SRoC: Slightly Right of Centre

Transparency DCMS style – it’s rather like transparency, with curtains

2012-05-04T09:28:00.000+01:00

The Open Rights Group managed to claw another bunch of meeting minutes and attendee’s lists from the Department for Culture, Media and Sport (DCMS); shedding a bit more light on the options being discussed for the next batch of copyright protection measures, along with some pointers as to who’s pushing them.

...

What I’m still very worried about...

... is the way these plans are being formulated - in secret, amongst a select group of “industry” representatives. No small business representatives, no consumer voices, no civil society involvement.

I’ve said it many times before. The internet is more than a handful of global tech giants, internet advertisers and ISPs. Legislation drafted this way will inevitably end up favouring today’s incumbents at the expense of innovation and fair market competition tomorrow.

Or end up an unworkable mess.

As far as transparency goes, DCMS has crafted a franky unacceptable fudge.

In order to claim secret meetings of a select few are transparent and include a wide group of stakeholders there will be an infrequent sideshow to give other voices a chance to bemoan what’s continuing to be agreed behind closed doors.

...

Personally I think in this case nothing would be better than something; Nothing would deny the Minister an opportunity to make a far-flung claim that this process is transparent; a claim I'd lay money on him making.

>> Read the full article >>

@JamesFirth

A word from our sponsors: Dalton Firth Limited, software and data analysis

2012-05-03T11:55:00.004+01:00

A short and sweet advert for my day job.

Dalton Firth Limited: Software engineering and data analysis, Farnham, Surrey
(Est. 2005)

Can provide custom software fully tested to your requirements, or work on short and medium term contract rates.

I personally specialise in back-end (server side) and real time embedded, with 15 years experience including secure telecommunications (inventor of EP1359778), budget and financial analysis (creator of Budget Activity Tracker), data analysis and bespoke web services.

I also provide advice, consultancy and training on software development, software programme management and life-cycle (including agile) and Linux networking and system administration with experience in high availability computing (e.g. Red Hat Cluster Suite etc) and secure (e.g. SELinux).

Main languages: C, Objective C and PHP

Main platform experience: Linux (Red Hat Enterprise Linux, Fedora, Ubuntu, Debian), Unix (HP-UX, Solaris), OS X (and NeXT!)

Databases: MySQL, PostgreSQL, Oracle, MS-SQL, DB2

Notable past clients and employers: Motorola, Balfour Beatty Mott MacDonald, InterRoute, Telegraph Media Group, L3 ASA, Enterprise Solutions Group.

Call 01252 560 426

... use this contact form (preferred over email, less spam!)

... or email enquiries@daltonfirth.co.uk

... or twitter @JamesFirth

Daily Mail and Labour teaming up to show their digital illiteracy on porn and child protection is simply dangerous

2012-04-27T11:27:00.001+01:00

I've written extensively on the subject of web blocking to protect children from harmful content like pornography so I'll try and keep this short.

If you turned the internet off tomorrow you wouldn't stop kids getting hold of digital porn
General content filtering is impractical and imperfect. It doesn't even stop all accidental or incidental exposure and it certainly doesn't stop a motivated person or child getting to what they want with minimum technical knowledge.
Content filters over-block and prevent access to clean, lawful content and this impacts legitimate businesses
Even if content filters got much better, there is no one-size fits all. If you have children aged 7, 11 and 15 there is clearly content OK for a 15-year-old you wouldn't want your 7-year-old watching. So what level of content filtering do you want enabled by default on all connections?

I'm not coming at this problem from a pro- or anti- religious line. I'm ambivalent to the benefit or harm of pornography in society. I have no political affiliations. I have no funding from any vested interests (in fact I have no funding whatsoever).

The above is the simple technical position as I, an accomplished software engineer responsible for some of the communications technology on the street today, know it to be. And I don't see much changing soon.

If you are a parent you are responsible for:

What internet-enabled devices you give your children and where you allow them to use them
What level of content filtering you choose to set up. I'm not against ISPs, hardware and software companies offering a range of filtering options, but it's up to you as a parent to decide what is appropriate for your child to access.
Getting clued-up yourself.

You'd happily send your child on a road or bike safety course? You'd attend a first aid course yourself so you'd be able to help your child if needed? You'd research a subject in order to help your child with their general education and homework, yes?
Well stop moaning that someone else should be responsible for your child's online habits.

The campaign by the Daily Mail and Labour is DANGEROUS. It encourages the notion that it's OK for parents to abdicate responsibility for their child's online activities. The online dangers go beyond pornography and the primary responsibility rests with us, the parents (yes I am one).

@JamesFirth

"The internet is filling up!" - it raised a laugh but I said it to express an important concept

2012-04-26T12:40:00.001+01:00

Last week I almost became embroiled in a Ted Stevens series of tubes moment when I told a group of internet rights and privacy advocates that the internet was filling up; and this fact had quite profound implications for the way we understood online privacy and disclosure.

The Open Rights Group executive director Jim Killock almost spilled his drink as he snorked at my suggestion, but I said it for a reason: we need to look beyond the engineering challenge of data storage to the macroscopic properties of a massively distributed stochastic system where billions of users provide input and absorb output.

The internet never forgets is a common mantra amongst both privacy and anti-censorship advocates.

It captures how information, once published online, has the tenacity to stick around for decades - perhaps forever; having obvious privacy implications but also the capacity to undermine censorship, as any attempt to block or cleanse the information from the internet often turns into a game of whack-a-mole.

But the internet never forgets was coined in an era of limited participation. Now internet evangelists such as Vint Cerf talk about bitrot - the loss of data, or the inability to read or interpret stored data at some future point.

Bitrot comes in at least five forms I can identify:

Deletion of the last copy of the data (accidental; but also deliberate, without realising the future value)
Storage of the data in a format which can't be interpreted at some future point due to the unavailability of the software or expertise to interpret the data
Storage on a medium which can't be read due to lack of a physical device to read the data
Failure or degradation of the storage medium so the data can no longer be read
Storage in a forgotten place or a location which can't be found with available search tools

Archivists worry about bitrot because we often don't realise the value of past works and historical data until some future point, when our understanding of the subject has improved sufficiently to make sense of the historical record.

But I'm surprisingly relaxed about bitrot. Bitrot is an engineers-eye view of a problem which can be solved by further engineering.

We're on the verge of producing zettabytes of data per year. That's approaching two trillion DVDs worth of data; which, stacked end-to-end(!), would reach out into space approximately five times further than the moon.

But this fact doesn't cause engineers to lose much sleep. In fact it excites them. We'll continue to find more efficient ways of storing data than DVDs. We'll filter the noise and de-duplicate!

But the fact that data, without some nurturing, risks disappearing into oblivion should be seen as an opportunity to explore some of the benefits of forgetting.

An opportunity to look beyond the data and towards how people and data interact; look at how we use and organise data, and in particular look at the social implications of a connected society now, rather than the benefit to archivists later.

A collective brain

Bitrot is not simply a threat to archivists that we should fight with brute storage. It's also a phenomenon we might embrace to weed-out garbage and let useful data sit at the front of our collective minds.

When I use the internet today it sometimes feels as though digital content is organising itself along the lines of a giant central human brain, with short and long-term memory.

Short term memory: things we can't help to be reminded of. Current events, trends, things people talk about on social networks. Information that's easy to find on Google. You get the idea.

Long term memory: things we have to hunt out. We have to piece together multiple parts of a jigsaw with many well-crafted web searches, or combine data unique to ourselves - data we've stored on our local systems.

I started thinking along these lines a few years ago when the world's best search engine* started to show some of the creaking flaws of its predecessors.

Anyone who remembers using Lycos, Yahoo and Excite to find content back in the 90's will perhaps also remember the wow factor when they first used Google. Google just found stuff - the stuff you wanted - with minimal effort.

Now things are very different. I can find some stuff easily, and some just falls between the gaps.

The principle of extreme sharing (or, as some call it, toxic disinhibition) has simultaneously lead to an increase in serendipitous moments, a massive increase in noise and a loss of privacy.

Mass participation has also introduced chaos into a well-engineered electronic system.

Many people now (rightly) want to have their say and put their spin on news events. Plus, commercial drivers lead to the creation of content, content, content; optimised to appear high up the search rankings despite having little inherent knowledge value.

Data is growing. A good proportion of the population has at their fingertips a means to input and retrieve data from this thing we call the internet. The internet itself grew autonomously from a series of basic regulated principles - protocols.

Now even Google can't help me find an article I read on a reasonably well established professional source just last week. Twitter only allows tweets from the last 2 weeks to be searched - beyond which you need to rely on third-party and expensive tweet archives.

The internet is filling up!

Some feel that search technology will catch up, but I disagree. When Google became the dominant search engine it wasn't facing the same challenge we see now. The challenge back then was to scan all available content and maintain an algorithm which brought the most relevant results to the top.

A decade after the advent of the World Wide Web relevance was pretty much a universal constant. Now it's highly subjective. Less than 20 years ago no national newspaper put their content online. Now when a major news event breaks in the UK it can spawn a thousand articles - many times more if you count personal blogs and social media.

Depending what you're looking for, any one of 100,000 websites could be relevant.

Enter the personalised web. But that doesn't solve the problem of discovery - finding something completely new to the searcher. And it doesn't solve the problem of finding something specific if that something happens to be outside your normal personalised search bubble or circle of relevance.

Personalisation is a fig leaf based around the premise that around 90% of what we're looking for can be guessed from our past behaviour and, in cases, our friends' past behaviour. But this thinking locks us into our past and can make the thing we actually seek even harder to find.

We're facing a new set of challenges that increasingly make the old adage, that the internet never forgets, look naive.

The internet is filling up, and that not only has profound implications for the way we use and store data; it will impact all online businesses, have implications for free and open online competition when a few dominant providers act as gatekeepers, and will affect legislation attempting to tackle e.g. government transparency, privacy and regulation of online content.

The prominence of data is becoming governed not by how engineers store and organise it but how humans interact with each other in a way that simply can't be predicted, to bring certain information to prominence and let other facts linger at the back of our collective minds.

@JamesFirth

Three words for you Mr Hunt: Digital Economy Act

2012-04-24T18:03:00.000+01:00

Leveson? Meh.

Jeremy Hunt's verdict on the Digital Economy Bill: "We wanted an iPod, but we got an Amstrad"

But he still voted for it, allowing Madelson's shambles to get through the wash-up.

Now he's the head of a department, DCMS, which has seen vested interests rule the roost whilst failing to sort out the mess that is the Digital Economy Act (now delayed until 2014 at the earliest).

So no, the revelations at Leveson today regarding Murdoch and News Corp don't surprise me in the slightest.

How he's managed to keep his hands clean this long, given the mess which is the UK's digital policy under his watch, I've no idea. Mr Hunt, who happens also to be my local MP, should now resign.

@JamesFirth

We need mass internet surveillance and data storage, quick as poss pls

2012-04-24T16:52:00.000+01:00

A guest post from Billy Bytesworth

Who said what to whom, dates, times, data retention of traffic information... We must enact the government's planned mass internet surveillance in double quick time. This might be a message alien to regular readers of this, the erstwhile stomping ground of a liberal who believes in privacy from state intrusion.

But there is a serious need for these measures. A need greater than battling terrorism. A need greater, even, than stomping out copyright infringement. The reason we need a permanent immutable record of all internet transactions is clear from the shenanigans surrounding Messrs Murdoch, Murdoch, Hunt & Co.

Governance.

I think we all agree it's in the public interest to do all we can to ensure we have a system of governance that works in the public interest. A reliable and stable government is after all the most important prerequisite for a civil society. (Dear Anons, please skip over this assertion. No need to DDoS me.)

For that we need public accountability and for that we must have true freedom of information. We must ensure from now on that secretaries of state, ministers, civil servants, special political advisers, newspaper proprietors and senior police officers will have a true and accurate aide memoire of all electronic correspondence. Especially those tricky few emails which evade one's recollection.

That governments will be better held to account if every single email sent to or from a senior figure is captured, time-stamped, stored and made available for immediate public scrutiny I am of no doubt.

The only question is whether such a system may have the unintended and unforeseen consequences of inhibiting frank and open dialogue necessary for the furtherance of informed government.

If ministers and civil servants feel that such a system is not suitable I am willing to reconsider my position.

If those in power feel it is disproportionate to put the need of this country to have an honest and reliable government behind the need for officials and elected representatives to have a full and frank exchange of views in private, I may be persuaded...

Or maybe government officials feel such an invasive system won't end malfeasance? Maybe they feel such a system would be disproportionate? It would be costly, highly intrusive; yet fail in its aims, being easily circumvented by officials intent on subversion using widely-available tools to mask their electronic correspondence...

Yes, I might well come round to this view.

In fact we might even extend the principle beyond government. To furnish the right to all to be granted a level of privacy and autonomy that enables frank and open dialogue necessary for the furtherance of society and of knowledge.

BB

Update

2012-04-18T17:15:00.005+01:00

Whilst I'm still struggling to find a way to keep Open Digital staffed I'm making some progress on the personal front.

I need a job since there's now very little prospect of a salary from Open Digital in the near future and I've invested all my spare cash getting it going.

Lots of people have been in touch with potential job offers, please keep them coming as it's a matter of finding a tolerant employer happy for me to continue my public advocacy in my spare time if Open Digital is to survive at all.

I've also now started writing a weekly blog at Computerworld UK.

Although after 2 years SRoC was well read and, so I discovered, by some influential people; I hope moving my writing there will help get issues raised with a different audience and might help the rescue package I'm trying to cobble together for Open Digital. Hopefully more on this later.

That's about all for now. You can read my first post over at Computerworld:

Why the end of Consumer Focus is a blow to UK tech policy

When a government in the midst of a cuts agenda releases a report entitled Empowering and Protecting Consumers, you just know it will not be good news for under-empowered and unprotected consumers in the cut-throat utilities sector.

I imagine the report might have started life as a memo: ‘make a case for getting rid of these meddling windbags’.
What many people, even those in the tech sector, perhaps don’t appreciate is the role Consumer Focus plays in batting for sense in UK tech policy.

...

Consumer Focus is not Big Government. It’s a safeguard against unavoidable monopolies in the utilities sector, including Internet Service Providers. It fights largely from behind the scenes, pushing back against many of the self-interested demands of tech lobbyists.

>> Read the full post >>

@JamesFirth

Thanks and goodbye - the end of 2 years of SRoC

2012-04-10T11:26:00.001+01:00

Thanks for all who've helped and supported us over the last 2 years on SRoC and the last year at Open Digital.

Sadly I can't fund this blog or Open Digital any more so the projects are on hold - indefinitely.

Whilst some mock blogging, many of the stories on here - some I have broken way ahead of mainsteam media - take days and sometimes weeks of research and networking with tech cos, attending events and meetings in parliament, etc.

Whilst it's never over till the hard disks are wiped and the organisation is liquidised the financial reality is that I can't put any more time into SRoC or Open Digital until I can make it pay.

If anyone's interested - I earned £1.71 from running adverts on this blog for a week, a week with 5k unique hits when I published 5 original posts. Whilst I believe a digital publishing correction is due, the money is clearly aimed at social puff over substance and one just can't survive on £1.71 a week.

I have mouths to feed and my public CV is here if anyone wants to hire me:
http://www.opendigital.org/consultants/OpenDigital_JamesFirthCV.html

Sorry it's been so brief. Whilst I'm sure there are many out there funding work towards ethical data policy I have not managed to get any of it to flow in our direction.

We all have to eat; and, sadly, as I have written many times over, policy follows the money.

Bye - for now at least,

@JamesFirth

UPDATE: 17:57 - I am just moved by the massive votes of support via email, twitter, G+ etc, and the 2 Flattr donations I didn't even ask for. Also the multiple suggestions - some of which might see me continuing to write here or elsewhere. More relatively soon on that, hopefully. I'm also considering what could be a decent job offer that could see some time allowed for side projects like this. It means so much to see people appreciate what I've done here and at Open Digital, even though it may not work commercially; support from so many quarters.

Good but weak leaders driven by fear and reassured by their own arrogance are unwitting bidders for the devil

2012-04-08T14:28:00.000+01:00

Great leaders defend their principles, weak leaders make excuses for their decisions.

The string of politicians responsible over half a century for the subversion of justice and erosion of freedom from state intrusion are on the whole good people.

Good but weak leaders who have opted to make excuses rather than defend what they know to be right.

Politicians and leaders pushing detention without trial, control orders, secret justice, Guantanamo interrogations, mass electronic surveillance, rendition... Driven by fear.

A fear that conventional justice is not sufficient to deal with the 'new' threats of today.

A fear that if they don't act, something bad will happen.

A fear that the internet fundamentally weakens the power balance which allows governments to maintain law and order.

Weak leaders, good people, are turning their backs on their own belief in society; a belief that in our individual freedom and autonomy lies our collective strength; instead becoming advocates for shallow excuses.

Advocates for safeguards that aren't quite the safeguards developed over centuries; independent judicial oversight degraded to the nod of a senior officer, presumption of innocence - but only for less-serious crimes, open justice - unless the government insists on secrecy.

Their arrogance isn't malign, but the consequences are.

An arrogance in understanding; a blind belief that the new safeguards are sufficient and state intrusion necessary in the first place.

And somewhere behind these good but weak leaders lies the devil, waiting to pounce on a civilisation where doing the wrong thing has been normalised through fear of evil.

@JamesFirth

Can freedom survive?

2012-04-06T21:06:00.002+01:00

The fuss over the government's latest net snooping plans might have died down for a while in the UK but with a similar battle emerging in the US I get the feeling this is going to run and run.

I know of at least one event planned for soon after Easter and I wondered whether this cause is worthy of a theme tune. To get the ball rolling I've penned some lyrics to Gloria Gaynor's 'I will survive'.

All we need now is a band to record it (hopefully under a Creative Commons license so it can be shared and remixed as needed) and maybe a video, too? (Must pan in to RIPA Part III on line 2!)

Can Freedom Survive? (CC-BY-NC James Firth)

When the net was first used by paedophiles,
Government made laws to access all our files,
And then onto the scene, came the copyright brigade,
Jobs are under threat and campaign bills must be paid...

And now we're tracked, from outer space,
They put all our website visits in a database,
We should have known that terrorists
Would be used to set the scene,
For a level of surveillance that Orwell had foreseen.

Go on now, go, walk out the door,
Your moves all logged and stored, till twenty eighty-four,
Try and leave your phone behind, that doesn't get you off the hook
Cameras match your features to your photos on Facebook.

Now freedom, can it survive?
When the government knows what I write before my blog goes live,
I've got all my life to live, my data leaks just like a sieve,
Can freedom survive? Survive? Hey, hey,

Can we trust high strength encryption not to fall apart?
With a man sat in the middle trying to subvert,
Breaking all the bonds of trust just to read a batch of spam,
What's it all for? Have you heard of TOR?

There is another way, it's really nothing new,
You can trust most netizens to hold up good and true,
Our autonomy's our strength, in a society that's free,
We're all keeping our eyes open for the threats that you foresee.

Go on now, go, walk out the door,
Your moves all logged and stored, till twenty eighty-four,
Try and leave your phone behind, that doesn't get you off the hook
Cameras match your features to your photos on Facebook.

Now freedom, can it survive?
When the government knows what I write before my blog goes live,
I've got all my life to live, my data leaks just like a sieve,
Can freedom survive? Survive?

@JamesFirth

Alleged NSA contact book leaked by Anonymous could indicate scale of private industry profits from security

2012-04-05T16:22:00.001+01:00

Anonymous claims to have leaked an NSA contact book. The 4,000-entry list containing many private sector contacts appears to have been published some point on or before Tuesday 3rd April.

I'm in two minds whether to link to the leak; it contains personal data - including what appears to be home addresses for many of those listed.

Plus, I don't support Anonymous - many of their antics are not helpful and I'm aware that Anonymous as a concept provides a vehicle for malignant forces to co-opt from a highly-skilled cohort of sometimes-impressionable hackers.

For this second reason I don't want to cheer-lead for them but at the same time this leak looks newsworthy and indicates the US National Security Agency has tentacles into many major technology companies, perhaps indicating the scale of both the cyber-security industrial complex and the military-digital complex.

Essentially there's a huge amount of money to be made from keeping us safe and this opens up the possibility that some of those profiting have an incentive to over-hype the threat to keep the cash rolling in.

The collateral damage is our privacy and freedom. Few rational people mind protective measures taken in our collective interest to maintain security and stability, but we need to be sure that inflated or non-existent threats are not used to justify excessive state intrusion.

Below is a list of email domains scraped form the alleged NSA leak with a count of the number of times each domain appears.

Disclaimer: There's no way of verifying the input data, and even if the list did originate at the NSA as is claimed, there are plenty of benign reasons companies who supply technology to government would appear on such a contact book, e.g. account management, technical sales, advanced research, etc.

At the same time the data is now out there being circulated on chat rooms and Twitter. Don't shoot the messenger, there's clear public interest as outlined above and the list deserves scrutiny.

The reader should be aware the leak may not be genuine, and in any case should not infer that NSA 'agents' are embedded in these companies:

172 gmail.com (public email address)
99 nsa.gov
86 mail.house.gov
73 aol.com (public email address)
65 osd.mil
64 yahoo.com (public email address)
64 dhs.gov
59 lmco.com
56 ic.fbi.gov
55 dia.mil
53 saic.com
49 gd-ais.com
45 ugov.gov
45 state.gov
44 ssci.senate.gov
43 hp.com
42 comcast.net
42 bah.com
41 nga.mil
41 caci.com
37 verizon.net
35 raytheon.com
35 ngc.com
32 nro.mil
31 baesystems.com
30 hotmail.com
28 potomacinstitute.org
28 dni.gov
23 appro.senate.gov
22 cox.net
22 boeing.com
20 microsoft.com
19 l-3com.com
18 mantech.com
18 earthlink.net
17 hq.dhs.gov
17 harris.com
17 accenture.com
16 oracle.com
16 gdit.com
16 ensco.com
15 att.com
14 ball.com
13 us.ibm.com
13 ucia.gov
13 hsgac.senate.gov
13 deloitte.com
13 armed-services.senate.gov
12 usdoj.gov
12 uscg.mil
12 tasc.com
12 srcinc.com
12 msn.com
12 ca.com
12 appsig.com
11 darpa.mil
10 usis.com
10 qinetiq-na.com
10 prtm.com
10 njvc.com
10 mitre.org
10 lmi.org
10 itt.com
10 geoeye.com
10 cubic.com
10 copt.com
9 pfiab.eop.gov
9 cisco.com
8 us.army.mil
8 techusa.net
8 sncorp.com
8 sgis.com
8 salientfed.com
8 qwest.com
8 lgsinnovations.com
8 jhuapl.edu
8 intelsatgeneral.com
8 finmeccanica.com
7 umd.edu
7 sypris.com
7 six3systems.com
7 mac.com (public email address)
7 kforcegov.com
7 globalcrossing.com
7 dell.com
7 arete.com
7 aero.org
6 theanalysiscorp.com
6 terremark.com
6 systek.com
6 sptrm.com
6 solers.com
6 serco-na.com
6 quest.com
6 navy.mil
6 mcafee.com
6 marklogic.com
6 kpmg.com
6 i2spros.com
6 emc.com
6 do.treas.gov
6 agilex.com
6 abraxascorp.com
5 us.pwc.com
5 sensasolutions.com
5 safenet-inc.com
5 netscape.net
5 mcbeestrategic.com
5 js.pentagon.mil
5 intecbilling.com
5 hughes.com
5 harding-security.com
5 faa.gov
5 drs-ds.com
5 drs.com
5 draper.com
5 dnovus.com
5 ciena.com
5 acqsolinc.com
4 wyle.com
4 westwaydevelopment.com
4 usmc.mil
4 stellarsolutions.com
4 sri.com
4 potadv.com
4 pentagon.af.mil
4 parsons.com
4 netapp.com
4 me.com (public email address)
4 live.com
4 juno.com
4 insaonline.org
4 hubcon.com
4 gd.com
4 federal.dell.com
4 esri.com
4 entegrasystems.com
4 cobham.com
4 camber.com
4 bellsouth.net
4 battelle.org
4 att.net
4 agtlawyers.com
4 agilent.com
3 zavda.com
3 usgif.org
3 trssllc.com
3 sysplan.com
3 syndetics-inc.com
3 sprynet.com
3 sotech.us
3 sheppardmullin.com
3 sei.cmu.edu
3 securemissionsolutions.com
3 reedcorp.com
3 redhat.com
3 radium.ncsc.mil
3 pherson.org
3 only.arl.psu.edu
3 omniplex.com
3 nsc.eop.gov
3 nmic.navy.mil
3 nciinc.com
3 mercyhurst.edu
3 jhu.edu
3 intelligent.net
3 implementstrategy.com
3 ieee.org
3 georgetown.edu
3 gdc4s.com
3 gartner.com
3 fabiani-co.com
3 exceptionalsoftware.com
3 eti-eng.com
3 defensegp.com
3 dau.mil
3 columbia.edu
3 carahsoft.com
3 bericotechnologies.com
3 atf.gov
3 aporter.com
3 anser.org
3 aecom.com
2 zai.com
2 who.eop.gov
2 wdc.sri.com
2 vt.edu
2 vt-arc.org
2 venturemanagement.com
2 venonaconsulting.com
2 va.gov
2 urs.com
2 tvarsolutions.com
2 totalintel.com
2 thenewberrygroup.com
2 thechartwellconsultancy.com
2 targusinfo.com
2 starpower.net
2 spectrumgrp.com
2 soteradefense.com
2 sms-fed.com
2 signaturescience.com
2 signaturegs.com
2 sdsi.net
2 sbcglobal.net
2 sassi-va.com
2 sanborn.com
2 sage-mgt.net
2 rogers.com
2 renesys.com
2 regent.edu
2 rand.org
2 proteuseng.com
2 prointelservices.net
2 parabon.com
2 osd.pentagon.mil
2 ockim.com
2 objectfx.com
2 nsf.gov
2 nnsa.doe.gov
2 mpiresearch.com
2 missionep.com
2 missionconcepts.com
2 millcp.com
2 mi.army.mil
2 mgiss.com
2 mcmunn-associates.com
2 makfinsky.com
2 langley.af.mil
2 lacaixa.es
2 kgsgov.com
2 kellyservices.com
2 keane.com
2 jwac.mil
2 ivysys.com
2 interf.com
2 intellacademy.com
2 ichnet.org
2 iacsp.com
2 hughes.net
2 hud.gov
2 gtri.gatech.edu
2 graydome.com
2 gmu.edu
2 gmri.com
2 gmai.com
2 globaltechops.com
2 gci.net
2 fts-intl.com
2 falken.us
2 ey.com
2 everest.nu
2 erols.com
2 eastportanalytics.com
2 disa.mil
2 dhs.com
2 cust-matters.com
2 ctssgroup.com
2 cornell.edu
2 co.clark.nv.us
2 civitasgroup.com
2 chicagopolice.org
2 centurum.com
2 centratechnology.com
2 cdsinc.com
2 casl.umd.edu
2 boyden.com
2 a-tsolutions.com
2 apgtech.com
2 ansaldo-sts.us
2 analex.com
2 americansystems.com
2 american.edu
2 agogegroup.com
2 adobe.com
2 3001inc.com
1 yandex.ru
1 yakabod.com
1 xebecglobal.com
1 woti.com
1 worldnet.att.net
1 woodcons.com
1 wisc.edu
1 windsorvisions.com
1 whitecliffsconsulting.com
1 wharton.upenn.edu
1 wgint.com
1 webb.senate.gov
1 washpost.com
1 ward-solutions.com
1 waldenu.edu
1 vyndicar.com
1 voa.gov
1 visualintelgroup.com
1 viadesigns.com
1 vermilliongroup.com
1 venable.com
1 vacoxmail.com
1 uva.nl
1 usintelgroup.com
1 usfca.edu
1 usd.com
1 usaf.mil
1 us.af.mil
1 unveillance.com
1 unitedplacements.com
1 unisys.com
1 txdps.state.tx.us
1 ttemi.com
1 tsc.gov
1 tsa.dhs.gov
1 triumph-tech.com
1 triumfant.com
1 trinity-health.org
1 tribune.com
1 tresys.com
1 treadstone71.com
1 tmomail.net
1 tidalwave.net
1 tibco.com
1 thinkingahead.com
1 thepolagroup.com
1 themekonggroup.com
1 theedgegroup.cc
1 the-analysis-corp.com
1 terminusnet.com
1 telesecret.com
1 taurigroup.com
1 tamu.edu
1 takt-gs.com
1 sun.com
1 student.american.edu
1 stratspace.net
1 strativest.com
1 stopso.com
1 stanleyassociates.com
1 srtrl.com
1 srccomp.com
1 splunk.com
1 spectrumresolutions.com
1 spadac.com
1 sourcefire.com
1 socratiq.com
1 smu.edu
1 skunkhollow.com
1 si-intl.com
1 signalscape.com
1 siemensgovt.com
1 sidley.com
1 sfa.com
1 sensis.com
1 senecatechnologygroup.com
1 selil.com
1 securityconsultants.us
1 scires.com
1 sc.edu
1 savasolutions.com
1 sarnoff.com
1 sap.com
1 sandia.gov
1 sandia.com
1 runbox.com
1 rss-i.com
1 rri-usa.org
1 rpssol.com
1 rotter.com
1 robersongroup.com
1 riverglassinc.com
1 republiccapitalaccess.com
1 reed.senate.gov
1 recordedfuture.com
1 radiantblue.com
1 r3consulting.com
1 quintron.com
1 quantum-intl.com
1 qualcomm.com
1 qssgroupinc.com
1 ptf.gov
1 psu.edu
1 prtc.net
1 proposalcrafter.com
1 prime-policy.com
1 post.harvard.edu
1 poseidon2020.com
1 portableexpert.com
1 polisci.osu.edu
1 policeone.com
1 pnl.gov
1 photot.com
1 phaseone.net
1 pge.com
1 perkinscoie.com
1 patriotsecuritygroup.com
1 paragondynamics.com
1 parabal.com
1 palantir.com
1 pacific.net.sg
1 owlcti.com
1 ou.edu
1 ostp.eop.gov
1 osec.usda.gov
1 ornl.gov
1 orbital.com
1 optitechis.com
1 opm.gov
1 omb.eop.gov
1 ogn.af.mil
1 odci.gov
1 objectvideo.com
1 nyct.com
1 nyc.rr.com
1 nss.us.com
1 nsgac.senate.gov
1 npci.com
1 nova.org
1 novakbiddle.com
1 noblis.org
1 nmic.gov
1 nmarion.k12.or.us
1 nist.gov
1 nima.mil
1 newyorkguard.us
1 newhaven.edu
1 networkconsultantsgroup.com
1 netwitness.com
1 netstarconsulting.com
1 netscape.com
1 neosystemscorp.com
1 neigelcorp.com
1 ndia.org
1 nctc.gov
1 nationalstrategies.com
1 na.manpower.com
1 mviewcc.com
1 msu.edu
1 msshq.com
1 morganfranklin.com
1 monetts.com
1 mobytechnologies.com
1 mjww.net
1 missionsyncllc.com
1 missi.ncsc.mil
1 misc.pentagon.mil
1 mindspring.com
1 microstrategy
1 metsala.com
1 metacarta.com
1 meridiangroupintl.com
1 mdsp.org
1 mcguirewoods.com
1 maximusit.com
1 mathc2.com
1 masygroup.com
1 marotta.com
1 markle.org
1 lorenzresearch.com
1 lnssi.com
1 llnl.gov
1 lingualistek.com
1 liberty.edu
1 lgscout.com
1 level3.com
1 leo.gov
1 lat-intel.com
1 lasd.org
1 lakenheath.af.mil
1 l-3com-spg.com
1 ktech.com
1 kmssol.com
1 kippsdesanto.com
1 kinnearcundari.com
1 kiernangroupholdings.com
1 keywcorp.com
1 kanturkpartners.com
1 kames.com
1 juniper.net
1 jmu.edu
1 jiddo.dod.mil
1 jfsc.ndu.edu
1 jb-a-inc.com
1 jasonhealey.com
1 jamitek.com
1 ix.netcom.com
1 iwp.edu
1 itsfed.com
1 itllc.com
1 isomcorp.com
1 islinc.com
1 iridium.com
1 ios.doi.gov (attn: secretary salazar)
1 interlocutor.net
1 intellpros.com
1 intelligent.com
1 integrity.us.com
1 insightbb.com
1 input.com
1 innoviss.com
1 innovativedecisions.com
1 infragard.org
1 infragardnational.org
1 infragardmembers.org
1 infoassure.net
1 in.doe.gov
1 imetlabs.com
1 imageryx.com
1 iis-us.com
1 ida.org
1 icioffshore.com
1 icentric-marketing.com
1 i-centralpoint.com
1 ibgweb.com
1 i2group.com
1 htgcorp.com
1 hstoday.us
1 hq.doe.gov
1 hightoweradvisors.com
1 hhs.gov
1 heurtevent.org
1 hengcon.com
1 hbgary.com
1 gwu.edu
1 grsco.com
1 greenlinesystems.com
1 gov.com
1 google.com
1 goodrich.com
1 gmx.com
1 geospatialconcepts.com
1 geointsolutions.com
1 gdds.com
1 gcsinfo.com
1 futures-inc.com
1 fundintel.net
1 fulcrumco.com
1 flexispine.com
1 feinstein.senate.gov
1 fedsys.com
1 fedcappartners.com
1 fbnt-inc.com
1 fas.usda.gov
1 fasi.com
1 f4winc.com
1 eurasiagroup.net
1 etginc.com
1 esu.edu
1 es.ibm.com
1 esi.baesystems.com
1 esc-techsolutions.com
1 eodt.com
1 encrisp.com
1 emihq.com
1 email: mel.tuckfield
1 email: lynda.burroughs
1 email: lsunden
1 email: arothman
1 ed.gov
1 ec.rr.com
1 ebrinc.com
1 eagletsi.com
1 eaglerayinc.com
1 eagle32.com
1 dsbox.com
1 drs.ca.com
1 drc.com
1 dps.state.la.us
1 dowless.com
1 dot.gov
1 dol.gov
1 doc.gov
1 dlt.com
1 dlnmedia.com
1 digitalriver.com
1 digitalglobe.com
1 dfaco.com
1 densmoregroup.com
1 demiurgeconsulting.com
1 deltek.com
1 delta-risk.net
1 delphiresearch.us
1 delex.com
1 defgrp.com
1 datadomain.com
1 dark-lite.com
1 danjryan.com
1 cybersquared.com
1 cubrc.org
1 ctc.com
1 csis.org
1 cs.com
1 crucialsecurity.com
1 crucialpointllc.com
1 crs.loc.gov
1 criterion-sys.com
1 cray.com
1 cpdconsultants.com
1 convera.com
1 connellyworks.com
1 concentric.net
1 compositesw.com
1 comlinks.com
1 comcast.net;
1 cohengroup.net
1 cia.ic.gov
1 chw.edu
1 chglobalsecurity.com
1 cfr.org
1 cfl.rr.com
1 cert.org
1 centauri-solutions.com
1 capgemini-gs.com
1 cableone.net
1 butulis.com
1 bushschool.tamu.edu
1 buckgroup.net
1 bstonetech.com
1 bp.com
1 bond.senate.gov
1 bluelink.net
1 bluelineinfo.com
1 blueglacier.com
1 bluecanary.us
1 blersch.net
1 bldg.com
1 blackwatchglobal.com
1 biometricgroup.com
1 bhgrp.com
1 benchmarkes.com
1 bea.com
1 bcmcgroup.com
1 basesystems.com
1 barracloughltd.com
1 barcap.com
1 aya.yale.edu
1 attach.net
1 atk.com
1 atichcd.org
1 asu.edu
1 astroguy.net
1 asims.ca
1 arl.psu.edu
1 arinc.com
1 arcaspicio.com
1 aqua.com.do
1 apptis.com
1 applicology.com
1 ang.af.mil
1 alumni.nd.edu
1 alumni.duke.edu
1 alumni.bates.edu
1 alum.mit.edu
1 alionscience.com
1 akamai.com
1 ait-i.com
1 aim.com
1 afcea.org
1 adl.org
1 adapx.com
1 acxiom.com
1 activeassurance.com
1 acg-hq.com
1 absicorp.com
1 1secureaudit.com

@JamesFirth

Confusion over warrants, surveillance powers and the intrusiveness of traffic data

2012-04-04T13:36:00.000+01:00

Since I wrote a post explaining how the Government's draft surveillance plans had the effect of downgrading what traditionally would be classed as intrusive interception to a lesser category of access to traffic data - which has far fewer safeguards - a few people have written to me asking about the issue of warrants.

As it stands today a local authority, police force or government intelligence agency does not need a warrant to access traffic data, whereas access to the content of electronic communications - interception - requires an interception warrant, each ultimately authorised personally by the Secretary of State.

The use of interception warrants is overseen by the secretive Interception of Communications Commissioner (ICC) whereas traffic data is regulated as personal data by the Information Commissioners Office (ICO).

Confusion over warrants for access to traffic data arises perhaps because of the coalition's much-vaunted Protection of Freedoms Bill, which will require a judicial warrant for many requests for traffic data.

The Protection of Freedoms Bill is still ping-ponging between the Lords and the Commons so it's still not absolutely clear when a warrant will be required, but it's pretty certain that Local Authorities will have to approach a magistrate for approval.

But this won't solve a fundamental problem in that RIPA, the law governing the state use of surveillance, was written for an analogue era; despite being enacted a good 8 years after the world wide web took off.

As I expressed in another post, drawing analogies between traffic data from a telephone network and data milked from an internet connection undermines a step-change in sensitivity caused by the way we use modern communications today.

Traffic data - which includes the websites we visit - can give a good indication of:

Our religion, if we visit church websites
Our political views, by virtue of the newspapers we read
Our sexual preferences
Our taste in popular culture, films, music, theatre etc
Our location at most times, day or night
Whether we are politically active, or members of a campaign group
Where we work

Additionally, a key measure of the intrusiveness of traffic data has its origins in the data being already available, compiled as a necessary part of running a telephone network (billing data).

The Data Retention Directive, by requiring designated ISPs to store data it would otherwise discard, already moves away from this concept. A method which requires additional steps or measures in order to capture data is inherently more intrusive than passive access to data already available.

The latest government plans take this one stage further, introducing the possibility that additional hardware and/or computer software will be added to networks to gather this so-called traffic data.

This should be taken as a strong indication that we are no-longer talking about traffic data, as traffic data is information required for getting data from point A to point B. Such information is always placed in the easily-accessible header section of all communications packets and specialised equipment is not needed to extract this.

When we start talking about what is to all intents and purposes a network tap dressed up as a tool to access some bastardised concept of traffic data it's time to wake up and realise the underlying law - RIPA - is not fit for the internet age.

We need new definitions for what is intrusive for online surveillance.

And to get there we need an open, honest and adult debate about what represents an acceptable balance between security and privacy in communications.

Safeguards will form part of this balance, and we need to ensure the level of oversight and protection is in each case appropriate to the intrusiveness of any given method of monitoring.

Yes I respect and admire the work of security services and police but that doesn't mean the state gets carte blanche. There has to be some give - some let-up in the secrecy for there to be a public debate about what is necessary and proportionate.

After all, public trust and confidence in the work of the security forces is a bigger asset, even, than the ability to monitor all electronic communications. A consensual approach makes society stronger and inherently stable.

Related: Privacy initiatives as an enabler for cyber security

@JamesFirth

Bootnote: It has been pointed out that access to traffic data stored under the Data Retention Directive has been made available to civil litigants under a Norwich Pharmacal Order. Again this needs to be looked at:- if we introduce measures for the sole purpose of preventing serious crime and securing the nation we must also introduce robust safeguards to prevent the measures then being used for far lesser infringements.

'Maintaining' 'lawful' intercept capability

2012-04-03T11:05:00.004+01:00

20 years ago I was a member of a social network. It was called the pub and it enabled like minds to interchange small talk, gossip and express political opinions.

I was also a member of a video-on-demand service called the video shop. At short notice, I could decide which film I wanted to watch, beg my Dad to lend me the car, and within 20 minutes there was a good chance I would be back home with a film to watch.

There was electronic mail, of sorts. I'd type letters on my Commodore Amiga, print them out on my new Canon BJ10 Bubble Jet printer, stuff them in an envelope, address it, stamp it, and stick it in the post box.

My newspaper was delivered by me, the local paperboy, and the only record kept of which paper I read was a hand-written delivery diary at the family-run shop where I worked part time.

When the Government talks about 'maintaining' interception capability they conveniently forget that the capability to monitor 'endpoints' - who talks to whom - never existed for most everyday interactions until very recently, when so much of our everyday activity moved online.

Now my social network is called Facebook and the Government wants to invent the capability of seeing who I write to, who everyone writes to, despite the absence of suspicion.

And, if suspicion should fall on you, they want to be able to see everything you do - in fact they can do this already, but that's another story and there are reasonable but secretive safeguards to help prevent abuse.

The new plans for mass internet monitoring and surveillance go way beyond any capability any government ever admitted to having before.

The information available without a warrant will include which newspapers I read online, which films I watch online (if URLs are to be captured, as rumoured) and everyone I communicate with - whether or not I am working as a journalist with an obligation to protect my sources, or working as a counsellor in sensitive areas, or organising a lawful political protest.

The Home Office insistence that these plans are maintaining a capability which is lawful today is a claim built on strata upon strata of sand. Sand that the Government previously laid in the gradual erosion of our privacy because the internet has made it possible to gather so much more information than was previously available without a large-scale surveillance operation 20 years ago, when most transactions were conducted in person.

It was decided that access to traffic data was not 'intrusive' back when many telephones still had a rotary dial. Traffic data was collected as a necessary part of running a telephone network.

Now, to access what Home Office lawyers claim is a modern equivalent, networks need to be monitored with specialist software. All internet activity needs to be intercepted in order to extract this context-sensitive notion of traffic data.

The lines between interception of content and traffic data are now so blurred they are useless.

We have moved from passive access to data already collected as part of running the network to active and intrusive gathering of new data not otherwise needed.

And this is being justified by reference to a layer of sand previously laid by the UK government when it lobbied Europe for the Data Retention Directive, forcing selected ISPs to gather and store some - but nowhere near all - of this data, just in case it needs it later.

Instead of making flawed analogies between online activity and the public switched telephone network it's time to rethink the boundaries where monitoring becomes intrusive.

It's intrusive to watch what websites I visit, who I message and where I'm located the vast majority of the time, unless perhaps when there's evidence that I'm suspected of a crime.

We need to stamp out a few government myths right now. Their plan to watch everyone, just in case someone does something bad, is disproportionate, of questionable legality and in no way maintains an existing capability.

@JamesFirth

Equalities and Human Rights Commission:web monitoring potentially incompatible with the right to privacy

2012-04-02T17:56:00.000+01:00

Organisation: Equality and Human Rights Commission

Source: Press Releases

Date: 02.04.12

A commission spokesperson said:

"The Government's email and web monitoring plans would potentially be incompatible with the right to privacy of many ordinary people in the UK.

"The Commission's own research last year into information privacy concluded that there was a lack of proper regulatory oversight and too much conflicting legislation, all of which fails to provide adequate protection for citizens and their private information.

"We found that the way the government and its agencies collect, use and store personal data is not respecting people s right to privacy. However, because of the complexity of the current laws, obligations are unclear and authorities may be unaware they are breaking the law.

"These issues need properly addressing rather than introducing new proposals which further reduce people's rights to privacy."

@JamesFirth

Do not allow the government to back-door our entire communications infrastructure

2012-04-02T11:46:00.004+01:00

Communications Capabilities Development: Mass Internet Interception and Surveillance Programme

My earlier description of CCDP explains how the government proposes to introduce warrantless mass surveillance by downgrading much of our internet activity from content to traffic data.

Despite what many readers may instinctively think, my objections to this internet monitoring plan aren't primarily rooted in generalised notions of civil liberties such as privacy.

Costly unsustainable capability-based policing must not come at the expense of consensual community-based online policing.

I think the proposal is disproportionate with questionable benefit. Serious criminals, terrorists and state actors will up their game, rendering much of this surveillance useless. Telephone and mail interception didn't stop the terrorists of the 70's, 80's and 90's.

MPs may feel compelled to act, for if they don't and something bad happens, questions will inevitably be asked why this type of surveillance wasn't installed.

And herein lies a problem as no-one will know if mass surveillance would have stopped it.

But we already have a good idea of the price of surveillance. Greg Callus wrote an excellent piece in light of the Leveson inquiry, detailing how we're struggling even today to stop enterprising criminals selling access to our private communications.

I have three further worries. There will be a costly arms-race, I have no doubt of that. Only the manufacturers of surveillance equipment can possibly benefit.

Plus, back-dooring our entire communications infrastructure creates a cyber security risk. Yes, that's right, a risk. The claim that such monitoring will help the good guys is based on a premise that only the good guys will have access to it. (If you haven't already, do go and read Greg's piece.)

Anyone who claims a system is 100% secure is either deluded or lying. And the more people involved, the more private companies involved - surveillance equipment manufacturers and private ISPs - the greater the chance that the system will leak or be cracked.

I firmly believe that privacy is actually an enabler for cyber security. It encourages us all to act responsibly and autonomously, reduces the amount of exploitable sensitive data on the network and and minimises what system designers call "common-mode weaknesses" in the network.

And I'm worried that the focus on capabilities-based 'behind the scenes' intrusive policing will come at the expense of developing a far more effective and sustainable consensual-based policing approach for online spaces.

Surveillance and monitoring encourages cops to dig around in the bowels of the internet to find the crooks, rather than developing cyber-detective skills which in reality are nothing more than traditional detective skills transposed into the digital space.

Delving around behind the curtains is not sustainable because crooks quickly learn not to leave evidence there.

Every police force needs a substantial new division of cyber detectives, people tasked to understand not just the technology but motive, culture, who's who in online communities, what are the current tools of the criminal trade.

People on the internet are just people. They slip up, they make mistakes. Anonymous are not anonymous but pseudonymous, and this is important.

Yes, a large proportion of anons are not criminal. But the few that are rely on pseudonyms in order to build a reputation. A reputation which acts as a currency for acceptance with other criminals.

But loose collectives of cyber criminals rely on open spaces to congregate and find each other. Their pseudonyms are both necessary and a weakness. Pseudonyms allow good cyber detectives to build a profile without resorting to intrusive mass surveillance.

The online space is just a community of people like any other

Any good neighbourhood cop, such as Surrey's top neighbourhood cop Chief Superintendent Gavin Stephens will tell you that policing a community is a delicate balance. An absence of authority can in some cases make people feel more secure, and in other cases less. A police presence can reassure or unnerve, and police forces have learned over centuries to strike the right balance.

The internet is just a community space and people on the internet are just people.

Yes I expect police and government to have access to powerful tools as and when needed. But we have learned from real-world policing that guns - things in the UK the average guy on the street doesn't have access to - aren't for the most part required for maintaining general order.

Having a largely unarmed police force prevents an arms race with criminals. Having an approachable neighbourhood police presence helps the police harness community good-will.

We the online community might be happy to help police the online space if we could trust that the authorities were acting in our best interests, not falling over themselves to censor, contain and control the online space.

Achive: more from me on communities, policing, security and open versus closed.

@JamesFirth

Government internet snoop plans in a small a nutshell as I can manage

2012-04-02T10:24:00.001+01:00

Communications Capabilities Development: Mass Internet Interception and Surveillance Programme

Yesterday's announcement on the Government's new internet snoop plan (a re-hash of something Labour twice tried to introduce under the title 'Interception Modernisation Programme') comes as no surprise to me, since I broke the story last year on 10th December.

To explain what the government is trying to do you need to know 3 things:

Information about electronic communications are by UK law separated into 2 categories. Traffic data and content. Traffic data is defined in the Regulation of Investigatory Powers act as information such as who you're communicating with, for how long, etc, plus location data. The content of communications is what you're writing or saying.
Government, police and even local authorities (although a magistrate will soon have to approve for local authorities) can access 'traffic data' records from your telephone or internet service provider without a warrant. Requests are signed-off by a mid-ranking officer in the force or department making the request.
Access to content is harder and requires an interception warrant ultimately approved by the Secretary of State, police Chief Constable or a few other designated senior authorisation officers. All authorisations are overseen by the Interception of Communications Commissioner

In a nutshell, the Communications Capabilities Development Programme as described to me will have the effect of downgrading content into traffic data, thereby allowing the government, police, security services and local authorities to milk far more private information from our internet activities without need for a burdensome interception warrant.

'They' want to know who we're talking to, when and how often, to keep us all safe.

The problem for the UK government is that we're all talking to people using a wide range of platforms which include e.g. overseas email services, non-UK gaming platforms, social media, whatever. Unless these companies cooperate, the UK government can't get what it sees as traffic data from them.

Traffic data is a legacy concept not for the internet age

Confusion comes about because traffic data is a legacy concept not fit for the internet. When telephone networks were computerised in the 70s and 80s suddenly a lot more data was available to law enforcement.

This data was captured for genuine purposes (billing) and it seemed reasonable that the police could access these records. Whether or not they should be obliged to seek a warrant from a court to access this data was a hot debate when the Regulation of Investigatory Powers Act was drafted in the 90's and very early 00's.

The internet messed up the neat distinction between traffic data and content. To my ISP the traffic data is simply my computer talking to Yahoo! servers. To Yahoo! the traffic data is whom I'm sending my email to. Similarly for direct messages on Twitter, Facebook or any other messaging service.

Moreover my ISP has no genuine reason to store this information since it is not billing me per visit.

Because law enforcement had relatively easy access to such data from telephone networks for a relatively short time - around 25 years from the mid 1980's to now, when many people rarely use phones to make a voice call - it wants this capability back.

Turning content into traffic data

The proposal is essentially to install a new network of 'little black boxes' (on top of the existing network used for what is known as 'directed surveillance'). These boxes will scan all internet activity to look for what government lawyers believe can be disclosed as traffic data.

These boxes will use an algorithm to perform the intrusive surveillance, but only output what the government claims is the less-intrusive part.

But as our use of communications technology has evolved, even traffic data is now incredibly intrusive. We interact many hundreds of times more each day, but say less; and the traffic data says so much more about our personal likes and dislikes: the websites we visit, where we shop, which films we view. It's time to rethink the legal distinction, not invent technology to get around the existing legal safeguards.

I'm also hearing very worrying noises from Conservative party sources. Once installed, these boxes could be re-purposed - given an appropriate act of parliament - to implement secret blocking orders against overseas websites.

My source claims these blocking provisions could be enacted late on in the development of the Communications Bill around 2014. Such moves will be seen as more palatable if the cost of installing the technology was already borne by earlier legislation.

As for the surveillance aspect there's already a spanner in the works as, since this plan was formulated 5 years ago many websites such as Facebook, Twitter and Gmail allow access via secure HTTPS communications.

The government ~~used to have~~ in theory had the capability to monitor HTTPS (clarify: by exploiting procedural weaknesses in the SSL certification chain), although not without potentially alerting a tech-savvy operator. Moves by Google and Mozilla to rethink who we trust to issue SSL certificates will thwart this particular man-in-the-middle attack vector but that doesn't mean there aren't others.

My biggest worries are that this approach to scan and interpret the content of our communications will be open to abuse, will yield results for only minor offences and mid-level criminals, will place an emphasis on capabilities-based policing when what the internet sorely needs is a community or consensual-based approach to policing (as any good neighbourhood cop knows), will lead to a costly arms race as new services launch that attempt to evade monitoring, and will create a security back-door for our entire communications network that ultimately will reduce not improve our cyber security.

Part 2: we must not allow the government to back-door our entire communications infrastructure.

@JamesFirth

80-year-old peer dusts off typewriter to pen 'think of the children' UK anti-porn net censorship law

2012-03-30T12:56:00.002+01:00

Opt-in to porn (or you might not be able to buy a bra)

Unelected 80-year-old Baroness Howe of Idlicot has seemingly had enough of Government inaction protecting the children and dusted-off her typewriter to draft a Private Member's Bill which will force all ISPs to provide porn-free internet unless subscribers opt-in to porn (and prove they're over 18).

The Online Safety Bill was introduced into the Lords with its first reading last Wednesday (HT @netazen) but sources inside and outside parliament tell me they think it's highly unlikely to become law.

Why? Because I'm told measures to tackle access to adult content are due to be unveiled in the Government's forthcoming Communications Bill. That itself is a bit of a wow, as I was previously lead to believe that the Government had pressurised ISPs into implementing a series of voluntary agreements under the threat that legislation would follow if ISPs didn't start to act responsibility.

I'm told the UK's smut filter won't be "opt-in" but "Active Choice", which essentially means instead of one tick-box for new ISP subscribers asking "do you want porn?" it will have 2 tick-boxes saying "do you want porn, yes [ ] or no [ ]"

No-one knows for sure what will be in Communications Bill. The Government's green paper has been delayed - for how long is up for debate - and even then it won't stop Ministers adding in a few extra measures between the Green and White Paper stages.

But it's clear there's a move not just from an 80-year-old veteran of the 1989 Telecommunications Act (whom I'm told has been overheard telling fellow peers that internet regulation is possible as it's really nothing more than a fancy telephone) but from a range of mainly pro-Christian lawmakers in Parliament to 'sort out the internet'

Well, and this won't make comfortable reading for the Christians... (And they can't even dismiss me as a fundamental atheist as I am a Christian myself)... If you turned off the internet tomorrow you would not stop children sharing and trading in digital pornography.

Memory cards, thumb drives and Bluetooth data transfers - however they do it the data files Baroness Howe wants filtering from the internet are already in massive circulation in playgrounds across the UK - and have been since the late 1980's, pre-dating the world wide web.

Just like the copyright owners, the elderly Baroness is standing like Cnut against an unstoppable tide. Her involvement will do nothing to improve online safety, especially if it gives parents false comfort, but it will impact legitimate businesses caught in the crossfire.

There is no magic net-nanny. All technical measures available today can be easily circumvented by enterprising children chasing a bit of flesh.

Parents need to take responsibility for their children online and offline, and educate them to the moral hazards as they see fit. Parents of younger children should ensure net access is supervised at all times.

There is no magic definition of what is or is not unsuitable for children. Content OK for older children won't be suitable for younger children. It's a sliding scale and again parental judgement is key.

@JamesFirth

Has UK gov notified EU of regulatory changes to electrical safety ("Part P") before consultation has closed?

2012-03-27T07:46:00.000+01:00

What does it take to be a policy geek? Well for one you stay glued to the various EU/EC mailing lists.

And this morning I was catching up with some non-telecom notifications and I spotted this in the EC Enterprise and Industry notification database: Changes to Part P (Electrical safety - Dwellings) of the Building Regulations. The draft text is visible from this link.

Why is this relevant? Well the text was submitted to the EC on the 13th February 2012, but the government consultation on these changes doesn't even close until next month!

Has the government presumed the outcome of both a public consultation and Parliamentary Select Committee inquiry?

In total, the UK government submitted draft changes to six sections of the building regulations (parts A, B, C, L, P, K) on 13th February before a parliamentary select committee inquiry into changes in building regulations even took its first evidence on 20th February.

As discussed on this blog in relation to 2 remaining pieces of legislation required for the file sharing clamp-down under the Digital Economy Act, the UK government must notify Brussels under the 'Authorisation Directive' (98/34/EC) of upcoming changes to 'technical standards'.

The purpose of notification is to give visibility to suppliers throughout Europe of upcoming changes to UK regulation so that they may plan for the change or object on the grounds that the change will affect free trade across Europe.

As revealed on this blog, even strongly pro-Europe MPs are concerned that in theory the notification requirement can lead to a deadlock between the UK government and Europe, with the EU vetoing a bill after Parliament has passed it.

So it makes sense for draft legislation to be notified before final vote in Parliament. But that assumes Parliament won't try and amend regulations, for if they do, then the amendments will need to be re-notified to Europe. Each re-notification causes a 3-month standstill period which could delay urgent legislation.

But in practice this rarely (if ever) happens and it seems absolutely absurd to notify the European Commission of changes before a Parliamentary Inquiry and public consultation has even closed, never mind reported on recommendations.

It certainly looks to an outsider not involved in this sector that the Government has made up its mind ahead of the public consultation, and in a highly public way, which could leave the relevant ministerial decisions further down the line open to judicial challenge.

@JamesFirth

Our standardised privacy policy project is not an exercise in iconography

2012-03-26T13:25:00.004+01:00

More than icons

TM. A visualisation of Privacy Footprint, part of the proposed standardised personal data scheme.

I've spoken to a quite a few people about our plan for a suite of standardised privacy policies. Whilst about 70% of people are enthusiastic of our plan (non-scientific study!), inevitably many tend to focus solely on the icons, and at that point tell me either (a) it's been tried before (yes, I know) or (b) it won't change user behaviour.

Here's a quick response: our proposal is not primarily about icons.

And here's a fuller response...

My perspective on the Mozilla Privacy Icons project: it attempted to graphically represent all the ways that data could be used or shared, and capture this in an icon.

In some respects the Mozilla privacy icon project is a graphical progression of P3P, the compact privacy policy project. Both approaches are looking at privacy perhaps as a software engineer would.

Where we - as in Julian Ranger and myself at Open Digital - are coming from is somewhat different.

We're not trying to encode a complex amount of information into an icon.

Instead we're creating a series of say 6-7 standardised privacy policies which become gradually more private so that users may easily compare like-for-like services to find which take data protection more seriously than others.

As an engineer myself there is a temptation to see this as a technical problem. But it's not - it's a social problem and an economic problem, caused by the massive increase in capability brought by technology and the commercial value in personal data today.

We can either try and fix the socioeconomics or attempt to control the technology to regulate the resultant data. Neither is an easy challenge, but I prefer the former over the latter.

Our scheme, instead of trying to offer a diverse range of visualisations to accommodate a diverse number of data-sharing practices, defines a handful of policies based on best-practice.

We hope these policies will help users understand what is being done with their data. They don't have to read every privacy policy, they just have to familiarise themselves with half a dozen standardised policies.

Our aim is to provide a driver for minimising the use of personal data, improving the storage of personal data and promoting the ethical use of personal data.

Our 'most private' licenses will require data to be stored securely within a system which is designed to be private. Their use may mandate the conformance to other emerging standards such as private by design.

Above this there will be a range of less-private options, showing data may be shared with selected businesses.

And then the most open license. I use license and privacy policy interchangeably as I see you being the licensor for your data. You decide what can and can't be done with the data, and any contract you sign up to must be clear as to what rights you grant others to use your data.

Icons are used in place of e.g. a simple numerical scale of 1-7 to aid visual recognition - a mixture of endorsement (certification marque) and visual guide.

Sure there will be businesses who don't want to be boxed in to our scheme. They will want to differentiate themselves.

But I sincerely believe there will be a push from users who want clarity. They want to understand what they're signing up to.

There are two unanswered questions. (1) can a suite of standardised licenses and associated iconography impact user behaviour and (2) will sufficient businesses adopt the scheme.

To answer these questions we first propose two studies. A socio-economic study to answer (1) and a business attitudes study for (2). We will use the results to decide whether and how to proceed.

As a society we're faced with 2 choices: regulate how data is used and take the consequences of either an over-bearing enforcement regime or widely circumvented laws; or, leave it to the markets and risk having corporate interests trump user interests in at least the short and mid term.

I don't think regulation will work, so I'm looking at ways to encourage the market to work more in the interests of users.

@JamesFirth

Call for sponsors and shareholders: Open Digital and SRoC to end in current forms in 7 weeks without funding

2012-03-26T10:51:00.001+01:00

I've spent the last 3 years working pretty much full time trying to bring just a small element of rationality to the internet policy debate in the UK.

I co-founded Open Digital just under 11 months ago as a platform to develop better digital policy.

But I have spent the last 3 years working full time, focussing on policy at the expense of funding.

I suddenly find myself with an organisation that's embedded itself at the heart of digital policy debate in the UK - from cyber security to blocking and censorship, copyright and protection of the vulnerable - and no funding whatsoever for year two.

I'm sure there are a few lobbyists, many civil servants and even a government minister or two quietly rejoicing at the fact that both Open Digital and this blog will end in their current form in just 7 weeks if we can't secure significant funding. (Oh, and I'll need a job then, too...)

But I have responsibilities to my family as well fighting for what I believe in. I've been treading water for the best part of 3 years and I now need to either turn what I do into a paid career or resume my software career.

We now need to proceed with a fully-funded project, find alternative funding, or park our work. We're focussing on our drive to create a suite of standardised privacy policies that gives clarity in how your personal data will be used. Read more on the Open Digital Policy Blog.

@JamesFirth

Fed up with Twitter of other social network? Try a stream switch

2012-03-23T18:43:00.001Z

Twitter, it can get dull. Same old people, same old issues. Yes, I'm sure many think that about me too.

But this isn't a post about getting back at the dullards, in fact it's the opposite. You shouldn't be questioning why people post what they do - you should be questioning why you're bothering to listen.

It's a reminder that on Twitter and other social networks, audience is a privilege, not a right.

There's some weird psychology at play. Gaming the numbers, Peerindex, Klout score, follower count etc.

You don't want to unfollow for risk of offending. Or because you know they'll unfollow and kill your ambitions to reach X-thousand followers.

So you'd seriously put up with the shit just to look more popular? Or, as I'm hearing more and more, ditch using the network entirely because its lost its zing!

I'm evangelical about the way information seeps through the social web and personal publishing. It's radically different to anything we've seen before - it's symmetrical; a 2-way process. And it's massively distributed - control of the "channels" is in the hands of the many, not the few.

In some respects it restores the way we communicate to before the advent of affordable mass printing. We had to rely on word-of-mouth, 1-to-1 or 1-to-few communications. Word came down from the emperor to the senate, and from senators to their civic leaders, and from these leaders out to the villages.

And word went back. Not only that, but civic leaders addressing congregations got to immediately judge the mood of their people.

Since the Gutenberg press and up until the web hit mainstream, all developments in broadcasting have been one-to-many. Plus there was a massive asymmetry in feedback. Upset about a TV programme - you had to write to the broadcaster.

So the likes of Twitter are both inherently democratic and put you the "listener" in control, with an almost infinite choice of what to listen to.

Twitter especially offers options for those stuck with too much baggage on their stream. Start afresh. Leave your old account active but create a new one. Search for discussions which interest you and start following.

So you're parking an account with a healthy following for one with zero. The humiliation! Just get over the stats game and make a stream of conversations you find interesting.

Alternatively, bite the bullet and ditch the baggage. Make a fresh omelette!

@JamesFirth

Censorship and terrorism, relevant modern history

2012-03-23T10:37:00.003Z

Yesterday morning I heard Vint Cerf, chief internet evangelist at Google and one of the recognised fathers of the internet, talk about the importance of open communications, trust and free speech.

He said there was a big question over how social norms such as acceptable speech would develop. Clearly people need to be discouraged from harassing others, but we must keep perspective as to the actual harm rather than the perceived harm.

He said one of his biggest fears for the internet was that we as a society would over-react and shut down the good stuff in the pursuit to cut out the bad.

He cited the battle against online piracy as an example, "piracy is not good, but breaking DNSSEC is worse."

Of course there's more to internet policy than piracy (as I keep saying). Vint explained how, generally, people who want to control the internet use examples of the very worst human behaviour to justify the need for controls.

Around four hours after Vint's speech I was passed an iPad from the delegate sat next to me. There was a breaking news summary of Sarkozy's speech in the wake of the tragedy of the French shootings. He plans to jail visitors to websites glorifying terrorism.

A clear example of what Vint Cerf had described hours earlier. Holding up the very worst examples of human behaviour to justify controls over information.

It's not just France. In the UK there's still pressure from within government and parliament to criminalise the "glorification of terrorism", with a view to shut down or block any website which does.

On this I'm reminded of past attempts to use censorship to fight terrorism. In 1988 the Thatcher government gagged 11 spokespeople from Northern Irish organisations engaged in terrorism.

Anyone alive at the time will no-doubt recall the nightly news bulletins with the words "due to reporting restrictions we are unable to bring you the words of Gerry Adams."

The situation quickly descended into farce, as actors or news readers repeated verbatim what one of the gagged spokespeople had said over the top of muted footage of that person at a rally or talking to camera.

The then Home Secretary Douglas Hurd now says he accepts that the ban soon became enormously counter-productive [ref].

Words don't kill people. It's as simple as that.

Yes, words may incite violence, but they also abate violence. The political situation in Northern Ireland wasn't improved through censorship, robust policing and imprisonment of terrorists (sometimes detained without charge). It was improved through dialogue.

As autonomous individuals in a free society we are relatively robust against being told what to do. Yes, websites can be used to whip-up hate, but they can also be used to engage with those disgruntled for whatever reason and show how collectively society stands against violence.

We need to learn how to encourage individuals at risk of becoming disgruntled to the degree they want to commit acts of violence out of the echochambers I'm told they inhabit and see the wider debate, not push these echochambers deep underground where participants would be even less likely to surface for air.

Criminalising information no matter how offensive can impact those who work on the fringes, the people sympathetic to a viewpoint but never to the point of violence. Censorship also breeds fear and mistrust. We want to know what we're not allowed to know, it's just human nature.

We need to keep the dialogue open with all sections of society, and closing down information is no way to achieve this.

@JamesFirth

Ed Vaizey denies Comms Bill green paper delayed till post-Olympics, but sources claim DCMS/No 10 spat over copyright

2012-03-22T16:48:00.001Z

I have three sources telling three different parts of a tale that seems to indicate the coalition is finally putting its foot down to prevent any further copyright over-reach affecting technology and innovation in the UK.

But I'm hearing a battle in Whitehall is still raging, with the Department for Culture, Media and Sport (DCMS) desperately trying to salvage SOPA-style provisions in official government policy to be announced... at some point this year.

The government is expected to publish its long-awaited Communications Bill green paper this spring. And the Government "means early in 2012" as Ed Vaizey told the Parliament and Internet Conference last October.

"There's a joke in Westminster that spring runs from February to November, but when I say spring I mean spring," said Communications Minister Vaizey in October.

Ed repeated this joke today at the annual Nominate Policy Forum, insisting that the green paper would be published 'soon'.

I asked specifically if that would be before or after the Olympics. "That's a great way of putting it, definitely before," said the Minister. (Before joking that he hadn't clarified which Olympiad he was referring to!)

Ed Vaizey didn't look easy in his speech today, trying to sell his policy as "regulation light" yet taking necessary steps to protect creative content online. It sounds like he wants SOPA without the controversy.

The minister's unease perhaps reflects the mood in the Government's policy team, who I'm told sent back a draft of the Comms Bill green paper to Vaizey's team with serious questions on whether the draft bill meets the Goverment's policy objectives in key areas such as minimising regulation, encouraging high-tech growth and creating a secure infrastructure.

Enter source number two, who doesn't work for the Government but claims to have seen a draft, riddled with concessions to copyright owners after a series of mainly secret round-table meetings chaired by Ed Vaizey himself, claimed my source.

It's seriously scary stuff. I'm told ISPs would become responsible for deciding what is and what isn't copyright infringement on their networks and blocking infringing content without intervention from a court.

Notice and takedown would be expanded so that a whole website or domain could be taken down on a mere allegation from rights holders that the domain was used "substantially" for copyright infringement.

And search engines would be asked to police results, maintaining both a blacklist of whole domains which would never appear in search results and a whitelist of preferred purveyors of e-entertainment who would always appear at the top of the search results.

It's only a green paper, but surely its not great for governments to ride roughshod over EC Directives protecting ISPs (mere conduit provisions in 2000/31/EC) and basic competition law re whitelisting.

Enter source number 3 who tells me DCMS have been sent back to the drawing board but have no resources now until after the Olympics. All hands on deck, as the torch relay starts soon.

Not only do DCMS have primary responsibillity for the Olympics, but reading between the lines the whole government is entering lock-down.

They don't want SOPA-style protests between now and August and a fourth source in Parliament has just told me the legislation they expected in February was heavily inspired by US bills SOPA and PIPA.

In any case, we're now within the 6-week purdah period where policy announcements even from central government are strictly limited in advance of the local elections (3rd May) to prevent accusations of sweeteners to sway voters.

If we take Ed Vaizey at his word, the green paper will be out sometime after 3rd May, but the Olympic torch relay starts 2 weeks after this, and I expect DCMS officials may have their hands full.

The cynic in me says the controversial sections will re-appear after the fuss of the Olympics passes, but I'm hopeful that David Cameron's team has got the message that copyright and content protection is only a small part of the wider digital economy.

@JamesFirth

Security versus freedom, open versus closed

2012-03-21T10:09:00.003Z

I was shocked and delighted to attend a cyber security summit where delegates didn't focus solely on control mechanisms to provide a secure online environment.

I've never been an out-and-out "hands off the net" activist, my background in communications security working at Motorola and, before that, a private military research company helps me see how formal control structures are helpful in thwarting some threats.

But I'm worried when expensive and intrusive mass surveillance and control systems are heralded as the mainstay in protecting society from any number of threats.

I'm worried because the value of such systems is yet to be proved - especially since technology is evolving so quickly. Keeping internet control and surveillance systems up to date will likely descend into a costly arms race.

I'm worried that a focus on such systems could come at the expense of developing community approaches to policing and enforcement - traditional methods translated into the digital space.

Cyber detectives hunting cyber criminals, and doing this using the internet in the "normal way" rather than trying to hook in to the fabric of the internet to create a capability that the good guys have and the bad guys don't have.

Capability-based policing will always rely on a power imbalance and is a long way from how traditional policing methods have evolved in democratic countries: consensual policing.

And I'm worried that a "closed" approach to security will not yield stronger systems in the same way that private encryption algorithms often prove weaker in the long term than public ones.

Whilst this defies common sense - if your attacker knows how you're encrypting he or she can reverse engineer - cryptographers know the opposite to be true: if your algorithm is "out there", the world + dog is trying to break it. World + dog tend to be quite noisy when they do break something, so you're sure to know about it.

The cryptographic algorithms that survive are either secure, or take the computing resources of a nation state to crack. The sheer effort needed to crack encryption makes the nation state threat irrelevant to all but the most high profile of targets.

Yes it's worrying from a privacy perspective, but there's also a finite limit to the number of communications that can be cracked, meaning encryption can offer a safeguard against the mass generalised surveillance people fear.

Also, as cryptographic history has shown, where nation states do have access to a vulnerability no-one else does, they tend to use it wisely for fear of tipping the enemy to the vulnerability.

With privacy in particular, rather than being at odds with the aims of securocrats it can actually be an enabler for cyber security, as explained in my blog here.

"Economic harm"

Another trend picked up on by some civil rights lobbies is the tendency of governments to bundle economic interest of the nation with national security.

On one hand it's understandable that economic systems such as banking and stock markets are just another piece of our "critical national infrastructure" without which society would struggle to function and citizens would suffer.

On the other hand there is a temptation to misuse the "economic harm" argument and conflate the financial performance of a corporation or group of companies with general economic harm. Once the state starts propping up preferred economic interests at the expense of others there's a problem.

Anyhow, it turns out there's an "economic harm" argument in support of freedom as I blogged about in Trust bubbles: how security, trust and economic prosperity are interlinked.

Essentially societies which have a high degree of what researchers call 'generalized trust' - essentially trust in strangers - have a higher GDP. There is a link between trust engrained in society and economic prosperity.

In Trust bubbles I explore the drive to create technical solutions to allow strangers to trust each other online, such as customer review/feedback indicators, and offer the premise that society still needs a foundation of generalised trust to enable economic growth.

And generalised trust essentially comes about from strong foundations such as law & order, a sense of civic responsibility and internalised motivation for citizens to do the right thing.

I don't believe this can be replaced with a technical solution, and unless that solution is perfect it will actually damage our economic prospects rather than help as it will end up encouraging distrust in strangers outside the "trust bubble", essentially creating the online equivalent of a closed community.

The solution to improving online trust and hence economic output will lie in building strong foundations that encourage trust between strangers. That essentially is enforcing the rule of law and maybe building a few safety nets rather than controlling everything.

Starting off from a position of distrust as many security policies seem to do can only push things in the opposite direction, discouraging "bare trust" outside of the trust bubble and hurting innovation.

@JamesFirth

Combined UK digital economy dwarfs creative sector, time for governments to marginalise copyright lobbyists

2012-03-19T12:51:00.002Z

I've previously described the disproportionate amount of lobbying hence policy effort governments dedicate to copyright as a distributed denial of service (DDoS) attack on government.

Governments should be focussing on the wider digital economy but focus their efforts instead on one small area: copyright.

They do this because a huge amount of lobbying goes towards pushing the copyright agenda.

Focus on copyright comes at the expense of directing policy resources at other more important areas of digital policy, such as ensuring networks remain trusted and secure.

Today, researchers helped put this in perspective. The UK digital economy - as in the total value of trade which directly relied on the internet - was worth £121 billion in 2010.

The digital economy contributed 8.3% of the total UK GDP in 2010, and that is higher than any other nation.

By comparison £121 billion dwarfs both the entire UK film industry (not just the digital distribution), which contributes around £1.6bn per year to UK GDP (source) and global sales of digital music, which are worth $4.6bn annually (£3bn).

Impressively the UK is claiming a third of the share in music download sales (£1bn) so let's be generous and add the value of the GDP contribution of the entire UK film industry to this and estimate digital content to be worth around ~~£2.6bn~~ £6.3bn (see update) per year to the UK.

~~£2.6bn is just 2% of the total value of the UK digital economy.~~
£6.3bn is just 5% of the total value of the UK digital economy.

Surely it's now time for the government and parliament to spend 50 20 hours discussing other digital policy issues (e.g. provision of rural broadband, deployment of 4G mobile broadband, online consumer protection, trust, payment methods, cyber fraud, etc...) for each hour spent discussing copyright.

UPDATE 13:05: Thanks to comments I've missed videogames, which seem to contribute around £1bn to UK GDP (source, although 3 years old) and book and print publishing, which from older research contributes around 0.18% to GDP (2004).

Assuming proportions remain approximately the same that would amount to £2.7bn from current GDP from print, and that would be generous since not all of this GDP contribution comes from digital.

UPDATE 13:27: doh! Ok I mixed dollars and pounds when calculating percentage from print. Corrected again.

@JamesFirth