Government to monitor Internet Use

Well that didn't last long:

http://www.bbc.co.uk/news/uk-politics-22652051

Boris Johnson has added his voice to suggestions the Communications Data Bill could be revived following the murder of soldier Lee Rigby.

Someone really wants this bill passed. Badly.

[Fawkes]

It's not just Boris calling for this:

Lib Dem opposition to communications data bill 'putting country at risk'.

Following Woolwich attack, Labour peers Lord West and Lord Reid call for Nick Clegg to revive 'snooper's charter' bill.

I have to hope that they honestly believe this would make a difference. But I have this gut wrenching feeling they may be using a mans murder to further their political agenda.

[techguyone]

If the two who murdered the soldier were as low tech in planning as in implementing, it won't matter what Boris and co monitor.

It's doesn't matter that this bill wouldn't have helped, has stopped politicians using the attack to push for it.

---------- Post added at 14:09 ---------- Previous post was at 14:07 ----------

http://www.guardian.co.uk/politics/2...mbat-terrorism

She also confirmed she was still fighting to ensure the full communications data bill – the so-called snooper's charter – is passed by parliament and has won the support of the influential former Labour home secretary Alan Johnson, who said she should resign if the cabinet was not prepared to back her.

[Nidge41]

Originally Posted by papa smurf

this government make lots of promises- what can i say words are cheap

Do you really expect any truth to come from Cameron??

http://www.guardian.co.uk/politics/2...eb-five-letter

The five biggest internet companies in the world, including Google and Facebook, have privately delivered a thinly veiled warning to the home secretary, Theresa May, that they will not voluntarily co-operate with the "snooper's charter".

In a leaked letter to the home secretary that is also signed by Twitter, Microsoft and Yahoo!, the web's "big five" say that May's rewritten proposals to track everybody's email, internet and social media use remain "expensive to implement and highly contentious".

We need to keep fighting this bill everytime it comes up.

They have so far declined to spell out how they would force them to hand over data but officials have confirmed that, in extreme circumstances, they would consider using probes, also known as "block boxes", to intercept such data from overseas-based services as it passed through British communications networks.

Most of these services operate SSL don't they? Wouldn't that stop this from working?

[Sirius]

Originally Posted by techguyone

If the two who murdered the soldier were as low tech in planning as in implementing, it won't matter what Boris and co monitor.

---------- Post added at 21:44 ---------- Previous post was at 21:41 ----------

Originally Posted by Damien

http://www.guardian.co.uk/politics/2...eb-five-letter



We need to keep fighting this bill everytime it comes up.



Most of these services operate SSL don't they? Wouldn't that stop this from working?

To be honest i don't think it would.

Originally Posted by Damien

Most of these services operate SSL don't they? Wouldn't that stop this from working?

I have to ask this, do you think SSL will prevent governments from seeing what you are doing? Do you think the government use's SSL to encrypt its sensitive data/files its so secure? Please answer.

[Uncle Peter]

They will be able to determine the site you are visiting. If they wish to intercept the data stream between your browser and the site this means breaking the ssl channel. They would have to spoof the trusted root and intermediate trust points to do this unless they sneaked an "inspection certificate" into your key store.

[Fawkes]

Originally Posted by Damien

We need to keep fighting this bill everytime it comes up.

The problem is the Home Office isn't listening.
They're not listening to the public, they're not listening to CSPs and they're not listening to the joint committee who said:

Our overall conclusion is that there is a case for legislation which will provide the law enforcement authorities with some further access to communications data, but that the current draft Bill is too sweeping, and goes further than it need or should.
We believe that, with the benefit of fuller consultation with CSPs than has so far taken place, the Government will be able to devise a more proportionate measure than the present draft Bill, which would achieve most of what they really need, would encroach less upon privacy, would be more acceptable to the CSPs, and would cost the taxpayer less.

EDIT
Link to quoted text: publications.parliament.uk

Originally Posted by Bogof

I have to ask this, do you think SSL will prevent governments from seeing what you are doing? Do you think the government use's SSL to encrypt its sensitive data/files its so secure? Please answer.

Well I wasn't sure the level to which SSL can be broken.

[Chrysalis]

Originally Posted by Damien

http://www.guardian.co.uk/politics/2...eb-five-letter



We need to keep fighting this bill everytime it comes up.



Most of these services operate SSL don't they? Wouldn't that stop this from working?

The charter is completely out of touch with reality.

Here is some figures.

For techncial reasons (so can stat data and diagnose problems) I tend to log 10 days worth of smtp data on servers I manage, this data includes, the sender address, sender ip (both email client and ip used on server to send), receipient address, subject of message (this I havent specifically enabled its on by default), ssl/tls settings, whether or not they have authed to send, recipeient server ip, error messages if any, success error number if any (250). Also is logged is if my mail server rejects or greylists emails, delivery failures etc.

On a server with 600 domains and about 4000 email accounts a day's log is approximately 200-500 meg in size typically. thats also with many rogue traffic filtered by firewall which stops it even appearing in the log, otherwise the log would be many multiple of that size. this log doesnt log contents of emails.

Now imagine first the resources required to have eg. 2 years worth of these logs. then imagine if say 100k or more users on the server (larger isps). then imagine if contents of emails logged. It would require completely unrealistic time and resources. Then of course is the realism that encrypted email contents cannot be read unless during the decrypted stage which isnt exactly moral for the isp to be doing that to senders, and contents would only be readable if in text format, what happens if eg. messages are put inside encrypted tarballs, that is very trivial to do and would make things ridicolous.

Then we have the fact BT, facebook, sky etc. only carry a fraction of actual email and communication traffic directly, in other cases they just the carriers. eg. I host my own email which is on a server in germany and also has redundancy on a server in america. Due to the insane policies (and cost) in this country I now host very little content on uk servers. My broadband isp BT cannot do anything to read my emails, they all sent encrypted. They cant even read the headers to see sender and rcpt as also encrypted. The charter is a complete waste of time.

This is very different to eg. asking isps to block illegal sites, as the former is possible (partly), this isnt.

[techguyone]

Heh set up a few hotmail accounts and do stuff likely to cause spam, that'll increase storage requirements for someone by a lot x a lot of people doing it.

[Fawkes]

Originally Posted by Chrysalis

...Now imagine first the resources required to have eg. 2 years worth of these logs. then imagine if say 100k or more users on the server (larger isps). then imagine if contents of emails logged...

I agree with what you are saying but you should note they are currently looking for 1 years retention not 2 and no content of the messages.

Also the government have agreed to compensate ISPs for any costs they incur from implementing this bill which they estimate to be £1.6 billion over ten years.

[Qtx]

Originally Posted by Damien

Most of these services operate SSL don't they? Wouldn't that stop this from working?

GCHQ and the NSA have the processor power to descramble 128 bit ssl connections but usually it is done by a man-in-the-middle attack, aka isp's and telecom providers. As they control part of the route they can (and do) spoof SLL certificates between you and the server which allows them to see the data. As an example, Nokia decrypt customers data using this trick for compression reasons.

It can be done so easy and surely no one doubts that this is done already at all the major isp's and telecoms in the UK and the US on behalf of intelligence services. Anything that makes the news about if we should/shouldn't is probably only about making the info available to the general police or other agencies. Look at how council workers can now look at individuals bank accounts, have them spied on etc, as to how this will go down hill quickly.

What the UK Gov actually want is a special login to facebook/twitter servers which gives them access to private messages and ip addresses in real-time, rather than having to persuade a judge to tell facebook to give them some details on a per person basis. The US Gov probably already has something like this.

---------- Post added at 18:27 ---------- Previous post was at 18:21 ----------

Originally Posted by Chrysalis

On a server with 600 domains and about 4000 email accounts a day's log is approximately 200-500 meg in size typically. thats also with many rogue traffic filtered by firewall which stops it even appearing in the log, otherwise the log would be many multiple of that size. this log doesnt log contents of emails.

Now imagine first the resources required to have eg. 2 years worth of these logs. then imagine if say 100k or more users on the server (larger isps). then imagine if contents of emails logged. It would require completely unrealistic time and resources.

Intelligence agencies are in to data mining in a huge way at the moment and huge amount of storage is not a real issue. Think about how much data online file lockers store and move around a day...