-
Notifications
You must be signed in to change notification settings - Fork 0
/
SfS7.html
191 lines (188 loc) · 51.5 KB
/
SfS7.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
<html>
<head>
<title>Stand: Defining Digital Freedoms In The UK</title>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1" />
<meta name="description" content="The Stand weblog." />
<meta name="keywords" content="Stand, weblog, blog" />
<link rel="stylesheet" href="./weblog/includes/style/global.css" type="text/css" />
<style type="text/css">
@import url(./weblog/includes/style/global_non_ns4.css);
</style>
</head>
<body link="#006611" alink="#006611" vlink="#996633">
<div id="top">
<div id="masthead">stand</div>
<div id="controls">
<span class="control"><a href="/">home</a></span>
<span class="control"><a href="weblog/about/">about</a></span>
<span class="control"><a href="mailto:stand@stand.org.uk" onclick="alert('Long gone, dude!'); return false;">email</a></span>
<br>
</div>
</div>
<div id="page-body">
<div id="main">
<h1 class="titletomski">Scrambling for Safety 7</h1>
<p>The <a href="http://www.fipr.org/sfs7.html" title="This link will open in a new window">Scrambling for Safety 7</a> conference was held at the <acronym title="London School of Economics"><a href="http://www.lse.ac.uk/">LSE</a></acronym> on Wednesday, October 22, 2003, to discuss the detail of and issues around the <a href="http://www.stand.org.uk/HomeOfficeDraftOrders.html">five new Statutory Instruments</a> released from the Home Office last month to do with the <a href="http://www.legislation.hmso.gov.uk/acts/acts2000/20000023.htm">Regulation of Investigatory Powers Act 2000</a> and the <a href="http://www.legislation.hmso.gov.uk/acts/acts2001/20010024.htm">Anti-Terrorism, Crime and Security Act 2001</a>, not least after <a href="http://www.fipr.org/press/SI20022322.html">last year's withdrawn "Snoopers Charter"</a>. The conference was organised by <a href="http://www.privacyinternational.org/">Privacy International</a> and <acronym title="Foundation for Information Policy Research"><a href="http://www.fipr.org/">FIPR</a></acronym> and was chaired by Dr Simon Moores, of <a href="http://www.zentelligence.com/">Zentelligence</a>, who wrote an <a href="http://www.zentelligence.blogspot.com/2003_10_01_zentelligence_archive.html#106691219392503513">interesting review of the event in his blog</a>. Though I think he should have gone with the Che Guevara tie… ;o)</p>
<p>As I disclaimed for <a href="http://www.flirble.org/~owen/SfS6.txt">SfS6</a>, I won't guarantee the accuracy of my notes, not least because my
handwriting and hearing are both rather suspect. Also, some of my notes are rather cursory, with little context to them. Sorry, they were written as aides-memoires, rather than as a certifiable transcript. All "quotes" are likely to be paraphrased, not verbatim. I've tried to look up people's names for the correct spelling, where audience members gave their name in panel discussions, but apologise for any mis-hearings or mis-spellings, as some are inevitable. I'm more than happy to correct any errors, do feel free to <a href="mailto:owen@stand.org.uk">mail me</a>. Hyperlinks from this page have not been set to open in a new window, so you may wish to do so manually.</p>
<p>Also, as one of the audience noted, these issues tend to involve a lot of acronyms; I have tried to explain all of these with <acronym> and <abbrev> tags, which should leave a dotted-underline on terms where I have added an explanation. Hovering over these terms should (hopefully, in most browsers) show you a tooltip with an expansion of the acronym and, usually, an explanation of what it actually means.</p>
<p><acronym title="Foundation for Information Policy Research"><a href="http://www.fipr.org/">FIPR</a></acronym><a href="http://www.fipr.org">'s website</a> contains <a href="http://www.fipr.org/sfs7.html" title="This link will open in a new window">the agenda, some notes and some photos</a> from the event itself. I made copious notes of the actual discussions, mainly for my own benefit and that of my Stand.org.uk colleagues who couldn't make it, but I figured that other people might find my notes useful, so I thought I would make them publicly available here on our site.</p>
<p>Comments and corrections should be addressed to me, Owen Blacker <<a href="mailto:owen@stand.org.uk" onclick="alert('Long gone, dude!'); return false;">owen@stand.org.uk</a>>. Queries should be addressed to the speakers themselves :oþ</p>
<h2>Table of Contents</h2>
<p>Table to go here…</p>
<h2>Panel One: Overview and analysis of the proposals</h2>
<p><em><strong>Panelists:</strong> Simon Watkin (<a href="http://www.homeoffice.gov.uk/" title="This link will open in a new window">Home Office</a> civil servant responsible for the <a href="http://www.homeoffice.gov.uk/docs2/access_comms_data.html" title="This link will open in a new window">Data Access consultation</a>); Bob Lack (Home Office civil servant responsible for the <a href="http://www.homeoffice.gov.uk/docs2/vol_retention_comms_data.html" title="This link will open in a new window">Data Retention consultation</a>); Richard Clayton (<a href="http://www.fipr.org/" title="This link will open in a new window">FIPR</a>, <a href="http://www.fipr.org/sfs7/clayton.pdf" title="This link is to an Adobe PDF file">slideshow PDF</a>)</em></p>
<p><strong>Simon Watkin (Home Office):</strong> The Home Office is seeking, with these <acronym title="Statutory Instrument; a piece of secondary legislation that implements primary legislation (Acts of Parliament">SI</acronym>s, to bring in regulation where currently there is none. The <a href="DraftRipCommsDataOrder2003.doc" title="This is a link to a Microsoft Word document">Data Access SI</a> is a very different Order than last year's order (see his arguments on this in his rebuttal to FIPR's critique of the Order). The SI only provides for currently-used powers — it does <strong>not</strong> provide for anticipated powers and it does <strong>not</strong> provide for any powers "just in case".</p>
<p>The SI does not (because it cannot) cover some of the other safeguards, which would require primary legislation, it does not provide for training or ensuring that recipients of comms data would hold the appropriate level of understanding. It was floated, in consultation responses, that there could/should be a concept of third party approval of requests for comms data by agencies unfamiliar with comms data (and the Home Office would seem to prefer that Sir Swinton Thomas, the Interception Commissioner, perform such approval than the courts do). This could not, however, be a statutory requirement, as that would require further primary legislation.</p>
<p>Simon mentioned that <acronym title="September 11, 2001; the terrorist attacks on the World Trade Center and other locations in the US">9/11</acronym> is part of the reason why data retention became a popular idea and acknowledged that there are grave reservations over any voluntary régime.</p>
<p><strong>Richard Clayton (FIPR):</strong> <em>[A <a href="http://www.fipr.org/sfs7/clayton.pdf" title="This link is to an Adobe PDF file">PDF of Richard's fantastic slideshow presentation</a> is available on the FIPR site. As I anticipated his presentation would be made available electronically, I made relatively sparse notes]</em></p>
<p>Issues regarding Data Retention:</p>
<ul>
<li>Would a voluntary retention régime be lawful?</li>
<li>How would we assess whether or not any voluntary régime has worked?</li>
<li>What percentage of <acronym title="Communications Service Provider; a term used in legislation to mean, broadly, telephone companies (telcos) and Internet Service Providers (ISPs), for example">CSP</acronym>s would have to take up any voluntary scheme for it to be a success?</li>
<li>What would be the cost of the scheme?</li>
<li>Will the government reimburse the costs of CSPs partaking in the scheme?</li>
</ul>
<p>Issues regarding Data Access:</p>
<ul>
<li>Whilst access maybe intended for Trading Standards, for example, there would be nothing to prevent data being requested for use by Planning or some other body, for whom access to comms data was not envisaged. <em>[So, Stand's assumption about Councils is correct, the new restrictions may well be worthless]</em></li>
<li>There is a lot of confusion over the different categories of data. There are three categories — A (traffic data), B (usage data), C (everything else, usually referred to as "subscriber data" or <acronym title="Reverse Directory Enquiries">RDQ</acronym>s), but there is a lot of confusion as to whether who-called-who information would falls into A or B, or, indeed, into either, depending on call direction! <em>[Richard summarised this well in a post to <a href="http://www.chiark.greenend.org.uk/mailman/listinfo/ukcrypto">UK Crypto</a>: <a href="http://www.chiark.greenend.org.uk/pipermail/ukcrypto/2003-September/028161.html" title="This link will open in a new window">Analysis of Councils' opinions on caller relationship data</a>]</em></li>
<li>The third category of data there is very widely defined. C is defined as anything that is neither A nor B; there is some concern, for example, that this could easily include the <acronym title="Personal Identification Number">PIN</acronym> to a voicemail account.</li>
<li>There is still no Code of Practice.</li>
</ul>
<h3>Discussion</h3>
<p><strong>Caspar Bowden (former director of FIPR):</strong> Mentioned the visibility of Sir Swinton Thomas, the Interception Commissioner <em>[See similar comments from <a href="http://www.flirble.org/%7Eowen/SfS6.html">SfS6</a>]</em> and how his rôle has changed so that he now has to interact more with the public. Is there a difficulty in separating the rôles of the Commissioner and the Tribunal? Sir Swinton is a High Court judge, he has little experience of the media.</p>
<p><strong>Simon Watkin:</strong> The Home Office knows this is an issue and Sir Swinton's profile is gradually being raised.</p>
<p><strong>Baroness Emily Blatch (Tory Leader in the Lords):</strong> The baroness is concerned about the ability of government to be able to handle sensitive data like this — compare with the fiascos with the Criminal Records Bureau and the Firearms Register), notably that the data is sometimes sent to third world countries for processing. How do we manage the information overload? The baroness is concerned that we do not yet have the competence to handle all these data the government is wanting to be able to gather.</p>
<p><strong>Simon Watkin:</strong> The Home Office believes that trust will be <em>improved</em>, not worsened, by this legislation. The point was frequently made that this legislation is not granting new powers, merely regulating existing ones — regulation should mean that the agencies using these powers should be trusted <em>more</em>, once their actions are more carefully monitored. Also, we want to move the onus of deciding whether the data requirements are proportionate, in each case, away from CSPs and on to the public authorities.</p>
<p><strong>Richard Clayton:</strong> Yes, but the ATCSA provisions are more worrying, because CSPs are talking about the costs of retaining data for which they no longer have a clearly-defined business need, for example. Also, some data currently stored are becoming unnecessary for the CSPs' businesses (because they no longer need to store call data, if they're using a flat-rate billing tariff, for example), so the net effect of the retention powers could be to cause much more expensive communications for us all. Also, <acronym title="Law enforcement agencies, eg the police and intelligence services">LEAs</acronym> require access to data <em>after</em> a crime has been committed, which would mean that data preservation is just as good a solution.</p>
<p><strong>Steen Larsen (Director of Security, <a href="http://www.messagelabs.com/">MessageLabs</a>):</strong> Steen is concerned about the costs of data retention, including the cost that could be brought about as a result of private litigants and fishing expeditions, for example. Once the data are retained under ATCSA provisions, they're there and can be acquired for all kinds of purposes (where "necessary and proportionate"), not just the anti-terrorism / anti-serious-crime provisions envisaged by ATCSA.</p>
<p><strong>Simon Watkin:</strong> We should expect the number of requests to go down. It is the Information Commissioner <em>[previously the Data Protection Commissioner]</em> who has said that the data should be made available for non-ATCSA purposes, once it's been retained under ATCSA provisions.</p>
<p><strong>Bob Lack:</strong> The reason it's a voluntary Code of Practice (as opposed to a mandatory one) is because Parliament decided it should be, originally.</p>
<p><strong>Peter Reid(?):</strong> How much does this legislation roll back the Human Rights Act 1998 (HRA). For example, the Gaming Board of Great Britain (GBGB) believe that they do not currently have data access powers, as a result of the conflict between their legacy powers and the privacy provisions under the HRA.</p>
<p><strong>Simon Watkin:</strong> We're not rolling back the HRA, but rather <em>enforcing</em> it; see, for example, the necessity and proportionality requirements in RIP. CSPs don't want to be taking decisions about releasing information under the Data Protection Acts (DPA) exemptions; that's not their job.</p>
<p><strong>Caspar Bowden:</strong> The Information Commissioner seems to have decided it is acceptable for data retained under ATCSA to be accessed for other purposes, under RIP. Ben Emerson QC, however, said something rather different in his Legal Opinion for the Information Commissioner.</p>
<p><strong>Bob Lack:</strong> "It might be lawful". RIP doesn't exclude such access and Parliament approved RIP. The Home Office believes such access would be lawful under RIP.</p>
<h2>Panel Two: Who should be given surveillance powers?</h2>
<p><em><strong>Panelists:</strong> Bryan Letwin (Assistant Chief Officer, <a href="http://www.northamptonshire.gov.uk/">Northants County Council</a> <a href="http://www.northamptonshire.gov.uk/Being%2BSafe/Trading%2BStandards/">Trading Standards</a>); Paul Boyle (<a href="http://www.dca.gov.uk/">Department of Constitutional Affairs</a>, Information Rights Division); Richard Kitchen (Chief Investigation Officer, <a href="http://www.dwp.gov.uk/">Department of Work and Pensions</a>); <acronym title="Detective Inspector">DI</acronym> John Donovan (<acronym title="Association of Chief Police Officers"><a href="http://www.acpo.police.uk/">ACPO</a></acronym> Data Communications Strategy Group)</em></p>
<p><strong>Bryan Letwin (Northants Trading Standards):</strong> As an Assistant Chief Officer, Bryan is an authorising officer, under the <a href="DraftRipCommsDataOrder2003.doc" title="This is a link to a Microsoft Word document">Data Access Order</a>. Bryan sought to give some examples of uses of the powers the SI seeks to grant. He gave the example of <a href="http://www.marksandspencer.com/">Marks & Spencer</a> — they're a reputable and responsible business; if you had some kind of problem with something you'd bought there, you could go back to the store, or write to their head office at Baker Street, or use their website. This is not the kind of company that Trading Standards departments generally have to deal with. 90% of councils' data access will be for Trading Standards and 99% of Trading Standards' access will be to get RDQ information, <em>viz</em> providing a phone number and getting a name and address from the <abbrev title="telephone company">telco</abbrev>.</p>
<p>Bryan mentioned the example of Andrew Bagshaw, mentioned in the <a href="http://www.homeoffice.gov.uk/docs/consult.pdf" title="This is a link to an Adobe PDF file.">Data Access consultation paper</a>. The only way Andrew Bagshaw was traced and brought to justice was through the use of RDQ information; he ripped off countless members of the public by claiming to be a <a href="http://www.corgi-gas-safety.com/"><acronym title="Confederation for the Registration of Gas Installers">CORGI</acronym></a>-registered gas fitter when he wasn't and by misleading his customers over pricing and the like.</p>
<p>With a reputable company, like Marks & Spencer, you would not expect threatening phone calls at 2am or someone to come round to your home and abuse you, if you had a complaint. Bryan Letwin mentioned the case of Kenneth Hornsby, who was a washing machine fitter and had 19 different telephone numbers (again caught and brought to justice via RDQs) and technology to divert calls elsewhere, if they were from a Trading Standards officer, by looking at the <acronym title="Caller Line Identification; the 1471 information that allows someone to see who is calling them before answering the call.">CLI</acronym> information.</p>
<p>So why should the police not handle these powers on behalf of smaller data users, such as council Trading Standards offices? Well, the police are busy. The vast majority of council investigations are for regulatory offences, but increasingly they involve serious crimes, like the cases above, and are commercial crimes. "99.999%" of the people about whom councils are seeking data access powers are tradesmen and businessmen, not individuals.</p>
<p><strong>Paul Boyle (Dept Constitutional Affairs):</strong> The <acronym title="Department for Constitutional Affairs, much of which was formerly the Lord Chancellor's Department">DCA</acronym> has no data access powers and has no interest in being granted them. The DCA's interest in this debate is as the government department responsible for the implementation of the <acronym title="Data Protection Acts (1984 and 1998)">DPA</acronym> and the <acronym title="Human Rights Act 1998">HRA</acronym>.</p>
<p>Only the organisations with a very clear need to exercise Data Access powers should be granted them. If they need these powers under RIP, powers to seek information are probably already given by other legacy legislation. Paul Boyle believes that the <acronym title="Gaming Board of Great Britain">GBGB</acronym> are just being (over?)-cautious with regard the HRA, after having received internal legal advice.</p>
<p>Organisations <em>must</em> act in a way that protects individuals' rights to privacy and confidentiality <em>[in all their actions, that's part of the point of the Human Rights Act]</em>. Any breach of an individual's right to privacy must have a clear basis in law and be proportionate. The <acronym title="European Convention on Human Rights"><a href="http://conventions.coe.int/Treaty/en/Treaties/Html/005.htm#A-8">ECHR</a></acronym><a href="http://conventions.coe.int/Treaty/en/Treaties/Html/005.htm#A-8">'s Article Eight</a> states that there must be <em>"no interference … except … in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."</em></p>
<p>As a result, there is a limited list of rationales against which the proportionality must be evaluated. Essentially, one must ask what end is it that the organisation is trying to achieve. The investigation of terrorist offences, for example, would suggest a greater level of interference would be acceptable than would be with, say, Trading Standards investigations. The DCA is very pleased that the regulatory structure seeks to encompass everyone's powers. The DCA is less pleased about the <acronym title="Department of Work and Pensions; the department of the UK government who handle the distribution of most State benefits">DWP</acronym>, for example, who would seem to seek to evade such regulation by using their own powers <em>[from the <a href="http://www.legislation.hmso.gov.uk/acts/acts2001/20010011.htm">Social Security Fraud Act 2001</a>]</em>.</p>
<p><strong>Richard Kitchen (Dept Work and Pensions):</strong> Over £100 bn are given out by the DWP every year in State benefits. 21m members of the public receive some form of State assistance. The DWP goes to great lengths to make sure their systems are accessible to the vulnerable.</p>
<p>By consequence, some people try to defraud the DWP. Around 85% of the roughly £2 bn lost to fraud and error are due to a failure to notify changes in the personal circumstances of a legitimate claimant. Only 15% of the cases include an initial motive to defraud.</p>
<p>There are several categories of deception:</p>
<ul>
<li>Deceptions of income;</li>
<li>Deceptions of capital;</li>
<li>Deceptions of health and/or ability;</li>
<li>Deceptions of family circumstances; and</li>
<li>Deceptions of identity, which are "increasingly common".</li>
</ul>
<p>The DWP has no power of arrest and no power to commit intrusive surveillance. There are 100 000 staff at the DWP, of which 5000 are in the investigation branch.</p>
<p>In 2000, powers were debated and granted by Parliament <em>[in the <a href="http://www.legislation.hmso.gov.uk/acts/acts2001/20010011.htm"><acronym title="Social Security Fraud Act">SSFA</acronym></a>]</em> to gain information from private bodies (including telcos). The structure was debated and approved <em>after</em> and <em>in light of</em> the HRA. There is a Code of Practice, which requires clear breaks between those officers who obtain the data and those officers who interpret the data. Around 175 officers are authorised to use the SSFA powers to get telecomms data. These are housed separately from the other DWP officers, in investigations offices, are specifically trained and the records of each of these officers is available for inspection by the Interception Commissioner.</p>
<p>The DWP didn't want inclusion in the RIP régime, because their powers are wider and the structure is solidly created. Since May 2002, there has only been one complaint where it was alleged that these powers have been misused, which Richard Kitchen says suggests they're doing quite well.</p>
<p><strong>DI John Donovan (<acronym title="Association of Chief Police Officers">ACPO</acronym>):</strong> The ACPO publishes a manual of standards, despite not yet having a statutory requirement to do so, as RIP Part I, Chapter 2, has yet to come into force. With industry, the ACPO created the <acronym title="Single Point of Contact; the scheme whereby only specific, trained law enforcement officers liaise with communications service providers, for Data Access purposes">SPoC </acronym>procedures and a two-week course of training for the officers involved. They already force the use of the RIP procedures, rather than the DPA procedures, because they're a better way of handling things <em>[incorporating the HRA safeguards, whereas the DPA predates the HRA]</em> and they ensure that, as would be the case under RIP Part I, Chapter 2, but is not the case under the DPA exemption régime, that CSPs are paid costs for the access granted to law enforcement bodies.</p>
<p>Their manual of standards <em>[as was mentioned by Richard Clayton in his presentation]</em> cannot yet be published, as the ACPO are waiting for the Code of Practice to be finalised.</p>
<h3>Discussion</h3>
<p><strong>Anonymous male:</strong> Mentioned that miscarriage of justice groups have had their phones and emails interfered with. The RIP Tribunal has never upheld a single complaint.</p>
<p><strong>DI Donovan:</strong> DI Donovan cannot comment on the RIP Tribunal, where issues such as this should be dealt with. The Tribunal, of course, cannot investigate issues such as these yet, as RIP Part I, Chapter 2, is still not in force.</p>
<p><strong>Paul Boyle:</strong> The Tribunal is the right place for issues such as these and, thus, the DCA cannot comment. But it the Tribunal were not to be functioning and serving its purpose correctly, then this would be something that the DCA could look into. Of course, this isn't yet something we could know, though.</p>
<p><strong>Adrian Norman (UK Internet Gateway):</strong> As a 40-year veteran of this debate, he has been very interested to hear from the Panelists Clearly, though, it would be possible to create CSPs that would not be susceptible to intercept. Why do people think that "the villains" wouldn't just find ways to get around the purview of these laws?</p>
<p><strong>Richard Kitchen:</strong> It would be wrong to seek powers just in case they might be useful in the future and, obviously, noone could seek to obtain information from a CSP who does not have it. He acknowledges that the law will always be "playing catch-up" with the bad guys.</p>
<p><strong>Simon Moores:</strong> Mentioned about identity fraud.</p>
<p><strong>Ian Miller:</strong> There has been only one complaint made to the DWP? But how would one know that one's privacy has been invaded? <em>[Amongst other things, Ian is alluding to that there is no post-facto notification required to surveillance targets.]</em> If you don't know your privacy has been invaded, you can't level a complaint about it!</p>
<p><strong>Richard Kitchen:</strong> Criminal law requires that details of the investigations are disclosed to all parties. Ian's point, though, is valid, where there is an out-of-court settlement, for example. The <acronym title="Department of Work and Pensions">DWP</acronym>'s Code of Practice contains a clear indication for people to write to the Dept to raise complaints, also the DWP are open to regulatory inspection. He recognises that there is some merit to the ACPO <em>[their methods? — notes are unclear here]</em>; one can complain on the suspicion of having been a target of surveillance and the DWP will check their files to see if that has been the case.</p>
<p><strong>John Dixon:</strong> Criminals are already devising systems to attack such countersystems — for example spammers are coordinating to attack anti-spam campaigns. The whole process inevitably lags behind criminals and, thus, it's all a waste of time.</p>
<p><strong>DI Donovan:</strong> Yes, that is the case. DI Donovan mentioned the <acronym title="National Hi-Tech Crime Unit">HTCU</acronym> and zombie spammers. "And the greatest threat, of course, is encryption" <em>[which generated some laughs]</em>.</p>
<p><strong>Malcolm Hutty (Regulation Officer, <acronym title="London INternet eXchange"><a href="http://www.linx.net/">LINX</a></acronym>):</strong> Might the key reason that the DWP do not wish to go through the RIP régime be that, under the <acronym title="Social Security Fraud Act 2001">SSFA</acronym>, there is no requirement to reimburse CSPs' costs? Organs of State seem to have an insatiable appetite for data (with good intentions, of course, because these data are required). Who considers the necessity and proportionality? Is this not a problem of self-serving bias? Paying costs to the CSPs would help with that some. With regard Data Retention, Malcolm would be very interested to know if the government is prepared to pay the full cost of retention; if not, there would seem to be a business case against co-operation.</p>
<p><strong>DI Donovan:</strong> They currently reject around a quarter of all requests, mainly because the paperwork isn't right. The ACPO is pleased and proud that they pay reasonable costs (on the RIP Part I side, they pay <em>all</em> costs).</p>
<p><strong>Richard Kitchen:</strong> The DWP doesn't require Data Retention, only access to existing data. Parliament discussed the issue and decided not to require the DWP to pay costs. Similarly, the Inland Revenue and Customs & Excise don't grant similar costs. In 2000, there were around 4500 instances of directed surveillance from the DWP. In 2002, after having taken on his current rôle, Richard had got this number down to 2500, due to having put better systems and structures into place. The DWP isn't looking after its self-interest, but rather the public interest. Richard argued rather strenuously that he doesn't think it's appropriate that public money should be being given to the private sector in compensation for costs incurred in complying with these Data Access provisions.</p>
<p><strong>Anonymous male:</strong> To Bryan Lewin, when will public authorities announce a "public act of decommissioning" and formally "put beyond use" all legacy powers?</p>
<p><strong>Bryan Lewin:</strong> Public authorities welcome RIP, they don't want to rely on DPA exemptions. Generally, they welcome the oversight and the greater transparency.</p>
<h2>After a coffee break</h2>
<p><strong>Simon Davies (Privacy International):</strong> Hopefully, there will be another meeting, around a week before the debates in the House of Lords (so about a month after this meeting). Simon spoke about the Legal Opinion that Privacy International commissioned from Covington and Burling, which proves that Data Retention is an illegal violation of the rights guaranteed by the ECHR. <em>[The Opinion doesn't yet seem to be on PI's website, but I will add a link once I have one.]</em> PI have invited the House of Commons Human Rights Committee to attend. The Opinion states that mandatory Data Retention "completely eliminates the principle of foreseeability" required by the ECHR.</p>
<h2>Panel Three: The industry perspective</h2>
<p><em><strong>Participants:</strong> Beatrice Rogers (<a href="http://www.intellectuk.org/">Intellect</a>); Philip Virgo (<a href="http://www.imis.org.uk/">IMIS</a>)</em></p>
<p><strong>Beatrice Rogers:</strong> Data Retention is the government forcing industry to hand over information for purposes other than those that were originally foreseen. What is the correct balance between national security and individuals' privacy? This is part of a worrying trend of government expecting industry to implement public policy. Intellect welcomes the ability to have input into the process, but is disappointed that the government continues to ignore industry's concerns.</p>
<p>There are legal concerns — there is a lack of certainty with regard to the <acronym title="Data Protection Acts (1984 and 1998)">DPA</acronym> and that breaches won't leave CSPs liable, let alone left with damaged reputations. The Home Office has made verbal assurances that this won't be the case, but there has been no firm commitment on indemnity. And is the Home Secretary able to indemnify the private sector anyways?</p>
<p>There are technical and implementation issues — these seem to have been sidelined. CSPs will be required to ensure that any data that could legally be accessed would be searchable and retrievable for <acronym title="Law enforcement agencies">LEAs</acronym>, all of which is complex and expensive. The Home Office is prepared to contribute to reasonable costs, but this does not include the costs of implementing business processes in order to comply. There is no direct return on investment and the <acronym title="Information Communications Technology">ICT</acronym> industry is not endowed with capital to spend on non–business-critical issues. This legislation will seriously inhibit the productivity increases called for from the government.</p>
<p>Business issues — Industry is not convinced by the lack of a business case. There is no evidence of having been any assessment or qualification of the interrogation of such systems. The Home Office has moved forward, but the definitions are still unclear. The regulations could imply that every packet containing IP addresses could require storage, which would be a massive amount of data.</p>
<p>The consequences are that the Data Retention requirements could threaten consumer confidence and the take-up of new services. Privacy is very important to CSPs' customers and the retention régime would raise grave privacy concerns amongst the customer base, which could threaten the growth of the whole e-market and e-government. In the US, post 9/11, the technical industry are finding investment increasingly difficult because of the requirements "due to national security concerns".</p>
<p>This cost burden has to be paid for somewhere and in the end, those costs will be passed onto the customer.</p>
<p>This would create a distortion in the UK market. If all CSPs have to comply, then there is a disproportionate burden on small companies. If, however, only larger CSPs have to comply, then they will suffer a disproportionate burden. Either way, there will be a direct impact on the competitiveness of UK companies in the global market. This could result in an off-shore black market, leaving UK CSPs at a competitive disadvantage and put criminals even further from investigation by UK LEAs, as "the bad guys" will just go off-shore.</p>
<p><strong>Simon Moores:</strong> Mentioned the Matrix Churchill affair and questioned the government's ability to indemnify (in this case) CSPs against the breach of their customers' privacy. He also asked if Beatrice had any idea of the total cost of implementing these requirements.</p>
<p><strong>Beatrice Rogers:</strong> There could be a short term gain in the data storage industry but, in the long term, the whole technology industry would suffer. Of course, in the end, it can only be either the consumer or the taxpayer who ends up footing the bill.</p>
<p><strong>Philip Virgo (IMIS):</strong> Philip wanted to try to give a user's voice, as the main membership of IMIS are IT managers. IMIS thoroughly supports the need for regulation, but is concerned at the regulations' inadequacies:</p>
<ul>
<li>What about the powers that are left out?</li>
<li>How could one easily check the authority of the requesting officer(s)?</li>
<li>What is the cost of Data Retention — have we really done a risk/benefit analysis?</li>
</ul>
<p>So what should an IS professional do, on receipt of a fax, requesting data, purporting to be from, say, the DWP?</p>
<p>A High Street bank routed all requests to a Head Office department and required four full-time members of staff just to handle them. Three quarters of all requests "disappeared" with a little interrogation — calling back the agency to get a reference number and some identification, for example. Were these fraudsters, or stalkers, or just staff who didn't know how best to make the request? We can't know.</p>
<p>Unless there's an easy way to check the authority of a request, individuals' privacy and safety may well be compromised. Philip mentioned a 25 year old story about a Columbian drug cartel, who gained information about all the people who had contacted the US Drug Enforcement Agency at the Embassy and had all the informants killed. Retained data can be dangerous, not just expensive.</p>
<p>Regulation is long overdue, but we don't know enough about how to make Data Retention work. There are some very grave doubts.</p>
<p><strong>Ian (<acronym title="British Computer Society"><a href="http://www.bcs.org.uk/">BCS</a></acronym>, talking for <acronym title="Small to Medium-sized Enterprises">SMEs</acronym>):</strong> Ian <em>[whose last name I didn't note]</em> has been working on a village network of around 20 people, which has no real source of funding. They are likely to be selling services to guesthouses, for example, so that visitors to the village may access email and the Web. So is RIP deliberately protecting the "big boys" against the interests of small businesses, where noone can afford to spend time learning about RIP and how to process requests and the like, as money is very tight?</p>
<p><strong>Beatrice Rogers:</strong> Indeed, there cannot be parity for all the players in the industry. The implementation needs looking at in a lot more detail; it's a very good question, to which she does not have the answer.</p>
<p><strong>Philip Virgo:</strong> Indeed, training will be required of CSPs, even if it's just so they know, for example, how to check the identity of a requesting officer from the DWP and what they should do, on receipt of a request.</p>
<p><strong>Simon Davies:</strong> Denmark instituted mandatory data retention recently. It has been suspended indefinitely, due to problems with technical and implementation details.</p>
<p><strong>Simon Moores:</strong> What about identity theft — innocent people could easily become the focus of an investigation, just because the had had their identity stolen.</p>
<p><strong>Philip Virgo:</strong> "Twelve percent of the credit cards" used in Operation Ore had been reported as stolen before the investigation started. That makes it incredibly difficult to trace anyone.</p>
<p><strong>Anonymous male:</strong> But can we trust human nature? There are always bad apples in any business (see, for example, the current scandal of <a href="http://news.bbc.co.uk/1/hi/magazine/3210614.stm">racism in the police forces</a>). Can industry categorically be sure that their own employees won't misuse any retained data?</p>
<p><strong>Philip Virgo:</strong> Banks and insurance companies already take the view that you must assume that you can't trust all your employees. A major advance with RIP is that the SPoC process is superb. Companies handling data such as this will always attract a few criminals who want to abuse the powers they get given in their job.</p>
<p><strong>Beatrice Rogers:</strong> One should always assume that faults will occur.</p>
<p><strong>Ross Anderson (Chair, FIPR, and <a href="http://www.cl.cam.ac.uk/~rja14/">Reader in Security Engineering, Cambridge University</a>):</strong> Ross is very supportive of Philip Virgo's views, partly because he has been involved in stopping Cambridge University creating a register of faculty members' other interests. This has been important because otherwise animal liberation types, for example, would abuse the outside interests of faculty members — telephoning board members of companies for whom they consult, for example, at 2am or hurling abuse at them outside their homes).</p>
<p><strong>Simon Watkin:</strong> Can the panelists accept that CSPs already retain the data that the Data Access order seeks to acquire? It seems to him that people have been trying to imply that no CSPs store any data, even for their own business purposes, at the moment, when the data they already hold could be useful to LEAs.</p>
<p><strong>Beatrice Rogers:</strong> Yes, of course CSPs already hold some data, but it seems worrying that the Home Office seems to want to hold CSPs' business practices at the status quo, whereas they may soon find they no longer need to hold certain data on their customers. <em>[See above for the example of telcos no longer needing to log call usage data, for example, if they move to fixed-rate billing.]</em> Also, blanket data retention will cause other problems that will be difficult to resolve.</p>
<h2>Panel Four: The wider picture</h2>
<p><em><strong>Participants:</strong> Richard Allan, MP (LibDem: <a href="http://www.sheffieldhallam.org.uk/">Sheffield Hallam</a> and joint Treasurer of the <a href="http://www.apig.org.uk/">All-Party Internet Group</a>); David Carnegie, The Earl of Northesk (Conservative peer, introduced the <a href="http://www.publications.parliament.uk/pa/ld200102/ldbills/079/2002079.htm">Computer Misuse (Amendment) Bill [HL] 2002</a>)</em></p>
<p><strong>Richard Allen:</strong> Spoke about how he approaches the issue, as a legislator. He believes he has a specific responsibility to his constituents and a general responsibility to the country — both to uphold our civil rights and privacy and to safeguard our right to safety. We have an important principle that policing in Britain is by consent. Noone would support an <em>absolute</em> right to privacy, but the public must consent to interference with that right.</p>
<p>There was, however, no consent for <a href="http://www.fipr.org/press/SI20022322.html">last summer's SI</a>. The Home Office correctly identified that such consent would depend on the government explaining how such interference would be done and why it would be necessary. Of course, it is difficult yet to tell how the test of proportionality will be seen in the courts.</p>
<p>Data Retention is more complex and will also require the consent of industry. If a mandatory scheme is imposed, this will require CSPs that exist at the time to store any data they already collect for business purposes. It won't prevent, however, new CSPs setting up and deciding to hold no such data on their users. Obviously, we don't want effectively to encourage telcos who set up specifically not to hold call data, for example. Of course, no sane business would want to avoid helping LEAs but, similarly, no sane business wishes to incur unnecessary costs.</p>
<p>ATCSA was the wrong place for these powers. A legally-workable scheme and Codes of Practice may, in any case, require amendments to the DPA and to acts such as the Communications Act. They would have been more appropriate places to put these powers. Richard Allan made an entertaining analogy about mandatory Data Retention, of squeezing jelly too hard and making an awful mess. He made another analogy with the use of <a href="http://www.anonymizer.com/">Anonymizer</a> in Iran, because there is no consent by much of the population to be governed. We don't want to create a comparable situation here.</p>
<p><strong>David Carnegie, Earl Northesk:</strong> The Earl believes that "that which is unregulated should be regulated". The SIs do need to be fit for the purpose, though, and he feels that these are not. He does not believe that they deliver on the requirement that authorisations should be made at the right level and that categories of data are well defined and so on. Also he feels that, despite the efforts of the Home Office to ensure that it was "technology neutral", RIP is now out of date.</p>
<p>There were key objections made in the House of Lords about Data Retention. It fails on the tests of effectiveness, necessity, proportionality and consonance. Basically, it won't work. Why, therefore, is the government so determined it's the right way forward. There are obvious alternatives, notably that of Data Preservation. The Earl fears that governments (plural) have adopted the mindset that Information Technologies were only invented to help governments in their aims. The Earl's belief is that IT belongs to the users.</p>
<p>RIP and ATCSA are bad legislation (albeit that they were improved by the House of Lords). This is because so few people in Parliament understand IT, so the government starts with an advantage and too many things slip through Parliamentary scrutiny.</p>
<h3>Discussion</h3>
<p><strong>Simon Moores:</strong> Could you explain the difference between Data Retention and Data Preservation?</p>
<p><strong>David Carnegie, Earl Northesk:</strong> Data Retention is the blanket holding of all data, just in case it might be needed. Data Preservation is targeted to specific individuals — <acronym title="law enforcement agencies">LEAs</acronym> only ask that information not be deleted where it pertains to individuals under investigation. <em>[Data Preservation, incidentally, is what we had immediately after 9/11, where all UK ISPs were asked by the government not to delete any traffic logs and the like, so that the police and intelligence services could garner any information about the conspirators' communications.]</em></p>
<p><strong>Romek Szcsesniak (Security Consultant, <a href="http://www.atlas.net.uk/">Atlas Internet</a>):</strong> Anyone can set up a telco; anyone can secure their data with technologies like <acronym title="Internet Protocol, version 6"><a href="http://www.ietf.org/rfc/rfc2460.txt">IPv6</a></acronym> and <acronym title="Internet Protocol Security Protocol"><a href="http://www.ietf.org/rfc/rfc2401.txt">IPSEC</a></acronym>. How is the government going to enforce anything when everything is encrypted?</p>
<p><strong>Richard Allen:</strong> Industry must <em>want</em> to comply. If an LEA goes to a company, most companies are going to comply.</p>
<p><strong>Anonymous male:</strong> Terrorists will just go somewhere else that won't comply, though.</p>
<p><strong>Ian (<acronym title="British Computer Society"><a href="http://www.bcs.org.uk/">BCS</a></acronym> guy from above):</strong> All this harkens back to the RAP Bill, under Queen Victoria — the Regulation of Automotive Power Act <em>[sorry, Google didn't give me any hits]</em>, which proposed that cars should mandatorily be slowed down, because policemen on bicycles can no longer keep up with them.</p>
<p><strong>Caspar Bowden:</strong> ATCSA provides that blanket retention is only a concept under discussion on the grounds of national security. David Blunkett has said this will have no effect — you can't separate the data, so you either retain it all or you don't. Most sophisticated criminals can already circumvent these provisions, so it's inherently disproportionate because it's ineffective against the most serious criminals. No analysis has been made as to whether targeted data preservation would better solve this problem.</p>
<p><strong>Richard Allen:</strong> It strikes Richard that this is the result of a classic Parliamentary compromise, so that both sides can claim victory. Effectively, data retained on the grounds of national security are available under RIP provisions — for much wider classes of crimes — so it's largely irrelevant. All the analysis performed by <acronym title="All-Party Internet Group"><a href="http://www.apig.org.uk/">APIG</a></acronym> was related to telephone data; similar analysis has not been done for Internet data. These two classes are quite different and should be treated separately.</p>
<p><strong>Mat Hanrahan (Technical Analyst, <a href="http://www.dalcais.com/">Dal Cais Research</a>):</strong> Question for any of the panellists and the chair, actually, on the practical implementation of RIPA. Do you think a unique national ID number would help implementation of RIPA? I'm asking in terms of whether its going to be carried by a smartcard or not and I'm thinking in particular in reference to the recent green paper on child protection, which is talking about a <a href="http://news.bbc.co.uk/1/hi/uk/3085044.stm">unique national ID for children</a>. Taking into account the ID issues that were raised earlier would it make the implementation RIPA easier in reference to proving who's using what record?</p>
<p><strong>Simon Moore:</strong> I'm going to give a swift answer to that. First of all we have to leap over the proposals for the smartcards [regarding] making them available and making them work, and I have great reservations whether we can in the first place.</p>
<p><strong>Mat Hanrahan:</strong> But the unique ID doesn't necessarily have to be enclosed in a smartcard, it can just be held on a database at the back-end.</p>
<p><strong>Simon Davies:</strong> I think that raises a number of privacy issues, that will be addressed—</p>
<p><strong>Mat Hanrahan:</strong> Is that an issue with the green paper and the Child Protection Act?</p>
<p><strong>Richard Allen:</strong> What's different in the context of the data we're looking at under RIPA, where people have multiple identities none of them verified by Government they are individual identities my relationship with BP, with Demon, etc. So independent reasons for that. I think smartcards are a loony ID they're a solution looking for a problem.</p>
<p><strong>Mat Hanrahan:</strong> But unique ID at the backend?</p>
<p><strong>Richard Allen:</strong> I don't think it will come into the RIPA stuff but there's all sorts of other stuff it may have relevance to investigations or otherwise that government may want to carry out, how useful a unique ID might be but my communication is held on my BT account number, etc and I can't see anyone proposing to link that into a unique ID.</p>
<p><em>(Mat Hanrahan has helped me correct this part of the transcript, not least my mis-hearing of his name. He suggests it may be interesting to compare this with Nicola Roche's comments in response to Q17 of the <a href="http://www.publications.parliament.uk/pa/cm200304/cmselect/cmhaff/uc130-i/uc13002.htm">Home Affairs Select Committee's questions to the Home Office</a>, where Ms Roche misses this point completely.)</em></p>
<p><strong>Anonymous female:</strong> Operation Ore — why is technology not being used to prosecute Operation Ore suspects? There are thousands of pædophiles known to have accessed the FBI child porn site…</p>
<p><strong>Anonymous male:</strong> Corrected some of the "facts" mentioned by the previous questioner about Operation Ore. Importantly, Operation Ore has the names and addresses of thousands of credit card numbers, not thousands of pædophiles. Many of these credit cards had been reported stolen before the Operation was even publicised.</p>
<p><strong>DI Donovan:</strong> There is an issue of Data Retention — how can we preserve that which we have not retained?</p>
<p><strong>Richard Allen:</strong> Of course one could find things as a result of Data Retention, but are we consenting to that retention?</p>
<p><strong>David Carnegie, Earl Northesk:</strong> Data <em>can</em> be very useful, but the fundamental issue is that systems <em>must</em> be trust-based.</p>
<p><strong>Anonymous male:</strong> A clarification on Data Retention and Data Preservation. A request for Preservation must come in before the data are deleted (as a part of the normal business practices of the CSP). The data are deleted, customarily, because they are <em>very</em> large. Keeping these data for an order of magnitude longer time than CSPs already do is a <em>big</em> storage issue. The current régime of Preservation (used in cases of hacking and Computer Misuse) works well already.</p>
<p><strong>Anonymous male:</strong> One could make an analogy to regular waste. Trash often includes evidence of crimes, but we don't mandate that people don't throw out their trash, just in case they're disposing of evidence. Sometimes, things are just the wrong solution.</p>
<h3>Summation</h3>
<p><strong>Simon Watkin:</strong> The SIs can only address Secondary Legislation issues. The Home Office recognises that there are insoluble issues which will be part of an ongoing process. Telephony/Internet issues are complex, because of <acronym title="Voice over IP">VoIP</acronym> and so on.</p>
<p>There is some acceptance that these data are valuable. There are cases that have shown that data have been required and that this has only been known some time after the event.</p>
<p>If the public wants to stop data being kept, then society must consent to that too. Simon mentioned how the "Real" IRA members involved in the White City BBC bombing were only caught from their mobile phone location data, which was only recognised some time after the event.</p>
<p>The Home Office recognises that some areas need further examination, especially that of sanctions for abuse of the RIP and ATCSA processes. "We're not there yet, but we're all moving in the right direction."</p>
<p><strong>Simon Moores:</strong> Simon finds that a good yardstick is to try to explain things to a London cabbie <em>[…]</em>. Is this approach a sledgehammer to crack a walnut? Any régime must, self-evidently, be both transparent and proportionate.</p>
<h3>Conference Ends</h3>
</div>
</div>
<script type="text/javascript" src="insert-div.js"></script>
</body>
</html>