UK's Investigatory Powers Bill: A "Breath-taking Attack" on Internet Security

In keeping with global trends, the UK released its own draft Investigatory Powers Bill last week. The legislation sets out to clarify and simplify previous law, but also to negatively impact privacy and security for all.

Key measures include:

• Internet connection records (ICRs) retained for one year, to be accessed in order to identify the sender of a communication or the communications services a person is using or to determine whether a person has been accessing or making available illegal material online. ICRs include main web addresses visited, but not the content or profiles viewed or the searches performed on each page.

• Targeted interception of phone calls and emails with Secretary of State-issued, Judicial Commissioner-approved warrants.

• Targeted equipment interference, allowing for data to be obtained from computers, tablets, smart phones, cables, wires and static storage devices, through a warrant process similar to the aforementioned.

• Bulk communications data obtained when required to protect national security, through the aforementioned warrant process.

Until 2016, the Bill remains a draft, leaving time for the very “scrutiny and debate” Home Secretary Theresa May requested in the Bill’s foreword.

One British human rights organization, Liberty, is promoting just that by encouraging concerned citizens to sign their names in support of an eight-point Safe and Sound plan, which seeks:

1. Prior judicial authorisation of all surveillance requests.
2. No blanket powers forcing communications companies to store more personal data.
3. Surveillance conducted for tightly defined reasons such as the investigation of serious crime and preventing loss of life, with requests and warrants targeting individuals on the basis of suspicion in criminal activity.
4. Improved redress and increased transparency for those who have been under unlawful surveillance or are no longer under suspicion.
5. Use of intercept evidence in court to bring perpetrators to justice.
6. Data-sharing arrangements between UK and other countries made public and set out in law.
7. Legislative protection against the breaking of our country’s encryption standards.
8. Recognition of the unique threat posed by hacking to British people’s security.

In the words of Liberty's Director, Shami Chakrabati, "After all the talk of climbdowns and safeguards, this long-awaited Bill constitutes a breath-taking attack on the Internet security of every man, woman and child in our country. We must now look to Parliament to step in where Ministers have failed and strike a better balance between privacy and surveillance."

The Investigatory Powers Bill is neither perfect nor complete; let Parliament know where you stand before this Bill becomes law.

---

Want to know more about cybersecurity legislation worldwide? Read on!

• CISA: Thankfully, Not Yet A Law
• Australia's New Law: A Honey Pot for Hackers
• Public Comment Welcomed on South Africa's Cybercrimes Bill

SumRando Cybersecurity is a South Africa-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

The Myth of Privacy vs. Security

A mere five weeks into the new year, the 2015 state actor has repeatedly demonstrated its willingness to sacrifice privacy in the name of security.

On January 12, British Prime Minister David Cameron insisted that government surveillance of online communications is necessary to keep its citizenry safe in an era of increased terrorist threats: “But the question remains are we going to allow a means of communication where it simply isn’t possible to [access a message’s content]? And my answer to that question is no we must not. The first duty of any government is to keep our country and our people safe. The attacks in Paris once again demonstrated the scale of the terrorist threat that we face and the need to have robust powers through our intelligence and security agencies and policing in order to keep our people safe.”

The following day, in a speech to the National Assembly, French Prime Minister M. Manuel Valls similarly declared, “The fight against terrorism requires vigilance at all times. We must be able to continuously monitor all convicted terrorists, know where they live and monitor their presence or absence.” A week later, Valls announced the creation of 2,500 counterterrorist jobs as well as a forthcoming bill to reevaluate the legal structures surrounding French surveillance and intelligence operations.

In both cases, responses have come from a variety of sectors, but the message has been singular: there is no greater threat to security than that of compromised privacy. Cybersecurity expert Graham Cluley knows that there is simply no way to give government access to communication without also leaving it vulnerable to hackers; he countered Cameron’s proposal by acknowledging that “regular consumers and businesses will be put at risk if secure messaging systems are backdoored.” From a national security perspective, former French Prime Minister Francois Fillon warned, "This must not lead to the renouncing of fundamental freedoms, otherwise we prove right those who come to fight on our soil.”

If their critics’ warnings are not enough to stop Cameron and Valls from following through on current proposals, perhaps the international community’s response to China’s new cybersecurity policies should be. In late 2014, under the stated aim of strengthening cybersecurity, the Chinese government developed regulations that called for foreign companies selling technology to Chinese banks to share source code and build accessible ‘backdoors’ into the technology.   

On January 28, rather than comply or abandon the Chinese market, 18 United States business lobbies submitted a formal letter urging China to postpone implementation of the regulations in order to allow for dialogue with all involved stakeholders. As the letter recognized, “Our concern is not with the goal of enhancing security, but the means to reach it.  An overly broad, opaque, discriminatory approach to cybersecurity policy that restricts global internet and ICT products and services would ultimately isolate Chinese ICT firms from the global marketplace and weaken cybersecurity, thereby harming China’s economic growth and development and restricting customer choice.” Much like Cameron and Valls, Chinese President Xi Jinping wrongly equated compromised privacy (and isolation) with increased security. 

The nature of cybersecurity requires that countries see themselves as members of a composite rather than as individual actors. As such, no one government can be entrusted with secure information. China tried to position itself as an omnipotent, unilateral actor and now finds the world saying no. Let David Cameron and Manuel Valls take note that in the current climate of cybersecurity, one country cannot guarantee its security by infringing upon the privacy of its citizenry and one man cannot succeed if the rest of the world has stopped listening.

In the UK, Renewed Interest in a "Snooper's Charter"

The Guardian reports that the UK government is considering measures requiring phone companies to retain detailed records about phone calls, text messages, and internet activity in response to new threats to national security.  This latest effort follows a failed attempt at similar legislation last year (dubbed the "snooper's charter" by opponents), when the Labour Party and Liberal Democrats banded with outside groups to defeat the efforts. UK Home Secretary Theresa May, a chief proponent of the law last year, insists that these measures are essential in the face of new threats by groups like al-Qaeda and ISIS.

The Guardian reports on the details of the proposed legislation, which is expected to pass:

"Any new 'snooper's charter' bill would require a vast extension of the communications data that the phone and internet companies are currently required to retain. It would mean the retention of all data tracking everyone's use of the internet and mobile phones, including every web page visited, and not just the bare details kept for billing purposes by the companies."

The UK government has launched an effort to generate support for the emergency measures, emphasizing the harm the government is seeking to prevent.  The UK Home Office shared their official stance on the matter with The Guardian, saying, "The retention of communications data is absolutely fundamental to ensure law enforcement have the powers they need to investigate crime, protect the public and ensure national security."

The government feels especially pressured to act given that, in April, the European court of justice (ECJ) ruled against surveillience programs put into effect in 2009, saying that it was "too sweeping."  The Guardian reports, "The government appears to have secured support from Labour and the Lib Dems to reinstate the surveillance laws after the ECJ struck them down. But the Lib Dems are insisting that the plan will not amount to the reintroduction of the so-called 'snooper's charter' – the communications data bill – that split the coalition and was ditched in 2013."

Essentially, the government is pushing for efforts less invasive than those implemented in the past and those proposed last year.  While the details that distinguish this plan from the others are important in evaluating the plans, there seems to be concerning support for programs premised on the idea that greater surveillance amounts to greater security.  Where exactly is that "line in the sand" previous "snooper's charter" opponents drew as it relates to this latest effort?  What about shorter timeframes of record-keeping really makes this acceptable?

Read more about the UK government's latest effort at The Guardian.

London Bans Creepy Stalker Trash Bins

A government not hesitating to take proactive and concrete steps to protect our privacy seems almost bizarre given recent news cycles, but indeed, the city of London stepped up and asked marketing company, Renew, to remove their mobile-tracking trash bins from London's sidewalks.

Renew deployed 12 bins featuring "ORB" technology that allowed them to collect the unique media access control (MAC) address of Wi-Fi enabled mobile devices as they passed within range. The idea, as outlined in a press release, was to use the data gleaned from tracking pedestrians to serve the most effective ads on the LCD screen on each bin.

The consolidated data...highlights the significance of the Renew ORB technology as a powerful tool for corporate clients and retailers. It provides an unparalleled insight into the past behavior of unique devices--entry/exit points, dwell times, places of work, places of interest, and affinity to other devices--and should provide a compelling reach data base for predictive analytics (likely places to eat, drink, personal habits etc.). [Renew]

You can think of this as a less malicious version of Moscow's new mobile tracking system (although, they use different technologies). 

With only 12 bins, Renew was able to log data from more than 4 million devices over a single week. It is unsettling, at best, that this data could be used to paint reasonably detailed portraits of pedestrian behaviour without any notification or ability to opt-in to this data collection program.

Certainly, tracking systems like this should be a concern for anyone using a Wi-Fi capable mobile device. And while Renew likely does not harbour any malicious intent, similar techniques have already been shown as feasible. In previous demonstrations, researchers showed that by simply using common network names like "Apple Store" or "Boingo Hotspot," mobile devices could be tricked into auto-connecting to unsecured Wi-Fi networks that serve your data to anyone watching.

Fortunately, defense against programs like ORB is available. A simple mobile VPN will ensure that any data sent over unsecured Wi-Fi networks is safe and disabling Wi-Fi on your device when you don't need it will prevent it from talking to these networks at all.

Fraud and Identity Theft is on the Rise. Lock that info up!

Photo Credit: Adam Thomas

Blightly's Fraud Prevention Service said two out of three fraud cases in the UK involved identity theft.

I know, I know, we're all aware that identity theft happens. But most people don't think about how it happens.

Of known attacks, hacking is used in about 11%. But, and this is a big but, 65% of identity theft victims don't know how their identity was stolen. Experts believe a large portion of that 65% is a result of hacking. (Here's an interesting Wired piece on it.)

Here's some data on fraud from CIFAS, a fraud prevention organization in the UK:

·         Nearly 250,000 confirmed frauds were identified during 2012 by CIFAS Members, the highest number of frauds ever recorded by CIFAS Members and over 150,000 cases had an identifiable victim.

·         The continued blight of Identity Fraud accounts for over 50% of all frauds recorded in 2012.

·         The takeover of customer accounts increased by 53% from 2011, meaning that data driven identity crimes now constitute the vast majority of all fraud in the UK.

·         Conversely, frauds committed by the genuine account holder or applicant have all declined: the most notable being the decrease in fraudulent misuse of an account (Misuse of Facility fraud) which fell in 2012 by over 15% from the record levels seen in 2011. There has also been a fall in proven false insurance claims and instances of individuals submitting false details or documents in support of an application.

So here’s the takeaway: Fraud and identity theft are on the rise and a lot of it is linked to your online activity.

This is just a friendly reminder to take your online security seriously. Get an antivirus program, be smart when you click on links, and use a VPN! If you haven’t heard us say it a thousand times, a VPN is one of the best ways to keep your online information safe! Remember, identity thieves won’t think twice to snoop on your Wi-Fi connection to snag your banking credentials, your credit card number, or even your home address. But if you lock that information up with 128-bit encryption and a VPN tunnel, even the most adept hackers won’t have a hope of stealing your data!