end encryption banned?

The register has reported on the horrifying technical capabilities that the government is introducing now we have the Investigatory Powers Act (here).

One of the key points is: That includes encrypted content – which means that UK organizations will not be allowed to introduce true end-to-end encryption of their users' data but will be legally required to introduce a backdoor to their systems so the authorities can read any and all communications.

My first comment, as always, is that this targets non-criminals - the normal users of communications, and makes us all more vulnerable to criminals by introducing exploitable back doors. The criminals wishing to communicate can do so - encryption is not made illegal as such, just that encryption applied by, or on behalf of, the telco has to be breakable. It will not even be suspicious to use encryption as even MPs do this, and so do many web sites you visit - the telco will not be able to see the content of https sessions, for example.

So criminals are in the clear - just in case any criminals were worried about this...

However, it does not necessarily mean end to end encryption is banned. For a start, it is only going to be practically enforceable against UK companies. But even then, as long as the encryption is applied by (or on behalf) of someone that is not a communications provider, that should be fine. End to end encryption is applied by, on on behalf of, the end users, not the telco.

This may mean that is someone makes an end to end encrypted communications app, they may have to be a separate company that does the app itself, and manages keys, to the company that passes the data or manages end point addressing. I don't believe that just making a device or writing an app puts you under this crazy regime. I am sure someone will say if I have that wrong.

So it should mean FireBrick IPsec tunnels are fine.

The complication would come where we "manage" the FireBrick for a customers, and that may have to change at some point. However, we normally don't actually manage any IPsec for people, we advise on how to set up keys and configure things but don't have access to those keys ourselves as an ISP.

The fact that encryption will still be legal, and practical, and usable by criminals, just shows how bloody stupid this all is, and what a waste of public money it is (money we could be spending on the NHS).

Snooper's Charter and LINX

Update: (at the top to be clear)...

As expected...

LINX have confirmed that the governance discussions are totally unrelated to IPA and intercept on the basis that such laws apply regardless, and gagging orders apply. The good news is LINX have been taking legal advice to understand how they would handle such orders, and if they can provide warrant canaries (which they feel they cannot).

Original article:

As reported in the register, and LINX reply, there is concern over some of the changes to the way LINX is governed - a matter to be voted on this week at the LINX96 meeting.

For those of you that do not know, LINX is a major UK peering point - it is a network infrastructure mostly in London (the "L" in LINX) that connects lots of Internet providers together and is used by everyone that accesses the Internet in the UK a lot.

This is a serious matter - what do all of the secret / gagged orders in the Investigatory Powers Act mean for a membership organisation like LINX? Could it mean secret orders that a handful of people know if implemented in order to spy on member's traffic? Every member is a part of LINX!

Well, what I am told is that is not the idea, but I am concerned that the changes could inadvertently allow such orders. We need to be sure of some transparency, at least, before approving them.

However, what it has hi-lighted is that we need some frank and open debate within LINX on the whole issue of the IP Act and the possibility of secret orders to snoop on LINX traffic. The same needs to happen at LONAP too.

So, personally, I am not yet up to speed on the changes proposed, and if they allow "secret" orders or not, but this is my overall view, so far. I expect to blog again once we have had some discussions during the week and the vote is over. It is serious stuff - my own staff are already asking if we should stay LINX members or leave, just based on The Register article, and we are not alone in asking this.

So what needs to be addressed:

• We need to consider what LINX may be asked to do. This means lawyers and maybe even talking to The Home Office (maybe someone has?!). And we need to debate and agree in advance the way this needs to be handled with members.
• We need to consider the level of transparency of any such orders, with members, and outside LINX. What if LINX M&A mean the directors have to discuss any orders with members? Is that good or bad? Does it make The Home Office re-think orders? What do they have to consider in asking for intercepts and data retention (collection)?
• To what extent will LINX management challenge orders. Clause 87(4) tries to stop any retention order forcing a provider to monitor "third party data". But for LINX, anything over and above Ethernet MAC addresses is "third party data", so needs to be challenged via the appeal process and even the courts if necessary. I am sure LINX would get support from ORG and/or EFF on taking any such a matter to CJEU or the ECHR (whilst we still can).
• What exposure does LINX management and even LINX membership have? Can management share "gagged" orders with membership? They have to be able to share to some extent with the techies making it happen, so there is scope, but how much transparency is allowed, and what are the consequences? Some of it is NOT CRIMINAL in any way in that no "offence" is defined in law - it is simply a "duty" not to disclose, enforced by civil proceedings (telling LINX "stop sharing this information" after it is already been shared). But even if shared with members, are members exposed if they share with customers or the press, and is that exposure for LINX as a whole or just that member?
• In all of this I am making the huge assumption that LINX members do not want snooping by anyone - very much against the spirit of the Internet. If I am wrong and actually LINX members do want government snooping, we will be leaving LINX and so will many others. But we need the debate to understand if we do all agree on this position in the first place.

But ultimately, do any of us (LINX members) want to be part of an organisation that would secretly snoop on its members? I would not. Let's hope that is not what this is about, and we can move on with M&A changes in one form or another, and then start some serious debate and discussion with members on what will and must happen if the IP Act ever does come to bite us...

If this is all a storm in a teacup, then fine. We will soon see.

Investigatory Powers Act on EuroNews

http://www.euronews.com/2017/01/27/adrian-kennard-challenging-surveillance

This was the day I coughed so hard an ambulance crew was called - not sure if cracked rib or badly pulled muscle, but this interview was literally as ambulance crew and their "gas & air" left and before I was on the pain killers...

On the TV again

Thanks to RT... Very brief inclusion in this clip, but it all helps get the message across.

Good news for privacy - Investigatory Powers Act vs CJEU

As reported by the BBC, the European Court of Justice has made a ruling that could seriously impact the powers in the Investigatory Powers Act to collect data on everyone in the UK.

The IP Act has provisions, much like the Data Retention and Investigatory Powers Act (DRIPA) it replaces, and the Data Retention Directive (DRD) before it, to retain data about use of communications systems.

The IP Act actually pushes this much further - previously telcos/ISPs could have been asked to retain certain data they processed (e.g. telephone itemised billing records) but could not be required to actually generate data they were not processing. The IP Act allows much more and it has been made clear that the government wish to log usage of the Internet in some detail - down to the level of recording every web site everyone has accessed. This is far more than just retention of data, and would apply to everyone, even those not suspected of any crime.

The good news is that the ruling from the CJEU is that this sort of mass retention of data is not consistent with our basic human rights and EU law. These apply regardless of whether we leave the EU or not.

The BBC article is not ideal in its analysis, and Open Rights Group have a much better analysis (here).

Retention is an invasion of privacy

The key point of argument here is that the UK Government considered that indiscriminate retaining of data should be allowed as long as access to that data was restricted and controlled in a suitable way. However, that is not the case. The court ruled that indiscriminate retaining of data was simply not acceptable. You have to be much more specific about whose data is to be collected to target suspects in a crime.

Only to be used for serious crime

The court also looked at the issue of controls over access to the retained data. Again, this did not go well as the access has to be restricted to only serious crime. The IP Act tries to even redefine serious crime to include things that are not serious, so that will have to change too.

Proper independent authorisation of requests for data

On top of that - the access to the retained data should be approved by an independent body, such as a court, and not simply by the current system of a Designated Senior Officer. This could finally mean we see proper court warrants for access to retained data.

No more secrecy

As I have long said, the secrecy around data retention and collection of data is not really acceptable. The ruling says subjects of access should be told about it once there is no longer a risk of prejudice to the investigation.

We can still catch criminals

None of this stops wire taps (or the Internet equivalent) on suspects in serious crime, set up and accessed with the proper controls. All it stops is the indiscriminate logging of everything we all do on the Internet - and that is a good thing - we are all meant to be innocent until proven guilty, after all.

Read more

Read the ORG article for a lot more useful insight in to this ruling.

Investigatory Powers Act - devil in the detail

It is published (here). It is an interesting read, so here are some initial observations...

I have been trying to focus on the bits that could impact us (A&A and FireBrick) mainly, and I am very happy to have had help from a friendly lawyer on this matter. I am the first to accept that I am not an expert on reading legislation, but getting better as the years go on.

So, some observations, in no particular order...

Can a retention order be placed on BT Wholesale to monitor A&A traffic?

We think no - surprisingly. This is because of 87(4): "A retention notice must not require an operator who controls or provides a telecommunication system (“the system operator”) to retain data which relates to the use of a telecommunications service provided by another telecommunications operator in relation to that system".

So that should mean, we think, that BT Wholesale or Openreach or BT plc as "the system operator" cannot be ordered to retain data which relates to the use of the telecommunications service provided by A&A in relation to that system. We see that as meaning BT provide PPP and we provide IP, and so BT cannot be ordered to log IP (or above), only PPP which is basically their RADIUS logs, because IP is related to what we provide via that system.

Good and bad - good is it means, in theory, if we say we have no monitoring (we don't) and we can assume BT do not, then there is no monitoring (same logic to LINX and transit providers). Bad news is that they may be more inclined to ask us to do retention as a niche ISP.

But it gets more fun - given that this now covers private as well as public telecommunications services, it is easy to say that every single one of our customers is a telecommunications operator even if only running one router to provide service to one person. So we can argue that we cannot be expected to retain data relating to our customer's use of the IP - you have to ask each and every one of them to retain data and not us.

We'll see how that plays out if ever we are asked to do retention (which we, A&A, have not been).

Can FireBrick be forced to add a back door?

We think no, thankfully. The definition of a telecommunications operator, which we thought could cover FireBrick would require that FireBrick is providing a "service", which we are not, we are providing a product, and that the FireBrick itself is a "system", which it is not, it is apparatus.

Even so, we still have standing order that if asked to back-door FireBricks then the UK company FireBrick Ltd would be dissolved.

In short, you can trust FireBrick!

Is FaceBook a telecommunications operator?

Well, this is tricky. Home office think so, apparently. An operator offers "services", and services means a service consisting of access to or facilitating making use of, a "system". A system is something allowing transmission of communications by electrical or electromagnetic energy.

So a system is wires and fibres and radio; A services provides access to that or making use of that; An operator offers a service to do that.

I think the wires, and fibres, and radio, facilitate the use of FaceBook, not the other way around. The "make use of" may be the sticking point.

I think it is badly drafted! FaceBook may want to argue on that definition.

What are Internet Connection Records?

Something much hyped in the process of this becoming law, but relegated to a small part of the Act.

It is a narrow and specific definition, "In this Act “internet connection record” means communications data which may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person)."

So it is just stuff to identify the service used by the sender, nothing more. But why does this narrow definition matter?

Well, retention can cover all sorts of data, anything that is not "content", which is "meaning of the communication". And that can be way more than ICRs. It is clear that ICRs are a subset of that data.

However, requests for this data to be acquired (e.g. from retained data) can cover anything.

There are restrictions on "local authorities" getting ICRs, but as that is a subset of the data ISPs may be forced to collect. So that is a less than useful constraint. Local authorities could ask for all sorts of non ICR data an ISP was required to "retain"!

How serious is "serious crime"?

Some aspects of the acquisition of data have restrictions for "serious crime", and that covers stuff with long prison sentences. Good. But, oddly the section also covers "relevant crime" which is rather fun as it covers offences that are "by a person who is not an individual, or which involves, as an integral part of it, the sending of a communication or a breach of a person’s privacy." This means things like failing to put your company number on your letterhead (a crime by a company) is lumped in with "serious crime"!

And the irony that you can get all this data which is a huge invasion of privacy to investigate a breach of a person's privacy is not lost on me.

Can the food standards agency get browsing history?

Well there are caveats, but yes, they are in the list and not even covered by the "local authority" exception to getting ICRs.

Does this mean back-doors can be mandated?

Well, yes, to any "service" which can be ordered to maintain a capability to decrypt stuff and even notify if new services are planned to ensure they have the back-door.

But not if you do the encryption yourself, using PGP or your own apps or pen and paper! Criminals can do this and do so legally with no interference by this Act. Well done!

Evaluating a VPN provider

At A&A we are looking in to how we can best help customers exercise their human rights for privacy and rights to net neutrality and to access to legal content.

The IP Act puts in place horrendous snooping powers, and the DE Bill as proposed puts in place a new national censor with the job of blocking porn sites - legal porn sites. We can all imagine how much further such proposals could go.

At present there is no ban on operating a VPN - it would be hard to ban without also banning https used by many web sites and businesses and banks and the VPNs used by industry and even parliament.

There are VPN providers now (sensibly) targeting the UK market - they provide an VPN endpoint which you connect to from your computer or using a router that can do VPN for your whole house. They make a point of having equipment and legal entities in countries that do not require logging and snooping, and make a point of not recording anything or accepting orders from governments like the UK.

So, the next question is how we evaluate VPN providers and even make some recommendations. We may even set up a VPN operation ourselves (well, not ourselves, a foreign company with foreign servers, so no subject to UK jurisdiction).

These are this obvious aspects I can think of, but keen on other comments.

Speed

One simple aspect of the service and the devices you choose to operate the VPN at your premises is whether the service can keep up with the speed of your Internet connection, such as an 80Mb/s VDSL service.

Price

Obvious one, but you want a reasonable price. Free is great but there has to be a catch some how, so you expect to pay a few dollars a month at least for any reasonable service.

Anonymity

Are they really not logging anything, do they have a clear history of refusing information requests?

Trust

Can we really trust them? Very hard to be sure but reputation and how long they have been in business are key factors.

Geotagging

Can they have your traffic look like UK traffic (if that is what you want)? This may be tricky and without it things like netflix may not even work. If someone sets up a service specially for UK use they may be able to convince netflix and others that it is UK IP addresses even if plugged in via another country.

Technical

MTU issues, latency, transparency of IP protocols and ports and so on, IPv6. All things that matter from a technical point of view. Ironically, maybe even fixed IP - if blocking/censorship is your main concern.

Human Rights

The BBC did a good article on the Investigatory Powers Act (which oddly has yet to appear on the legislation.gov.uk web site).

But there is one aspect they did not make that clear...

The headline was :-

"Tech firms seek to frustrate internet history log law"

It should have been

"Tech firms seek to help people exercise their basic human rights"

We all have the right to a private life and family and correspondence,  and that is all people are after here. Nobody is aiming the thwart the law, unless, that is, if the law is trying to take away that basic human right.

So please, BBC, report it correctly. Nobody is trying to break laws, or frustrate them - we are just trying to exercise our human right in EU and UN declarations of human rights - a right to a private life - that is all.

Snooper's Charter and A&A

First off - I appreciate that my blog is not an official statement for A&A, but I have linked the status page here to give you an idea of my thoughts on the matter and how that may play out for A&A in due course.

Summary: Watch this space - more to come over coming weeks.

I have commented many times on the Investigatory Powers Bill, and submitted written evidence to parliament as well as oral evidence to the committee. I have attended meetings with privacy groups and legislators. I have spent a lot of time on this. I have tried very hard to try and get some degree of sanity in to this legislation, and I am sorry to say that on the whole I have failed to make any real changes, sorry.

Once we see it, I am planning to go through the final wording of the Act, with a lawyer friend of mine, and we are going to try and make sure we understand the nuances that finally made it in to law. Once we have done that I do plan to write up something much more comprehensive.

But how does this impact A&A and the services offered.

As I say, this is not an official statement yet - we'll be posting more details of what we are doing and when as time goes on. At this stage there is nothing that needs doing urgently - it will take time for anything to happen in relation to the new Act and a lot of time (and money) for the monitoring and logging to get in to place.

It is also worth pointing out that I don't really have a real problem helping the police investigate crimes as long as there is a proper oversight and control.

In practice a lot of the Act relates to the intelligence agencies, and whilst there a lot of problems with this, it is unlikely we can do much now, or that we would be impacted by this aspect of the Act. However, some of the steps we can take for privacy thwart those parts of the Act too!

The real issue we see is the huge invasion of privacy in collecting and storing data on innocent people - and the bulk powers for "data retention" do just that. They are designed to allow lots of personal information to be gathered on everyone - so mostly people completely innocent and almost entirely people not even suspected of a crime in any way. This is compounded by systems to search through that data over many ISPs and provide it to a wide range of people including the police, without a warrant of any sort.

We expect that it is very unlikely A&A will be asked to do anything - this is because companies like BT and Talk Talk will be asked (ordered) to and that will allow deep packet inspection in the back-haul networks that are used by A&A (and most ISPs).

So what can we do about that?

One of the biggest things we can do is provide information and advice about exercising your basic human right to a private life. This will take some time to put together in detail once we fully understand the legislation. We will start a specific section of the wiki pages as well to cover ideas people have. We are interested in suggestions people have too.

There is also a good possibility that we can engineer some services that operate in a way that bypasses the logging. A simple example would be an outgoing email server that is esmtp only (encrypted) to a service that is outside the jurisdiction of the UK and new law. This would be servers outside the UK and also set up in a way that A&A, or any people in the UK, technically have no control of them. This means that nobody under UK law could be required to comply with an order to include logging on those servers. As an ISP we, or BT/TT, would only see encrypted esmtp traffic to that server and hardly any useful meta data on the emails and nothing on the addresses involved.

Of course, even something simple like this suffers the big problem that the person at the other end of such communications (e.g. emails) will not have the same degrees of security and hence allow logging of meta data at that end. This is always a problem with any communications.

There is also a lot of advice on the use of tools and apps that help - like signal and tor. Sadly even tor has limitations and performance issues.

One answer is VPN services with endpoints outside UK jurisdiction but still reasonable latency. This is hard to scale up - but we are already talking about this in the FireBrick dev team about this.

In the short term we are seriously considering a trip to Iceland to investigate data centres and transit there - perhaps installing some tin that can run VMs as needed - but we also have to investigate the exact way such servers can be outside our control and hence not subject to orders on us to add data retention or intercepts under UK law.

Irony?

It is, of course, right for everyone to expect to be able to exercise their human rights, including the right to privacy. There are a lot of people, in light of this incredibly intrusive new legislation, that wish to do so, and so there will therefore be a lot of companies working on ways to provide (sell) services to help people do that. These services will have to be designed to be outside UK law, obviously. But this means they are also outside the law where there is a specific suspect of a crime, and a more reasonable justification to provide intercept or collect data to help law enforcement (with suitable warrants). So by encouraging people to need privacy and encouraging companies to offer privacy you actually make fighting crime harder. It is worth bearing in mind that serious criminals have always been able to avoid this type of monitoring, but more and more normal people and, occasionally, those committing minor crimes will find it easier and easier to use services offering privacy now.

Giving the police more power? (#IPBill/#IPAct)

With the Investigatory Powers Bill reaching final stages I expect to have some detailed comments by next week, once we have the final text of the Act.

However, we had a rather odd email today from the police, a Cyber Distribution & Prevention Team, no less. You would hope they have some clue, but their email shows drastic lack of clue...

We do occasionally get requests, usually under RIPA, usually related to telephony, and almost never actually correct. Typical errors are:-

• Not one of our numbers!
• Number too short
• Number too long

But also issues they would not know, but still a nuisance:-

• Number simply not in use, and hence must just be spoofed CLI
• Number leased to another telco

This request was different. It was a request to suspend a "line" which is in fact a VoIP service. But it shows some serious lack of clue here.

Firstly they are entirely going on the CLI. They have not attempted to trace the source of the calls via the telephone network in any way (else they would not have got to us as it is part of a block leased to another telco). But even though only based on CLI they are assuming the CLI is genuine. No hint that they know it could be otherwise, and indeed, asking us to suspend a line based only on CLI provides a means to "attack" a victim by using their CLI for something iffy and getting the police to get the victims line suspended! Our reply refers them to the wikipedia article on spoofing CLI.

Also, it is marked "Classification: PROTECT - INTERNAL USE ONLY" yet they have sent it externally to us. Ooops.

Then they explain "Attempts to contact the line have not been undertaken to prevent jeopardising any ongoing or potential investigation that may follow." Hang on?!? What would we say to a customer (if it was our customer) when we suspend them that would not jeopardise ongoing or potential investigation - seriously - suspended line is going to be a tad noticeable.

Then there is the actual request "We request that you consider suspending this line as soon as possible to prevent further harm to members of the public occurring and for a minimum period of 12 months." which I am not sure I understand. This is just a number. If we suspend it at all, the end user can have a new number to make calls within seconds, so not going to stop him, just alert him that they are on to him. Also it means the fraudster is now using a new number which nobody is blocking or watching out for, so actually that increases harm - by always using the same number one can alert people "don't accept calls from X" if that was a sane thing to do when considering CLI spoofing anyway. It also makes handling the reports they are getting easier to collate as they know it is the same person. But also, why suspend for 12 months? How does that help?

But then we have the fraud itself - a simple matter of someone calling an claiming to be something official (I am not giving details here), but a key point is the victim is then asked for "bank details" to pay something they have been convinced is due. As far as I know that only allows a direct debit, and a direct debit can always be reversed. So either the victims are getting really bad advice and not getting the DD reversed and their money back, or the fraudster is particularly stupid. The email is quite specific, and says the other trick is to ask the victim to get "I tune"[sic] vouchers and read the number, but that again makes no sense as this is someone claiming to be from an official body which nobody would be stupid enough to think could be paid in iTunes vouchers. What they are saying here really makes no sense. I suspect the fraudster is smarter than they are saying and the police are recording the details totally wrongly.

I hope they catch the fraudster, but in this case there is nothing we can do to assist further - as the calls are not through us or from one of our customers.

These are the people we want to give access to details of every web site visited by every person in the UK. Seriously?