Snooper's Charter and LINX

Update: (at the top to be clear)...

As expected...

LINX have confirmed that the governance discussions are totally unrelated to IPA and intercept on the basis that such laws apply regardless, and gagging orders apply. The good news is LINX have been taking legal advice to understand how they would handle such orders, and if they can provide warrant canaries (which they feel they cannot).

Original article:

As reported in the register, and LINX reply, there is concern over some of the changes to the way LINX is governed - a matter to be voted on this week at the LINX96 meeting.

For those of you that do not know, LINX is a major UK peering point - it is a network infrastructure mostly in London (the "L" in LINX) that connects lots of Internet providers together and is used by everyone that accesses the Internet in the UK a lot.

This is a serious matter - what do all of the secret / gagged orders in the Investigatory Powers Act mean for a membership organisation like LINX? Could it mean secret orders that a handful of people know if implemented in order to spy on member's traffic? Every member is a part of LINX!

Well, what I am told is that is not the idea, but I am concerned that the changes could inadvertently allow such orders. We need to be sure of some transparency, at least, before approving them.

However, what it has hi-lighted is that we need some frank and open debate within LINX on the whole issue of the IP Act and the possibility of secret orders to snoop on LINX traffic. The same needs to happen at LONAP too.

So, personally, I am not yet up to speed on the changes proposed, and if they allow "secret" orders or not, but this is my overall view, so far. I expect to blog again once we have had some discussions during the week and the vote is over. It is serious stuff - my own staff are already asking if we should stay LINX members or leave, just based on The Register article, and we are not alone in asking this.

So what needs to be addressed:

• We need to consider what LINX may be asked to do. This means lawyers and maybe even talking to The Home Office (maybe someone has?!). And we need to debate and agree in advance the way this needs to be handled with members.
• We need to consider the level of transparency of any such orders, with members, and outside LINX. What if LINX M&A mean the directors have to discuss any orders with members? Is that good or bad? Does it make The Home Office re-think orders? What do they have to consider in asking for intercepts and data retention (collection)?
• To what extent will LINX management challenge orders. Clause 87(4) tries to stop any retention order forcing a provider to monitor "third party data". But for LINX, anything over and above Ethernet MAC addresses is "third party data", so needs to be challenged via the appeal process and even the courts if necessary. I am sure LINX would get support from ORG and/or EFF on taking any such a matter to CJEU or the ECHR (whilst we still can).
• What exposure does LINX management and even LINX membership have? Can management share "gagged" orders with membership? They have to be able to share to some extent with the techies making it happen, so there is scope, but how much transparency is allowed, and what are the consequences? Some of it is NOT CRIMINAL in any way in that no "offence" is defined in law - it is simply a "duty" not to disclose, enforced by civil proceedings (telling LINX "stop sharing this information" after it is already been shared). But even if shared with members, are members exposed if they share with customers or the press, and is that exposure for LINX as a whole or just that member?
• In all of this I am making the huge assumption that LINX members do not want snooping by anyone - very much against the spirit of the Internet. If I am wrong and actually LINX members do want government snooping, we will be leaving LINX and so will many others. But we need the debate to understand if we do all agree on this position in the first place.

But ultimately, do any of us (LINX members) want to be part of an organisation that would secretly snoop on its members? I would not. Let's hope that is not what this is about, and we can move on with M&A changes in one form or another, and then start some serious debate and discussion with members on what will and must happen if the IP Act ever does come to bite us...

If this is all a storm in a teacup, then fine. We will soon see.

Good news for privacy - Investigatory Powers Act vs CJEU

As reported by the BBC, the European Court of Justice has made a ruling that could seriously impact the powers in the Investigatory Powers Act to collect data on everyone in the UK.

The IP Act has provisions, much like the Data Retention and Investigatory Powers Act (DRIPA) it replaces, and the Data Retention Directive (DRD) before it, to retain data about use of communications systems.

The IP Act actually pushes this much further - previously telcos/ISPs could have been asked to retain certain data they processed (e.g. telephone itemised billing records) but could not be required to actually generate data they were not processing. The IP Act allows much more and it has been made clear that the government wish to log usage of the Internet in some detail - down to the level of recording every web site everyone has accessed. This is far more than just retention of data, and would apply to everyone, even those not suspected of any crime.

The good news is that the ruling from the CJEU is that this sort of mass retention of data is not consistent with our basic human rights and EU law. These apply regardless of whether we leave the EU or not.

The BBC article is not ideal in its analysis, and Open Rights Group have a much better analysis (here).

Retention is an invasion of privacy

The key point of argument here is that the UK Government considered that indiscriminate retaining of data should be allowed as long as access to that data was restricted and controlled in a suitable way. However, that is not the case. The court ruled that indiscriminate retaining of data was simply not acceptable. You have to be much more specific about whose data is to be collected to target suspects in a crime.

Only to be used for serious crime

The court also looked at the issue of controls over access to the retained data. Again, this did not go well as the access has to be restricted to only serious crime. The IP Act tries to even redefine serious crime to include things that are not serious, so that will have to change too.

Proper independent authorisation of requests for data

On top of that - the access to the retained data should be approved by an independent body, such as a court, and not simply by the current system of a Designated Senior Officer. This could finally mean we see proper court warrants for access to retained data.

No more secrecy

As I have long said, the secrecy around data retention and collection of data is not really acceptable. The ruling says subjects of access should be told about it once there is no longer a risk of prejudice to the investigation.

We can still catch criminals

None of this stops wire taps (or the Internet equivalent) on suspects in serious crime, set up and accessed with the proper controls. All it stops is the indiscriminate logging of everything we all do on the Internet - and that is a good thing - we are all meant to be innocent until proven guilty, after all.

Read more

Read the ORG article for a lot more useful insight in to this ruling.

Investigatory Powers Act - devil in the detail

It is published (here). It is an interesting read, so here are some initial observations...

I have been trying to focus on the bits that could impact us (A&A and FireBrick) mainly, and I am very happy to have had help from a friendly lawyer on this matter. I am the first to accept that I am not an expert on reading legislation, but getting better as the years go on.

So, some observations, in no particular order...

Can a retention order be placed on BT Wholesale to monitor A&A traffic?

We think no - surprisingly. This is because of 87(4): "A retention notice must not require an operator who controls or provides a telecommunication system (“the system operator”) to retain data which relates to the use of a telecommunications service provided by another telecommunications operator in relation to that system".

So that should mean, we think, that BT Wholesale or Openreach or BT plc as "the system operator" cannot be ordered to retain data which relates to the use of the telecommunications service provided by A&A in relation to that system. We see that as meaning BT provide PPP and we provide IP, and so BT cannot be ordered to log IP (or above), only PPP which is basically their RADIUS logs, because IP is related to what we provide via that system.

Good and bad - good is it means, in theory, if we say we have no monitoring (we don't) and we can assume BT do not, then there is no monitoring (same logic to LINX and transit providers). Bad news is that they may be more inclined to ask us to do retention as a niche ISP.

But it gets more fun - given that this now covers private as well as public telecommunications services, it is easy to say that every single one of our customers is a telecommunications operator even if only running one router to provide service to one person. So we can argue that we cannot be expected to retain data relating to our customer's use of the IP - you have to ask each and every one of them to retain data and not us.

We'll see how that plays out if ever we are asked to do retention (which we, A&A, have not been).

Can FireBrick be forced to add a back door?

We think no, thankfully. The definition of a telecommunications operator, which we thought could cover FireBrick would require that FireBrick is providing a "service", which we are not, we are providing a product, and that the FireBrick itself is a "system", which it is not, it is apparatus.

Even so, we still have standing order that if asked to back-door FireBricks then the UK company FireBrick Ltd would be dissolved.

In short, you can trust FireBrick!

Is FaceBook a telecommunications operator?

Well, this is tricky. Home office think so, apparently. An operator offers "services", and services means a service consisting of access to or facilitating making use of, a "system". A system is something allowing transmission of communications by electrical or electromagnetic energy.

So a system is wires and fibres and radio; A services provides access to that or making use of that; An operator offers a service to do that.

I think the wires, and fibres, and radio, facilitate the use of FaceBook, not the other way around. The "make use of" may be the sticking point.

I think it is badly drafted! FaceBook may want to argue on that definition.

What are Internet Connection Records?

Something much hyped in the process of this becoming law, but relegated to a small part of the Act.

It is a narrow and specific definition, "In this Act “internet connection record” means communications data which may be used to identify, or assist in identifying, a telecommunications service to which a communication is transmitted by means of a telecommunication system for the purpose of obtaining access to, or running, a computer file or computer program, and comprises data generated or processed by a telecommunications operator in the process of supplying the telecommunications service to the sender of the communication (whether or not a person)."

So it is just stuff to identify the service used by the sender, nothing more. But why does this narrow definition matter?

Well, retention can cover all sorts of data, anything that is not "content", which is "meaning of the communication". And that can be way more than ICRs. It is clear that ICRs are a subset of that data.

However, requests for this data to be acquired (e.g. from retained data) can cover anything.

There are restrictions on "local authorities" getting ICRs, but as that is a subset of the data ISPs may be forced to collect. So that is a less than useful constraint. Local authorities could ask for all sorts of non ICR data an ISP was required to "retain"!

How serious is "serious crime"?

Some aspects of the acquisition of data have restrictions for "serious crime", and that covers stuff with long prison sentences. Good. But, oddly the section also covers "relevant crime" which is rather fun as it covers offences that are "by a person who is not an individual, or which involves, as an integral part of it, the sending of a communication or a breach of a person’s privacy." This means things like failing to put your company number on your letterhead (a crime by a company) is lumped in with "serious crime"!

And the irony that you can get all this data which is a huge invasion of privacy to investigate a breach of a person's privacy is not lost on me.

Can the food standards agency get browsing history?

Well there are caveats, but yes, they are in the list and not even covered by the "local authority" exception to getting ICRs.

Does this mean back-doors can be mandated?

Well, yes, to any "service" which can be ordered to maintain a capability to decrypt stuff and even notify if new services are planned to ensure they have the back-door.

But not if you do the encryption yourself, using PGP or your own apps or pen and paper! Criminals can do this and do so legally with no interference by this Act. Well done!

Evaluating a VPN provider

At A&A we are looking in to how we can best help customers exercise their human rights for privacy and rights to net neutrality and to access to legal content.

The IP Act puts in place horrendous snooping powers, and the DE Bill as proposed puts in place a new national censor with the job of blocking porn sites - legal porn sites. We can all imagine how much further such proposals could go.

At present there is no ban on operating a VPN - it would be hard to ban without also banning https used by many web sites and businesses and banks and the VPNs used by industry and even parliament.

There are VPN providers now (sensibly) targeting the UK market - they provide an VPN endpoint which you connect to from your computer or using a router that can do VPN for your whole house. They make a point of having equipment and legal entities in countries that do not require logging and snooping, and make a point of not recording anything or accepting orders from governments like the UK.

So, the next question is how we evaluate VPN providers and even make some recommendations. We may even set up a VPN operation ourselves (well, not ourselves, a foreign company with foreign servers, so no subject to UK jurisdiction).

These are this obvious aspects I can think of, but keen on other comments.

Speed

One simple aspect of the service and the devices you choose to operate the VPN at your premises is whether the service can keep up with the speed of your Internet connection, such as an 80Mb/s VDSL service.

Price

Obvious one, but you want a reasonable price. Free is great but there has to be a catch some how, so you expect to pay a few dollars a month at least for any reasonable service.

Anonymity

Are they really not logging anything, do they have a clear history of refusing information requests?

Trust

Can we really trust them? Very hard to be sure but reputation and how long they have been in business are key factors.

Geotagging

Can they have your traffic look like UK traffic (if that is what you want)? This may be tricky and without it things like netflix may not even work. If someone sets up a service specially for UK use they may be able to convince netflix and others that it is UK IP addresses even if plugged in via another country.

Technical

MTU issues, latency, transparency of IP protocols and ports and so on, IPv6. All things that matter from a technical point of view. Ironically, maybe even fixed IP - if blocking/censorship is your main concern.

Human Rights

The BBC did a good article on the Investigatory Powers Act (which oddly has yet to appear on the legislation.gov.uk web site).

But there is one aspect they did not make that clear...

The headline was :-

"Tech firms seek to frustrate internet history log law"

It should have been

"Tech firms seek to help people exercise their basic human rights"

We all have the right to a private life and family and correspondence,  and that is all people are after here. Nobody is aiming the thwart the law, unless, that is, if the law is trying to take away that basic human right.

So please, BBC, report it correctly. Nobody is trying to break laws, or frustrate them - we are just trying to exercise our human right in EU and UN declarations of human rights - a right to a private life - that is all.

Snooper's Charter and A&A

First off - I appreciate that my blog is not an official statement for A&A, but I have linked the status page here to give you an idea of my thoughts on the matter and how that may play out for A&A in due course.

Summary: Watch this space - more to come over coming weeks.

I have commented many times on the Investigatory Powers Bill, and submitted written evidence to parliament as well as oral evidence to the committee. I have attended meetings with privacy groups and legislators. I have spent a lot of time on this. I have tried very hard to try and get some degree of sanity in to this legislation, and I am sorry to say that on the whole I have failed to make any real changes, sorry.

Once we see it, I am planning to go through the final wording of the Act, with a lawyer friend of mine, and we are going to try and make sure we understand the nuances that finally made it in to law. Once we have done that I do plan to write up something much more comprehensive.

But how does this impact A&A and the services offered.

As I say, this is not an official statement yet - we'll be posting more details of what we are doing and when as time goes on. At this stage there is nothing that needs doing urgently - it will take time for anything to happen in relation to the new Act and a lot of time (and money) for the monitoring and logging to get in to place.

It is also worth pointing out that I don't really have a real problem helping the police investigate crimes as long as there is a proper oversight and control.

In practice a lot of the Act relates to the intelligence agencies, and whilst there a lot of problems with this, it is unlikely we can do much now, or that we would be impacted by this aspect of the Act. However, some of the steps we can take for privacy thwart those parts of the Act too!

The real issue we see is the huge invasion of privacy in collecting and storing data on innocent people - and the bulk powers for "data retention" do just that. They are designed to allow lots of personal information to be gathered on everyone - so mostly people completely innocent and almost entirely people not even suspected of a crime in any way. This is compounded by systems to search through that data over many ISPs and provide it to a wide range of people including the police, without a warrant of any sort.

We expect that it is very unlikely A&A will be asked to do anything - this is because companies like BT and Talk Talk will be asked (ordered) to and that will allow deep packet inspection in the back-haul networks that are used by A&A (and most ISPs).

So what can we do about that?

One of the biggest things we can do is provide information and advice about exercising your basic human right to a private life. This will take some time to put together in detail once we fully understand the legislation. We will start a specific section of the wiki pages as well to cover ideas people have. We are interested in suggestions people have too.

There is also a good possibility that we can engineer some services that operate in a way that bypasses the logging. A simple example would be an outgoing email server that is esmtp only (encrypted) to a service that is outside the jurisdiction of the UK and new law. This would be servers outside the UK and also set up in a way that A&A, or any people in the UK, technically have no control of them. This means that nobody under UK law could be required to comply with an order to include logging on those servers. As an ISP we, or BT/TT, would only see encrypted esmtp traffic to that server and hardly any useful meta data on the emails and nothing on the addresses involved.

Of course, even something simple like this suffers the big problem that the person at the other end of such communications (e.g. emails) will not have the same degrees of security and hence allow logging of meta data at that end. This is always a problem with any communications.

There is also a lot of advice on the use of tools and apps that help - like signal and tor. Sadly even tor has limitations and performance issues.

One answer is VPN services with endpoints outside UK jurisdiction but still reasonable latency. This is hard to scale up - but we are already talking about this in the FireBrick dev team about this.

In the short term we are seriously considering a trip to Iceland to investigate data centres and transit there - perhaps installing some tin that can run VMs as needed - but we also have to investigate the exact way such servers can be outside our control and hence not subject to orders on us to add data retention or intercepts under UK law.

Irony?

It is, of course, right for everyone to expect to be able to exercise their human rights, including the right to privacy. There are a lot of people, in light of this incredibly intrusive new legislation, that wish to do so, and so there will therefore be a lot of companies working on ways to provide (sell) services to help people do that. These services will have to be designed to be outside UK law, obviously. But this means they are also outside the law where there is a specific suspect of a crime, and a more reasonable justification to provide intercept or collect data to help law enforcement (with suitable warrants). So by encouraging people to need privacy and encouraging companies to offer privacy you actually make fighting crime harder. It is worth bearing in mind that serious criminals have always been able to avoid this type of monitoring, but more and more normal people and, occasionally, those committing minor crimes will find it easier and easier to use services offering privacy now.

More on Live TV from my man cave

SkyQ is fucking useless - it did not record tonight's live RT UK News interview. It is a heap of shit is so many ways.

Update: Someone managed to record it - thank you.



However, I am pleased to report that doing a live Skype TV interview worked well.

They texted me with around 30 minutes notice - the Skype login did not work - the camera was not set up and then did not see the lens but instead of telling my it just caused the app to freeze, the headset cable did not work, and I had to reboot the Mac, and well, those 30 minutes were busy.

However, the good news is that, in the end, the audio worked properly simply by selecting 48kHz as a USB audio device. The room is a tad echoey, so that needs improving but the H4n pro worked for audio.

Also good news is that the 1DX MkII with a 24-70 f/2.8 L lens worked well with the BlackMagic HDMI box to provide full HD. The picture, as broadcast was crystal clear and clearly HD and looked excellent.

I am well underway to having a decent studio here in the man cave for TV interviews, and I think I did quite well being live on air at 30 minutes notice to be honest.

Only snag was audio in my earpiece went to zero just as we went live, I wonder if the volume control caught on my collar or something, fixed, and was live a few minutes later. Well done coping RT...

The only sad part was that the topic was the IP bill finally becoming an Act. Sad days. More on that when we have reviewed the final text.

Giving the police more power? (#IPBill/#IPAct)

With the Investigatory Powers Bill reaching final stages I expect to have some detailed comments by next week, once we have the final text of the Act.

However, we had a rather odd email today from the police, a Cyber Distribution & Prevention Team, no less. You would hope they have some clue, but their email shows drastic lack of clue...

We do occasionally get requests, usually under RIPA, usually related to telephony, and almost never actually correct. Typical errors are:-

• Not one of our numbers!
• Number too short
• Number too long

But also issues they would not know, but still a nuisance:-

• Number simply not in use, and hence must just be spoofed CLI
• Number leased to another telco

This request was different. It was a request to suspend a "line" which is in fact a VoIP service. But it shows some serious lack of clue here.

Firstly they are entirely going on the CLI. They have not attempted to trace the source of the calls via the telephone network in any way (else they would not have got to us as it is part of a block leased to another telco). But even though only based on CLI they are assuming the CLI is genuine. No hint that they know it could be otherwise, and indeed, asking us to suspend a line based only on CLI provides a means to "attack" a victim by using their CLI for something iffy and getting the police to get the victims line suspended! Our reply refers them to the wikipedia article on spoofing CLI.

Also, it is marked "Classification: PROTECT - INTERNAL USE ONLY" yet they have sent it externally to us. Ooops.

Then they explain "Attempts to contact the line have not been undertaken to prevent jeopardising any ongoing or potential investigation that may follow." Hang on?!? What would we say to a customer (if it was our customer) when we suspend them that would not jeopardise ongoing or potential investigation - seriously - suspended line is going to be a tad noticeable.

Then there is the actual request "We request that you consider suspending this line as soon as possible to prevent further harm to members of the public occurring and for a minimum period of 12 months." which I am not sure I understand. This is just a number. If we suspend it at all, the end user can have a new number to make calls within seconds, so not going to stop him, just alert him that they are on to him. Also it means the fraudster is now using a new number which nobody is blocking or watching out for, so actually that increases harm - by always using the same number one can alert people "don't accept calls from X" if that was a sane thing to do when considering CLI spoofing anyway. It also makes handling the reports they are getting easier to collate as they know it is the same person. But also, why suspend for 12 months? How does that help?

But then we have the fraud itself - a simple matter of someone calling an claiming to be something official (I am not giving details here), but a key point is the victim is then asked for "bank details" to pay something they have been convinced is due. As far as I know that only allows a direct debit, and a direct debit can always be reversed. So either the victims are getting really bad advice and not getting the DD reversed and their money back, or the fraudster is particularly stupid. The email is quite specific, and says the other trick is to ask the victim to get "I tune"[sic] vouchers and read the number, but that again makes no sense as this is someone claiming to be from an official body which nobody would be stupid enough to think could be paid in iTunes vouchers. What they are saying here really makes no sense. I suspect the fraudster is smarter than they are saying and the police are recording the details totally wrongly.

I hope they catch the fraudster, but in this case there is nothing we can do to assist further - as the calls are not through us or from one of our customers.

These are the people we want to give access to details of every web site visited by every person in the UK. Seriously?

The new elephant in the room - meta data collection. We need your help!

The Investigatory Powers Bill has many issues, and one of these is the collection of meta data known as "Internet Connection Records", or ICRs.

Up until now the main focus on security has been on the content of communications, and we now have very powerful processors (even in our phones) and we are able to ensure that the content of our communications is secure, end to end, encrypted.

But there is a new threat, the collection of meta data. By collecting ICRs from everyone, and creating a national database that can be searched and collated we create the very definition of a nanny state or big brothersister, and the all seeing eye of police state as depicted in "1984".

The problem is that (a) meta data is actually very revealing of our lives, what we do, and who we associated with, and (b) the law sees it as less significant. This second point is important as it means that new laws can collect data from everyone, not just suspects in a crime, and can allow use of that data by a lot of people without a warrant. It is only seen as serious and needing of a warrant when you want to look in detail at the communications via some sort of "intercept", the very things that will not work with the modern "encrypt everything" culture. Of course that won't work with criminals.

The UK government want to make a national system of searchable ICRs, and that means getting data from every ISP. But that is hard. There are literally thousands of ISPs, small and large, and they each would need notices to retain data. But it is worse - each ISP needs to consider the collection, storage, and access to this data, and how that will comply with the Investigatory Powers law and Data Protection law. The ISP may have to have positively vetted staff, and secure data storage systems, and all sorts. This is far from cheap or proportionate for a small ISP with only a few hundred or even a few thousand customer lines. Current policy is government pays for this too, so even harder.

Even with this security, the data is vast and the risk for it being compromised is very real. It is a far greater threat than the terrorists we try to thwart by such measures (but then so are paper cuts, well, nearly).

The only sane approach the UK government can take, if they really are hell bent on this new police state, is to engage with the back-haul carriers, like BT Wholesale, Talk Talk Business, Virgin, and maybe a couple of others. By doing this they can get almost everyone covered, even A&A customers! And all done in secret.

So what can be done?

Well, for a start, it is important to make it clear that we are not talking about helping "terrorists", "pedophiles", or "criminals" here. They can all take measures themselves, using Tor, and so on, to protect their data very easily. Also, they are often already known and already under more detailed surveillance. What we are talking about here is the police state surveillance on every single innocent person in the country for no legitimate reason. A true police state.

An important step is for everyone to ensure they use encryption as much as possible, to protect that content, but using encryption to protect meta data is harder. Tor is a start, but that is a complicated network that really should be used for those that really need it. So how can end users feel any safer over meta data collection?

One obvious answer is use of standards based encrypted PPP links. They exist, they work, and some small ISPs do this. Well done to them. The challenge is scaling up to larger ISPs. Running proper crypto for thousands of lines and gigabits of data is quite simply not easy, yet.

This is a short term issue in a way - I am sure in a few years the hardware will be up to the job, but not quite yet, in our experience.

So what can we do - well we can obfuscate the meta data!

Basically, the PPP traffic may look like normal IP data, but actually the IP addresses, maybe the TCP and UDP ports, and perhaps a bit in DNS queries, will be "scrambled" a bit. It does not have to be processor intensive or too complex. Just something that cannot easily be automated on a large scale.

Scrambling the data is not hard, the trick is to make some sort of initial negotiation to make it hard to descramble without some work. We are thinking some Diffie Hellman exchange at the LCP level maybe, and simple XOR of meta data. Maybe change occasionally during the connection. Ideally some properly negotiated obfuscation and publishing an RFC, or specification of this, so linux pppd can do it as well.

The result is that L2TP DPI based PPP capture will not easily collect meta data. Indeed, it will actually capture screwed up meta data and create bogus ICRs.

So what would happen - well, the government will have to consider talking to each and every one of those small ISPs, and pay the price for doing it - not financially viable, surely. If nothing else, the ICRs they collect to start with will be less than useless.

So we want to make an RFC - how can we get some help?

Please comment on here, let me know if you can help, DM me on twitter. Let's make a standard, or at least a specification, and I will code it in the FireBricks at the LNS end to work with A&A customers as well as a few other ISPs using the same kit.

We do not need a police state in the UK, or any country that follows, and we can help stop it, or at least thwart it.

Will anyone buy a UK crypto solution ever again?

The Investigatory Powers Bill is progressing through the Lords, and facing some stupid issues still.

There was a long debate on the matter last night, and Earl Howe seems to miss the point.

Assuming that technical capability orders will be allowed that provide for a capability to remove protection from communications, it basically means that UK companies can be (secretly) banned from making encryption systems that are actually secure (where nobody but the parties communicating can ever see the communication).

So let's ask...

Would you buy this dodgy crypto product?

Would UK government , e.g. The Home Office, buy encryption solutions from a company in a country where they know that country's government can secretly force the supplier to have included some sort of "back door"? (whatever you call it, a means for third party access to the communications)

I'd actually like to see that question asked in the Lords ^^^

I think the answer would be no, and the same would be true for anyone wanting to buy some encryption solution...

Indeed, I have to wonder if the UK government would buy encryption solutions from UK providers after this, as they know that UK providers are basically not allowed to make a solution that is truly secure any more. The UK will have to buy crypto solutions from some other country!!!

On whom do you serve a technical capability order for open source code?

This is a biggie. The idea is to stop UK companies making secure solutions. Well, the idea is to stop anyone, even not in the UK, but there is no jurisdiction to do that. But what if the supplier is not just "not in the UK", but "not an entity" at all.

Open source comes from a collection of people contributing to source code that can be seen. Even if you tried to order one contributor to dumb down the solution, that could not be done in secret, and their change can be seen and removed by the "community".

Why do we need this?

The government want no safe place for a terrorist to communicate. That means there is no safe place for anyone to communicate as any system will not know if the user is a terrorist or not. That is what they want, and have clearly stated that.

But this law will simply mean UK providers cannot provide a safe place, for anyone, to communicate. It does not mean there are no safe places.

There are many ways to communicate secretly, including apps and solutions from non UK providers, open source solutions. Heck! Even pen, paper and dice.

So a person that wants to communicate secretly can do so with very little effort.

The people affected by this are the users that just want the convenience of using a product or service securely. Such products and services will not be allowed to exist, at least from UK suppliers. So those users suffer, as does the whole UK crypto industry.

The criminals do not suffer at all!

#IPBill commons committee stage... Was it worth it?

Looking at the report here, I see almost entirely typographical or grammatical changes and nothing else.

These include serious changes like:-

And perhaps the most meaningful change I can see is:-

I know there were many proposed changes (I help draft one) that would actually impact meaning. I see almost nothing that does that.

The Lords have their job cut out for them now.

P.S. I was a bit confused as the date is April, but no, this is the changes released start of May...

$5 wrench #IPBill

Encryption is all about keeping your information (e.g. stored data or communications) secure from attack, i.e. so that nobody else apart from those you intend can get access to it.

Technical attack

The first, and most obvious, line of defence against an attack is against the technical aspect of the encryption itself - an attack on the maths. You need systems where it is not possible for a computer to try every password in a few seconds, or where there are not mathematical tricks to extract the data.

It is fair to say that modern encryption systems are pretty good at this and getting better all of the time. This is the main thing people think of when considering the defence against attack.

However, as xkcd make very clear, tackling the mathematics is not how you attack good encryption. The "$5 wrench" is much more effective, sadly. So we need a defence against that.

Detection

One of the first things to consider is whether someone can detect you have something encrypted in the first place! If they cannot tell you have something encrypted, then they will not try and force the keys out of you with a $5 wrench!

There are several techniques for this. They generally rely on the fact that modern storage devices and things we store have spare space. So on a hard drive, you may have terabytes of space and actual content that is only a hundred megabytes. What is in the rest of the space? Well, it can be random data and nobody will think it is anything else. Except, if you know the right key you can turn random data in to an alternate file system with stuff on it. Drives have random data padding, or can, so you have some degree of plausible deniability.

Another, perhaps safer, system is using the random elements in some types of data. Audio, video, images, all have low levels of random noise. By replacing this with encrypted data, which looks like random noise, the images all look pretty much the same, but can be decoded. The nice thing is, as long as they are original recordings (so no reference to which they can be compared) there is typically no way to prove the "noise" is encrypted data and not "random" without the key. Again, plausible deniability.

Duress

Another simple approach, which may mean the $5 wrench gets re-applied, is that you can have a system were there is a duress code which, when used, wipes the data. You may think that it is hard to quickly wipe a hard disk, or that the hard disk can be copied first so you can always try again, but there are simple ways around that. The idea is you have a security device that holds the (long, and random) key used on the hard disk. It needs the code to extract the key to decode the disk. But, if given the wrong code, it wipes the key (which is quick and easy). It cannot be copied and has tamper detection as well, so trying to open it causes the key to be lost anyway. Apparently iPhones have this sort of technology now, but I don't think they have a duress code (yet) just the "wipe after a number of wrong attempts".

Deflection

Another cunning plan in that the encrypted data is arranged such that with one key you get the actual stored data, but with another, you get some benign data - though ideally the benign data wants to be something embarrassing that you might have wanted to encrypt. This is harder to do, as the data has to be somewhere, but with things like alternative file systems in hidden partitions, as above, it means that application of the $5 wrench can get access to encrypted data that "they" were sure was there, but not get the data you want to keep secret.

When it is not a $5 wrench

All of this is trying to address the adversary that is wanting to get to your data, on the assumption that they are "the bad guy". But what if the data is something you want to hide because you are a criminal?

Well, the problem is that every one of these techniques, designed to protect us against "the bad guy with the $5 wrench" work just as well to protect us from the FBI or the police. They will use threats of law enforcement, imprisonment, and so on, rather than a $5 wrench, but the answers are the same. If you can make it so they have no way to know there is something hidden at all, you win. If you can make it so after threats, you give a key that provides non-criminal data, you win. Even the duress code to wipe the data may work, if it does not flash up saying "wiping key" and just says "invalid code" and you can claim you really have forgotten the key.

The protections are the same, and so, if we are to continue to mostly win against the "bad guys" we will have systems that win against the police as well. That is just a fact of life, without which we open doors to criminals (and $5 wrenches). Sadly, maths does not understand law, and law should realise this and jus get over it and stop being an arse.

Explain it, as you would to a child... #IPBill

So, I'll try contacting Lord West #IPBill

Dear Sir,

I have heard some of your comments in the Lords, on parliament TV, and I would like to try and impart some technical knowledge to assist you in your work, if I may.

One of the key points you make, quite strongly, is that there should be no way that terrorists, pedophiles, criminals, should be able to communicate such that proper authority cannot by some means monitor what they say. No "safe places" for them.

I fully understand that the monitoring of communications is carefully controlled with safeguards and oversight to ensure such an intrusive power is used where necessary against such serious crimes.

However, I feel you may lack some understanding of basic mathematics of encryption.

It is a simple matter of fact that it is possible for two people to communicate in a way that is totally secret. Whilst computers make this easier, it can be done with no more then pen and paper and dice. It would allow secret messages that can only be read by the intended recipient, and not by GCHQ or NSA no matter how much resource they throw at it.

This is a fact - it is a fact of life and mathematics. It is not changed by speeches in the Lords or legislation.

Indeed, with the help of computers, it is possible for such communications to be embedded in random data in images and videos in such a way that it is mathematically impossible to prove there is a message being conveyed. So even outlawing such communications cannot be detected or enforced.

I will be more than happy to visit you and explain these basic principles, and even demonstrate pen and paper encryption to you. I also have some videos on the matter if you are interested.

Given that this is a fact of life, a reality, can you perhaps concentrate your efforts on the negative side effects of Draconian laws to stop people communicating. Criminals can communicate, end of story. All such laws do is impact those of us that choose to abide by laws, and in doing so we open ourselves to criminals attacking us.

Please do take this email seriously. I am a technology expert. I have given oral and written evidence to the committee on the IP Bill. I run training courses on this. I write code for a living and I run an ISP. I can help you understand the issues, and perhaps the serious negative side effects, of your views.

Respectfully,

--
Adrian Kennard
Director, Andrews & Arnold Ltd.

Good question from @LordStras on #IPBill today - shame about the answer!

Lord Strasburger asked at 15:20 today:

My Lords, paragraph 217 of the Investigatory Powers Bill gives the government almost unlimited powers to force, in secret, companies to, I quote: "remove electronic protection" from their products. Could the minister tell the house how the government intends to use this power in the increasingly frequent case where a company has designed the security of its products so that even the company itself is incapable of unlocking the equipment or decrypting the data. Will Apple, and others, be require to redesign their products so that they can break in to them, or will they be required to stop selling them in the UK?

Lord Keen seems to totally miss the point, and ends up, after several questions, stating: There is no question of encryption keys being weakened. There is no question of encryption keys being made available in response to a warrant. The encryption key would remain wholly in the possession of the provider of the service. The warrant will ask that they apply the encryption key in order to provide the decrypt. So there is no weakening of any encryption in these circumstances.

I am sorry, but (a) why can they not answer a straight question, and (b) do they really not understand?

A company can make their communications system, like Apple with iMessage, so that Apple do not have the keys to decrypt the communications. So that the key does not "remain wholly in the possession of the provider of the service" and so that it is not reasonably practicable for them to decrypt the messages.

The question is whether paragraph 217 could be used to force a company to redesign such a system so that they do have access to keys. The problem is that if they do this they are weakening the encryption system. They are not following best practice. They are making the communications more vulnerable to attack.

Think about it for a second - any step that changes from "government cannot see message" to "government can see message" (even under strict rules) has to be a step to weaken the encryption in some way. One more person being able to see the message means it has weaker encryption.

Lord West goes on to repeat the stupidity of saying that there can be no place for terrorists and pedophiles to communicate - as if he wants to outlaw multiplications. As I have pointed out so many times, anyone, with no more than pen and paper and dice, can send secret communications without a "service provider" providing the encryption, and without a way for GCHQ or NSA to crack the encryption. That is a fact of life and mathematics and no amount of legislation or speeches in the Lords can change that. Get a clue Lord West, please.

Who would want to work for an ISP? #IPBill

Working for an ISP you could find yourself between complying with IP Bill, or Data Protection Act, or your employer contract, and no way out. One way or another you are in the shit!?

Who would want to work for an ISP?

And those that do - will government compensate ISPs for the extra cost?

#IPBill madness

As reported, under the IP Bill/law "[Companies] subject to a technical capability notice must notify the Government of new products and services in advance of their launch, in order to allow consideration of whether it is necessary and proportionate to require the [company] to provide a technical capability on the new service,", and "The tech companies will have little say and the Government say explicitly they have the power to bring legal action against them if they do not comply,"

Seriously why would any company comply?

OK law will be law, so one simply makes a separate company which does not actually come under the IP Bill/law, and which is not subject to a technical capability notice which develops all new products. It has no obligation to notify. Then when launch arrives, it having prepared all the technical and marketing in advance, it tells the main company which is subject to a notice, and launches. Main company complies with law and tells government in advance of new product/service launch, 30 seconds in advance, but in advance, job done.

Many companies already develop new products and services with a degree of secrecy internally and externally, especially people like Apple, so this will simply add a legal layer of separation between R&D and product development and the main company. Simple step, easy, and makes the law on this totally fucking pointless.

Getting really really cross with UK Government wanting to spy one everyone now.

P.S. A&A are not subject to data retention or technical capability notices. Even so, we are agile enough that we will often launch a new service within days of coming up with the idea, so even complying with such laws will leave the government dragging their heels.

P.P.S Why would any foreign company comply with this bullshit anyway? They will have a UK subsidiary company which can be kept in the dark until actual launch.

Is this why we need to spy on every citizen on everything they do in their home all the time? #IPBill

This is one of the examples from the National Crime Agency as to why we need the IPBill and automated filters to search a huge distributed database of everything everyone does on-line in the UK.

This really does show how invasive this will be if allowed to continue in to law. It is quite shocking. This is police state gone mad.

There are so many things one could say about this terrible example, I don't know where to begin. But here are just a few of the issues.

1. Firstly I am surprised it is reported to the police as it would very quickly become apparent the the emails in questions are not from who they claim to be, and the recipients just put them in their spam folders and never see them again. Even so, this is some kid being naughty. It is not on, I agree, but does it really justify an expensive police investigation?
2. If it was reported to the police, would they actually do anything to investigate? I would suggest not - we simple do not have the resources in the police to handle such trivial cases. It is a sad state of affairs I know, but the police are under enough pressure as it is. I seriously doubt the case would get any attention. Problems like this go away if ignored (look like they stopped after two weeks anyway), so even more likely to get no urgent attention.
3. But seriously, if the sender is smart enough to use a Russian anonymising service, they probably are not going to get traced by this - for a start the service would probably be using https on a generic cloud based platform, or several of them, where the IP is shared with loads of other generic services and is changing all the time.
4. Also, the service would almost certainly suggest ways to be less traceable, using wifi in a coffee shop, using tor, and maybe even offering delayed sending of emails so you can be in the room when the email arrives removing any suspicion from you and screwing with the above detection method.
5. The whole thing relies on today's method of communication using a simple TCP connection, but that is changing, there are many other protocols and an increasing need (because of NAT) to communicate by a long standing persistent connection. As technology moves to that, any time stamp correlation goes out of the window.
6. In practice, all of this will only identify a household. It is possible the household has more than one suspect (sisters perhaps), and the suspect does not confess. Even with one child in the house, what if they do not confess? So what then? A raid on the house, seize all computers, phones, and tablets for investigation, demand PIN and passwords to unlock them? Breadwinner of house has work laptop taken, ends up losing job over stigma? The kid in question used privacy mode on the browser so police find no trace, and even if they did, they cannot tell which of the sisters used the machine, so no conviction or further action happens.
7. Worse, actual sender is a different kid, that uses the house wifi from outside, knowing that in this police state the house will get raided, which was their intention all along.
8. Or finally, what if the the kid sends these abusing communications by post,. Does the NCA call for a national database of everyone's handwriting and DNA to be collected and stored. Or do we just go for cameras in every room in every house to keep us safe?

I am just shocked that they do not see this as an example of how invasive and police state this example shows the IP Bill to be... Shocked!

P.S. Look how easy such a system is for tracking the confidential source for a journalist, or such like. All without a warrant even!

P.P.S. Technical point...

The police would have the name of the service used. The CSPs would have the IP addresses of the TCP connections made - they would not have the name. (Yes, https can expose the certificate name using DPI at present, but that will change soon).

So, the query needs to state IP addresses to be checked, not a service name or domain name.

I see nothing in the IP Bill providing for a system to track the IP addresses used by every domain name in the world in real time as they change. Indeed, I am not sure such a system is technically possible. It would also have to track the "view" from each ISP at the very least as DNS servers can (and do) give different answers depending on who is asking. Such a system would be a really huge project, but without it, the police would have no way to know what IPs to ask the CSPs for in their search as they would have no way to know what IP was in DNS two weeks ago!

Internet Connection Records, a small taste of the problems with #IPBill

We (A&A) upgraded some core switches on Thursday morning. There we more snags than expected but the work was completed in the planned work window, in the middle of the night, and once again I'd like to thank the staff involved.

However, there have been a small number of consequences which we have been working on. Obviously not show stoppers otherwise the planned work would have been reversed, but oddities.

One of them was that we were having difficulty getting SNMP from some of our LNSs, which meant some of our monitoring was unavailable. This had left us scratching our heads somewhat as the LNSs were not rebooted or reloaded or anything.

Then, another snag was that today one of our servers that does syslog started to run out of disk. Again, a puzzle. But this was easier to understand just by looking at the logs.

It turns out these are related. We have some debug logs from the LNSs related to setting up PPP sessions and allocation of IP addresses. These are kept for a couple of days to help resolve any connection problems.

One of the things logged is the IPv6 allocation, and this is logged by logging the DHCPv6 request/reply exchange from the customer router. Usually these either happen once after connection or maybe once an hour.

The problem, it seems, is rather odd. Some customers still use the Technicolor ADSL broadband routers that we used to sell from years ago. It seems many of these got upset in a rather odd way after the work on Thursday. We can see no logical reason for this, but they are now in a state where they are on-line and working, but generating approximately 1GB of uplink traffic a day, each, sending DHPCv6 requests! We were logging all of these. It seems the logging may actually have been so much load that it was impacting the SNMP responses.

The fix is rebooting the Technicolor routers, which, thankfully, we can do remotely.

But this gives me a slight insight in to the difficulty of collecting Internet Connection Records. Each of these DHCPv6 exchanges would be something that might well be logged as an ICR.

In practice, just trying to log this one type of packet we could not keep up - the log file was only 16GB (158 million entries) since 4am today. Looking at the traffic levels, that is a tiny fraction of the number of requests being sent by these routers. Our LNS logging system has built in limiting to try and avoid overloading things, and it was being pushed to the limits.

If we had to log every session (TCP/UDP/SCTP/IPSEC/ICMP, etc) there is just no way any of our existing kit could keep up. Of course it wasn't designed to! It was designed to shift packets quickly and provide Internet access to our customers, not snoop on anybody.

This also highlights the issue with any deliberate generation of ICRs by s/w on customer networks. It is easy with relatively low levels of traffic to cause a lot of ICRs to be created, if the #IPBill passes.

Public Bill Committee Written Evidence #IPBill

I am sorry that it has taken so long to get together a proper report on my findings when considering this Bill. It has been a lot of hard work, and I am very grateful to the assistance of many colleagues on this, including working through much of the Bill with me page by page on a Sunday!

There are, as before, a lot of issues.

My submission (PDF).

If you are thinking of making a submission, please do so ASAP. The first oral hearing is Thursday 24th and they have asked for evidence by Wednesday to allow time to consider it.

Please do feel free to quote me or copy to your MP. Ultimately they are the ones that vote on this.

I am happy to meet with MPs and Lords on this matter.

---

Oh, damn, once again, under this Bill your computer would now be logged as accessing a porn site, just because you read my blog. It would not log that you only accessed a benign favicon image, as that would be content, just that you accessed something on the site. Oops.