Communications Data Bill: Be Very Afraid

Communications Data Bill Be Very Afraid... Simon Phipps Director, Open Rights Group http://webmink.com

CDB tl;dr (for early leavers...)● New law that allows any agency so authorised to order your ISP to collect ALL meta-information about everyones internet activity, retain it for a year and supply it to them for arbitrary analysis.● Almost impossible to repair in a way that preserves citizen digital rights.● Needs your input now.● Needs you to start supporting ORG

The Topic Of The Hour● Previously rumoured as “Interception Modernisation Programme” under Labour● Announced as “Communications Capabilities Development Programme” in Queens Speech● Now “Communications Data Bill” (CDB)● Colloquially, “Snoopers Charter”

Didnt The Coalition Say No?● When the coalition was elected, they promised that: – “We will end the storage of internet and email records without good reason”● Nick Clegg added: – "We wont hold your internet and email records when there is just no reason to do so."● Seems someone had a “Yes, Minister” moment...

CDB Is A Zombie Bill● It gets killed ... It keeps coming back to life● Source is deep inside Home Office● Same outcomes sought repeatedly● This will probably not be the last time we need to defeat it...

CDB Structure● Part 1 creates a new power to order ISPs to collect communications data● Part 2 creates a system for assorted public bodies to get access to this data.● Part 3 adjusts other laws to reflect the new powers and establishes who has oversight.

What Data?● Modelled on existing powers (“may read the envelope”): postal, phone records● Any traffic data, use data, or subscriber data● But not the message itself● Kept for 12 months by default● Any civil, criminal or military proceedings can trigger indefinite retention● No requirement for any citizen to be told

Delivered-To: ryan.jendoubi@gmail.comReceived: by 10.68.48.163 with SMTP id m3csp12715pbn; Thu, 26 Jul 2012 07:11:49 -0700 (PDT)Received: by 10.60.168.230 with SMTP id zz6mr41583709oeb.11.1343311909082; Thu, 26 Jul 2012 07:11:49 -0700 (PDT)Return-Path: <simon@webmink.com>Received: from mail-ob0-f182.google.com (mail-ob0-f182.google.com [209.85.214.182]) by mx.google.com with ESMTPS id r4si21118589obz.27.2012.07.26.07.11.48 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 26 Jul 2012 07:11:48 -0700 (PDT)Received-SPF: pass (google.com: domain of simon@webmink.com designates 209.85.214.182 as permitted sender) client-ip=209.85.214.182;Authentication-Results: mx.google.com; spf=pass (google.com: domain of simon@webmink.com designates 209.85.214.182 as permitted sender) smtp.mail=simon@webmink.comReceived: by mail-ob0-f182.google.com with SMTP id un3so2755750obb.41 for <ryan.jendoubi@gmail.com>; Thu, 26 Jul 2012 07:11:48 -0700 (PDT)X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=subject:mime-version:content-type:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=/Z6B9ypN63nfDMrE4IT82Mugj6vTi/XfrBaT+4V2X8k=; b=mMYeUXuUVFvFbZx/JQwHHxef13P++yjuvrq2HdidgokubuMCiwg7ewtoaFnhLYCDNZ M7Cv0Zxl719jP3qS0DeCZQXwIQY5LZe5B4ouEKbQ4UQFR8jTaOpha1jkdhL6QyzEJcnk N1kbfidqqg8NMo6bVJEG0+mGsItSvnDfxsGaepb2lux1ehDlTDNnxY/XIsgo5KQP0Ipk +J1zqQh3zjXS1c7LJ4cL3giX5QTo0driOOvnz/LAjp/cMTzidDnPjaUDAO6vfZ31JvUl ieIYIKB8s3PQguKIPDhwhBKDmpduaMXZUmRK9RjiHTVJgTpj+D9taNeC2byohcLV8C8r bwLg==Received: by 10.182.116.2 with SMTP id js2mr42185754obb.38.1343311908355; Thu, 26 Jul 2012 07:11:48 -0700 (PDT)Return-Path: <simon@webmink.com>Received: from [10.168.10.10] (cosm4.all-cosme.info. [173.192.35.87]) OK by mx.google.com with ESMTPS id qv2sm10759032obb.11.2012.07.26.07.11.44 (version=SSLv3 cipher=OTHER); Thu, 26 Jul 2012 07:11:47 -0700 (PDT)Subject: Re: Speaking At OggCampMime-Version: 1.0 (Apple Message framework v1084)Content-Type: multipart/alternative; boundary=Apple-Mail-3--67519763From: Simon Phipps <simon@webmink.com>In-Reply-To: <CAFW3EdH1zPQ42PqZW8=HsQx6CCVUxMT3nL3746s9up5aKAAzhQ@mail.gmail.com>Date: Thu, 26 Jul 2012 15:11:40 +0100Cc: Jim Killock <jim@openrightsgroup.org>, Peter Bradwell <peter@openrightsgroup.org>, Ryan Jendoubi <ryan.jendoubi@gmail.com>, Mark Johnson <mark@barrenfrozenwasteland.com>Message-Id: <79B93F4D-84EA-46FB-8278-4CDCC00B9D81@webmink.com>References: <CAFW3EdFKOjNQkkyREOP0qyAX7iVhuNeC8QpQUOwBQ2vxFV-V-w@mail.gmail.com> <93CB5E6C-948F-4F70-B8B5-4748251E94A9@openrightsgroup.org><CAFW3EdHA=3__ZkaPvMGsAYP34oCLX-_XSbZ4kzGk-AF3U_OHug@mail.gmail.com> <6FE3A751-8F86-47A2-B82B-C25478C77142@openrightsgroup.org> <CAFW3EdGCY6gzP_erUF-SGBmELT2DUo1j3z74vqHjpUc1NWLRaA@mail.gmail.com> <EF48292D-F557-4522-9BC8-7D67151C47E6@openrightsgroup.org><CAFW3EdH1zPQ42PqZW8=HsQx6CCVUxMT3nL3746s9up5aKAAzhQ@mail.gmail.com>To: Dan Lynch <dan@danlynch.org>X-Mailer: Apple Mail (2.1084)X-Gm-Message-State: ALoCoQmaq4J5AUU0LXmhSdsgSViBrM1WrP9ho/r7yY512bu2pMzZY3z4mqwCSX5L5HlRmLOTgRdI--Apple-Mail-3--67519763Content-Transfer-Encoding: quoted-printableContent-Type: text/plain; charset=us-asciiLooking forward to being there again :-)S. Not OK--Simon Phipps, http://webmink.com/Meshed Insights & KnowledgeMobile: +1 415 683 7660New office line: +44 238 098 7027

Exactly What Data?● Information about how the service is used by people, except for the contents of communications● Any information that a telecoms operator has about people who use their service● Traffic data: Anything associated with a communication for the purpose of facilitating transmission, which also satisfies at least one of these criteria: – Identifies any person, apparatus, or location which the communication is being sent to or from – Identifies apparatus involved in sending the communication – Controls apparatus involved in sending the communication – Identifies the time when something relating to the communication occurs – Identifies data that is associated with the communication● For postal operators: anything the postal service uses to transmit the communication, anything about how people are using the postal service, and any other data that the postal service has about people who use the service

Thats a lot!● Yes, and for a long time & a lot of eyes● Enormous volume of data● Can be data mined, heuristically analysed & triangulated with other data● Can be managed by a central service● Can be shared with wide range of users● With friction of mechanical records removed, offers unprecedented ability to deduce anyones location, actions, opinions and associations

Who can request?(a) a police force,(b) the Serious Organised Crime Agency,(c) Her Majesty’s Revenue and Customs,(d) any of the intelligence services,(e) any public authority designated for thepurposes of this Part by order of the Secretary ofState,

For What Purpose?(a) in the interests of national security,(b) for the purpose of preventing or detecting crime or of preventing disorder,(c) for the purpose of preventing or detecting any conduct in respect of which a penalty may beimposed under section 123 or 129 of the Financial Services and Markets Act 2000 (civil penaltiesfor market abuse),(d) in the interests of the economic well-being of the United Kingdom,(e) in the interests of public safety,(f) for the purpose of protecting public health,(g) for the purpose of assessing or collecting any tax, duty, levy or other imposition, contributionor charge payable to a government department,(h) for the purpose, in an emergency, of preventing death or injury or any damage to a person’sphysical or mental health, or of mitigating any injury or damage to a person’s physical or mentalhealth,(i) to assist investigations into alleged miscarriages of justice, or(j) where a person (“P”) has died or is unable to identify themselves because of a physical ormental condition, to assist in identifying P, or to obtain information about P’s next of kin or otherpersons connected with P or about the reason for P’s death or condition.The Secretary of State may by order amend this subsection so as to add to or restrict thepermitted purposes.

Who & For What Purpose● Anyone the Secretary of State wants.● Anyone to whom the Secretary of State delegates● For any purpose the Secretary of State wants.

Justifications● “We have to keep up with the technology criminals are using”● “Its meta-data that contains no personal details”● “Well ask OfCOM first”● “We will make sure the data is used properly”● “It will only cost £1.8bn”

Whats Wrong With That?● “Keeping Up” – This is not the postal service – Theres no public accountability or judicial oversight● “No Personal Data” – Meta-data allows triangulation – Mass data allows heuristic analysis● “Ask OfCOM/Data Protection” – Already ineffective on behalf of citizens● “Used properly” – Mission creep will happen – Home Secretary can arbitrarily extend without oversight

Triangulation

Mission Creep● Congestion charge cams● Traffic status cams● Routine police tool● Car park cams● Routine business tool● Once created, any resource can be repurposed in response to a popular crisis

Summary● CDB makes us all a suspect.● Instead of being under surveillance when there is evidence of wrongdoing, you will be under suspicion by default.● Once created, this resource can only grow in scope & use

What shall I do?In order of engagement:● Join Open Rights Group – http://openrightsgroup.org● Read ORG materials – https://wmk.me/TMvWns● Respond to consultation THIS WEEK – http://www.parliament.uk/business/committees/committees-a- z/joint-select/draft-communications-bill/news/call-for-evidence/● Join (or start) a local ORG chapter

Simon PhippsDirector, Open Rights Grouphttp://webmink.com

http://webmink.com	670
http://www.newsblur.com	17
http://www.linkedin.com	1

Communications Data Bill: Be Very Afraid

by Simon Phipps on Oct 27, 2012

Accessibility

Upload Details

Usage Rights

3 Embeds 688

Statistics

Communications Data Bill: Be Very Afraid Presentation Transcript