Intercept moving forward

A number of documents published by the Government in the last few weeks now seem to point towards a continuation of the Intercept Modernisation Programme (IMP) that was under discussion under the previous government.

Interestingly, there are some divergent pointers yet the overall impression seems to be that the Government is now looking to update provisions with an intention to have a range of new services in place to support law enforcement and national security by the end of the current parliamentary session (2015).

First to come along was the Strategic Defence and Security Review with the announcement that the Govt. intends to, ‘introduce a programme to preserve the ability of the security, intelligence and law enforcement agencies to obtain communication data and to intercept communications within the appropriate legal framework.’ The following explanations are taken straight from the discussions that surrounded the transposition of the Data Retention Directive back in 2008. ‘This programme is required to keep up with changing technology and to maintain capabilities that are vital to the work these agencies do to protect the public. Communications data provides evidence in court to secure convictions of those engaged in activities that cause serious harm.’

When this came around first time (brought forward by the then Labour government) there was some substantial critiscism from the opposition and from industry. That opposition took the form of both the civil liberties argument and a technical response. That was around the idea that the technology to perform the kind of real-time interception and storage simply did not exist, nor was likely to within the timescales envisaged. The Defence Review continues, ‘ We will legislate to put in place the necessary regulations and safeguards to ensure that our response to this technology challenge is compatible with the Government’s approach to information storage and civil liberties.’

So, at least the paper recognises that there are issues with information storage and with civil liberties.

Now, at the beginning of November, the Home Office has published its business plan for 2011 to 2015. That states that the Home Office will:

‘End the storage of internet and email records without good reason; Develop and publish proposals for the storage and acquisition of internet and e-mail records; Implement key proposals, including introducing legislation if necessary’

The plan includes some dates and milestones. It indicates that plans are already underway for the storage and acquisition of internet and e-mail records and that this is expected to be completed by December 2010. Whoaa - that’s next month. Clearly the discussions and shelving that took place under the previous Government have not stopped the agencies from continuiing to plan for storage. The business plan indicates that action will then be taken (December 2010 onwards) to implement recommendations and to introduce legislation. That is anticipated to be complete by 2015. Now the interesting words there are ‘if necessary’.

When Baroness Pauline Neville-Jones was in opposition she made it clear that she was opposed to new powers being introduced without primary legislation. That, of course, requires debate in Parliament and an opportunity for both supporters and opposers to express their views. Now it seems that there is some confusion, perhaps it may not ‘be necessarsy’ to introduce new legislation. Perhaps the security and law enforcement agencies have persuaded their new masters that the need for access to communications data overrides the civil liberties argument. That is a dangerous route to follow.

The next few weeks look to be interesting. It will be interesting to follow the outcome of plans and proposals from the Home Office. This may be moving rather more quickly than had been expected.

Interestingly this speed now puts the Home Office ahead of the European review of the Data Retention Directive. That was supposed to have taken place but has now been put back to nxt year. There remain arguments that the Directive is flawed and should be withdrawn - it will be interesting to see how the Home Office responds if the European Directive is struck down.

IMP - an overview

A significant paper from the LSE provides an overview and substantial critique of the Government plans for review of the interception of communications traffic data - currently under consultation.

The paper, which can be downloaded here provides a review of UK intercept law, changes in communications and the technological limitations of the proposals for high levels of deep packet inspection (DPI). This is a paper that is informative and a useful contribution to the debate. It notes that there are significant privacy issues although these are for others to discuss. What it does do is to point out the limitations of the core technology concepts behind the Intercept Modernisation Programme (IMP) and ‘Mastering the Internet’, the GCHQ programme aimed at collecting and analysing data within the UK’s Internet traffic.

Every MP and member of the House of Lords should read this - and should then be made to sit an examination on its contents with passage to permission to debate only granted on being able to demonstrate a satisfactory understanding of the content. Well, pigs might fly!

The Home Office Consultation, ‘Protecting the Public in a Changing Communications Environment’ can be downloaded here.

Article 8 again ….. and the UK loses another case!

A few months ago we heard the outcomes of the case of ‘Marper and S v United Kingdom’ brought before the European Court of Human Rights. Now, you may remember this one - something of a landmark. The court opined that the storage of DNA profiles in England was contrary to the privacy requirements enshrined under Article 8 of the European Convention on Human Rights.

Just in case you had missed the Article, it states:

ARTICLE 8
1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

The problem for the UK, and for England in particular, was that the claimants in the case were innocent persons who had not been charged or convicted of any offence. It was, said the Court, an infringment of their privacy for their DNA records to be retained within a national criminal database. Now, interestingly Scotland applies the law in a different way to England (of course!) and the Scottish model was approved by the European Court. The Conservatives have given a commitment to implementing the Scottish model when (not if!) then win the next election. We’ll hold them to that. The Government in London has now announced a revision of rules to apply in England - rules that have all the sublety of a two fingered salute to Europe - and has indicated that it will change the rules to allow law enforcement to retain data for 6 or 12 years. No intention there to remove the data as required by the Europen court.

But - along comes another case and again the Courts find that the actions of law enforcement in the UK go against the requirements of Article 8. Andrew Wood had his photograph taken by police surveillance units when (perfectly legitimately) he attended the AGM of a company in which he had shares. The police photographs were stored on file and were potentially available for use in investigation of other acts. The Appeal Court has now rules (2 to 1) in the case and has instructed the Metropolitan Police to destroy copies of photographs of Mr Wood.

The implications here are interesting. The police must now destroy Mr Wood’s images - but must also now look to identifying, removing and destroying images of other perfectly law abiding persons who happened to come in front of their surveillance photographers - perhaps at football matches, demonstrations etc. Taking photographs is a legitimate practice the court held - but the police should identify those who were of good character and should destroy the images. The implication of that opinion by Lord Justice Dyson is that images should only be retained of those who are nicked - and they will be photographed at the police station anyway so facial recognition should be able to locate, and identify them in surveillance image databases. Anyone else should then deleted.

Naturally the police were not too happy and may now consider an appeal to the House of Lords (note - there was one dissenting opinion in which Lord Justice Laws argued that the police were ‘operating within the margin of operational discretion in keeping the photos’.

The Crusher senses the wind of change blowing - the surveillance society created under New Labour is unravelling before the courts. With an increasingly lame duck administration and an imminent election (which the PM has tacitly recognised that Labour will lose) we may be seeing a few steps back from the oppressive nature of surveillance. Where next - data retention and the Communications Data Bill?

Not so centralised database ……

So, after all the speculation, the Home Office have now published the consultation paper on ‘Protecting the Public in a Changing Communications Environment’ and it now makes clear that the idea of a single centralised database containing records of all telephone calls, Internet login/logout, email, web access etc. has been kicked into touch. Page 25 of the paper makes clear, ‘The Government has no plans to create a centralised database to store all communications data.’

However, it is also clear that this would be the preferred option, ‘This approach would have several advantages. It would be the option most likely to come close to maintaining the historic capability of public authorities in their use of communications data. It would be the most effective at delivering fast and efficient access in support of the law enforcement and intelligence agencies and emergency services; the least challenging technically to implement; and the cheapest to build and run.’ But, Government is clearly aware of the sensitive politics of any implementation in this manner and has accepted that this wqould be a step too far and a massive intrusion into privacy. Richard Thomas, Information Commissioner, had made it quite clear that a single centralised database would be seen as an infringement of data privacy legislation and this advice seems to have been taken on board, ‘The Government recognises the privacy implications in holding all communications data from the UK from a 12-month period in a single store. The Government therefore does not propose to pursue this approach.’

So, the remaining option is to require communications service providers (CSPs) to retain data themselves and to release to national security and law enforcement authorities on receipt of the appropriate (RIPA) authority. That is similar to the current provision and the requirements of the Data Retention Regulations. However, the proposed plans go further than the requirements of the European Data Retention Directive (DRD) - law enforcement agencies have advised government that they require access to a broader range of data than that required under DRD. “We also need to ensure that UK companies collect and store additional types of communications data about their own services, which are not included under the EU Data Retention Directive. This includes data that communication service providers do not generate or process about their services.”

So what would this additional data retention requirement include. Web access for certain - but again, not the content, only the access to the server (to the domain rather to internal pages), volume of data transferred (download/upload), access to third party services.

Ah, this last is interesting. Acccess to third party services. Government is clearly aware of the limitations of the DRD and is now looking to close loopholes. DRD does not include web access and does not include access to services that are not hosted in the UK. Now, we know that a large number of users use webmail and that the major services (Hotmail, Gmail etc.) are hosted in the US. There is no provision under DRD for retention of any data relating to mail sent via these services - nor for any retention of data sent via other means including social networking sites, game sites, forums etc. Govt. now wants to close this loophole, ‘This would include third party data relating to internet-based services and communications services provided from outside the UK.’

Now that leaves some interesting questions. If CSPs are to be required to retain data relating to access to systems and servers outside of their network (and outside of the UK and EU) then they are going to have to collect the data by analysing the traffic flow on their own network. In practice this means deep packet inspection (DPI) of ALL traffic. DPI imposes some overheads - in order to undertake analysis and extraction of data without impacting on user experience will require real-time inspection with substantial processing demands. That is expensive. Well, at least the Govt. recognise this as the potential costs are estimated in the consultation as £2 Billion (yes, that’s right, 2 BILLION pounds).

The technical limitations are not the only concern. For CSPs to effectively read each and every packet will require substantial changes to current legislation. In effect, what will be required will be the electronic equivalent of opening mail, checking the contents and storing data. It is illegal to intercept the post, it is illegal to intercept traffic in a communications environment. Clearly the intention of the Government is to change the legal position to allow CSPs to analyse traffic and to retain data.

At present, there may be some inspection going on at CSP level in order to identify traffic types and to prioritise traffic flow - packet shaping. This is used to control use of high volume services such as peer to peer transfer. What is currently done is relatively simple compared to what may be required - traffic packets are checked to see what the type of data is and automatically routed or controlled as a result. The plan is for data to be read and then recorded and retained - and for the data to be retained for 12 months.

Now we can see an advantage for the Govt. in making CSPs retain the data. If there is a leak of data then it will be the CSPs at fault and not the Govt. Govt. agencies (national security, law enforcement etc.) will only become involved when they request data to be transferred from the CSP store.

The single centralised database has become a decentralised, distributed store of data. Once you set those up, the next step is to look to see how they could all be linked. We know that the Govt. views the single database as being the best option (and the cheapest). What they are going to do is to plan a distributed store that may circumvent privacy concerns, will be more expensive but will still store the same information. And that is going to be far more than is currently retained.

Privacy watchdogs will just be sharpening their claws - they will need them.

May we live in interesting times ……!

The next week (week beginning 27th April 2009) appears to have the makings of a rather interesting time. Perhaps the ancient Chinese proverb was indeed close to the truth.

Later this week we expect the Home Office to publish details of the Intercept Modernisation Programme and the Communications Data Bill. Readers will remember that the Bill was originally trailed in the Government’s Draft Legislative Programme published in summer 2008 but was quietly dropped from the Queen’s Speech later in the year for ‘ additional public consultation.’

Well, it seems that time for consultation is here and we now expect the Home Office to publish the consultation document and details of the Intercept Modernisation Programme (IMP). The Daily Telegraph today (Saturday 25th April) printed a front page story to indicate that the consultation will resurrect the ideas of a single centralised database to hold details of all telephone calls, emails, web access etc. The Telegraph reports (in print - it does not appear on their web site - why not?) that the Information Commissioner has reiterated his opposition to the database, indicating that he considers this to be a major intrusion into privacy.

The Government, of course, appear to be trotting out the same old story - we need to monitor web access, email etc. in order to track terrorists and serious organised crime. And, if recent performance is anything to go by, also those sending their children to school and those ‘allowing’ their dogs to foul the pavement.

There are fundamental issues of privacy and rights of the individual at stake here. The current authoritarian and nanny obsessed government simply cannot be allowed to rail-road this legislation through. Remember the sentient words of Benjamin Franlink in 1775, ‘Those who give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.’

What we need is a little real risk assessment and some real truths - not the one-sided ‘business case’ that we have seen with other consultations. This is a fundamental issue of rights and the ability of the Government to spy on its own citizens. Levels of control as are being suggested have only existed in the most heinous totalitarian regimes - we cannot sleep walk into allowing a British government to overturn centuries of hard won reforms for a short term gain. As Franklin suggests, the cost to the people is just too great.

DNA retention - Sir Alec speaks out

An interesting piece on BBC Radio 4 today - 15th April. Martha Kearney interviewed Professor Sir Alec Jefferies on the ‘World at One’ about the Home Office response to the recent S and Marper judgement in the European Court of Human Rights.

Now that judgement was unequivocal - in a judgement delivered unanimously (17-0) the judges of the ECHR held that the retention of the applicants fingerprints, cellular samples and DNA profiles was in violation of Article 8 of the European Convention on Human Rights (Article 8 deals with the right to privacy). The full judgement makes interesting reading and is recommended.

Now, Sir Alec Jefferies should know a thing or two. He developed the DNA fingerprint technique whilst working at the University of Leicester in the early 1980s. It is interesting that he is very concerned about the expansion of the UK DNA database and, in particular, its inclusion and retention of data relating to innocent persons (ie those not convicted of any crime). Today he condemned the Govt. for branding innocent people as criminals by not destroying their DNA profiles.

The Home Office recognise that the UK database is the largest of its kind in the world - to quote their own website: ‘The UK’s database is the largest of any country: 5.2% of the UK population is on the database compared with 0.5% in the USA. The database has expanded significantly over the last five years. By the end of 2005 over 3.4 million DNA profiles were held on the database – the profiles of the majority of the known active offender population.’.

The Home Office goes on to note that other police forces are keen to emulate the crime solving success of the database. OK, so the database can help to solve crime. But it contains the records of people unconnected with any crime and may serve to stigmatise those. Anecdotal evidence suggests that the database contains disproportionate records of certain groups within the population - it has been suggested that the database contains the DNA profiles of some 40% of the black youth population of the UK.

It was the retention of data relating to innocent persons and the disproprortionate nature of data in the database that attracted the dismay of the European judicial process. Today the Home Office told the BBC that it was their intention to bring forward an amendment to the Policing and Crime Bill to allow them to retain DNA and that the new regulations would be subject to full public consultation. An interesting response from the Home Office and somewhat at odds to the response to the ECHR judgement shown on their website, ‘The Government recognises the importance of the Judgment and will publish its response and timeline to the Court’s findings as soon as possible.’ Bringing forward regulations to allow the retention of DNA data hardly seems to recognise the important and significant comments made in the judgement, in fact, it flies in the face of the judgement and suggests that the Government intend to plough ahead and to ignore the advice of learned judges in Strasbourg.

The ECHR judgement indicated that retention was blanket and indiscriminate - and there are suggestions that there may be up to 800,000 records of people who have no criminal conviction. The BBC reported that the Govt. had suggested that it would be prepared to remove profiles from the database but would retain the original DNA samples - this matches up with the suggested changes to the Police and Crime Bill.

Removing the DNA profiles of innocent people is what the judgement indicates. Retaining the original DNA samples makes a mockery of the judgement - it is simply easy to re-profile the samples at a later date and to re-populate the database. Quite simply this is sticking two fingers up to the ECHR.

The Home Office and law enforcement agencies and officials must realise and must be made to realise that nothing short of complete removal and destruction of all records and samples relating to those not convicted or charged with any offence will do. The data relating to innocent persons must be removed from the database and there must not be work arounds or variations to allow DNA to be retained. Retaining DNA is an infringement of individual privacy and there must be no process to allow retention where there is no crime.

This is all about proportionality. The risk of crime and the demands of crime detection do not override the risks of damage to those concepts that we hold dear - the right of a democratic approach where a person is held to be innocent unless proven guilty beyond all reasonable doubt and where individual privacy is respected.

This Government steps out against the ECHR at its own peril. The population can and are seeing the results.

[Note: The Police and Criminal Evidence Act (PACE) and the PACE Code of Practice 'D' set out the manner of collection of fingerprints, DNA samples etc. It is important to note that fingerprints or DNA samples taken on a 'speculative' basis must be destroyed unless the subject has given permission for the data to be retained. Once permission is granted it cannot be revoked. It would be sensible to refuse permission for data to be retained.]