Personal use call recordings

This has me a tad unsure, and curious on views...

Someone on the internet said ...

... that it is better to not use a call recording when making a complaint or dispute. Why? Because you can "legally only make the call recording for personal use".

Well, yes, first off, GDPR related, "personal use" is a thing that takes stuff out of  GDPR. But it is also possible to make a call recording as someone registered with the ICO under GDPR and comply with the rules and use for something else. After all, the call centre you are calling does that. But I fully agree, that would be unusual for someone personally making some sort of complaint. So yes, it would be for "personal use".

But then, surely, "personal use" must cover "having a record of what I said and what was said to me", and "personally using that in a court or with an ombudsman" - is that "personal use"? Maybe, maybe not, I really do not know.

But then... I could definitely make "personal use" of a recording to "aid my memory" in making a transcript of the call - nobody else hears the recording, only me. And making a transcript of a call is something I can legitimately do with, or without, a call recording, yes? The fact that "I made this transcript using a call recording to aid my memory so as to ensure it is 100% accurate" has to carry a lot of weight with a court or ombudsman. Indeed, if the other party claimed my transcript is wrong, it starts to be accusations of fraud, and I am sure in such cases a recording could then be used to validate the transcript, surely?

I also seriously doubt a court or ombudsman would ever exclude a call recording anyway. The other party raising legal objections that the recording should not have been made would rather hurt their argument as it is "we only said wrong things because we thought you would not have proof of it". Of course if a court or ombudsman said they won't accept a call recording, you just say "fine, here is the transcript I made, using the call recording to aid my memory" (perhaps even with an oath of its accuracy) - they are going to accept that - so the call recording has been useful.

I also find that simply saying "I'll check the call recording" is a hugely powerful phrase, and you don't even need the recording most of the time!

However, this then got me thinking of the alternatives suggested.

Email - keeping a record of the emails sent and received. I 100% agree this better, but not based on "not being able to use a call recording". I can take my time composing an email (I fail to do that some times, sadly). I can avoid losing my cool, etc. But then so can the other party (and they may have more training and practice).

My thought here is: how exactly is a record of an email exchange any different, legally, from a record of a spoken exchange. Why would one be "legal" and one not? Surely they hold the same "personal information" (if any). Does GDPR differentiate between them? Or is this not GDPR but something else? Surely the record of emails is just as much only allowed for "personal use"?

And how is that different than taking a screenshot of an "on-line chat" (another suggested idea). This even has the fact that the other party cannot simply assume that of course you have a copy (like email), as you had to actively make a copy, without asking.

And really, how is this different from old school written letters?

I am curious to know - where is the line drawn, why, and by what law?

Be reasonable

Update: New rules 13th May change the examples that are reasonable.

This is a blog about a little bit off the way laws are drafted. I am not an expert on legal drafting, and not a lawyer - however, laws are meant to be understood - as a member of the public I should be able to work out if something I am about to do is legal or not, even if that means I need a bit of help to understand the way laws are written. I'd be delighted in any feedback from those that are experts.

I'm picking, topically, on section 6 of The Health Protection (Coronavirus, Restrictions) (England) Regulations 2020 as amended. In particular, it basically says, in 6(1) that you need a reasonable excuse to leave home.

So that gives us a test - is my excuse a reasonable excuse or not. If that is all it said, it would be somewhat open to interpretation, and my view could be very different to yours. This is an issue where one party is a policeman and disagrees on what is and is not reasonable.

Of course, I would hope, being public health legislation, not public order, that any excuse that does not pose a public health risk should be considered reasonable. It is shame there is not paragraph clarifying the basis of a reasonableness test. Surely taking your household for a drive to a secluded spot for a picnic should be reasonable, clearly, as not a health risk as you do not interact with anyone. Even more reasonable if you ensure well serviced car, enough fuel, and driving carefully. Sadly this is not so simple, and we know the police are quite clear on that not being reasonable, so we need clues. We need to know how to apply this reasonableness test.

6(2) of the regulations helps, it defines reasonable as including... and a list of things. The use of the word "including" here is very important as it means it is a non-exhaustive list. It means some thing may be reasonable but not on the list. Sadly it gives no real idea how to tell if things not listed are or are not reasonable. So, for example, I would consider feeding a horse reasonable, but that probably comes under 6(2)(h) as a legal obligation under animal welfare laws.

This is where a computer programmer and a lawyer would diverge somewhat. To a computer programmer the rules in 6(2) are simple tests - if you pass any then you are reasonable. If not then there is an implicit final "generally reasonable" test, but the wording of the tests in 6(2) would not have any bearing on that "generally reasonable" test.

However, the wording does matter. The items in 6(2) are not simply positive things. They do not say "this is reasonable" and "that is reasonable", no, they say "this is reasonable except in this case", and "that is reasonable, if another thing applies".

This is quite clever in a way as it uses examples to couch the boundaries of the test, to say what goes in and what goes out - where the line is drawn.

So, for example, 6(2)(ga) to visit a burial ground or garden of remembrance, to pay respects to a member of the person’s household, a family member or friend; says visiting a burial ground is reasonable, but only in some cases. It has caveats, and they matter. It is was just that visiting a burial ground was reasonable the clause would not go on to say member of the person’s household, a family member or friend at all, so this means that visiting someone you don't know is not in fact reasonable.

So even though 6(2) is a non exhaustive list, using "includes", every restriction or caveat in the clauses in 6(2) effectively define the edge - line beyond which something is not reasonable, for those things that are listed.

Looking at 6(2)(b) to take exercise either alone or with other members of their household; the caveat is either alone or with other members of their household matters, and so exercise with someone else is not reasonable. As I say, as a computer programmer it would be different - exercise with someone else would simply fail 6(2)(b) but a "generally reasonable" test would not consider why it failed 6(2)(b), or that 6(2) has a test relating to exercise in it with caveats. However in English, those caveats start to matter as we list "exercise" and they say where the line is drawn. Exercise itself is not something not listed, and so possibly also included, because 6(2)(b) does cover exercise.

Looking at 6(2)(f) to travel for the purposes of work or to provide voluntary or charitable services, where it is not reasonably possible for that person to work, or to provide those services, from the place where they are living; seems to clearly relate to doing work (or volunteering, etc) but it has a caveat of not being possible to do it from where you are living. Again, the clause covers working, so you would not consider it reasonable to go out to work when you can do it at home - even if that is not a public health issue.

Of course, the use of "includes" does allow for something completely different to be reasonable and not be in the list. Ideally something that is obvious to all that it is clearly reasonable. But anything that is in the list with deliberate constraints clearly defines the boundary and implied directly what is beyond that boundary and hence not reasonable.

Sadly, 6(2)(f) also has the caveat "to travel", which directly implies that outside of that caveat, working away from home at all is not a reasonable excuse.

Sadly, on that last point, as 6(1) now needs an excuse to simply be outside, it suggests doing work that is not travelling for work, outside your home, is no longer reasonable.

Oddly even 6(2)(k) in the case of a minister of religion or worship leader, to go to their place of worship; is a problem as such a minster can go to their place of worship, but then no longer has a reasonable excuse to be there, or even to travel back home!

Some clauses just muddy the water, like 6(2)(l) to move house where reasonably necessary; effectively defining reasonable excuse as a thing that you need to do because is reasonably necessary! That is not helpful...

P.S. Stay home!

NIS Directive and Internet companies in the UK…

This blog is about some upcoming legislation which could have a lot more impact than you might expect on smaller companies that provide internet related services.

Summary

The Network and Information Systems Directive is an EU Directive which will be implemented in to UK law next May. At this stage the UK implementing law is not drafted and we have a chance to influence how it is drafted by responding to a DCMS consultation. If you offer any sort of web hosting, or your are ISP, even a small one, you may find yourself in scope, and so should look in to this now. The penalties can be huge, much like GDPR penalties.

Key problems

Who should be in scope? It is not entirely clear on some aspects who should be in scope - who the directive is aiming at - we can guess some big players like LINX, Google, and Nominet, but when it comes to DNS and cloud services, it is very unclear.
Defining the scope. This is very important as defining the scope by describing the service and some measurable scale, can be very hard. I would struggle to define a DNS provider to include all of that they intend with no unintended consequences, even if I could understand the intended scope in the first place.

Both of these are areas where DCMS urgently need help so as to avoid some bad legislation — not only would it put an undue burden on smaller ISPs, it would actually be counterproductive and increase the risk.

What is the NIS directive?

If you have not heard of it before, the NIS directive is an attempt to increase the security and resiliency of network and information systems, primarily the Internet, to minimise disruption and downtime, and the ensuring impact on the economy. It builds on rules which are already in place covering electronic communications networks and services.

Essential Services

The main targets are those providing essential services. This covers Transport and Energy and so on but specifically covers internet related services provides by IXPs, DNS providers, and TLD registries. Whilst IXPs covered are likely to be LINX and perhaps a few others, and TLD providers are likely to be Nominet, the “DNS providers” is a concern as I will explain later.

Digital Service Providers

The directive also covers Digital Service Providers, which covers all sorts of people like on-line marketplaces, cloud computing, and search engines. Unlike “essential services”, there is a threshold test for digital service providers: a provider which employs fewer than 50 persons and whose annual turnover and/or annual balance sheet total does not exceed €10 million is out of scope.

Do we really need legislation

Sadly the time to tackle this has gone as this is an EU directive which the UK is bound to implement, though it will be reviewed from time to time. However, this is an important question as the UK has some discretion as to the way in which the directive is implemented, and it may be possible to limit the scope to the few larger providers that already have in place the measures that the directive requires. Considering if the legislation is actually needed could be a factor in this.

The reason I am unconvinced is that the industry, at all levels from low level protocol design, to network operations of companies like google and ebay, already take these issues seriously and are constantly working on improvements.

Just looking at DNS, it was designed to be robust in the first place, and improvements to resolvers (randomised ports) and changes like DNSSEC are tacking some of the ways the system can be “attacked”. Even at higher levels, things like https (secure web pages) are making DNS attacks less useful. You then have the reputation of these larger companies, and their experience - when was the last time you could not get to Google or Facebook which was their fault (i.e. not just a broadband outage)?

So if industry is constantly working on this, do we need legislation? Will legislation simply add additional burden? Can we limit that burden when putting this in to UK law?

Search engines

They presumably mean google and bing, but how in scope do these companies become if they shut down EU offices? Maybe they should just list them as being in scope? However the definition actually talks of a service that searches all web sites, which no search engine does or ever could do, so google could easily argue it is out of scope. I am not that fussed as we are not a search engine, phew, but it would help to get DCMS to understand and refine these definitions — and, to their credit, they really do appear to be willing to listen.

Cloud computing and on-line marketplaces

This gets more complex as it could cover simple web hosting. There are the turnover figures, but if a medium sized company was to do some web hosting it could find itself in scope. At the very least the thresholds need to be tied to “relevant turnover”, and I think the definitions need to pinned down somewhat. There is a danger we could be in scope one day, and many ISPs only slightly bigger than us are probably going to be in scope.

The scope of “cloud computing services” proposed to be in scope by DCMS seems to go way beyond what the UK is required to implement under the directive, and we are not sure why. The directive requires only providers of a “digital service that enables access to a scalable and elastic pool of shareable computing resources” to be in scope, but DCMS is seemingly proposing that anyone who provides online services to businesses must be in scope — email, IM, VoIP, web hosting, and so on. Since very few of these services are actually critical to the economy, their inclusion seems unnecessary.

DNS providers

This is a special can of worms, and hence the largest part of this blog post. The problem is that this comes under the onerous “essential services” category which includes some serious fines for non compliance, and does not have the same turnover / employee threshold as the "digital services" obligations.

The actual EU directive talks of DNS being a “hierarchical system” that “refers queries”. To me that is authoritative DNS servers only. Remember that TLD operators are covered as well. The proposed UK legislation seems to cover caching and recursive resolvers too. That is where it becomes a problem.

The two sides of DNS…

Authoritative servers: The DNS database is distributed and hierarchical. It is a target for attack. If you can change the DNS entries, or make them appear to be changed, for, say, a bank, or one of those digital service providers, you can disrupt services and defraud people as well. So DNS is important.

One problem here is that DNS can be, and is, in the hands of the companies with these important domains. It is unlikely they would rely on their local ISP to manage the DNS. The TLD provider like Nominet would refer (delegate) to the company’s own authoritative DNS servers. So it could be that the DNS servers in question are not covered by the legislation anyway in the cases where attacks would cause the most damage.

Where it could come in is where there are ISPs providing authoritative DNS as a service to others. We do that as a small ISP. But our customers can, and probably should, be using secondary servers from other providers.

The threats here are mainly that DNS records are changed, and this could be by some social engineering (phoning claiming to be customer, emailing, trojanning to get control page login details, etc), or technical (straight hacking). Obviously there is a risk of something simple like a power outage, but that should be covered by the the fact DNS has redundant servers. There is also a risk of DoS attacks on such servers. The issue here really is that small ISPs like us, that could well be in scope here, are not going to be used by big players like a bank, or someone important. As such we are a lower risk target anyway, and less of a disruption when attacked. Even so, we offer our customers two factor authentication to minimise risk of unauthorised changes being made.

There is one other threat, one of incompetence, and I worry we could be failing such legislation if it applies to us. What happens is a customer will go to some web developer. The web developer will say that they will need the DNS name servers for the domain changed over to them. Many web developers work like that, and have no clue about other uses of DNS, even email!. We try very hard to warn customers if they ask for DNS to be changed to new name servers, but even so, it is not uncommon to have the customer on the phone an hour later asking why email is not working any more.

At the end of the day, I am not sure which “larger players” in the authoritative DNS market (below the TLD such as Nominet) would sensibly be a target for this legislation. Are there “Authoritative DNS providers to the stars” out there, offering authoritative DNS to large companies? Who are they?

Caching and recursive resolvers: This is where it does get scary. As worded now by DCMS we come in to scope as an essential service provider because of the caching recursive DNS resolvers we provide to customers. That is crazy! We are a small ISP, with under 10,000 customers. DCMS has proposed that only providers who get more than 60 million queries in 24 hours would be in scope but, having measured these, we exceed this threshold by a factor of two on our customer facing resolvers right now, but it gets more complex.

Each of the customer routers typically has a DNS resolver or forwarder, some of these are owned by us, and for many ISPs the customer router is owned, or maintained, by the ISP. If they come in to scope (and I cannot see that they would not), then they will be getting an order of magnitude more queries. I think, in our case, most customer routers are not “ours”, thankfully, but even those that are, I am unsure how we would know how many queries they get. Of course one customer deliberately hitting their own router on its 100Mb/s LAN as fast as they can with queries would put that one router in scope, even if the requirement is billions of queries in 24 hours. That would put that customer, or us (if it is “ours”) in scope suddenly.

There are other issues with DNS resolvers. The industry has tacked threats as they have come along, and one was that older/simpler resolvers were vulnerable to being flooded with incorrect answers and then made to look something us - not that hard to do with code embedded in a web page. So what happens if a specific make of customer router has such a vulnerability - that could cause wide spread impact on services, spoofed DNS and fake web sites and fraud. Who is, or should be responsible for that? The manufacturer? The reseller? The end users? The legislation seems to ignore this risk completely, but it is also easy to see it being impossible to police for “made in china” routers anyway, and you really cannot make code 100% bug free.

The other issue is that this could easily “put all eggs in one basket”. At present ISPs will operate a lot of customer facing caching recursive DNS resolvers. Lots of redundancy. This makes attacks such as DoS harder. As a small ISP I doubt we can afford to find ourselves in the “essential services” scope, so what would we do? What would lots of small ISPs do? We would almost certainly (with suitable announcement) change DNS servers to use googles 8.8.8.8/8.8.4.4 service (and its IPv6). Alternatively we may subcontract some commercial DNS provider. That could get us below any thresholds and out of the essential services scope.

The problem with this is that you end up with a few large DNS resolver companies instead of every ISP operating lots of separate caching resolvers, giving end users choice and redundancy (they can always switch to use 8.8.8.8 if they want or even run their own resolver). These few large providers, even though in scope of the regulation (if they are in the EU) will then be a juicy target for attack, either as DoS or DNS poisoning or simple bribery. They become the sole gatekeepers of the underlying hierarchical DNS system, undermining its integrity. This undermines the reliability of DNS and goes head to head with the technical community that DCMS should be embracing, and not fighting.

Of course, we have the issue of published resolvers that will be hard coded. We could port map these to an external DNS resolver. But then the port mapper boxes become as important as the DNS resolvers they replace - so do they become in scope as “DNS resolvers” themselves? What if part of CGNAT boxes? What if a feature of customer routers?

Personally I cannot see any logic in including caching and recursive resolvers in scope at all. Is there a threat? Maybe if they specifically called out google’s public 8.8.8.8 service as in scope, perhaps that is all they intend?

Missing!

There also seem to be a few key services missing from the directive!

Data centres: Whilst technically a data centre is not different to someone else selling office space (they sell space, power, air-con and physical security basically), they are key to the operation of all of these digital services that are covered by the directive. Why are they not in scope?

Content Delivery Networks: These too are key to many services, and could have major impact if attacked, but again, it looks like they are not in scope.

Don’t just comment here!

Please, consider the directive and DMCS proposals and reply. We need people mitigating the impact, making sure it covers what needs to be covered, and making sure the definitions work.

The consultation document is here (https://www.gov.uk/government/consultations/consultation-on-the-security-of-network-and-information-systems-directive), and you have until 30th September to respond.

This is the A&A response, here.

(Thanks to Neil Brown for help with this blog post)

Porn ID checks set to start in April 2018

As per BBC article. I hate having to repeat myself, so I'll make it quick.

1. Is there a problem to solve? Show us the evidence please.
2. Is there a solution already? PCs can be set up with basic parental controls, and ISPs (even A&A) can help with that, so young kids that have no interest in porn can avoid it.
3. Is this a solution? Older kids that want to see porn will absolutely not be stopped by these measures, so no.
4. Will this work at all? Foreign web sites that are free are not covered, those paid by advertisers cannot be stopped by blocking card payments. Maybe some that take cards now will comply, but they sort of do as they take cards already.
5. Kids can get cards! (albeit pre-pay or debit rather than credit cards) which makes one means of age checking somewhat harder
6. How do you tell my age? It is almost impossible to make an age verification system that works remotely over the internet that cannot be fudged somehow. E.g. use a parents card details, simple as that. Anything an adult can type in can be typed in by a teenager. Even live video chat cannot be trusted - how long before there is an app to make your live face and voice seem a lot older in a convincing way.

Now for where it gets really bad...

1. The age verification companies appear under no special obligation to secure the data, in spite of calls for this. If any are outside the UK they may not even have the Data Protection Act to consider.
2. It is going to be nearly impossible to verify age without verifying identity, and almost impossible to come up with a way that cannot then be correlated to the site, and specific pages and sections of sites that identifiable people are accessing. This data will be hacked and leaked.
3. Free porn sites are simply not covered by the legislation anyway, so what is the point.
4. Web sites offering free porn (even those linking to or copying other sites) will now start asking for personal details to prove you are 18, including card details. They will be able to link to UK law and UK government information to justify asking. People will expect such sites to want lots of personal information. People will give details and then when scammed they are not that likely to complain or claw back as they are too embarrassed to go to their bank.
5. The scams and risks target minorities especially - those that, more than most of us, do not want anyone to know their sexual preferences, even though totally legal.

Also, if you do access a porn site, using incognito or privacy mode so not in your browser history, you won't have cookies, etc, and so will have to do age verification every time?!

Remember, we are talking about legal content from legitimate businesses here...

Boiler plate text on emails

You would think solicitors know better...

You are prohibited from reading this message unless and until you have read and agreed to the ****** Solicitors communication terms, which are deemed incorporated in this message.

Yes, that is right, you have to read (part of) the message to get to the bit telling you that you are prohibited from reading the message.

In order not to be prohibited you have to read and agree the terms which are incorporated in the message which you are prohibited from reading. So even if you consider that boiler plate text not to be part of the message, the terms are explicated stated as being incorporated in the message, the one you are prohibited from reading.

So to agree to the terms and not be prohibited from reading the message you absolutely have to have broken those terms already and ignored a prohibition.

AFAIK there is no way to "prohibit someone from reading a message". Even copyright law does not cover that, i.e. they have no "right" to prohibit reading a message and there is no consequence for ignoring their made up prohibition.

I cannot see how you could be deemed to have accepted their terms either, given that you have to ignore them in order to read and accept them in the first place.

Why do they do it?

Copyright and links

One of the rather annoying and weird bits of copyright legislation is that it does not just protect against copying but also making available. The second part is the tricky one, and a CJEU ruling recently muddied the waters only to be made worse by a case in Germany!

More on this from arstechnica.

The upshot is that if a commercial web site simply links to a web site/page that contains infringing material then the linking site becomes infringing as it is making available.

What is worse is that the link itself (according the Germans) does not have to be for some profitable purpose, simply a link on an otherwise commercial site. Also, the web site operator that created the link does not even have to know the linked-to site is infringing. Indeed, they could have done all due diligence when making the link and the content of the target site has since changed, or worse, not changed but the infringement status of what is there has (a time limited licence on use of an image, maybe). The German case was a link to something covered by a creative commons licence but it turns out the linked to site did not meet all of the requirements making it an infringing site. How the hell does someone making a link check that shit, and how can web sites continue to exist if every external link on every web page needs a small team of lawyers to check it, and recheck regularly?

This is, of course, crazy, and make no sense to anyone looking at it in any technical way. It makes little sense to those looking at it from a legal viewpoint either, as far as I know.

One of the problems is that the linking site being infringing means that anyone linking to the linking site is also infringing, and so on until the whole world wide web is infringing! If it was not like that, then you do not tackle the original problem - people actually linking to where one can download dodgy copies of stuff can simply link instead to a site that then links to where you can download dodgy copies of stuff, ideally with that intermediate site being outside of EU (and this crazy legislation).

Of course, you could make a non profit site that links on to other sites, like a URL shorter, but could be simpler and just strip its domain off end of link so very noddy. Then make all external links on your site go to that non profit site that links on to the target page. That way all your links are now laundered and not infringing?

I am not sure how either of these play points out legally.

Giving the police more power? (#IPBill/#IPAct)

With the Investigatory Powers Bill reaching final stages I expect to have some detailed comments by next week, once we have the final text of the Act.

However, we had a rather odd email today from the police, a Cyber Distribution & Prevention Team, no less. You would hope they have some clue, but their email shows drastic lack of clue...

We do occasionally get requests, usually under RIPA, usually related to telephony, and almost never actually correct. Typical errors are:-

• Not one of our numbers!
• Number too short
• Number too long

But also issues they would not know, but still a nuisance:-

• Number simply not in use, and hence must just be spoofed CLI
• Number leased to another telco

This request was different. It was a request to suspend a "line" which is in fact a VoIP service. But it shows some serious lack of clue here.

Firstly they are entirely going on the CLI. They have not attempted to trace the source of the calls via the telephone network in any way (else they would not have got to us as it is part of a block leased to another telco). But even though only based on CLI they are assuming the CLI is genuine. No hint that they know it could be otherwise, and indeed, asking us to suspend a line based only on CLI provides a means to "attack" a victim by using their CLI for something iffy and getting the police to get the victims line suspended! Our reply refers them to the wikipedia article on spoofing CLI.

Also, it is marked "Classification: PROTECT - INTERNAL USE ONLY" yet they have sent it externally to us. Ooops.

Then they explain "Attempts to contact the line have not been undertaken to prevent jeopardising any ongoing or potential investigation that may follow." Hang on?!? What would we say to a customer (if it was our customer) when we suspend them that would not jeopardise ongoing or potential investigation - seriously - suspended line is going to be a tad noticeable.

Then there is the actual request "We request that you consider suspending this line as soon as possible to prevent further harm to members of the public occurring and for a minimum period of 12 months." which I am not sure I understand. This is just a number. If we suspend it at all, the end user can have a new number to make calls within seconds, so not going to stop him, just alert him that they are on to him. Also it means the fraudster is now using a new number which nobody is blocking or watching out for, so actually that increases harm - by always using the same number one can alert people "don't accept calls from X" if that was a sane thing to do when considering CLI spoofing anyway. It also makes handling the reports they are getting easier to collate as they know it is the same person. But also, why suspend for 12 months? How does that help?

But then we have the fraud itself - a simple matter of someone calling an claiming to be something official (I am not giving details here), but a key point is the victim is then asked for "bank details" to pay something they have been convinced is due. As far as I know that only allows a direct debit, and a direct debit can always be reversed. So either the victims are getting really bad advice and not getting the DD reversed and their money back, or the fraudster is particularly stupid. The email is quite specific, and says the other trick is to ask the victim to get "I tune"[sic] vouchers and read the number, but that again makes no sense as this is someone claiming to be from an official body which nobody would be stupid enough to think could be paid in iTunes vouchers. What they are saying here really makes no sense. I suspect the fraudster is smarter than they are saying and the police are recording the details totally wrongly.

I hope they catch the fraudster, but in this case there is nothing we can do to assist further - as the calls are not through us or from one of our customers.

These are the people we want to give access to details of every web site visited by every person in the UK. Seriously?

Latest attempt at filtering the Internet

This is serious stuff - the only hope we have is that every time this exact wording has been tried before it has failed. However, we are in 2016 where stupidity reigns at every level of government in all of the major countries of the world.

The proposed amendments to the Digital Economy Bill are detailed by Open Rights Group here.

So two issues.

1. That a filtered internet *must* be offered by ISPs unless the subscriber “opts in” to subscribe to a service that includes online adult-only content; the subscriber is aged 18 or over; and the provider of the service has an age verification scheme which meets the standards set out by OFCOM in subsection (4) and which has been used to confirm that the subscriber is aged 18 or over before a user is able to access adult-only content.

Now some of that is OK as EVERY SINGLE A&A CUSTOMER HAS OPTED OUT OF ALL FILTERING and confirmed they are 18 or over. We have no interest in contracting with under 18's as that is much harder to enforce and hence get paid. The only issue there is the "age verification" aspect - that has a shit load of issues as explained at length by ORG. I really hope that at least that bit is ditched - otherwise all out signup for new services will have an extra cost for us to pay some age-verification provider to check you are over 18.

REMEMBER! THIS HAS NOTHING TO DO WITH USERS OF THE SERVICE! This is only for subscribers, which we want to be over 18 anyway. Their kids can be accessing all the porn they like and we would be 100% compliant.

2. The other worrying clause is CENSORSHIP of the internet at court order. We have this a bit for copyright law now, but A&A is too small to have ever had such an order, and it has been proved time and time again that such orders simply do not work.

There is NO TECHNICAL WAY for any ISP to actually PREVENT access to some part of the internet. If we allow ANY PACKETS in and out, even just DNS, then ACCESS will be possible so it is IMPOSSIBLE to comply with such orders. This needs knocking on the head now. It is nonsense.

Let's be clear here - if every ISP has to pay some third party age-verification service before they can sign up any customer, that will cost, probably several pounds, and that will be added to cost of signing up. For us it would not change our service, we ONLY do opt-out of censorship and ONLY do 18 or over, so nothing changes but paying an extra fee. Why do that?

P.S. Seems like the amendment has been withdrawn - but why do they keep trying to throw this in to legislation - what is the point?

WoW Gold and Blizzard bank?

There have been some interesting stories of Bitcoin being declared a legal currency by some legislators / courts around the world. Wikipedia has an interesting page on the matter.

The problem is that Bitcoin is not like any conventional currency - it has no central bank or issuing or control authority in the same way as a "conventional" currency. It is not tied to one nation, like a "conventional" currency. That scares nations, obviously! It is pretty much anonymous. It works at a distance without needing any trust.

One of the classic issues though, if Bitcoin is to be treated as a legal currency, and the legal burdens that can imposed, is how you define it. You cannot have the law say "bitcoin" as there are already many other similar digital currencies like Bitcoin, so you need to be more general.

The danger with a more general definition is including something like World of Warcraft Gold in the definition, or points in any other sort of game. Some games have in-game currency which is directly bought and sold (exchanged) for "real" money and used to buy things in game. It could be used to launder money - buying virtual currency, passing it in game, and selling it, so legislators may consider it worthy of the same legal controls.

But in-game money, like WoW Gold, does not follow most of the rules of "real" currency. Making it subject to the legal controls of "real" currency would be a problem. In the game, vendors sell things for WoW Gold and that WoW Gold does not go to the vendor account or a "Blizzard account", it just goes. Similarly there are things in game the provide WoW Gold or goods that vendors will buy for WoW Gold and again that gold is just created by the game, it is just a number. Overall the game has some controls, and so there is an internal market for goods and gold (the action house). But most of the way WoW Gold works in-game would not be allowed if it was deemed a "real" currency, and Blizzard might have to become a formal bank even!

Until recently and buying or selling of WoW Gold for "real" money was not allowed in the terms, but even so there are web sites selling WoW Gold, and they still exist. Players using them could lose their account. But Blizzard actually created a real way to convert money to WoW Gold in the form of a WoW Token. It is purchasable in the UK for £15 and can provider 30 days game play. However, you can also buy and sell WoW Tokens on the auction house, and they currently go for around 68,000 WoW Gold, which is quite a lot. This means there is an exchange rate for WoW Gold in the real world. Blizzard have been cunning, the game rules don't really allow laundering money - one could put money in to buy WoW tokens, but one cannot get money out of the game - you can only sell for WoW Gold or use for game time, so hopefully WoW Gold would be kept out of legal currency legislation.

But it is a fine line for legislators to make a sensible definition.

On a side note, this did mean I could be slightly extravagant, and for two WoW Tokens I managed to buy a vanity mount, one of the most expensive in-game things, a Grand Expedition Yak at 120,000 gold.

P.S. my favourite comment...

SORN

When the Statutory Off-Road Notification was originally introduced it was a fun set of new bits of legislation, but reading them carefully at the time it specifically allowed you to "notify" that a vehicle was off road, and hence remove some of the obligations for having the vehicle taxed and insured.

However, specifically, a SOR notice did not actually stop your vehicle having vehicle tax. It was, as I read it at the time, quite valid to have vehicle tax and be off road, thus removing insurance requirements. And if you only needed to be off road for a short period this was a lot less hassle, and could even be cheaper, than getting a partial vehicle tax refund and re-taxing when back on the road (and insured).

Back in those days you could easily prove you had tax as you had a real tax disk.

I can only assume they have changed the law, as it seems that sending a SOR notice causes you to get a partial refund of the vehicle tax and no longer be taxed.

I am trying to find my way through the minefield of the legislation changes to work it out, and see if one can declare a vehicle off road without cancelling/ceasing the road tax. So far I am failing to find the details that cover this specifically. The problem is that, without an actual "tax disk", they can say you are no longer taxed and you have no proof otherwise.

The reason this came up is my daughter did declare her vehicle SORN for a short period, in the middle of the year, having paid for a year's road tax in January. And was apparently unaware that this meant she no longer had road tax. After all, she paid for a whole year, why would she not have road tax for a whole year?

Now, I can understand that some people may well want to declare SORN and request road tax be stopped and partly refunded - maybe that is what she inadvertently did. The "form" that DVLA have is an "application" of some sort and not simply a "notice" now. Something to try and find out for sure, and next time only send the notice, and not apply for the vehicle tax to be stopped.

Help to Buy ISA

The scandal is reported in The Telegraph.

Now, I can understand why the government don't pay the bonus until completion - else people could cash the ISA and get the bonus as part of buying and then back out and keep the bonus. Makes sense!

What makes no sense to me is why, even with that caveat, that cannot work. The whole process of buying a house means various fees, and a deposit, and then a mortgage that gets actually paid on completion. I can understand the deposit being handed over on exchange, else you could find people don't have it on completion. But why can one not "hand over the ISA" at exchange too. Some legally binding commitment that on completion the ISA is cashed and used as a whole, with the bonus, at completion. After all the mortgage itself is like that, not actually paid until completion but all part of a legally binding process set up at exchange.

I am shocked it is not simply a signature on a suitable contact at exchange that gives the solicitor the ability to cash the ISA with the bonus at completion to make up with the mortgage the purchase price.

This cannot be beyond the wit of the legal profession, surely?

Editorial control

This is my blog and obviously I take responsibility for what I write.

There are a number of laws that could impact what I say, from Human Rights on freedom of expression, to Harassment and Defamation legislation. I try to be careful. I try to make it clear when expressing an honest opinion and not stating a fact. I try to be truthful and accurate. And no - this post is no because someone has had a go at me :-)

However, the comments section is perhaps more of a difficult issue. I don't take responsibility for the comments. They are posted by other people.

As a general policy I post all comments. Even if I do not agree with what they say. I'll respond if I don't agree, but I respect the basic right to freedom of expression of those that wish to debate the points I am making.

However, there is one exception, well, two actually. One is simple - duplicate posts - blogspot does not make it obvious that posts are moderated and so we get duplicates and I delete them. Not an issue I am sure.

However, the other area is spam. Where a post is deliberately just trying to get links to other sites to sell stuff, or in some cases just gibberish. Spam is usually very easy to spot, and quite a lot is clearly automated.

The issue is that this is a form of editorial control over the comments. That could, in theory, gain me some degree of liability for the comments if they are themselves defamatory. I don't want editorial control for that reason, but I don't want spam. I also don't want people thinking I only post favourable responses to my blog posts - that is not the case.

The editorial control to zap spam is not something that is in any way editing the comments people are genuinely making on my original post. So I hope it does not make me an editor.

However, it is also worth explaining the main criteria I use for this.

• If the comment is totally unrelated and looks automated, then I'll delete it. This is getting rarer, as the bots are looking for keywords in posts now and making related posts.
• If the comment links to some other product or site that is related, I make a judgement on whether I think it is a genuine person making a genuine helpful recommendation (which happens) or just a bot or spam post. I want to allow people to make useful comments obviously, but spammers are increasingly posting comments like "how very helpful my post was, and look I found a really good company that does this [link]". A big clue is a proper link in the comment rather than just the name of a company. Another clue is the wording style.

If you have made a genuine comment and I have deleted it, please do make it again and add some explanation. I would not want to zap a genuine comment.

But should I edit these at all, or just allow them unmoderated?

Is my judgement on this sensible or should I use other criteria?

Operations Manual - bloody stupid

I am working through our ops manual for drone piloting, gradually, and it really is sucking the life out of me. Then I did some practice flying - which is knackering - how I can it be that sitting on the floor twiddling my thumbs can be so much hard work? I did loads of ATTI (Attitude mode rather than GPS mode) flying around in squares as practice - something I'll need to master for the practical test.

But, back to the ops manual.

It is stupid, sorry CAA, but this makes no sense.

We are expected to write our own ops manual!

Why? Well, some aspects will be company specific - organisational structure, nominated staff, etc. Fair enough.

But a large chunk of it will be the same for every one-man operation, or the same for every small operation of a few staff. Some parts will be the same for everyone.

There are big chunks of it, like the emergency procedures, which surely must have well established best practice, and should be the same for everyone, or at least everyone with the same class of aircraft.

So why do I have to guess what risks there are and define what I think are the best emergency procedures, as someone that has, but definition, done no commercial flying yet?

Yes, the course had lots of information, but making me write the ops manual rather than just using a standard manual and making a few tweaks, is crazy.

One comment is that writing it, I have to think about it a lot, and that is good - but from what I can see it is the company that writes the ops manual and requests the PFAW (Permission for Aerial Works), and there seems to be no need for any of the pilots to have written it or have been involved in writing it. It could be written by our lawyer if we wanted to. So that argument falls flat on its face right there.

I would far rather have a standard small business operations manual, review and make a few changes, than have to write all this from scratch.

Oddly enough, our lawyer did say that he has much the same in setting up a law firm - they have to write their own manual as well - it must be a bit like having to construct your own light sabre?

Is it really a rule that we have to write our own (CAP722 seems to suggest so)?
Is that really in the best interests of safety?

P.S. First draft now done, 5th Jun. Once reviewed, we can book practical tests.

Protection from Harassment Act 1997

Verso Group (UK) Ltd has taken up some of my time of late, starting with a "junk call" clearly claiming to be from Verso Group (UK) Ltd, but apparently not (according to a man calling and claiming to be from Verso Group (UK) Ltd).

Personally, and this is totally my own honest opinion, I cannot see how the original call (here) was not in fact from them - I see no motivation for someone to impersonate them. The call seemed to be trying to use "tricks" to be a survey rather than even a lead generation call and even had the caller stating he would give my details to other companies. None of that shit works (well it does not really work anyway) if you are not actually calling from the company you say you are in the first place. However, in the interests of fairness, and understanding how things like this can be frustrating for those impacted, I have to re-iterate that the call was apparently not in fact from Verso Group (UK) Ltd, according to the man calling and claiming to be from Verso Group (UK) Ltd. I may yet get the call traced though if this goes any further. I hope this post is the end of it.

Now this is where the fun starts.

My employer started getting hassled (no other word for it) with a couple of emails and several calls, all claiming to be from Verso Group (UK) Ltd, and one particular director (that I won't name here today). They start (in email) asserting the call recording must be removed as it is confidential. Then (in calls) they insist it was not them calling. We try to call back several times and are told this gentleman* is in meetings or on a call. I tied up quite a lot of our company solicitor's time on this as legal threats were made against my employer in emails and calls, and even a "threat" to come to the office, which we welcomed and waited all day for.

To be clear, my employer are not involved. They do not host my blog and I do not post here or on social media in an official capacity. The call was to my home number. Oddly, to my wife's number (more on that later).

I have posted links to these blog posts on twitter automatically, and even a comment that we tried to call back mentioning the person that called the office. Several others have commented on twitter too.

Then, on the 10th, I get a call from Bedfordshire Police Crime Bureau advising that this person, who is a director of Verso Group (UK) Ltd (as I understand it), has called them alleging that I am harassing him on twitter!

Note this call was also to my wife's number, one I never publish as associated with me, so where did the police get it? I am asking them. The same number as the junk call definitely not made from Verso Group (UK) Ltd.

First off - no actual official complaint has been made to the police (phew!) - we are a week later and the police have confirmed that. They also confirmed the call I got was genuine, and I am working on getting permission to publish the recording...

But it got me thinking - I have not looked at the Protection from Harassment Act 1997 in any details before. Could I have been harassing someone without realising it?

For a start I am not 100% sure what "harassment" means. I may post on twitter to make a point, or further a discussion. I have no intention to "harass" anyone. The definition in the Act does include causing "alarm" and "distress". The problem is that I am reading this legislation like an engineer and not a lawyer. We do not always come to the same conclusions :-)

I cannot find a requirement for "intent" in there, which is a shame, just that I should know it ought to be harassment of another, and the test is that a reasonable person would know that if they knew all the facts. Given the level of religion and mental ill health in society, finding a "reasonable" person may be hard. But oddly, "intent" is not in there. So I could be harassing someone unintentionally.

However, there is some light at the end of this, my "conduct" would also have to be "unreasonable". Naturally I don't think I am ever unreasonable. There is also allowance for preventing or detecting crime. The junk calls, are they a crime? Certainly unlawful, so maybe.

It is also good that you can only harass an individual, and not a company. The Act makes that clear. All posts about Verso Group (UK) Ltd, even if they are harassment, would be of a company and not an individual.

The other caveat is that one has to do it twice. To make it an offence you need a "course of conduct" which, for one person, is twice at least.

This raises some interesting points for social media, like twitter or even my blog. I state on my blog, and expect in other social media, that if I do harass or otherwise offend people, I expect them to "block me". Social media allows that. So if I "upset" you once, you block me, so the second time cannot be upsetting you. Would a "reasonable person" think the same? That would make all but the most convoluted social media "harassment" non existent, surely? I can see some blocking on twitter for this particular gentleman*.

Anyway, someone has not had the nerve to follow through and actually make an official report against me. I almost want him to - as that would be wasting police time, and would also give me a good excuse to get the original call traced.

Even so, is this really the way a reputable company handles complaints? Accuse people of harassment and report them to the police. I think not.

The offer is open for a meeting at our offices resolve this - that makes this blog post more than "reasonable" and not harassment.

What I do take from this is that one cannot harass a company!

* I say gentleman but he is listed as "Ms" not "Mr" on some company check sites, as several people have pointed out on twitter.

Market power (Facebook and the French)

There is a rather odd article on the French deciding that Facebook contracts cannot be under California law and have to be under French law.

I have to say that I am a tad conflicted on this point.

The contract is clear and offers, for no fee, a service to anyone that wants it if they AGREE to be bound under California law for that contract. Why the hell should the French or anyone feel that is unreasonable. It is a free service, and offered freely for anyone to take or not take. If someone does not like being bound by California law, simply do not take the service.

The specific case, which is not yet decided, is over Facebook removing an image that breached their decency terms. But Facebook is their web site, why the fuck should they not have final say on what is on that web site. It is not like the "customer" paid them to display that post and they broke that contract. In fact, the "customer" broken the contract by posting the image.

Now, I wonder how it will play out in French courts. I hope there is some sanity that the customer in this case did breach the terms, even under French law, and that Facebook are entitled to control what is on *THEIR* web site. We'll see.

The whole thing does raise a lot of issues though.

Choosing jurisdiction is one - it is not unusual for a contract to define the jurisdiction and ultimately it only makes sense if that is defined as one place, and so one party to the contract defines it. Ultimately if the other party is not happy then they should not enter in to that contract.

The problem is "consumers are assumed to be stupid" and so, even if they agreed something, then maybe they should be protected from having done so. The solution, in my opinion, is more education, not stitching up companies when consumers are muppets. But that is just my view. I want consumers to make good, informed, choices.

But I wonder if this ruling has other problems. Is simply accessing one of my web sites that provides some useful "service" for free, something which has some implied "contract"? I have some useful sites like http://find.me.uk/ for example. I do not try to impose any contract and hence any jurisdiction on disputes over contract. But is there one, implied. And is it one that could be deemed under the law of some foreign country which has some Draconian rules and could apply some penalty if the site is down for a day? How can I tell.

Now, for my site, it may be better if I have a note stating it is a non-contractual arrangement. Such things are possible, and avoid any issue of jurisdiction as no contract disputes can exist. Maybe Facebook should try that.

Though I suspect for Facebook this will simply mean they have some French compatible contract terms drawn up under French law, and then they are covered.

Even so, this does raise other issues - at some point an organisation like Facebook or Google or Twitter reach a level globally and/or even within one country when maybe the usual rules need to stop applying. The "don't agree to Facebook terms" option stops being sensible when one would fall out of all social circles by doing so. At that point, maybe new rules need to apply somehow. It is, perhaps, the price of success.

P.S. I am told that one can have a contract under one countries governing law, and another countries jurisdiction, just to add to the fun. Thanks Neil.

#IPBill Joint Committee report

It comes out tomorrow at 09:30. I have a copy.

I note the embargo does not say a time zone, so I wondered about finding an Aus site to publish it on tonight, but maybe not.

The whole issue of what would happen if I published it sooner it a grey area - with penalties for contempt of the House of Commons and House of Lords being a bit tricky under Human Rights law if they do not have a clear legislative framework, but suffice to say that I am not planning to be a test case for that right now. Maybe next time.

I am actually quite surprised how easy it is to be part of the democratic process. I, like many people, vote. However, like most people I have to feel my vote makes almost no contribution to the result. I could stay at home (again, like many people) and make no difference.

But the process here has allowed anybody - and not even just any UK citizen - to contribute to the process and submit evidence, yet only 148 people and organisations did, and only 59 people gave evidence in person. I submitted two bits of written evidence and one oral evidence session.

I am mentioned on 15 pages of the 194 page report!

I feel like I have made a contribution to the democratic process somehow. It is really a strange feeling - 64 million people and I am quoted on a report about a new law that impacts them all, 15 times!!!

I mean, that is not just my "15 minutes of fame" which I have done many times on TV, that is actually in the parliamentary process. It is a tad scary. They even mentioned my pornhub comment! I think someone owes me a free subscription :-)

I'll comment on the actual report tomorrow once the embargo is over, but I am sure many others will comment in more detail. The bill has many issues. The committee has picked up many, but not all, of the serious concerns. We'll see how it goes.

Cycling on the pavement

There are quite a few good articles and blog posts on cycling on the pavement, e.g. here.

One of the common questions is about the legality of cycling on the pavement, and as you will see with very little googling, this is covered in Section 72 of the Highways Act 1835. No, it is not legal.

"If any person shall wilfully ride upon any footpath or causeway by the side of any road made or set apart for the use or accommodation of foot passengers; or shall wilfully lead or drive any horse, ass, sheep, mule, swine, or cattle or carriage of any description, or any truck or sledge, upon any such footpath or causeway; or shall tether any horse, ass, mule, swine, or cattle, on any highway, so as to suffer or permit the tethered animal to be thereon; every person so offending in any of the cases aforesaid shall for each and every such offence forfeit and pay any sum not exceeding level 2 on the standard scale], over and above the damages occasioned thereby."

Oddly, I was sure I had seen more recent legislation on this, but my googling does not come up with any, so that seems to be the relevant law on the matter.

However, I was pondering this the other day - and the reasons behind it. It seems not so much that it is there to protect pedestrians - as there is already plenty of law on that including laws on dangerous cycling - but it is specific to the cases where the footpath is along side a road. Other footpaths do not have cycling automatically prohibited even if they are used by pedestrians.

I can only conclude that the logic is that the cyclist should be using the road, and not the footpath.

So I wonder what the situation is where there is a footpath alongside a one way road? In such a case, if going the wrong way, one cannot use the road. Surely if the reason for this law is as it seems then one should be allowed to cycle on the footpath alongside a road which does not allow cycling in the direction you are going.

I mean, is a road a road if it only allows traffic in the other direction?

Oh, and for avoidance of any doubt - I use the road normally, or dedicated cycle paths if they go where I want to go (and there are not annoying pedestrians wandering all over them). Shared cycle/footpaths are a bloody nightmare.

Credit agreement for insurance

This bugs me.

I have insurance for home contents, and it is a one year policy, but I pay monthly by instalments. This means I have to have a credit agreement and interest.

But insurance is inherently a service provided on an ongoing basis. The fact that I am insured tomorrow is of no use to me today. It only matters once tomorrow has come and gone, and if, by then, the insurance has not been cancelled for some reason.

So if I am getting the "product" of insurance on an ongoing basis, month by month, day by day, hour by hour, yet I am paying each month in advance, why do I need "credit"? It simply makes no sense to me.

Some might say that I receive a whole years insurance in advance, and I have that now, and it is mine, so paying for it at the start makes sense (and hence spreading payments is credit). However, and do correct me if I am wrong, if I stop paying half way through the year, will they not cancel the policy? If there is any way they can cancel the policy part way through the year for any reason, then clearly that policy and year's worth of insurance was not mine in the first place, and it really is being "provided" on an ongoing basis.

It seems wrong, and I can only assume it is some historical quirk that it is allowed to work like this.

Internet and law

Times are changing, and the governments of the world are trying very hard to keep up. There are consultations on this at an EU level, and the UK is considering the "snooper's charter". Legislation is being considered that would impact everyone.

This blog post is my thoughts on the matter, and I hope a good start to some debate. As an ISP, I am, of course, somewhat biased - but I am also an Internet user, and a parent, and someone that has had computers nicked and needed police to trace an IP address.

Summary

• Physical infrastructure (ducts, mast owners) should be provided and managed independently to competing CPs (Communications Providers)
• CPs paying a fair price for access (e.g. non-profit running it) and no "fibre tax"
• CPs should have no responsibility for the content of communications ("mere conduit")
• This ensures CPs can continue to innovate and develop services
• CPs should not be expected to block traffic
• This avoids unnecessary technical and commercial impact on CPs
• Encryption and Tor and VPNs and proxies make such measures pointless
• CPs should not be expected to look in to the content of communications
• This avoids unnecessary technical and commercial impact on CPs
• Encryption means that CPs cannot do so anyway
• CPs are expected to assist authorities with criminal investigations
• This must be specific and targeted investigation with formal process and oversight
• CPs should not be expected to collect data or monitor users generally
• CPs should be paid for costs involved in assisting authorities
• Basic processes such as finding billing address from IP should be more streamlined!
• There should be transparency - advising subjects of requests once no longer suspect
• Encryption should be encouraged not restricted or banned
• Criminals are attaching the virtual world of the Internet and encryption is the protection for privacy and security that is now essential to combat such crime

Layers

One of the first issues which needs considering carefully in any legislation is the way that the government think of "the Internet". Having had an interesting dinner with several MPs (thanks to ISPA) it is clear that MPs see "the Internet industry" as very much one "thing", lumping in everyone from a company putting fibre in the ground to FaceBook as the same "industry".

In actual fact, just like the protocols used in the Internet, there are layers. It is important for legislators to understand this, as the rules have to be different for different layers. If you think about this, it does make sense, and I have included "a company putting fibre in the ground" in the above list deliberately as an example because that is pretty obvious. Putting glass in the ground, and even renting that glass out to companies, is clearly at much the same level as an electrician wiring up a house. They are clearly not responsible for what flashing lights are sent down that glass, and would not have any way to take any responsibility for that. I think even MPs can understand that.

At the other extreme, companies like FaceBook provide a service which "just happens to make use of the Internet as a means of communication". In theory one could operate such a service over the post (did any of you have a pen pal)? The fact that the Internet is use is, of course, important, but the service itself is very much more than simply flashing lights down a bit of glass. FaceBook have contracts with customers (albeit ones where there is no payment in most cases); they manage personal information; they operate in multiple countries and across borders; they have policies on content and police those policies. There are already a whole raft of rules and regulations in many countries that cover a lot of what they do.

Glass

I picked fibre as an example of the lowest level, but there is an even lower level that could be worthy of legislation. It is not legislation concerning snooping, or security, but more one of providing access to the Internet. Governments recognise (thankfully) that the Internet is an invaluable resource within a community, and ensuring good access for all citizens has benefits to the community and the economy as a whole, so should be encouraged.

It seems to me fairly obvious that there needs to be a lowest level of access by way of "ducts" and radio mast sites that take physical space and can be included in designs for new housing developments. These are things that probably do not benefit from competition in their provision at that level - having multiple providers running cables and ducts in the same street is how it was done in the past but it may make sense if ducts and basic roadwork type stuff is handled by someone like the council, or a non-profit responsible for providing access to physical infrastructure to competing telcos.

Internet Protocol

The level above copper and glass is the actual data being sent over those. There are actually two layers here really - the means to send data over the raw infrastructure, and the operation of a network of such infrastructure to provide something like a packet routing system such as Internet Protocol. At present we see companies like BT and TalkTalk operating national infrastructure networks, using Openreach copper pairs, and providing access to end users and connecting that to internet providers.

At the lowest level, the internet provider (ISP) routes packets - simple as that. There are extra services that are essential, like DNS, and then more optional services like email, web sites, and so on.

When it comes to the low level communications itself, such as routing IP packets or telephone calls, I think it is very important to separate the communications system itself from what is being communicated.

We already have this concept in EU, and also in US. In EU it is called "mere conduit", and it means that CPs don't have liability for what is being communicated.

This is not a very new principle - even the postal service has some long standing legal protections in place. The most obvious being that the post office are not responsible for the content of letters, and are not considered to be assisting or aiding and abetting any criminal activity carried out by post, nor even profiting from crime; and, the security and integrity of the post is important and "interfering with the mail" is considered a serious matter. Communications itself needs to be reliable and independent of what is communicated. These protections allow CPs to provide the services cost effectively.

I feel quite strongly that Internet service needs to have these protections, and that even "mere conduit" is not quite far enough. We have to consider slightly more, and this is something the EU is considering now - "Net neutrality" is the term being used. It is important that CPs are not locking horns with "content providers" over access and priority of traffic. This has happened in the US and could lead to some complicated issues which would impact customers. Essentially, it is important that  CPs route traffic fairly, and when there is congestion packets are dropped purely on technical and practical basis and not for political or commercial reasons.

I also consider it important that CPs are not expected to look in to packets for any reason. This is much like "interfering with the post" but it is also down to a simple practical fact of life now - that encryption exists. Whatever the reason a government may want for CPs to look in to the packets is basically going to be thwarted by normal, day to day use, of encryption. It is common now for encryption to be used for web site access, messaging systems, and pretty much anything using the Internet. Even if encryption was somehow banned or crippled, the fact that it exists means that criminals or suspects could use it and be breaking just one more law. There are also many ways to use encryption which would either not be illegal, or not be detectable or provable.

Blocking web sites

Even though there is "mere conduit" there is one catch in the copyright legislation that allows a court to grant an injunction against a communications provide where they are aware of copyright infringement. This has been used to block access to some specific web sites like The Pirate Bay.

Unfortunately this is pretty much totally ineffective. The Pirate Bay have loads of mirrors and proxies and they move all the time. This means ISPs are spending time and effort messing about playing whack-a-mole. Of course VPNs, proxies, Tor and the like means that even if the ISP was actually blocking the site in question reliably, their customers can still easily access it.

After a spate of blocks, The Pirate Bay reported that they had massive increases in traffic - it was publicity! This means that he blocks are not just ineffective, they are counter productive. One court in the EU even reversed an injunction because it was ineffective.

Given that this has been tried and failed, it seems sensible to remove this anomaly from the copyright legislation - to stop ISPs having to waste time on this crap.

Of course, in principle, ISPs could provide blocking services to customers. It is rather concerning that the UK government seem to have pressured many ISPs in to providing some blocking by default for porn sites. We already see over blocking, which could create liability for ISPs and may even be a breach of the Computer Misuse Act. We also see that people now sell USB sticks with pre-installed Tor browsers so that kids can bypass blocks!

Back on the whole net neutrality front, it makes sense that ISPs simply do the job or routing packets, not blocking or prioritising things, just providing the raw communications means. ISPs have enough work doing that without getting bogged down with politics.

Of course, there are things people do using a communications system that are illegal, and they should be held to account for that.

Helping the authorities

Obviously I am keen on legislators not interfering with CPs and I think it is critical to ensuring CPs can provide the innovation, development and investment in providing access to everyone in the best way.

However, CPs are a key factor in helping the authorities investigate crimes. One of the most obvious things that anyone investigating a crime will need is the ability to track where an IP address is being used.

Unfortunately the very nature of Internet Protocol makes that impossible to do reliably. I recall an old cop show on TV and they were thwarted tracking a call to a payphone which had the handset taped to the handset of the adjacent payphone. Whilst that is a tad silly for phones it is actually incredible simple for IP networks, and even normal. IP can be, and is, tunnelled over IP or relayed at higher levels as a proxy. There are systems like Tor that specifically relay connections randomly around the Internet with no record of the real endpoints.

Even so, there is a starting point for authorities if they can quickly locate the installation address (if there is one) for an IP address for a connection. CPs can be an assistance to authorities in this in many cases. However, even with something so seeming simple as this, there is a catch. Carrier Grade NAT and transparent or explicit proxies mean that the IP address seen at the other end on the Internet is of the CGNAT or proxy system and not the end user. It is not necessarily practical for an ISP to have logs of every single connection made via such a system, and even where there are logs you may need millisecond accurate timestamps to track to one installation address. Even when you have an installation address you do not know what user at that address (if the user is there even) applies.

So, yes, CPs need to help the authorities, but there is only so much they can do. We have RIPA with covers this already. What we do not need is forcing CPs to start logging everything that they don't log anyway. This has a technical and commercial cost that CPs do not want, but also a security issue. You potentially start having logs of everyone's "activity" using the Internet - including all of the people that are not criminals and suspects. This is not just an invasion of privacy (which should be protected) but also a target for crime and hacking. Information has value.

One of the other concerns I have is the transparency of these processes. RIPA allows all sorts of "authorities" to request all sorts of information. What seems obvious to me is that this needs oversight, and controls. One simple step is that the subject of any such requests should be notified of the request. This is a problem if they are a suspect in a crime, so some requests have to be kept secret., but even then, once no longer a suspect the subject could then be notified.

Encryption

This is perhaps the elephant in the room. Encryption is not a new concept, but the changes in computer technology over the years have moved the goal posts somewhat. What has changed is that computing power in our hands (quite literally in most cases - mobile phones) is now at a level where encrypted communications can be used completely routinely. It used to be used only in specific cases like on-line banking, but is now used for simple web site access (even the conservative party web site). Once again, this is seen as a threat by the spooks that want to be able to covertly monitor suspects communications.

It is important to realise that there is always "plain text" at each end of the communications, and various ways one can access that if you can compromise one end (either social engineering, infiltrating a criminal organisation, or technical means like key loggers on computers). It is also the case that encryption normally means some degree of verifiable trust and use of keys - and people can be sloppy over encryption keys no matter how good their computers are. So encryption does make some things harder but it does not stop the authorities investigating crimes and suspects.

It is also important to understand that encryption exists. It is not a secret. Most encryption software is free, and so there is no "software company" to go after with legislation. This means that making it illegal (or illegal to use "strong" encryption) does not make it go away. Criminals can use encryption and will just be breaking one more law. It is also possible to use encryption in ways that cannot be proved (designed to provide "deniability") and the software to do that is also free and freely available and not secret.

It is also important to understand that encryption is not "hard". Yes, computers are good at this, and use a lot of processing to do the encryption we use every day, but there are systems you can use to unbreakably encrypt messages that nobody can decode without the right key and yet use pen and paper and dice and nothing more (see my video here). So unless you also ban something as basic as "adding up" you still allow "strong encryption".

Encryption is however important. It is seen by anyone with any technical clue as complete irony for governments to make statements like "In our country, do we want to allow a means of communication between people which […] we cannot read?" yet at the same time as saying encryption is "important to the economy". There is simply no way to make a system which allows only the authorities to read a message, and ensures only criminal's and suspect's messages can be read by the authorities.

Criminals are moving on, even "terrorists". I don't like the use of terrorists and pedophiles in the media and by MPs to justify any legislation like this as they represent a tiny fraction of crime and harm done to the public. I find it ironic that the whole idea of terrorism is to create "terror" and then we make that "terror" ourselves in the way to portray and report terrorists. If we reported every car accident with the same publicity as any terrorist attack then nobody would dare drive again. But yes, if someone is hell bent on causing big scary havoc, they do need a bomb, they can hack in to critical infrastructure or even domestic infrastructure. Things like taking down the power grid are big and scary, but even things like hacking the logistics systems for all of the major super markets could suddenly mean nobody has any food for a few days - now that is a terrorist attack. There are also issues on smaller scales, like hacking in to cars (already been done) - imagine just disabling a small percentage of all of the cars on the M25 all at once so they stop and cannot be moved. All of this is without hacking banks and simply stealing money. These systems are protected by strong encryption, and any steps to weaken that or add back doors for the authorities will make the crimes easier.

So, in short, encryption needs to be encouraged, not banned or crippled.

Debate

Please do comment and discuss. I may have missed something.

CCTV

We have CCTV at the house, we have had for some time.

The main motivation was some years ago when someone came up our dead-end road all the way to the top of the hill where we are, in a van, in the middle of the night, and nicked five bicycles off the drive. I was pissed with that. Ever since, I have taken security and visible deterrent somewhat seriously, even more so since the office was robbed last year. There have been other incidents in the road since, and police have had several occasions to ask us to see my CCTV.

We have a sign about CCTV and very visible cameras. It has always been "personal use" and so should be exempt from any DPA issues, but a ruling has changed that (the judge decided it matters if the CCTV shows the road outside of your property regardless of "usage" of the CCTV images being personal use - a daft ruling IMHO). So now we need DPA registration for CCTV at the house even! However, I suspect I'll just make the company data controller and sort it all under that as we pay for DPA registration anyway. May as well follow the rules even is stupid.

Anyway, more on the technical side of things, as times have changed over the years.

First I had a single camera, a Mobotix camera which was IP, PoE, two cameras (one day, one night) and could record to an NFS mount. This has some issues including the fact that day/night was a time schedule and not light levels, but also that it was not geared up for linux usage. I could see images but not video. It did have a built in SIP speaker phone which was fun. It looked the part (which is key for deterrent). They have better models now, it seems.

Moving on, a year ago, when I started the man-cave project, we had just put cameras in the office after the robbery. These were the cheap 4 camera "HD" security things you can buy for a few hundred quid. Cheap and cheerful, simple to install, and work. Downside is they are crappy PAL analogue cameras so low resolution (in spite of the "HD" label), but the recording and playback sort of work, they have working night vision, and a simple iPhone app allows me to see the video on the cameras 4 at a time easily. I got some for home, but they spent most of the year being squirrel cams in the loft! Having finally started work on the garage I installed them, and found that three had gone rather purple. The office cameras are not fairing much better, so in hindsight a pretty crappy investment and in need of replacing at home and office.

Times have moved on, and some very promising cameras are made by ubiquiti. The prices are very good. The cameras work with (free) recording system rather than as standalone systems. I will try these and post more later as they seem like a good option. Notably they do both 720p and 1080p cameras.

However, what I have at the house is not those, but four vivotek cameras based on a recommendation. These are good, sturdy, external cameras with self contained web servers, including https and IPv6. There are many apps that can show the cameras on a phone, which is good (though the free ones just froze on me). The fittings and housing are good solid metal and look very sturdy - I like the fact you can install with wires behind them and no visible wiring.

But I need a DVR for them. There are some free ones, and I will be trying them, but what I got was a vivotek DVR as that seemed an obvious simple choice. This is where it all falls down rather. The DVR does not work at all with a Mac using safari or firefox - it is useless! You cannot even work most of the settings. The recording only works via http and not https from the cameras - fine in my case as on same network. It does have an 8 port PoE switch to power the cameras directly, which is one redeeming feature. It also has no fans.

There is an iPhone app to work with it, but it is really crap. I am also wary that I had to set up an "account" to use it. The video playback is "possible" but hard work. I cannot even find a rewind option, you have to play one camera at a time from a date/time, and that is it. Not totally unusable, but if free s/w is better then that makes it a stupid choice. Watch this space.

All that said, the video quality of the actual cameras is good, and the night vision is excellent. It is 1280x800 so "HD".

They are obviously there to be a deterrent and to provide evidence if there is an "incident", so need to be good, and look good. I think they will do for that, but I do have to look at upgrading the office. These vivotek cameras are twice the price of the ubiquiti cameras of similar resolution, so we will see how that goes when we get one to try.