text:
tag:theconversation.com,2011:/au/topics/gchq-7562/articles GCHQ – The Conversation 2019-11-26T10:04:26Z tag:theconversation.com,2011:article/127758 2019-11-26T10:04:26Z 2019-11-26T10:04:26Z Watching the whistleblowers: two new spy films tailor-made for an age of paranoia

Whistle-blower: Keira Knightley as Katharine Gun.  Nick Wall/IFC Films

The revelations surrounding US president Donald Trump's telephone conversation with the president of Ukraine, Volodymyr Zelenskyy, are raising serious questions about attempts to solicit outside interference in US domestic affairs. The erupting impeachment scandal has placed whistleblowers firmly back on the international agenda.

In a scene from director Gavin Hood's 2019 film Official Secrets, journalist Martin Bright (Matt Smith) meets a source in an underground car park. "Very Deep Throat," he comments drily, referencing the famous source in the 1970s Watergate conspiracy that brought down then US president, Richard Nixon. His informant holds up her mobile phone: "No signal," she replies, indicating the real reason for her choice of location.

In a single moment, the film – which is set in 2003 – both acknowledges its generic heritage and positions itself in the technological context of early 21st-century spycraft. The pervasive fear of surveillance has been updated for the digital age.

Official Secrets is the first of two films released in the UK in autumn 2019 that reflect on the events that took place in the lead up to, and aftermath of, the 2003 Iraq War. It follows the decision of 27-year-old GCHQ translator Katharine Gun (Keira Knightley) to leak a memo that her employer received from the US National Security Agency (NSA) in January 2003.

The memo asked the British listening station for its cooperation in a US "surge" against selected members of the UN Security Council. The aim was to gather material designed to influence voting intentions and secure a second resolution (ultimately unsuccessfully) in support of the Iraq War.

The film dramatises Gun's journey from loyal civil servant to whistle blower and court defendant, charting the personal and professional fall out of her actions as she finds herself pitted against the might of the British establishment – and its judicial wrath. In parallel, the film follows the painstaking processes of the investigative journalists (Martin Bright, Peter Beaumont and Ed Vulliamy) who broke the story.

Official Secrets offers a passionate and damning assessment of UK government collusion in a US dirty tricks campaign designed to sway international opinion in favour of the Iraq War. It champions the efforts of individuals who stand up for their moral principles, whether through whistleblowing, journalism, or legal activism.

While ostensibly commenting on these historical actions, the film also illuminates contemporary concerns about government secrecy, accountability, and factual manipulation.

In the UK, the alleged suppression of the Parliamentary Intelligence Security Committee (ISC) report into Russian covert activity recently prompted suspicions about what (if anything) the British government is hiding about external meddling.

The temporary brand switch of the Conservative Party Press Office Twitter account to "FactCheckUK" during the a debate of party leaders in the run up to a December general election provoked complaints about an act of deliberate deception designed to muddy the (already murky) waters of online discourse. By fictionalising historical attempts by the British government to manipulate the court of public opinion, Official Secrets invites parallels to be drawn with the current erosion of trust in the political elite.

Cover up

The second film released in November to chronicle historical efforts to hold officialdom to account is Scott Burns' The Report. While also containing the near obligatory car park informant scene, The Report is an altogether darker, denser thriller. It follows US Senate assistant Dan Jones (Adam Driver) as he is assigned by the Senate Intelligence Committee to investigate the CIA's programme of Enhanced Interrogation Techniques (EITs) during the post-9/11 War on Terror.

Enhanced interrogation, it is rapidly made clear, is a euphemism for torture. Waterboarding, sleep deprivation and cramped confinement (false burial) were among 16 techniques designed to break the resistance of terror suspects. With mounting intensity and moral purpose, Jones meticulously pieces together the stories of each of the 119 detainees, eventually producing a 6,700-page report (reduced to a 700-page executive summary).

Interspersed with flashbacks of dehumanising violence, the film charts Jones' increasingly obsessional pursuit of the truth. It is uncompromising in its denunciation of the CIA as perpetrators of torture, and of the US government for authorising its use and colluding in the cover up.

The criticism, however, is not restricted to the Bush-Cheney regime. Also in the firing line is the hypocrisy of the Obama presidency (represented in the film by John Hamm as the White House chief of staff) who, it is suggested, was only too happy to reap the benefits of CIA propaganda when it came to the 2012 re-election campaign.

Real-life dramas

In a similar way to Official Secrets, The Report both dramatises an historical event and offers an implicit commentary on the current political climate in the Anglo-American sphere. By showing a recording of the actual speech given by the late John McCain on publication of the report, the film drags the recent past firmly into the present. It provides a glaring contrast between the bipartisan values that motivated the Senate investigation and the wilful disinformation that continues to emerge from the Trump administration.

In the present febrile political climate the tagline of The Report could be read as a clarion call to politicians on both sides of the pond: Truth Matters. If only they would listen.

Catherine Edwards does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Two new films feature the bravery and tenacity of government employees who risk everything to expose official wrongdoing. Catherine Edwards, Doctoral Researcher, University of York Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/115972 2019-04-25T10:33:03Z 2019-04-25T10:33:03Z Trump accuses the UK of spying again – but intelligence agencies have learnt to ignore him
Donald Trump has repeated unverified claims that Britain's intelligence agencies spied on his 2016 presidential campaign, a day after Buckingham Palace confirmed he would make a three-day state visit to the UK in June.

Trump was tweeting in response to former CIA analyst, Larry Johnson, who told the conservative One America News network, he believed the earlier claims that had first emerged in 2017 to be true. "It is now just a question of time before the truth comes out, and when it does, it will be a beauty," Trump tweeted.

Trump's tweet prompted another rebuke from the UK's intelligence, cyber and security agency, the Government Communications Headquarters (GCHQ). "The allegations that GCHQ was asked to conduct 'wire tapping' against the then President Elect are nonsense. They are utterly ridiculous and should be ignored," a GCHQ spokesperson told Reuters news agency.

In 2017, Sean Spicer, who was White House press secretary at the time, repeated allegations originally made by Fox News legal analyst Andrew Napolitano that president Barack Obama had "used GCHQ". American officials were quick to dismiss the claims, showing a "complete lack of understanding" of US-UK intelligence relations. "It would be epically stupid," said one official. GCHQ were quick to issue an unprecedented rebuke, and US officials promptly denied the claims, saying they would "not repeat" them, following pressure from UK officials.

So is there any truth behind the claims? Well, no. For conspiracy theorists and believers in the "deep state", the GCHQ story is a useful tangent. The idea that Trump is the victim of a wider conspiracy has been a major theme of his latest outbursts, following the publication of special counsel Robert Mueller's report on Russian efforts to interfere in the 2016 campaign. The problem is that conspiracies are quick to form, and difficult to erase, despite evidence to the contrary.

Johnson, who provoked Trump's latest outburst, was the source of the original GCHQ story. He was also the source of other equally outrageous claims.

Reports quoting sources from both UK and US intelligence agencies – and supported by European agencies – do, however, suggest that GCHQ found out about "interactions" between Russian agents and figures close to Trump's inner circle in 2015. The issue was deemed so sensitive it was handled at director level by GCHQ's then director Robert Hannigan, who shared the material with CIA head John Brennan. There is no suggestion that GCHQ was investigating Trump, rather that the contacts showed up in routine surveillance of Russian intelligence.

But despite evidence to the contrary, the GCHQ connection has remained a useful bogey for "deep state" believers and Trump himself.

Keep calm and carry on

But while the president seems happy to attack the UK, just days after his state visit was confirmed, the special relationship between intelligence agencies is resilient. Just as Trump's earlier claims of wiretapping were dismissed by officials on both sides of the Atlantic, the same will happen in this case.

While politicians will never see eye-to-eye, officials in GCHQ and its US counterpart, the National Security Agency (NSA), realise that intelligence sharing is vital to mutual security. In the 1970s, despite president Richard Nixon's best efforts to cut off vital sharing arrangements, intelligence officials found new ways to share information. The mutual threats of Russia, China and international terrorism, mean there's too much at stake. The longevity of the alliance, geography and language are other important factors.

The GCHQ story is an unwelcome distraction in transatlantic relations, but its impact will be short lived. Intelligence officials will just shrug their shoulders and continue their work.

Dan Lomas does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 The president says major revelations are coming. GCHQ says he's talking nonsense. Dan Lomas, Programme Leader, MA Intelligence and Security Studies, University of Salford Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/90650 2018-01-25T14:42:33Z 2018-01-25T14:42:33Z British government's new 'anti-fake news' unit has been tried before – and it got out of hand

  UK Government

The decision to set up a new National Security Communications Unit to counter the growth of "fake news" is not the first time the UK government has devoted resources to exploit the defensive and offensive capabilities of information. A similar thing was tried in the Cold War era, with mixed results.

The planned unit has emerged as part of a wider review of defence capabilities. It will reportedly be dedicated to "combating disinformation by state actors and others" and was agreed at a meeting of the National Security Council (NSC).

As a spokesperson for UK prime minister Theresa May told journalists:

We are living in an era of fake news and competing narratives. The government will respond with more and better use of national security communications to tackle these interconnected, complex challenges.

Parliament's Digital, Culture, Media and Sport Committee is currently investigating the use of fake news – the spreading of stories of "uncertain provenance or accuracy" – through social media and other channels. The investigation is taking place amid claims that Russia used hundreds of fake accounts to tweet about Brexit. The head of the army, General Sir Nick Carter, recently told the think-tank RUSI that Britain should be prepared to fight an increasingly assertive Russia.

Details of the new anti-fake news unit are vague, but may mark a return to Britain's Cold War past and the work of the Foreign Office's Information Research Department (IRD), which was set up in 1948 to counter Soviet propaganda. The unit was the brainchild of Christopher Mayhew, Labour MP and under-secretary in the Foreign Office, and grew to become one of largest Foreign Office departments before its disbandment in 1977 – a story revealed in The Guardian in January 1978 by its investigative reporter David Leigh.

This secretive government body worked with politicians, journalists and foreign governments to counter Soviet lies, through unattributable "grey" propaganda and confidential briefings on "Communist themes". IRD eventually expanded from this narrow anti-Soviet remit to protect British interests where they were likely "to be the object of hostile threats".

   Read more: Good luck banning fake news – here's why it's unlikely to happen

By 1949, IRD had a staff of just 52, all based in central London. By 1965 it employed 390 staff, including 48 overseas, with a budget of over £1m mostly paid from the "secret vote" used to fund the UK intelligence community. IRD also worked alongside the Secret Intelligence Service (SIS or MI6) and the BBC's World Service.

Playing hardball with soft power

Examples of IRD's early work include reports on Soviet gulags and the promotion of anti-communist literature. George Orwell's work was actively promoted by the unit. Shortly before his death in 1950, Orwell even gave it a list of left-wing writers and journalists "who should not be trusted" to spread IRD's message. During that decade, the department even moved into British domestic politics by setting up a "home desk" to counter communism in industry.

 <img alt="" src="https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=835&fit=crop&dpr=1 600w, https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=835&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=835&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=1050&fit=crop&dpr=1 754w, https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=1050&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/203397/original/file-20180125-107959-1ygb0fx.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=1050&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 George Orwell played his part in government 'propaganda' in the 1940s. BBC

IRD also played an important role in undermining Indonesia's President Sukarno in the 1960s, as well as supporting western NGOs – especially the Thomson and Ford Foundations. In 1996, former IRD official Norman Reddaway provided more information on IRD's "long-term" campaigns (contained in private papers). These included "English by TV" broadcast to the Gulf, Sudan, Ethiopia and China, with other IRD-backed BBC initiatives – "Follow Me" and "Follow Me to Science" – which had an estimated audience of 100m in China.

IRD was even involved in supporting Britain's entry to the European Economic Community, promoting the UK's interests in Europe and backing politicians on both sides. It would shape the debate by writing a letter or article a day in the quality press. The department was also involved in more controversial campaigns, spreading anti-IRA propaganda during The Troubles in Northern Ireland, supporting Britain's control of Gibraltar and countering the "Black Power" movement in the Caribbean.

 <img alt="" src="https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=859&fit=crop&dpr=1 600w, https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=859&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=859&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=1080&fit=crop&dpr=1 754w, https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=1080&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/203402/original/file-20180125-107963-g07ybp.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=1080&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Overthrown: President Sukarno of Indonesia.

Going too far

IRD's activities were steadily getting out of hand, yet an internal 1971 review found the department was still needed, given "the primary threat to British and Western interests worldwide remains that from Soviet Communism" and the "violent revolutionaries of the 'New Left'". IRD was a "flexible auxiliary, specialising in influencing opinion", yet its days were numbered. By 1972 the organisation had just over 100 staff and faced significant budget cuts, despite attempts at reform.

IRD was eventually killed off thanks to opposition from Foreign Office mandarins and the then Labour foreign secretary, David Owen – though that may not be the end of the story. Officials soon set up the Overseas Information Department – likely a play on IRD's name – tasked with making "attributable and non-attributable" written guidance for journalists and politicians, though its overall role is unclear. Information work was also carried out by "alongsiders" such as the former IRD official Brian Crozier.

The history of IRD's work is important to future debates on government strategy in countering "fake news". The unit's effectiveness is certainly open to debate. In many cases, IRD's work reinforced the anti-Soviet views of some, while doing little, if anything, to influence general opinion.

In 1976, one Foreign Office official even admitted that IRD's work could do "more harm than good to institutionalise our opposition" and was "very expensive in manpower and is practically impossible to evaluate in cost effectiveness" – a point worth considering today.

IRD's rapid expansion from anti-communist unit to protecting Britain's interests across the globe also shows that it's hard to manage information campaigns. What may start out as a unit to counter "fake news" could easily spiral out of control, especially given the rapidly expanding online battlefield.

Government penny pinching on defence – a key issue in current debates – could also fail to match the resources at the disposal of the Russian state. In short, the lessons of IRD show that information work is not a quick fix. The British government could learn a lot by visiting the past.

Dan Lomas does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 A new national security communications unit has echoes of the past, when the government tried to weaponise information, with mixed results. Dan Lomas, Programme Leader, MA Intelligence and Security Studies, University of Salford Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/65502 2016-09-20T11:25:10Z 2016-09-20T11:25:10Z Does the UK need or even want a 'Great British Firewall'?

Is a Great British Firewall what UK plc perhaps needs? Or is it asking for trouble? Andrea Danti/shutterstock.com

You've probably heard of the Great Firewall of China, the virtual fortification that allows the Chinese government to monitor and restrict internet traffic to and from the world's most populous nation. Well, the cyber-security chief of the UK Government Communication Headquarters (GCHQ) has suggested early plans for what sounds rather like a "Great British Firewall". Privacy groups immediately sounded the alarm that it might pose a risk to freedom of speech, and offer the potential for Britain's secret services to get up to no good. So what exactly is GCHQ proposing and should we be worried?

Firewalls are standard tools for computer defence. They are essentially filters which can control what traffic enters and leaves a network. You are probably protected by a firewall right now, at your workplace or at home, that runs either on your computer's operating system or on the hardware that provides your connection to the internet.

A firewall can be configured to reject certain types of traffic deemed undesirable or potentially harmful. This might be a connection request from an untrustworthy source, such as a web address known to harbour hackers or spammers, for example. Or it could block a file that looks like it might contain a computer virus or other malware. While deflecting this sort of undesirable traffic the firewall allows standard traffic such as web browsing and email to pass through.

Who decides what gets in and what doesn't? This is normally the job of whoever manages the network, be that an IT professional working at a company, or you (or your ISP) at home. The policy this manager applies determines what is accepted and what is rejected, so anyone relying on the firewall to be effective needs to trust that this policy is acting in their best interest.

What GCHQ seems to be proposing is a large-scale, nationwide firewall behind which any UK organisation could sit. The intention appears to be that organisations that are central to Britain's national security would be required to operate behind this firewall, while other organisations big and small could opt-in.

There are too few details at the moment, but this seems like a classic case of who watches the watchman?. If GCHQ is to be the guard that chooses what is deemed "good" or "bad", then the debate about the merits of a Great British Firewall is really a debate about whether there is trust in GCHQ.

Wearing two hats

 <img alt="" src="https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=752&fit=crop&dpr=1 600w, https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=752&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=752&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=945&fit=crop&dpr=1 754w, https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=945&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/138101/original/image-20160916-17018-24rtq.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=945&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Who's listening? Stephen Clarke/shutterstock.com

GCHQ has two roles that don't always sit particularly comfortably together. Most fundamentally it leads Britain's signals intelligence, which means essentially that GCHQ eavesdrops on communications for the UK government and the armed forces. Few would argue with the value of spying on enemies during wartime. What has proved much more controversial is GCHQ's capabilities and activities revealed by former National Security Agency contractor Edward Snowden, including the bulk collection of communication data relating to everyone's online activities. GCHQ has been accused of conducting mass surveillance, and there is no doubt that these revelations have damaged the reputation of it and the security services among some in the UK and worldwide.

However, GCHQ's other important role is as a source of cyber-security expertise. It helped develop the National Cyber Security Strategy and has been working hard to implement it alongside the UK government, industry and academia. In October 2016, the National Cyber Security Centre will open and will oversee many of these activities. GCHQ employs many cyber-security specialists and is supporting the training of even more. Put simply, there is a lot of cyber-security expertise in GCHQ.

So if there is to be a Great British Firewall, GCHQ seems like the logical organisation to provide it. Private companies will be given the opportunity to choose whether to trust GCHQ as their firewall guard. So long as they are genuinely free to make this decision for themselves, and their customers are aware of this relationship, then this might well be workable. Achieving security in cyberspace inevitably requires placing faith in some organisations – why not trust one that knows a great deal about cyber-security?

Of course there is a precedent: the use of the Great Firewall of China by the Chinese government to censor internet content is infamous. Through constant tight monitoring of internet traffic the government blocks access to websites, filters or blocks searches for keywords, and monitors the population's interactions in cyberspace. There is no doubt that the Great Firewall of China stifles freedom of speech and is used in an authoritarian, anti-democratic fashion. Other nations are also known to interfere with the global Domain Name System (DNS) that links domain names (such as theconversation.com) to the actual internet addresses used by the web servers for those sites. Filtering out DNS requests for certain domains and dropping them essentially prevents those domains from being accessed – certainly not in the spirit of the global open internet that many desire.

Is GCHQ proposing something equivalent? I suspect not, as the UK has a very different view of human rights and internet governance than in China. But there is a fine line between having the power to censor the internet, and choosing to implement that power. Returning to GCHQ's two functions, while I suspect the security function of GCHQ has good intentions, the intelligence function of GCHQ does not have an unblemished record in this area. Something to think about before choosing to hide behind the Great British Firewall.

Keith Martin receives funding from the EPSRC and the European Commission.
 Having a nationwide firewall means trusting the same people who spy on communications. Keith Martin, Professor, Information Security Group, Royal Holloway Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/63544 2016-08-05T10:01:08Z 2016-08-05T10:01:08Z If two countries waged cyber war on each another, here's what to expect

  lolloj

Imagine you woke up to discover a massive cyber attack on your country. All government data has been destroyed, taking out healthcare records, birth certificates, social care records and so much more. The transport system isn't working, traffic lights are blank, immigration is in chaos and all tax records have disappeared. The internet has been reduced to an error message and daily life as you know it has halted.

This might sound fanciful but don't be so sure. When countries declare war on one another in future, this sort of disaster might be the opportunity the enemy is looking for. The internet has brought us many great things but it has made us more vulnerable. Protecting against such futuristic violence is one of the key challenges of the 21st century.

Strategists know that the most fragile part of internet infrastructure is the energy supply. The starting point in serious cyber warfare may well be to trip the power stations which power the data centres involved with the core routing elements of the network.

Back-up generators and uninterruptible power supplies might offer protection, but they don't always work and can potentially be hacked. In any case, backup power is usually designed to shut off after a few hours. That is enough time to correct a normal fault, but cyber attacks might require backup for days or even weeks.

William Cohen, the former US secretary of defence, recently predicted such a major outage would cause large-scale economic damage and civil unrest throughout a country. In a war situation, this could be enough to bring about defeat. Janet Napolitano, a former secretary at the US Department of Homeland Security, believes the American system is not well enough protected to avoid this.

Denial of service

An attack on the national grid could involve what is called a distributed denial of service (DDoS) attack. These use multiple computers to flood a system with information from many sources at the same time. This could make it easier for hackers to neutralise the backup power and tripping the system.

DDoS attacks are also a major threat in their own right. They could overload the main network gateways of a country and cause major outages. Such attacks are commonplace against the private sector, particularly finance companies. Akamai Technologies, which controls 30% of internet traffic, recently said these are the most worrying kind of attack and becoming ever more sophisticated.

Akamai recently monitored a sustained attack against a media outlet of 363 gigabits per second (Gbps) – a scale which few companies, let alone a nation, could cope with for long. Networks specialist Verisign reports a shocking 111% increase in DDoS attacks per year, almost half of them over 10 Gbps in scale – much more powerful than previously. The top sources are Vietnam, Brazil and Colombia.

Number of attacks

 <img alt="" src="https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=294&fit=crop&dpr=1 600w, https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=294&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=294&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=369&fit=crop&dpr=1 754w, https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=369&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/133098/original/image-20160804-496-1r4cwza.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=369&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
  Verisign

Scale of attacks

 <img alt="" src="https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=177&fit=crop&dpr=1 600w, https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=177&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=177&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=223&fit=crop&dpr=1 754w, https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=223&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/133100/original/image-20160804-505-1p0xdpd.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=223&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
  Verisign

Most DDoS attacks swamp an internal network with traffic via the DNS and NTP servers that provide most core services within the network. Without DNS the internet wouldn't work, but it is weak from a security point of view. Specialists have been trying to come up with a solution, but building security into these servers to recognise DDoS attacks appears to mean re-engineering the entire internet.

How to react

If a country's grid were taken down by an attack for any length of time, the ensuing chaos would potentially be enough to win a war outright. If instead its online infrastructure were substantially compromised by a DDoS attack, the response would probably go like this:

Phase one: Takeover of network: the country's security operations centre would need to take control of internet traffic to stop its citizens from crashing the internal infrastructure. We possibly saw this in the failed Turkish coup a few weeks ago, where YouTube and social media went completely offline inside the country.

Phase two: Analysis of attack: security analysts would be trying to figure out how to cope with the attack without affecting the internal operation of the network.

Phase three: Observation and large-scale control: the authorities would be faced with countless alerts about system crashes and problems. The challenge would be to ensure only key alerts reached the analysts trying to overcome the problems before the infrastructure collapsed. A key focus would be ensuring military, transport, energy, health and law enforcement systems were given the highest priority, along with financial systems.

Phase four: Observation and fine control: by this stage there would be some stability and the attention could turn to lesser but important alerts regarding things like financial and commercial interests.

Phase five: Coping and restoring: this would be about restoring normality and trying to recover damaged systems. The challenge would be to reach this phase as quickly as possible with the least sustained damage.

 <img alt="" src="https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=356&fit=crop&dpr=1 600w, https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=356&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=356&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=447&fit=crop&dpr=1 754w, https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=447&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/133139/original/image-20160804-513-143grda.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=447&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Mission: recovery. kirill_makarov

State of play

If even the security-heavy US is concerned about its grid, the same is likely to be true of most countries. I suspect many countries are not well drilled to cope with sustained DDoS, especially given the fundamental weaknesses in DNS servers. Small countries are particularly at risk because they often depend on infrastructure that reaches a central point in a larger country nearby.

The UK, it should be said, is probably better placed than some countries to survive cyber warfare. It enjoys an independent grid and GCHQ and the National Crime Agency have helped to encourage some of the best private sector security operations centres in the world. Many countries could probably learn a great deal from it. Estonia, whose infrastructure was disabled for several days in 2007 following a cyber attack, is now looking at moving copies of government data to the UK for protection.

Given the current level of international tension and the potential damage from a major cyber attack, this is an area that all countries need to take very seriously. Better to do it now rather than waiting until one country pays the price. For better and worse, the world has never been so connected.

Bill Buchanan does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 How the internet has made us terrifyingly vulnerable. Bill Buchanan, Head, The Cyber Academy, Edinburgh Napier University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/52401 2015-12-16T11:06:30Z 2015-12-16T11:06:30Z How to crack British intelligence service's devilish Christmas puzzle

Easy-peasy? GCHQ

Calling all aspiring spooks. Robert Hannigan, director of Britain's security and intelligence organisation GCHQ, has included a rather tantalising puzzle with his Christmas card this year. He hopes that it will exercise your grey cells over the holiday period.

If you can solve the puzzle, along with the others that it will lead to, you can email the solution to GCHQ (the Government communications headquarters) before January 31. A winner will be drawn from all the correct answers – and doubtless be named to much fanfare.

So what do you need to do to be in with a chance?

The puzzle requires that you shade in squares on the 25x25 grid shown above. But which ones? Well, a few of the "black" squares have been completed for you, but most you will have to do yourself. By way of a clue, each row and cell has a sequence of numbers attached to it. The numbers represent a sequence of shaded cells, that need to separated from each other by at least one blank cell. For example, the row marked "7 3 1 1 7" should contain a sequence of seven shaded cells, followed by at least one blank cell, then three shaded cells, followed by at least one blank cell – and so on. The problem is made trickier because each horizontal row intersects a vertical column, each with its own sequence code.

Paper and pen

So how do you reach the solution? One way of cracking it is to resort to old-fashioned paper and pen. Just sit down, put on your thinking cap and try to reason it out.

It is not that difficult to get started. In fact, it is already started, and it is easy to fill in a few more squares. Take a look at row 22 on the horizontal axis – the one that has the sequence "1 3 1 3 10 2". These numbers add up to 20 and as there are six blocks, you need at least five blank squares to separate them. As we only have 25 squares in the row, this pattern can only fit in one way – the first square in the row has to be shaded, and the rest just follow, with only one blank square between each run of shaded squares.

Are there any others like this? Column seven ("7 1 1 1 1 1 7") sums up to 19. As we have seven numbers we need at six least separators. This also adds up to 25, so this row is easy to complete, too. The figure below shows the grid once we have filled in row 22 and column seven (the blank squares are marked in yellow).

 <img alt="" src="https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=600&fit=crop&dpr=1 600w, https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=600&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=600&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=754&fit=crop&dpr=1 754w, https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=754&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/106086/original/image-20151215-23176-1lga4db.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=754&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 State of grid after completing row 22 and column seven.

Any others where the row or column is also easy to complete? Yes, but I'll leave it to you to find them.

Once you have completed the "easy" rows/columns, you then need to start looking for other ways of completing the remaining rows and columns, or even reasoning about individual cells. In many ways, it is like completing a Sudoku puzzle. You should find that you never have to guess, but perhaps using a pencil and having a rubber to hand might be a good idea.

One more hint, colour in the blank squares, too – just use a different shade. This might sound obvious but leaving a square blank, once you have determined that it "must" be blank, might mean that it gets mistakenly shaded later. You can see in the figure above that I've have coloured the blank squares yellow, so we know that we should not make them black later.

Getting mathematical

If you don't want to exercise the brain, you can get a computer to do it for you.

Jean Francois Puget presents one such – SPOILER ALERT: the next link reveals the solution – methodology, which is based on mixed integer programming.

You define the problem using variables, zeroes for white cells and ones for black cells. You next define constraints. For example, each row/column has to have the correct sequence of blacks cells in each row/column, separated by at least one white cell. You also need to define an objective function. This is usually something you are trying to minimise (for example, waste) or maximise (for example, profit). In the case of this puzzle, there is nothing to minimise or maximise, as once we have a valid solution we cannot improve on it.

Once we have defined the variables, constraints and objection function, we can hand it over to one of the many solvers that are available online and it will return the solution.

The downside of mathematical approaches to complex problems is that there may be a solution, but it could take millions of years to find it. Fortunately, this puzzle can be solved quickly.

Other approaches

If you don't fancy either of the above two approaches, there are many other options. In a previous article we discussed how ants could be used to solve chess puzzles. So if ants can play chess, they could certainly solve the GCHQ puzzle.

Whether it is worth the effort to develop the computer model required, however, is open to debate. The same could also be argued for the many other meta-heuristic approaches. Almost any of them could solve this puzzle, but is it worth the development effort?

The puzzle has generated a lot of media interest and many people are trying to solve it. As we have shown above, there are already solutions on the internet and there is even more information about the subsequent puzzles on Reddit. That does seem to go against the spirit of the puzzle, however, and the spirit of the season. Why not just print the grid, get out a pen and exercise the grey matter sometime over the festive period? You may even win the honest way.

Graham Kendall does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Have you got the keen eye and quizzical mind of a professional spy? Let's find out ... Graham Kendall, Professor of Computer Science and Provost/CEO/PVC, University of Nottingham Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/48465 2015-10-05T10:24:54Z 2015-10-05T10:24:54Z GCHQ's surveillance hasn't proved itself to be worth the cost to human rights

 defenceimages, CC BY-SA

The release of yet more of Edward Snowden's leaked files reveals the still-astonishing scale and breadth of government surveillance after more than a year of revelations. These recent papers revealed to The Intercept website discuss a programme within Britain's GCHQ known as "Karma Police", in which the intelligence agency gathered more than 1.1 trillion pieces of information on UK citizens between August 2007 and March 2009.

Spurred on by the expansion of intercept warrants under the Terrorism Act 2006, this information is users' internet metadata – details of phone calls, email messages and browser connections that includes passwords, contacts, phone numbers, email addresses, and folders used to organise emails, but not the actual content of messages or emails.

Metadata can help identify people of interest, build profiles, and assist with decisions to start or escalate surveillance of individuals. All this information can be collected often at a fraction of the cost of doing this through traditional methods. In other words, metadata is not insignificant – and this is precisely why governments are so committed to collecting and processing it. However, bulk metadata collection – where information is collected from everyone whether a "person of interest" or not – is rightly a source of deep anxiety from both security and human rights perspectives.

Does it make us safer?

It's not at all clear that bulk collection of metadata makes society "safer". While such data may be (and often is) useful in investigating crime, its use in helping anticipate terrorist incidents is hotly disputed. This doesn't mean that security services cannot point to situations in which they have disrupted possible attacks through information gleaned from such activities, but it does mean that the justification for bulk, rather than targeted, data collection has not been made.

In fact the question as to whether bulk collection of metadata, and the sheer volume of data it generates, may actually hinder effective identification of terrorist suspects and other serious crime hasn't been satisfactorily addressed. Nor is it clear whether a bulk data collection approach, rather than one that emphasises directing more resources towards traditional police and human intelligence techniques, is any more efficient, especially in the domestic sphere where GCHQ and MI5 share information.

Bulk metadata collection relies on algorithmic computer analysis followed by human judgement. It's not clear how much is missed, or how many false positives are generated, by adopting a machine-centric approach over one that involves more human experience. Furthermore, we don't know to what extent resources are diverted away from funding the human expertise of policing, relationship building and developing professional investigative instincts as a result of such programmes of data collection and processing.

At the very least, intrusive operations such as this one should work; if they are to be accepted at all, they should be justified by their effectiveness, something that remains more a matter of rhetoric than of established fact.

Is it justified?

Even if bulk data collection does work, is this justification in itself? The answer, it seems to me, must be determined by oversight and the importance we ascribe to our civil rights.

No agency that collects and processes this volume of information should be without effective oversight. Yet we have seen that, despite GCHQ being subject to oversight from the Intelligence Services Commissioner for its intelligence function, and to the secretary of state for foreign and commonwealth affairs for its overseas-related work, its culture of secrecy and non-disclosure nevertheless means that we're left to rely on leaks and whistleblowers to get a clear picture of what is happening. The Wikileaks documents demonstrate this all too well, showing internal discussions that reveal GCHQ bosses felt their oversight bodies were "on side".

This is a matter of real concern from a human rights and civil liberties perspective. The growth of bulk data collection and computerised processing by government agencies is fundamentally shifting political, operational and potentially even popular conceptions of what "privacy" really entails. What are we entitled to keep to ourselves? When are we entitled to expect the state to have to justify its intrusions into that private space? The fact that this is metadata rather than content doesn't remove the privacy implications of such surveillance.

As the Court of Justice of the European Union said in April 2014, metadata "may allow very precise conclusions to be drawn concerning … private lives". In order for any retention regime to be proportionate – and so stay within the requirements of human rights law – proper safeguards and limitations must be built in. Otherwise the effects of surveillance could be corrosive, creating a chilling sense that "one is being watched permanently".

As GCHQ continues to amass data on internet users, it is time for political leaders to answer two vital questions: does bulk data collection work? And, if so, is it worth the cost?

Fiona de Londras has previously received research funding into security and societal impact from the European Commission.
 As Wikileaks reveals yet more details of the astonishing extent of GCHQ mass surveillance, where is the proof that bulk data collection even works? Fiona de Londras, Professor of Global Legal Studies, Birmingham Law School, University of Birmingham Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/43138 2015-06-12T04:31:42Z 2015-06-12T04:31:42Z Two years on from Snowden, UK gets green light to continue accessing bulk data

Nothing sinister, just taking a quick peek. Smit via Shutterstock

The US has recently taken steps to cut back on its surveillance programmes. In the UK, the government has just received the green light to continue.

The UK can continue to collect bulk data on overseas communications and can access bulk data held by telephone companies and internet service providers on UK citizens.

An investigation by the Independent Reviewer of Terrorist Legislation into the effectiveness of surveillance legislation has concluded that the UK government does need to access bulk communications data in the interests of national security.

A final report by lawyer David Anderson, published on June 11, acknowledges that there needs to be a clearer and more consistent legal framework to govern surveillance activities – but still concludes that public bodies need to be able to respond to security threats and "follow suspects in a borderless online world".

The investigation was launched partially in response to the revelations of NSA whistleblower Edward Snowden about the extent to which the UK and US governments were spying on their citizens. Almost two years on, after an enormous backlash, the US Congress recently passed the USA Freedom Act, restricting the ability of intelligence agencies to collect bulk data on US citizens.

Targeted surveillance is very different to bulk data collection. In targeted cases, it's generally accepted that the government should be able to access an identified person's communications where sufficient grounds, such as a threat to national security, are established.

Bulk data collection, on the other hand, involves gathering large amounts of data, including that relating to persons who are not under suspicion for any wrongful activity.

In approving the government's bulk data collection activities, Anderson recommended additional safeguards, such as the identification of a specific mission to be accomplished, to ensure that it is only aimed at those believed to be outside of the UK.

The report also backs the Data Retention and Investigatory Powers Act, under which service providers may be required to retain communications data on their customers for up to a year. The data collected is detail about communication such as the number dialled, the date and time, rather than the actual content of calls and emails.

While bulk data collection is aimed at overseas communications, the government can be authorised to access the communications data of UK citizens when held by service providers.

The end of privacy?

The silver lining for privacy campaigners in all this is that the report does recommend greater oversight of data collection and greater transparency about the activity. Under its recommendations, a new body called the Independent Surveillance and Intelligence Commission would be established to monitor the activities of the government. This would include issuing warrants for bulk data collection.

Anderson says the confusion surrounding existing laws on surveillance is "undemocratic, unnecessary and – in the long run – intolerable". He recommends a "comprehensive and comprehensible" law be drafted from scratch, setting out the limits of the government's intrusive powers.

The new law should make it clear that any surveillance that takes place must be necessary, for example in the interests of national security, and any intrusion into privacy proportionate to that need.

Immediately following the publication of the report, Home Secretary Theresa May announced that a draft surveillance bill would be published in the autumn, with legislation in place by the end of 2016.

Although it says that the commission charged with overseeing the government's activities will be independent and well resourced, Anderson's report will come as a blow for privacy campaigners.

But the report is not all good news for the government. Whereas ministers currently approve warrants for intercepting communications for agencies like GCHQ, Anderson suggests handing that role to judges. This is the one area touched on in the report that the government might push back on.

Nicholas Clapham does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 An independent review recommends greater transparency but ultimately concludes surveillance can continue. Nicholas Clapham, PhD Candidate (Privacy and Surveillance). Non-practising solicitor., University of Surrey Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/38947 2015-04-02T16:19:53Z 2015-04-02T16:19:53Z If intelligence services want more powers they must learn to live with increased oversight

Who is watching them while they are watching you? sacred_destinations, CC BY-NC

The UK's security and intelligence services face a "technology arms race" against terrorists and criminals' use of the internet and encryption, the head of MI6, Alex Younger, has said.

The internet and big data, he said, can "combine to our advantage, allowing us to know more about the people we meet". But their opponents have the same tools – opponents "unconstrained by consideration of ethics and law".

The implication is clear: give us more powers in order to meet the threat. The British spy chief echoes similar comments from the FBI and CIA, from police chiefs, and now from Europol.

But the stream of revelations stemming from the Edward Snowden documents reveal an altogether different view of surveillance carried out by GCHQ and other agencies. The subsequent inquiry by the Parliamentary Intelligence and Security Committee (ISC) into surveillance practices found reasons to worry about acceding to demands for greater powers, and missed opportunities to hold the agencies to account.

Nothing to see here

The ISC inquiry examined the range of surveillance techniques and how they were used, the scale of use and nature of their breach of privacy, and the legal safeguards surrounding their use.

The committee's report may be readily characterised as seeking to reassure the public that the immense amount of surveillance does not amount to anything untoward occurring. The committee found GCHQ has "neither the legal authority, the technical capacity nor the resources" for "blanket coverage" of all internet communications. Committee member Hazel Blears MP declared that "the way in which the agencies use the capabilities they have is authorised, lawful, necessary and proportionate".

On the other hand, there was no shortage of criticism; Privacy International pithily summed it up in saying:

No jargon can obscure the fact that this is a parliamentary committee, in a democratic country, telling its citizens that they are living in a surveillance state and that all is well.

Consolidating power and responsibility

The main recommendation of the report was that the current out-dated, fragmented, over-complex and unclear legislative legal framework should be replaced by a single new comprehensive act, one that "must clearly set out the intrusive powers available to the Agencies, the purposes for which they may use them, and the authorisation required before they may do so".

A number of intelligence-based activities, such as data-sharing with foreign intelligence bodies, currently have no clear statutory basis and in some cases are likely to be unlawful. Putting surveillance activity on a firmer legal footing is to be welcomed, especially considering that current laws date from before the recent explosion in social media use. The opportunities to gather personal information from data online have exponentially increased; inevitably, legal safeguards and regulations have failed to keep pace.

 <img alt="" src="https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=422&fit=crop&dpr=1 600w, https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=422&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=422&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=531&fit=crop&dpr=1 754w, https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=531&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/76825/original/image-20150401-31296-1y12vsj.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=531&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 England's doughnut of knowledge. Ministry of Defence

Snoopers' Charter?

The concern is that the proposed new legislative framework, while much more comprehensive, still doesn't address the key concerns raised by what we've learned from the Snowden files. To give any reassurance that privacy will be respected and protected, progressively more intrusive surveillance measures should warrant progressively higher levels of authorisation. This would suggest granting a greater role to judges, as a more independent check and balance; instead the committee proposes to give the authority to government ministers.

It has been suggested that this report may pave the way for a so-called "Snoopers' Charter", forcing data controllers and ISPs to hand over details of emails, social media messages, texts and voice calls.

In the context of a legislative overhaul, the system of oversight provided by the ISC might also have been expected to come under scrutiny. Yet the fact that it took the Snowden revelations to stir up any action over GCHQ's bulk collection of data suggests that it was a role that had hardly been rigorously discharged.

Power without control

So the findings of the ISC's report, and the committee's tendency to exonerate agencies from wrongdoing seem in harmony with calls for more powers for the likes of MI6, MI5, GCHQ – not in opposition. Whether or not there are extensive statutory guidelines for the agencies' activities does not in itself create any confidence that mass surveillance is not occurring. Greater transparency, in the sense of providing more information or clarification of the law, doesn't necessarily demonstrate that powers are not being abused – as indicated by what we've learned from the Snowden files.

The fact that the agencies' opponents are "unconstrained by consideration of ethics or law" does not, and should not, provide an argument that the agencies should be less constrained. Younger accepted that the difference between the agencies and their opponents was the rule of law. So demands for greater powers should concentrate their focus on the constraints that legal reform could impose, because the rule of law is not something that the UK or any of its government agencies should start considering as optional.

Helen Fenwick does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Police and spies' calls for more powers should fall on deaf ears until they have learned the letter of the law. Helen Fenwick, Professor of Law, Durham University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/38927 2015-03-18T06:25:50Z 2015-03-18T06:25:50Z The life of a British spy is about to change dramatically

Think less secret agent and more civil servant. Tony Fischer, CC BY

The report on privacy and security just published by the UK parliament's Intelligence and Security Committee has drawn mixed reviews. Shami Chakrabarti, leader of human rights group Liberty, was the notable critic, labelling the committee "clueless and ineffective".

Whatever the views on the details, its findings indicate an unprecedented shift in British thinking on intelligence services.

It has been widely noted that the report insists intelligence services do not seek to circumvent British law in their surveillance work. It suggests GCHQ applies rigorous filtering criteria to the data it seeks out and collects, despite claims that it carries out mass and indiscriminate surveillance on ordinary citizens.

But what has been overlooked is the section of the report that looks to the future. The committee argues the current legal framework for intelligence services is "unnecessarily complicated" and lacks transparency as a result.

They say existing legislation should therefore be replaced with a single act of parliament that would consolidate all regulation of the intrusive capabilities of British intelligence, and ensure tight oversight protocols in line with public disclosure. This amounts to a dramatic shift in thinking.

A history of turning a blind eye

Legislation on British intelligence is still in its adolescence. The intelligence services have spent the majority of their operating lives in a state of official denial, with no laws even acknowledging their existence, let alone govern their activities.

That only changed in 1989, with the Security Services Act – the first law to officially acknowledge security service MI5. In 1994, the Intelligence Services Act was brought in, acknowledging the secret intelligence service MI6 and GCHQ. This was the first time that British intelligence was placed on a statutory footing.

Both acts have attracted criticism ever since. They were seen as adding further protection to the services rather than imposing true transparency on them. Today, the consequences of that lack of transparency are being clearly felt and trust is at a low.

The revelations made by Edward Snowden about the work of British and US agencies gave rise to suspicions of mass and unrestricted surveillance of the digital activities of ordinary people. For almost two years, the intelligence services have been on the defensive against accusations that they can snoop on any communications should they so wish.

This fear is not without merit, as British intelligence is also afforded significant statutory exemptions that provide considerable protection from prying eyes. Most notably, they have a blanket exemption from the rules set out in the 1958 Public Records Act, the Data Protection Act, which controls how people's information is used by others, and the Freedom of Information Act, which provides citizen's with access to information about public bodies.

The idea has always been to exclude intelligence activities from the law as much as possible. Where they do come under a statute, the aim is to provide enough flexibility to allow the agencies to discharge their duties.

In from the cold

The legislation being proposed for discussion in the next parliament would be a shift away from the traditional approach and towards a more American style. Legislation would impose stringent and publicly clear parameters on the activities of these largely secretive organisations and an unprecedented level of public transparency.

While the new legislation does not yet even exist in draft form, several things are known about what it may entail. The parliamentary committee recommends listing the intrusive capabilities that are open to the intelligence services. This would, for the first time, create a public list detailing what the intelligence services actually do.

It is also intended that the use of these measures is more tightly regulated by linking each to statutory provisions such as human rights and data protection. The intelligence services would face time restrictions on intrusive monitoring and the period within which they can hold on to data.

While this would bring greater oversight though, consideration must be paid to the idea that intelligence instruments will be blunted. By creating a list of capabilities, the intelligence services will, quite literally, advertise its capabilities to its targets, who can then work to avoid detection accordingly. It is yet to be seen whether our intelligence services can remain as effective as they are in a world where they are forced to tell their enemies exactly what they are capable of.

Of course, this is assuming that the committee's recommendations are followed, and that whatever draft legislation is produced is actually passed through parliament. While the intelligence services themselves are in no position to resist the proposed changes – they simply operate within the legal architecture created for them – the British government now faces a genuine dilemma over whether or not to make intelligence more transparent.

Sweeping changes along these lines would thrust the intelligence services into the public eye like never before and radically alter the way they discharge their duties. What will remain, though, is the tricky balance that is ever present for an intelligence service in a democratic society. That balance is remaining operationally effective against the threats to the nation while also being accountable and maintaining public trust.

Daniel Steed does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Proposals from the Intelligence Committee could bring GCHQ into the public eye like never before. Daniel Steed, Lecturer in Strategy and Defence, University of Exeter Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/38792 2015-03-17T15:52:31Z 2015-03-17T15:52:31Z We are right to fear spy 'database of everything' if even politicians know little about it

(Security) Service with a smile. rogersg, CC BY-SA

The recently released Intelligence Service Committee's report suggested an overhaul of the laws governing the work of the intelligence and security agencies. But beyond the headline announcement were buried details and admissions to questions that have gone unanswered for more than 40 years.

To find out why we must go back to 1972 when, as computerisation continued apace, concerns about the role of "data banks" grew into fears of large, centralised and intrusive databases containing details of everybody's lives. In response the government set up the Younger Committee, which introduced ten principles to guide the growing use of computers for the processing of personal data.

When the government finally responded to the Younger report in 1975, it agreed that "government and private data banks should be considered and controlled together". It also insisted that different data banks should not be linked unless "expressly sanctioned by law or agreement, or are subject to scrutiny and control" by the same authority.

These recommendations and the ten principles went on to underpin data protection law, from the first Data Protection Act in 1984 until today. This covers both private and public sectors, though there are exceptions for areas such as national security in this and those laws that succeeded it.

Fast forward to February 10, 2011 when, after almost a decade of heated debate about a UK national identity card, the hard disks that contained the partial implementation of the National Identity Register database that underpinned the identity card scheme were physically destroyed.

It's tempting to view the next similar hardware destruction, that of The Guardian newspaper's computers containing Edward Snowden's leaked files in July 2013, as a somehow ironic remark by GCHQ on the previous.

It was obvious to anyone that copies of the files remained elsewhere at The Guardian and the other media outlets involved in the scoop. The chain of events set off by Snowden's revelations must now make us wonder whether GCHQ still holds a copy of that National Identity Register – and much more besides.

A database of everything

This issue raises its head in this report of the Intelligence and Security Committee, the UK parliamentary committee that oversees the work of MI5, MI6 and GCHQ. In response to the news stories based on Snowden's leaked information in 2013, the ISC first stated that GCHQ had not circumvented or attempted to circumvent UK law – a claim received with cynicism by parts of the press, but barely challenged by politicians with the exception of the Home Affairs Committee – and subsequently launched an inquiry.

That inquiry's final report reveals that the "database of everything" first feared in the 1970s had existed all along, in the form of Bulk Personal Datasets (BPDs) held by the intelligence agencies. Acknowledged for the first time, this strains the ISC's earlier claims of adequate knowledge and oversight and no practices that stretch or break the law.

 <img alt="" src="https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=528&fit=crop&dpr=1 600w, https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=528&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=528&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=664&fit=crop&dpr=1 754w, https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=664&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/75079/original/image-20150317-22305-1nqpcq6.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=664&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Not particularly enlightening. Crown Copyright

BPDs are defined in the report as "large databases containing personal information about a wide range of people", some with millions of records. What kind of information this might be appears to have been entirely redacted. They are acquired "through overt and covert channels", linked to other datasets where needed, and shared at will between the agencies and also with overseas partners.

For every past, current and future personal database (perhaps care.data?), we should now worry whether it is linked into this database of everything accessible to the security services not just in the UK, but perhaps other allied countries with very different views on data protection.

No insight, no oversight

The ISC is rightly concerned that "legislation does not set out any restrictions on the acquisition, sharing and destruction of Bulk Personal Datasets, and no legal penalties exist for misuse of this information". There is almost no oversight in how they are created and used – even the home secretary and foreign secretary do not get involved beyond general discussions about BPDs. Instead, the agencies work with them on the basis of the Intelligence Services Act 1994 and Security Service Act 1989, and take unsupervised decisions on the basis of Human Rights Act's principles of "lawful purpose, necessary and proportionate".

The information security commissioner, Sir Mark Waller, does include BPDs in his review visits, though not on a statutory basis, nor with any mention in the publicly accessible part of his report. That the only immediate response to the ISC report from the prime minister, David Cameron, was to make BPD oversight a statutory task may be viewed as an indication that BPDs are seen as important.

In his recent book Black Box Society Frank Pasquale, professor of law at the University of Maryland, describes how so-called Fusion centres were established in the US after 9/11 to support the intelligence agencies and their industrial partners. These were US equivalents of this "database of everything", where public and private data of all kinds – tax, health, traffic tickets, utility bills, insurance – were combined and sifted. Such databases would inevitably also include information about UK residents, and so it's likely Fusion centre databases would also be part of any sharing arrangement with UK agencies' BPDs.

Data retention

The ISC report mentions many datasets throughout, such as those that include the "bulk collection" of "communications data", or even the contents of private emails, texts and calls. In each case, the retention period is redacted. This lack of information should pose difficult questions for the agencies, considering retaining this sort of insufficiently targeted surveillance data was ruled unlawful by the Court of Justice of the European Union in 2014. Although it seems that by simply copying data into unregulated BPDs the agencies can retain the data indefinitely.

Going back to the original "data bank" fears, the usual questions reappear: what happens if BPD data is incorrect? What if incorrect data leads to action against citizens? Due to the National Security exemptions on data protection, there is no right to access, no right to correction and no right to redress. How are we to know if the data is secure and how would we find out if it gets abused by an insider – an eventuality that the report admits has already happened – or hacked from outside?

The database of everything feared in 1972 when computer processing power was exponentially smaller than today has finally come to light in 2015, at a time when far more data and data from far wider sources can be included. If even the government itself has only a tenuous grasp on the fact this mechanism exists, let alone a thorough oversight of it, we are right to be concerned.

Eerke Boiten is a senior lecturer in the School of Computing at the University of Kent, and Director of the University's interdisciplinary Centre for Cyber Security Research. He receives funding from EPSRC for the CryptoForma Network of Excellence on Cryptography and Formal Methods. He is a member of BCS and board member of its specialist group on Formal Aspects of Computer Science. He is also a director (governor) of The John of Gaunt School, a Community Academy.
 Committee report reveals 'citizens dossiers' feared but never admitted to have existed for decades. Eerke Boiten, Senior Lecturer, School of Computing and Director of Interdisciplinary Cyber Security Centre, University of Kent Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/38184 2015-03-02T06:21:32Z 2015-03-02T06:21:32Z Gemalto hack shows how far we are from deciding acceptable 'security norms'

SIM cards contain the key to unlock your phone. Oleksiy Mark/Shutterstock

Is it true spies hack technology companies? Can governments really listen to your phone calls? Should we care? The latest details of NSA and GCHQ intelligence agency activities to come from files leaked by Edward Snowden are of the apparently massive theft of mobile phone SIM card encryption keys from the Dutch firm Gemalto.

This "great SIM heist" targeted Gemalto because it produces billions of mobile phone SIM cards for 450 telecoms providers worldwide, and acquiring copies of encryption keys would make it possible to eavesdrop on cell phone calls with comparative ease. While press reports state these attempts were successful, after a brief internal audit – far too brief, some experts say – Gemalto has stated that nothing was stolen.

Who is right? Whether this is resolved or not, in this particular case the handbags will no doubt fly. But the fact of the matter is that there are bigger issues we should all be considering.

Putting walls around data

In the physical world we do a fairly good job of keeping ourselves secure. I assume, for example, that you locked your front door when you left your house this morning. In the digital world we tend to be a lot more careless. We tend to leave doors wide open. In many cases we don't even put doors between the outside world and our data. For intelligence agencies this is very fortunate since our emails, social media posts, and browsing habits are usually conveniently just lying around.

Encryption, on the other hand, provides a secure place with a front door behind which data is inaccessible. That is, unless you have the front door key. Encrypted data is meaningless and of little use to an intelligence agency – to make sense of it the keys to decrypt it are needed.

Mobile phones encrypt calls between the phone and the nearest mobile phone mast, preventing anyone who intercepts the call as it travels through the air from making any sense of it. The encryption key used is derived from the phone's SIM key, which is a personal key that comes pre-installed on your SIM card. Anyone who knows the SIM key – normally only your phone and your mobile operator – can decrypt the call if they listen in.

Gemalto's business is putting SIM keys into SIM cards; if someone breaks into Gemalto's systems then it is certainly possible that they could make off with SIM encryption keys. This isn't great news for the security of whatever mobile phones they later end up in.

Sidestepping the locks

Bad though this sounds, it's really just the latest of many revelations of this type that have leaked out of the Snowden files. The picture that has emerged is of intelligence agencies clearly frustrated by the increasing use of encryption in our everyday technology. As the encryption is (mostly) too good to break, so the intelligence agencies have been using every technique imaginable to find a way around it.

Broadly speaking, there are really only two ways to get around good encryption. Option one is to try to access data either before it is encrypted or after it is decrypted – Snowden's files suggest the intelligence agencies have been doing plenty of that. Option two is to try to get hold of the keys needed to decrypt the data. The Great SIM Heist seems to be the latest example of attempts at this second strategy.

What do we want for the future?

In one sense this is not a new development. As encryption has been deployed more widely, its use has created tension between the rights of the individual to privacy and the duties of the state to protect society. Over the last few decades governments have made several attempts to mediate between these, attempts which appeared to have concluded in favour of strong encryption and individual privacy.

Prior to Snowden it was publicly believed that the "crypto wars" had largely been lost by the intelligence agencies; instead, leaked files such as these reveal that the wars have just become bloodier than any of us really imagined.

Many people are outraged by the many Snowden revelations. Others take the view that this is the intelligence agencies' job and they ought to be left to get on with it. There are good arguments supporting both of these viewpoints.

So, should you care? If you do, then there has never been a better time to stand up and make your feelings known. We as a society really ought to form an opinion on what "security norms" we wish to see developing around our increasing use of the internet as a place where we, partially, live our lives. If we don't, then clearly others, with perhaps very different agendas, will decide them for us.

Keith Martin receives funding from the EPSRC and the EU Horizon 2020 programme.
 Can the NSA and GCHQ really listen to your phone? Should we be concerned if they could? Keith Martin, Director, Information Security Group, Royal Holloway Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/37309 2015-02-07T14:05:54Z 2015-02-07T14:05:54Z GCHQ datasharing with the NSA deemed unlawful – but don't expect things to change

Don't expect anything to change inside the doughnut. Barry Batchelor/PA

Two years after Edward Snowden's allegations concerning mass surveillance, the Investigatory Powers Tribunal, the UK intelligence agencies complaints tribunal, has ruled that the manner in which the UK's GCHQ shared intelligence from the US National Security Agency was unlawful.

In a brief ruling that follows a lengthy and more complex one in December, the tribunal at the same time announced its view that previous legal defects have been corrected, and that it is now satisfied that GCHQ is acting lawfully. At least, that is what you might think the IPT has decided. But in the peculiar point at which the law, intelligence and secrecy mix, things are not always what they seem.

In real life, wronged spouses, the general public, and judges and juries for that matter are usually wary of the "I did wrong but now I have changed" defence sometimes offered by those caught red-handed. But in this instance the UK government continues stubbornly to maintain its innocence – it is the tribunal itself that has offered that explanation on their behalf.

Undoubtedly, the IPT's finding helps the security and intelligence agencies save face. Officials were quick to claim the tribunal's finding of illegality was historical, and also a technicality – since it related only to disclosure about the details of data-sharing arrangements rather than finding that the practices breached privacy.

There are a number of problems here, both with the argument and in establishing the facts.

Historical matters?

The first claim is that these illegal matters are in the past. Well, what do we mean by "the past"? The tribunal's ruling is inconveniently precise – before December 2014. The past may be another country, but on any reckoning GCHQ was apparently acting in breach of the law until approximately eight weeks ago. This was long after ministers offered repeated denials of impropriety in parliament, and after it received a clean bill of health from the Parliamentary Intelligence and Security Committee.

Second, for reasons to do with the strange Neither Confirm Nor Deny world of security and intelligence accountability, the case brought by Privacy International, Liberty and others was conducted on an agreed assumed set of facts relating to the allegations.

In other words, the statements and arguments made in the ruling are based on circumstances and cases assumed to be hypothetical. This device made it possible for the tribunal to conduct five days of open hearings and to produce a lengthy and legally complex open judgement in December 2014 on how the law would apply to these hypothetical, unconfirmed, facts.

The tribunal's most recent judgment refers carefully to whether "the regime" governing communications is compliant with the law. But the government's disclosures in the case flit between what happens in practice and the hypothetical case so much that it's difficult to say definitively from the tribunal's conclusions that GCHQ fully complies with the law.

Only a technicality?

What about the claim the breach was merely a technical one? The issue of disclosure about data-sharing practices and privacy, and the practices themselves, are closely intertwined in law. Before data sharing or surveillance can be permitted under Article 8 of the European Convention on Human Rights (the right to respect for private life) they must be "in accordance with law", and the law in question must be publicly accessible.

In this case the Intelligence Services Act 1994 refers to safeguards in "arrangements" by the agencies. The tribunal found that the previously unpublished arrangements were insufficiently transparent and therefore breached Article 8. In other words, there was a breach of privacy because of the lack of transparency, rather than there being no breach of privacy per se.

What is certainly true is that we have no reason to believe that anything has changed at GCHQ. In fact the more striking aspect of all this was that the tribunal took documents that the government itself produced during the hearing as providing the necessary degree of disclosure and assurance for the future.

Matters do not end here. The question will now go to the European Court of Human Rights where both the "arrangements" and the Investigatory Powers Tribunal's own process are likely to be challenged.

Ian Leigh does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Two years after Edward Snowden's allegations concerning mass surveillance, the Investigatory Powers Tribunal, the UK intelligence agencies complaints tribunal, has ruled that the manner in which the UK's… Ian Leigh, Professor of Law, Durham University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/33717 2014-11-06T12:28:40Z 2014-11-06T12:28:40Z Intelligence world is an onion: the more layers you strip away, the more likely you are to cry

Keeping too many secrets will come back to bite you in the end. GlebStock/Shutterstock

One method for safeguarding online anonymity is Tor, "the onion router", whose name comes from its method of adding and stripping away encryption layer by layer as messages pass from one node to another in the network en route to their destination.

This image of peeling back layers could equally describe the task of trying to establish whether intelligence agencies comply with the law. This is an onion that is, a few layers down under its outer shell, giving off a distinctly mouldy smell.

Any government intrusion into citizens' lives that breaches their human rights should be proportionate – and only made when necessary to safeguard national security or public safety. In the days before the internet this was relatively easy to regulate. Post and telephone calls could only be intercepted in the UK on the basis of a warrant signed by a minister, or in some countries a judge. But the digitisation of practically everything has transformed this process, with the opportunity to "just collect everything" quite possible if the agencies have the will and resources to do so.

The tranche of documents released to the media by whistleblower Edward Snowden has demonstrated the extent to which that will exists.

We knew that material could be obtained from ISPs, telephone companies or the postal service under powers granted by the Regulation of Investigatory Powers Act 2000 (RIPA). We did not know that intelligence agencies also obtain this data by directly tapping the fibre optic cables or the servers and networking equipment at exchanges and data centres – done apparently without the companies' knowledge.

We do not pay for the services we use every day – Google, Facebook, Microsoft, YouTube – except with our personal information. But whether or not we "volunteer" this information knowingly to companies, this does not imply our consent to it being routinely available to governments.

The rapid growth of social media brings into sharp relief concerns about the misuse of personal data. A TNS poll in the UK found that 55% were concerned about the activities of search engines such as Google, 60% were concerned about social media such as Facebook and 43% were equally concerned about intelligence agency monitoring. And rightly so, it seems.

The Snowden files also give us insight into the collaboration between national intelligence agencies, especially between the five Anglophone nations within the UKUSA agreement from 1946, the formal basis for co-operation that began in World War II and continues into the present.

It has long been suspected that this co-operation was a way in which country A could get around legal restrictions on information gathering at home by receiving the information it sought from the foreign intelligence service of country B.

After the release of the Snowden papers, the parliamentary Intelligence and Security Committee (ISC), a key part of the oversight and regulation apparatus of British intelligence, issued a statement that the allegations GCHQ had illegally accessed material gathered by the NSA were unfounded. Its claim that in every case there was a ministerial warrant failed to reassure anyone outside government, however, and the ISC eventually announced that they would inquire more widely into the issues of privacy and security raised by these revelations.

These are the claims that have now come back to haunt the government, after Liberty and Privacy International challenged the legality of GCHQ's interception practices before the Investigative Powers Tribunal, which hears complaints about improper use of RIPA to conduct surveillance.

Instead, the documents now revealed in court have exposed how false the ISC's statement in response to the Snowden files was. In fact GCHQ can and does request and receive raw unanalysed bulk data from NSA, and others, with no warrant required if it were not feasible to obtain one in the UK.

This is not surprising to people who study international intelligence co-operation given the complexity – and secrecy – of the arrangements in place. However, this slow striptease of information indicates how inadequate the current law and system of oversight and accountability is. The senior judge with responsibility to oversee interception under RIPA describes the Act as "difficult for anyone to get their head round" and notes that "a reader's eyes glaze over before reaching the end of Section 1, that is, if the reader ever starts."

Bringing about better, clearer laws and more robust oversight of the intelligence agencies will be considerably more difficult and cutting into this mouldy onion will be enough to induce tears.

Peter Gill is a member of Amnesty International and Liberty
 One method for safeguarding online anonymity is Tor, "the onion router", whose name comes from its method of adding and stripping away encryption layer by layer as messages pass from one node to another… Peter Gill, Honorary Senior Research Fellow, University of Liverpool Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/33790 2014-11-05T11:21:27Z 2014-11-05T11:21:27Z Better locks to secure our data are the inevitable result of too many prying eyes

It was bound to happen eventually. wk1003mike/Shutterstock

Robert Hannigan, the new head of British signals intelligence agency GCHQ, has accused technology companies of aiding terrorists and criminals by providing them secure communications through their products and networks.

Far from adopting a conciliatory tone following last year's revelations from documents leaked by Edward Snowden about government spying on citizens, the intelligence chief has doubled down, railing against companies like Microsoft, Google, Facebook, Yahoo and Apple for what some will see as trying to balance user privacy against the rapacious demands of the surveillance services.

Hannigan's statement is bound to rile some. Privacy, he says, has never been "an absolute right". Extremist groups are using the liberties granted them by the web: while some have been harboured by dark areas of the net in the past, ISIS instead uses the internet to openly "promote itself, intimidate people, and radicalise new recruits."

Last month Apple released iOS 8, the latest version of its mobile phone and tablet operating system, with encryption for the phones contents enabled by default. This led to outcries from the FBI that it would make their work harder, while a Chicago police chief claimed the iPhone would become to "choice of phone for paedophiles".

The fifth version of Google's Android operating system, codenamed Lollipop, is released next week with similar security upgrades. Besieged by thefts and leaks of anything from intimate photos to financial data, users might legitimately ask why it has taken so long.

The protection for digital files on computers or phones provided by file attributes and content types has barely changed in decades, and is based on concepts of stand-alone computer systems, and with little thought on keeping things truly private. This works well from a corporate point of view, where we can keep backwards compatability and allow IT department administrators to keep full control.

The firms creating mobile devices, however, have different issues, as their devices are on the move, and often stolen or mislaid. The internet itself is built from the protocols used in the days of mainframe computers and teletype terminals, with little thought given to protecting data as it is stored and transmitted. Now more connected, more mobile than ever, we carry our most sensitive data with us all the time: what was once protected by firewalls and physical security is now in our pocket.

With mobile phones increasingly integrated into our lives, the devices need to be more protected that our traditional desktop computers. So Apple and Google now find themselves with consumers who will switch mobile devices to keep up to date, without many decades of previous operating systems and application software to maintain compatibility with – the ball and chain around Microsoft's neck, particularly. With the power and speed of even mobile phone hardware now considerable and growing all the time, the days when a special maths chip was needed to perform complex cryptography are gone.

This tension between law enforcement and the right to privacy remains unresolved. The FBI currently see the status quo, where major tech companies are persuaded or brow-beaten into cooperating with police and security agencies under the PATRIOT Act, as necessary to pursue criminals and terrorists. In the UK the Regulation of Investigatory Powers Act 2000 (RIPA) defines what information of citizens that law enforcement can access, with the support of a warrant.

In both cases this will undoubtedly become harder with encryption-by-default, and the same tension exists with encrypted and anonymised "dark net" service Tor, where law enforcement are scared that crime can go un-noticed, whereas privacy advocates promote the privacy capabilities it offers. But the introduction of improved security is a predictable response to a situation in which the agencies headed by Hannigan's predecessors and fellow spooks have been seen to ease themselves past those safeguards to citizens' information that remain.

Bill Buchanan no recibe salario, ni ejerce labores de consultoría, ni posee acciones, ni recibe financiación de ninguna compañía u organización que pueda obtener beneficio de este artículo, y ha declarado carecer de vínculos relevantes más allá del cargo académico citado.
 Robert Hannigan, the new head of British signals intelligence agency GCHQ, has accused technology companies of aiding terrorists and criminals by providing them secure communications through their products… Bill Buchanan, Head, Centre for Distributed Computing, Networks and Security, Edinburgh Napier University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/33812 2014-11-04T17:33:18Z 2014-11-04T17:33:18Z GCHQ: ask yourself not how to defeat our privacy tools, but why we feel we need them

Watching you, watching me. PublicDomainPictures

The language Robert Hannigan, the new head of GCHQ, uses in his opening statement is well considered in his appeal to openness, democratic values, and the need for corporate responsibility towards helping the security services.

"I understand why they have an uneasy relationship with governments", he writes:

They aspire to be neutral conduits of data and to sit outside or above politics. But increasingly their services not only host the material of violent extremism or child exploitation, but are the routes for the facilitation of crime and terrorism.

It's an important part of the on-going debate about privacy and security, but I suspect the piece has been read, tweaked and perfected by many eyes. It is a piece of political public relations. A strategic communications weapon, if you like, from the agency for whom communications – yours, theirs – is what they do.

Certainly Hannigan is right when he writes about misuse of data, and the increasing pressure that companies and governments are under to demonstrate that they handle it properly. Already, firms that directly or indirectly make money from advertising have done so under shady and sometimes illegal premises, such as the court case over Phorm advertising trialed by BT. The commercial application of techniques used to mine people's electronic data are intrusive, growing in sophistication and poorly understood by the public.

But companies will respond to customer demand. Clearly the growth of privacy-friendly technologies is because customers object to the corporate world's interest in their data, just as they distrust intelligence services and the national governments that direct them. They are capitalising on a market opening.

Apple and Google introduced encryption for their mobile operating systems because organisations supposedly accountable to democratic oversight abused their position. Citizens' lack of trust is a correct and proper response to a coterie of intelligence security services conspiring – a sinister word, I know, but accurate – to gather extraordinarily large amounts of data on their citizenry.

In fact the scale of surveillance surprised nearly everyone, from computer scientists, privacy lawyers, industry watchers and critically engaged academics to some politicians themselves.

Hannigan is correct in stating privacy is not an absolute right. He will not find a serious privacy campaigner that disagrees with him, because no one believes that privacy trumps all. This is because, in a liberal democratic society, privacy is a qualified right. The question is whether GCHQ has a good reason for such excessive measures and whether it should be able to do so employ them without oversight.

I believe this is by some margin a step too far, and deeply undemocratic. The task facing society is to build greater public accountability into the system while being able to make best use of relevant intelligence. Demanding surveillance without oversight is not good enough.

It's important, however, that we do not fall into the habit of casting security services in a cartoon-ish role of sinister organisations. The abuse of surveillance tools is enough concern without adding any excessively dystopian amplification. Recall that security services forced businesses to hand over data under secret orders, tapped privately-owned cables carrying citizens' communications, and gathered and stored data from telephone calls, internet searches and websites visited to analyse these at will.

This was done without public oversight or consent. As recent revelations in the Investigatory Powers Tribunal highlight, the legality of this is questionable because these activities circumvent UK laws on the need for a warrant to conduct surveillance.

Hannigan's article makes generous use of appeals to democratic principles, but they are precisely what the powers he would see his agency awarded would undermine.

Andrew McStay receives funding from ESRC and is affiliated with Open Rights Group.
 The language Robert Hannigan, the new head of GCHQ, uses in his opening statement is well considered in his appeal to openness, democratic values, and the need for corporate responsibility towards helping… Andrew McStay, Senior Lecturer in Media Culture, Bangor University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/29069 2014-07-11T05:15:46Z 2014-07-11T05:15:46Z Proposed data surveillance law will allow for a broad national debate – so don't knock it
In a surprise move, the coalition government has announced a fast-track piece of legislation, designed to oblige Internet and mobile telephone service providers to retain the meta-data of call, text, and Internet activity of their users.

David Cameron has stated the need to act quickly in ensuring national security, citing current events in Iraq and Syria as reason not to scale back our capabilities for data interception. The early response to this move has been backbench dissatisfaction with a perceived rushing of parliamentary protocol, effectively stifling the opportunity for public debate before the summer recess. This response is, however, very narrow-minded and fails to recognise the broader shaping of the issue following the next general election.

The collection of meta data has, since the Edward Snowden revelations in 2013, continued to grow as a controversial issue on both sides of the Atlantic. Public disquiet about the ability of intelligence services to access the details of telephone and internet usage has resulted in major moves both in Washington and Whitehall to address the issue and curtail the activities of the intelligence services.

In Whitehall this even resulted in the first televised session of the Intelligence and Security Committee, where the heads of Britain's three services – SIS, MI5 and GCHQ – took questions on matters raised by Snowden's leaks.

Sunset clause

While criticism has emerged from backbenchers about the speed of passage in this legislation, another criticism has yet to be raised. This is the concern that the government is actually legalising activity that benefits intelligence collection both for law enforcement purposes and for national security. This carries echoes of the controversy in the 1980s over MI5 operations, focused at the time on the perceived ability for that service to tap telephones and break into the homes of anybody it chose. That activity was formalised in the 1988 Security Service Act, the key criticism of which was that it simply legalised official burglary. A similar criticism of this latest legislation should be expected.

 <img alt="" src="https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=326&fit=crop&dpr=1 600w, https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=326&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=326&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=410&fit=crop&dpr=1 754w, https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=410&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/53563/original/56xgrkr4-1405018625.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=410&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Backbench concern: Tom Watson on Twitter. Twitter

This criticism should rightly be kept in mind, however a key detail that has so far eluded analysis in the coverage of this legislation has yet to be dealt with, which serves to mitigate the previous criticism of such legislative attempts. This is the two-year shelf life of the bill, announced by Downing Street as the "sunset clause" ensuring that this piece of legislation expires at the end of 2016. This will force the next government to revisit the issue and legislate again during the next parliamentary cycle.

This clause is hugely significant, in that it creates the opportunity in Britain for a prolonged and engaged public debate on the regulation of data collection, leading to the development of robust and enduring legislation. The issues of privacy, the right to forget, the regulation of data collection and the ability to ensure national security through enabling our intelligence services to function, can all be addressed in full measure.

The government has effectively adopted the same measure as it did for discussion on the Trident nuclear replacement – it has deferred the debate until long after the next general election.

Deferring the debate has received criticism, notably from the shadow home secretary, Yvette Cooper, who raised the question why can we not debate the issue now? She cites that the European Court ruling – which this legislation is being introduced to counter – as having taken place in April, meaning that plenty of time existed for discussion. There is some justification to her argument that the debate could have started several months ago with this development – and that the coalition has already been too slow.

Time for a broad debate

But the decision to defer does carry significant advantages: first is that a prolonged public debate can emerge that makes use of full parliamentary process, at a time which avoids being an primary election issue. As well as this, the fact that it is tabled for a period following the next national security and defence review which is scheduled for the autumn next year means that such a debate can be framed around an up-to-date assessment on the national security requirements that Britain faces. And unlike at present, where the implications of this legislation cannot be robustly analysed, deferring this debate prepares us for what lies on the horizon.

What lies on the horizon is that a dramatic shift in the legislative regulation of data collection will be coming this decade; one that will shape the online behaviour of Britons in dramatic ways in the future. It will also represent a potentially dramatic shift in how we legislate the activities of our intelligence services, the like of which has not been seen in more than 20 years.

It is rare to enjoy a position of advance notice of a major policy and legislative issue. So rather than lament the lack of consultation over this temporary piece of legislation, right now attention should turn to the future opportunity presented. This is that the government has shaped a possible timetable and agenda for this major issue to be properly debated. Preparation must now turn to establishing how we want to shape this debate as we move ahead to 2016.

Daniel Steed does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 In a surprise move, the coalition government has announced a fast-track piece of legislation, designed to oblige Internet and mobile telephone service providers to retain the meta-data of call, text, and… Daniel Steed, Lecturer in Strategy and Defence, University of Exeter Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/26540 2014-05-13T16:25:36Z 2014-05-13T16:25:36Z In a post-Snowden world, can we afford to criticise Clarkson?

Anyone could be Clarksoned these days. Mark Hooper, CC BY-NC-SA

Jeremy Clarkson is in the soup again for saying the wrong thing. This time he has been accused of using deeply offensive, racist language, in a Top Gear outtake two years ago.

The usual gang of anti-Clarksonites and more than a few others have lined up to demand the BBC fire him. Perhaps surprisingly, members of the government and some in the media not otherwise known as Clarkson fans have offered him qualified support.

Television presenters have long faced the threat of old footage being dug up an used against them. Now, though, we all have to worry about it. Unless you've spent the last two decades saying nothing bad about anyone, you could find yourself in the soup too.

We all love a good witch hunt, as long as we are not the one being hunted. But could any of us withstand the kind of scrutiny Clarkson's misspoken offence, recognised at the time but resurrected two years later, was subjected to? To be blunt, we are going to have to.

Soundbite politics, the 24-hour news cycle and our short attention spans mean that words and phrases are taken out of context and wielded as weapons to demonise and misrepresent opponents, shout insults past each other, blame and preferably punish someone.

And more importantly, for the best part of the past 25 years, commercial companies have been recording, storing, processing and analysing everything we see and do online.

Since the 2006 EU Data Retention Directive, telecommunications service providers have been obliged to store details of, and provide government access to, everything everyone does on the telephone or internet for a period of between six months and two years.

We've also discovered in the past year via the revelations of former NSA contractor, Edward Snowden, that governments, in particular the UK and US variety, have been going much further, watching and recording our networked lives in even more detail than previously realised. All telephone and internet traffic is being collected, processed and stored, nominally for current or potential future use in the fight against terrorism or serious crime.

Anyone's complete online life history can be examined in forensic detail. Just one of the problems with these mass commercial and governmental silos of personal digital life histories is that small items can sit like unexploded ordnance in your record. They can be taken out of context at any time and cause serious damage.

Most of us don't have Clarkson's public profile but, as Cardinal Richelieu is rumoured to have said: "Give me six lines written by the most honest man and I'll show you the evidence to hang him."

And even if we've never said anything offensive ourselves, which of us knows what nefarious activities people connected to people connected to people connected to us via the internet might have engaged in at some time?

Chris Inglis, former deputy director of the NSA, told Congress in July 2013 that you don't need to be a suspected bad guy to gain the attention of the intelligence services. The NSA track people "three hops" from their targets.

If I had communicated with 200 people during my online lifetime I'd be three hops away from more than 5m people. And most of us interact with far more than that.

Europe divided

In a historic decision on April 8, the Court of Justice of the European Union hinted that all this amounts to mass surveillance when deciding to invalidate the Data Retention Directive. Several European countries had already taken steps to overrule the directive. The UK government, by contrast, has decided the UK data retention regulations will remain in force whilst they consider what to do about the ruling.

The Court of Justice of the EU noted in its decision that the fact that anything we say or do is being recorded is likely to have a chilling effect on our freedom of expression.

I don't find casual laddish racist remarks at all funny. I find them offensive. They cause division, discrimination and tension. But Clarkson misspoke, by accident, two years ago, when recording a popular TV programme. The trademark of said programme is three middle-aged men, acting like big kids, mucking about with cars and laddishly insulting people for laughs.

Clarkson has apologised for inadvertently using a word he says he personally loathes. The motives of those who leaked the recording are not known.

I have no idea whether he is racist, though I suspect he isn't. Intended or not, ill-used words do cause damage but it is the presence or absence of hateful intent behind such remarks rather than the words used that define the mindset of the speaker. We can't read minds so we interpret that intent, by proxy, from people's words.

Nevertheless, I would suggest that he or she who wishes to throw metaphorical stones at Jeremy Clarkson think also of the many stored and detailed digital dossiers they have created in their own digital life and how fragments thereof might well, one day, be held against them.

Ray Corrigan is affiliated with The Open University. I have in the past consulted for the UN's World Intellectual Property Organisation (WIPO) and the consumer watchdog, Consumer Focus. I have contributed to NGOs such as the Open Rights Group and the Foundation for Information Policy Research. I am a signatory of a variety of human rights instruments and petitions such as the International Principles on the Application of Human Rights to Communications Surveillance https://en.necessaryandproportionate.org/text
 Jeremy Clarkson is in the soup again for saying the wrong thing. This time he has been accused of using deeply offensive, racist language, in a Top Gear outtake two years ago. The usual gang of anti-Clarksonites… Ray Corrigan, Senior Lecturer in Technology, The Open University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/24241 2014-03-12T06:38:08Z 2014-03-12T06:38:08Z The internet is on fire but Snowden's heroes can't save us

Someone get a fire extinguisher! Just, you know, maybe not Mark Zuckerberg. cibomahto, CC BY-SA

Just ahead of the 25th anniversary of the World Wide Web, Edward Snowden has sent what he hopes will be a strong message to the powers that control the internet in a video link streamed live to South by Southwest event in Austin, Texas.

Snowden pitched his appearance as a call to arms. The NSA is ["setting fire to the future of the internet"](http://techcrunch.com/2014/03/10/snowden-the-nsa-is-setting-fire-to-the-future-of-the-internet/ and those who understand how the nuts and bolts of the web work must step up to be our firemen.

His words have resonated with a lot of angry people. Revelations about the NSA's Prism project have confirmed many people's worst fears. The internet grew up in a culture of anti-authoritarianism, bottom up consensus and the rule of standards but it has been co-opted by powerful states that undermine those values and challenge our human right to private communications.

We might have expected this type of behaviour from authoritarian regimes but there was an assumption that in liberal states, where the promotion of human rights online has been championed, we wouldn't be subjected to this kind of invasion of our privacy. But the recent revelations that GCHQ was storing images from Yahoo chat (many of which were sexually explicit) put paid to the notion that even the most private online interactions can be secured.

The extent to which the NSA and GCHQ have been monitoring not only suspected wrongdoers but ordinary citizens exposes some deep concerns about the accountability of intelligence organisations – a frustration that led Edward Snowden to leave his comfortable life as a security contractor and reveal what had been happening last year.

Where do we go from here?

At SXSW, Snowden urged those who build websites and develop the services on which we rely to take action. For him, these are the people best placed to enhance our privacy. He said they should develop more effective encryption and encourage the companies they work for to make it readily available to the average user. Using an anonymising tool like The Onion Router (TOR) is fine for those determined to protect their online profile, for example, but it is beyond the capacity or inclination of many average users. This is where innovation from the private sector can help, just like Snowden proposes.

We shouldn't be surprised to hear an engineer proposing technological solutions to what are essentially political problems. His response is common and rational. But it ultimately ignores the ambivalence most people feel about whether it should be the job of private companies or states to protect our civil liberties online.

Clearly, most people have not been communicating online in the understanding that quite so much of their data has been retained and stored by Western governments. We do give it away for free to tech companies like Google and Facebook though, and perhaps that's why Snowden thinks we are more comfortable handing them more responsibility.

This of course, happens in a framework of commercial exchange. In return for the search engines and social networking tools we use every day, our personal data becomes a currency which is sold on to allow for targeted advertising. We are all complicit in this arrangement but few of us really understand what happens to our data and who has access to it. While these companies watch us, who is watching them?

Perhaps Snowden is hoping an organisation like the Global Network Initiative is will step in to save us. This industry led organisation comprised of a number of the information giants – Google, Yahoo, Facebook – has developed standards and practices for how companies should deal with requests by governments to hand over data.

Presumably, the GNI was a response to requests made in response to demands for information from governments in places like China and the Middle East. But where was the GNI when PRISM was on the prowl?

None of this will sit well with citizens if Snowden wants us to rely on the technical community to secure our privacy. How we want the internet to be governed over the next 25 years and beyond is a political question. It will take much more engagement with processes that can offer accountability and representation. It's unlikely that leaving it to the market is a long term solution.

Madeline Carr does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 Just ahead of the 25th anniversary of the World Wide Web, Edward Snowden has sent what he hopes will be a strong message to the powers that control the internet in a video link streamed live to South by… Madeline Carr, Lecturer in International Politics and the Cyber Dimension , Aberystwyth University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/23842 2014-03-03T06:02:11Z 2014-03-03T06:02:11Z How to protect yourself when GCHQ goes for your webcam

GCHQ has been making friends online. Shame it didn't tell them. Magic Madzik, CC BY

News that government intelligence agency GCHQ has been intercepting and storing webcam images from 1.8 million users of Yahoo's chat service under the codename Optic Nerve is a reminder of how close we are to living in a surveillance state. Webcams, embedded in laptops and sitting on top of monitors, have become a standard piece of computing equipment, but it has now become clear that these can be used against us.

Hackers have been stealing webcam images of unsuspecting users for some time. The Metasploit tool comes with packages that make it easy for even a novice hacker to gain access to the webcam of any computer that doesn't have all of the available patches and updates installed.

Equally worrying are reports that hackers could use the webcam on your laptop without even triggering the embedded warning light that indicates to the owner that the camera is in use.

Once they've gained access to your webcam, a hacker can then go on to trade or sell access to it on hidden websites and password protected chat rooms.

How GCHQ did it

But now it seems we have another unwelcome guest watching us as we type and chat. And what makes the actions of GCHQ unique is the scale on which it is capturing these images.

The Edward Snowden leaks revealed that GCHQ is tapping many of the large internet backbone cables that carry hundreds of gigabits of information from computers all over the world every second, including unencrypted Yahoo chat sessions.

GCHQ's main technical achievement was to find a way of scanning this massive amount of data and extracting the webcam images. While easy to do for a single image, the scale on which GCHQ did this must have taken a great deal of both technical expertise and computing power.

The second issue GCHQ had was how to store so much data. Here compromises were made. Only one still image from every five minutes of video was stored. GCHQ's aim was to view images from known targets (or users with screen names that were similar to known targets). It also experimented with face recognition technology to try to detect images of known suspects. But the leaks published by the Guardian make it clear that many of the images stored were from highly private, and in some cases sexually explicit, chats between individuals who were not intelligence targets.

Alternatives for Yahoo deserters

The best way to protect the privacy of your webcam chats is to make sure that they are encrypted. Yahoo's web chat server was based on its Yahoo Messenger system, which dates back to the nineties. This legacy system has never supported encryption and it was this weakness that made it possible for GCHQ to harvest personal images on such a large scale.

Google's offering, Google Talk, was developed much more recently and is possibly a better option in these post-Snowden times. The service encrypts data between the user and its servers, and then re-encrypts it when it is sent to another user. This would make the mass harvesting of images harder, but still allows Google access to the images. So in some ways you are more protected, but it means putting faith in Google to keep your data away from prying eyes.

Apple's FaceTime encrypts the images end-to-end, all the way from one user to the other, giving the best level of protection. That said, incidents such as the recently discovered "goto fail" bug in Apple's encryption remind us that any protection system can fail.

The best option of all would be for some discussion about how we strike the balance between personal privacy and national or international security. According to the latest leaked documents, GCHQ staff have been viewing intimate images of webcam users who were not intelligence targets.

This would be illegal if a hacker had done it but it is likely that GCHQ's actions are legal under the UK Regulation of Investigatory Powers Act. Even so, it seems doubtful that the mass collection of intimate images of innocent people was something that the authors of this law intended. We need to think about whether we can update this and other laws to better suit the digital age. That means better suited to everyone, rather than just GCHQ.

The University of Birmingham, where the author works, is a "GCHQ Academic Centre of Excellence".
 News that government intelligence agency GCHQ has been intercepting and storing webcam images from 1.8 million users of Yahoo's chat service under the codename Optic Nerve is a reminder of how close we… Tom Chothia, Lecturer in Computer Science, University of Birmingham Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/22610 2014-02-04T15:30:01Z 2014-02-04T15:30:01Z Ministers exploit legal grey area to justify GCHQ spying

All eyes are on GCHQ as it justifies its spying activities. Campaign Against Arms Trade

A debate is brewing after a report submitted to MPs suggested that GCHQ has been breaking the law by conducting mass surveillance on UK citizens.

In the red corner sits public law barrister Jemima Stratford, many of the MPs who commissioned her advice in the first place and, of course, Edward Snowden. In the blue corner we have GCHQ and foreign secretary William Hague, who has argued that the agency operates solely within the boundaries of the law.

The legal provisions in question in this case are remarkably obscure. This is not because they are ancient or unusually lengthy but because, when the statutes that govern these organisations were developed, two inconsistent objectives came into play.

On one hand, the government wanted to give democratic legitimacy to an agency – GCHQ – which had been formed in utmost secrecy during wartime. On the other, they needed to hide two big secrets in plain view.

The first secret was the precise nature of the ever-changing technologies of surveillance and the vast government agencies that develop and employ them. The second was the extent of international intelligence cooperation in particular under the historic transatlantic arrangements for sharing signals intelligence with the NSA.

When torn between legitimacy and secrecy, parliamentary drafters choose terminology that is designed to obfuscate. In this instance, the grey area is to be found in the statutory definitions in the Regulation of Investigatory Powers Act 2000, or RIPA for short. The government is keen to point out that GCHQ acts within RIPA and its charter.

As Stratford and her co-author Tim Johnston argue in their 33-page legal opinion for the All Party Parliamentary Group on Drones, this may be correct, but the elasticity of some of the concepts gives ample scope for activities that could violate human rights.

Central to the current debate is the distinction the RIPA provisions draw between interceptions of communications warrants, which must identify specific targets for surveillance and are approved individually, and "authorisations" for interception of external communications, such as when the originator or recipient of the communication is outside the country. These external communications authorisations, approved by the Foreign Secretary, need only specify general categories of information and are then subject to less rigorous controls over the examination of material obtained. The interception of metadata is likewise subject to lighter regulation and can be undertaken by a number of public agencies, subject to the approval of a magistrate.

The legislation does contain safeguards against the use of external communications warrants as a substitute for targeted interception of internal communications. But, crucially, RIPA does not distinguish between metadata and content in a way that corresponds to current technologies.

As a result, the weaker controls over gathering metadata allow for the collection of much personal information that a decade ago would have only been available under the stricter regime. Nor does the legislation contain any effective safeguards against the transfer of intercepted material to overseas agencies such as the NSA, or deal adequately with controls over material flowing the other way.

When challenged, officials like to point out that the UK system of surveillance and oversight has been found to be compatible with the European Convention on Human Rights. This is partially true but also quite misleading. The European Convention sets, at best, some rather minimal standards for surveillance and should not be the limit of parliament's ambition in regulating surveillance.

The European Court of Human Rights has found that the legal regime in RIPA for interception of internal communications is sufficiently clear to meet the standards of Article 8 of the European Convention. It is important to note, however, that the court's reasons were influenced by the targeted nature of internal surveillance in which warrants signed by ministers denote named persons and premises. There is nothing here to suggest that the court would approve of bulk electronic interception.

The court has also looked less favourably on GCHQ's mass surveillance of phone traffic between Ireland and England in the past by tapping into underwater cables. Its ruling that GCHQ lacked a legal basis and violated human rights in doing this should be taken as a significant indicator of how the court might approach the current allegations being made against GCHQ over mass surveillance. If Snowden is to be believed, the equivalent procedure is still practised by GCHQ and other intelligence agencies to obtain access to internet traffic passing through key cables.

In response to the growing concern about GCHQ surveillance, ministers have offered general reassurance and pointed to the largely irrelevant warrants. Since the allegations centre on mass surveillance by GCHQ involving interception of external communications and collection of metadata, this amounts to evasion rather than a meaningful response.

The Intelligence and Security Committee of Parliament came out with an initial defence of GCHQ and its practices but, in the face of mounting public concern, it has now initiated an inquiry into the adequacy of the legal regime for surveillance. At least it is asking the right questions, even if the government continues to duck them.

Ian Leigh does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 A debate is brewing after a report submitted to MPs suggested that GCHQ has been breaking the law by conducting mass surveillance on UK citizens. In the red corner sits public law barrister Jemima Stratford… Ian Leigh, Professor of Law, Durham University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/22552 2014-01-29T13:56:05Z 2014-01-29T13:56:05Z Angry Birds will have angry users until privacy rules are clear

Would you trust this guy with your personal data? tomazstolfa

It was reported this week that the NSA and British intelligence agency GCHQ have been gathering information from popular apps including David Cameron's favourite game, Angry Birds.

According to the Guardian, the spy agencies have been working since 2007 to develop the means to take advantage of "leaky" smartphone apps by sucking up user details when they are transmitted across the internet. This could include usernames and location as well as make and model of the phone being used. It is even being suggested that highly sensitive information such as sexual orientation can be gathered.

As the app market grows ever bigger and more small companies get in on the act, these latest revelations raise important questions about who is responsible for user privacy and protection when an app is developed.

What they know about you

Any company that is in the business of selling a mass-market product will be interested in gathering as much information as possible about the consumers in the marketplace. In most cases, gathering this information would involve getting some subset of the consumers to participate in a survey and use statistical analyses to extrapolate the results to the wider population.

But these techniques are expensive and difficult to implement because they require the active participation of the consumers. They need to be convinced to give up their time to fill in surveys or even take part in a face-to-face interview. That all costs time and money for the business.

This has all changed in the world of smartphone applications. App producers have the unique capability to passively gather a lot of information about their consumers because their products are necessarily used on an internet connected device. These devices have increasingly sophisticated sensors and, as a result, companies can very easily find out when you use their application, for how long and even what type of device you are using.

With a little additional effort they can also access information such as your contact list, call history, location, the list of other applications you have installed on your phone and which of these are running at the same time as theirs. The developers find this information useful because it allows them to figure out how to make their application better, such as by working out what makes it crash.

There are also a number of software services, such as Flurry, that provide data analysis services using this data to infer additional information such as gender, age and area of residence by combining the data gathered across multiple application providers.

The fact that all this information can be collected and transmitted across the internet means that it is vulnerable to intercept by other parties. And that includes national intelligence agencies.

You read the terms and conditions, right?

Different approaches to help mobile application developers think more systematically about the security and privacy implications of their software as they work have already been suggested. For example, the Canadian Information Commissioners office developed an approach called Privacy by Design and the mobile operators' interest group the GSMA developed a set of design guidelines for mobile app developers that are based on a number of privacy scenarios.

These are useful to many but they do still require developers to think about privacy at every step of the way and, crucially, to be able to explain the privacy issues relating to their product in a way that is understandable to users.

This means it is up to the end user to check the terms of the licence agreement and understand the security and implications of the behaviour of the app. Of course this isn't a very practical approach since most end users don't have the expertise, or inclination to do these checks. App developers generally get your permission for gathering personal data as part of the end-user license agreement you accepted when you downloaded the app, but probably didn't read.

Angry users

When a high-profile game such as Angry Birds turns out to be yet another vehicle for spying, users naturally become more aware of threats to their privacy. But in this case and many others, ignorance may prevent them from taking measures to protect themselves. Even though they know there is a problem, they don't have the knowledge and means to do anything about it. How do they identify which apps have these vulnerabilities against those that do not?

This lack of ability to control our own privacy is an issue that must be addressed and different options have been mooted.

Bringing in Privacy Nutrition Labels that help users get a quick understanding of what data an application gathers is one. Another is a system through which developers build an argument as to how their application meets the privacy needs of end users, which app marketplace platforms could use as the basis for certification.

The terms and conditions of apps are often fluid and need to be amended over time. They are, by their very nature, difficult to understand and unlikely to be read. This means that until we make it easier for users to enter into contracts with app developers with their eyes open, breaches like we've seen with Angry Birds will continue to happen.

It seems unlikely that people will stop downloading blockbuster games on their phones over fears they will be spied on. But of course one group of people may well do just that – those the NSA and GCHQ want to target the most. They may become hyperaware of the dangers of taking a break with Angry Birds and stop using these applications altogether. That still doesn't mean you can skip the terms and conditions reading, though.

Arosha K Bandara receives funding from the European Research Council, the EPSRC and the Qatar National Research Foundation.
 It was reported this week that the NSA and British intelligence agency GCHQ have been gathering information from popular apps including David Cameron's favourite game, Angry Birds. According to the Guardian… Arosha K Bandara, Senior Lecturer, Department of Computing, The Open University Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/22318 2014-01-27T14:26:55Z 2014-01-27T14:26:55Z Data surveillance is necessary, but we must have transparency

Who's viewing your metadata? Adam Fagen

The latest intelligence documents published by The Guardian tell us that the US National Security Agency (NSA) is harvesting up to 200 million text messages a day under the DISHFIRE programme, and that the UK Government Communications Headquarters (GCHQ) can "mine" this hugely rich source of data. These are the revelations come courtesy of former intelligence contractor Edward Snowden, who has exposed methods of communications interception to an unprecedented extent.

Despite the wailing and gnashing of teeth that has greeted Snowden's revelations in the US, his disclosures have prompted the establishment of a presidential review and a speech by Barack Obama on how he proposes to change NSA policy and practice.

In the UK, however, ministers have simply repeated assertions that the system for regulating intelligence collection is "probably the best in the world". Parliament's Intelligence and Security Committee (ISC) reported in mid-July that GCHQ had not acted illegally by accessing the NSA PRISM programme, but said that it would look further into the adequacy of current law. Three months later, the ISC broadened its inquiry to include "the appropriate balance between our individual right to privacy and our collective right to security" and invited evidence from interested parties.

No-one has doubted the legitimacy of governments carrying out "targeted" surveillance of those against whom there is some level of suspicion. Where there has been some shock and dismay is at the discovery that governments collect seemingly everything.

Who touched my data?

The preventive logic of intelligence work has always led agencies to collect as much information as possible: "you never know what you might need tomorrow". But achieving total surveillance has only become remotely realistic with the growth of digital communications, which provide the "electronic exhaust" of our lives. The ability to collect, store and search all this information has coincided with an increased demand for intelligence from western governments who, particularly since 9/11, have lived in fear of a "new terrorism".

Compared with the relatively predictable security threats of the Cold War, this has given rise to great uncertainty as to where, precisely, the next attack might come from. No politician wants to risk being accused of ignoring some potential source of life-saving information – so bulk collection is less a question of necessity than a case of "we can, so we will".

But is this proportionate? In the TEMPORA programme, GCHQ collects 1-2 billion records a day from transatlantic fibre-optic cables. About 30% of this massive volume of communications is rejected immediately, while 40,000 "selectors" chosen by GCHQ and 31,000 chosen by the NSA (based on key words and phone numbers, among other things) trawl the rest. Content remains on the system for three-to-five days and the metadata (information about who is calling who, when, where and for how long) is stored for 30 days – though analysts can store "interesting" material in another database for up to five years.

The NSA has said that it "touches" 1.6% of internet traffic, and that analysts "look at" 0.00004%. Although the agencies have not earned a reputation for complete openness in recent months, these figures look realistic: if 2 billion records a day are "collected", even the mere 32 million that are "selected" far exceed what can realistically be analysed. That 80,000 will be "looked at" still seems barely plausible if one accepts that analysis ultimately requires a human being to decide what the communication means, however clever the software in use.

In assessing whether this scale of collection is proportionate to the threat and effective in countering it, we face the apparently irresolvable problem that evidence (rather than official assertion) of impact is impossible to obtain. On one hand, while the potential for repressive invasion of privacy is vast, evidence of its actual use barely exists outside of authoritarian regimes. On the other hand, evidence that it has prevented serious attacks is also slim: some attacks are prevented, but precisely how many (and how) is kept very secret.

So, what is to be done? Obama's recent attempt to reassure the US public that their privacy concerns will be taken more seriously may just be rhetoric. It is inconceivable that US or UK governments will legislate to outlaw bulk collection. The best we can probably hope for is some improvement in the currently inadequate system for control and oversight of current intelligence practices – but this is not a part of the ISC inquiry's remit.

Unless there is a serious examination of the need for public education in what governments do to gather intelligence and why they do it, public suspicion will persist. As things stand, any enlightenment is more likely to emerge from the non-governmental inquiry into internet governance just announced at Davos.

Peter Gill does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
 The latest intelligence documents published by The Guardian tell us that the US National Security Agency (NSA) is harvesting up to 200 million text messages a day under the DISHFIRE programme, and that… Peter Gill, Honorary Senior Research Fellow, University of Liverpool Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/20353 2013-12-27T08:06:09Z 2013-12-27T08:06:09Z Privacy 2013: from Snowden to Facebook to Amazon's drones

That's one way to get around Facebook's facial recognition. mw238

While every year since the advent of the internet has had its share of privacy stories, 2013 has been a cornucopia of news about surveillance and personal data.

Undoubtedly, the biggest story of the year was the disclosure of thousands of secret documents detailing the US National Security Agency's global surveillance activities by Edward Snowden, a former NSA contractor. In June, Snowden met with Guardian reporters Glenn Greenwald and Ewan MacAskill and filmmaker Laura Poitras in Hong Kong. During a week of interviews, Snowden revealed a surveillance apparatus so vast, and spying programmes so all-encompassing, that it began a conversation about the modern surveillance state across the globe.

In addition to disclosing the reach of these programmes, Snowden's trove of secret documents revealed the weakness of oversight for US spying, exposing the wide gulf between classic wiretapping rules and the current regime governing surveillance.

The Snowden affair

The classified documents describe the NSA's near-omnipotent abilities to read and listen to the content of electronic communications anywhere on earth. They also detail NSA systems designed to access information on Microsoft, Apple, Facebook and Yahoo servers with and without company knowledge, with and without warrants. Emails, phone call details, chat messages, stored documents – the Snowden disclosures highlight the NSA's capability and clear intent to capture and analyse any data that might implicate US security. It came to light that the US was spying on 35 world leaders including Chancellor Angela Merkel of Germany and Brazilian President Dilma Rouseff.

The documents show the NSA's concerted effort to weaken encryption standards and hardware to make them easier to break. Britain's GCHQ was also revealed to collaborate closely with the NSA, and expected to "pull its weight" in exchange for access to US intelligence.

Augmenting these stories is the cloak-and-dagger tale of Snowden himself. Only 29 at the time of the disclosure, he left a well-paid life and a girlfriend behind to travel to Hong Kong to expose NSA secrets. Fearing capture, Snowden then flew to Moscow where he remained in limbo at Sheremetyevo Airport because the US had invalidated his passport. Several weeks passed, and Snowden was granted a one-year asylum in Russia, where he remains. Each week brings a new revelation of the NSA's insatiable appetite and seemingly limitless reach as news organisations analyse the disclosures and file new stories. The conversations Edward Snowden sparked – of the tension between law enforcement, security, and privacy, and legitimate versus illegitimate spying – as well as debates of whether he is a hero whistleblower or a national traitor, rage on.

 <img alt="" src="https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=555&fit=crop&dpr=1 600w, https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=555&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=555&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=697&fit=crop&dpr=1 754w, https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=697&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/37788/original/s2tcbxvy-1386952771.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=697&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Chelsea Manning: 35 years for a lot of data. scott_bl8ke

The year also saw the conviction and sentencing of Chelsea (formerly Bradley) Manning, who in 2007 gave hundreds of thousands of secret US government cables and documents to the whistleblower site, Wikileaks. Manning, a former intelligence analyst for the US Army, had been jailed since 2010, spending nine months in solitary confinement, and in August was sentenced to 35 years in prison. Julian Assange, the founder of Wikileaks, remains under virtual house arrest within the Ecuadorian embassy in London.

Privacy law

It's been an active year of privacy and data protection policy development. The European Commission continued to grind through a massive overhaul of EU data protection rules, updating the relatively ancient 1995 Data Protection Directive. The new rules seek to strengthen consent requirements, increase data portability, improve data breach notifications, and encourage "privacy by design" principles. Fearful of disruptions to existing business models, EU member states including the UK and others have voiced significant concern, and negotiations will continue well into 2014.

The "right to be forgotten" has appeared in the EU draft regulation, aiming at helping people remove their digital traces from the internet. However, while the intent is laudable, it's a very challenging proposal – the EU's own network security agency, ENISA, reported that any comprehensive enforcement method would be impossible. Meanwhile, Kazakhstan, South Africa and Malaysia have enacted their first data privacy laws, Singapore's goes into effect next year, and Brazil is expected to pass a law shortly.

In the US, individual states have been making headway on privacy issues. Montana and Maine became the first states to require police to get a search warrant to access current and historical location data from mobile phone carriers. Similar efforts are underway in Wisconsin and other states, and two bills were reintroduced to Congress this year aimed at controlling the use and release of geolocation information. Throughout the US, a number of new state laws have been passed on issues such as email privacy and prohibitions on the collection of biometrics.

Facebook

No end of year review would be complete without mentioning privacy's favourite whipping boy, Facebook. It's been a relatively quiet year for the social network. A bill to prevent the online tracking of 13-15 year olds, extending existing prohibitions on tracking children aged 12 and under, was introduced in the US Congress citing Facebook as a specific concern. Facebook's use of facial recognition technology also spurred Congressional attention, and a US executive agency has announced plans to study the privacy implications of such technology.

 <img alt="" src="https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=237&fit=clip" srcset="https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=400&fit=crop&dpr=1 600w, https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=400&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=400&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=502&fit=crop&dpr=1 754w, https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=502&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/37789/original/7dfz7cmy-1386953088.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=502&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
 Sorry Ms Merkel, you'll have to use your real name. jdlasica

German regulators lost a legal battle with Facebook, the court deciding that German privacy laws requiring the right to use services pseudonymously did not apply to the company.

The rest

Amazon recently generated a lot of buzz after announcing it was testing aerial drones to deliver small packages. Shortly thereafter, Deutsche Post-DHL made a similar announcement. As commercial, scientific and private uses of drones start to proliferate, issues of privacy and surveillance come to the fore. In response to these issues, different drone privacy bills are moving through the US Congress. The EU has yet to take an official position.

The UN recently reported that 40% of the world would be online by the end of the year. As people become digital citizens and society becomes more electronic, the transparent, pervasively monitored character of our online lives becomes more and more apparent. Privacy researchers speak of the panopticon – a space where we can all be watched, but we do not see the watchers. The year was full of stories that showed people how naked their digital lives are, and how weak the protections of their privacy have become.

While many responded with a shrug, others were appalled, and the advocacy community continued its fight in legislatures and the courts. The nature of the internet is to share information, but the social and psychological need for privacy remains a core human trait. This tension between society and its electronic tools is an enduring feature of the information age.

Gilad Rosner receives funding from the UK EPSRC and the University of Nottingham.
 While every year since the advent of the internet has had its share of privacy stories, 2013 has been a cornucopia of news about surveillance and personal data. Undoubtedly, the biggest story of the year… Gilad Rosner, Digital Identity Researcher, University of Nottingham Licensed as Creative Commons – attribution, no derivatives. tag:theconversation.com,2011:article/21622 2013-12-19T14:01:07Z 2013-12-19T14:01:07Z Keeping tabs on Huawei raises awkward questions for everyone

Huawei's technology HQ in Shenzen. Brücke-Osteuropa

In its often fractious dealings with western governments, Chinese tech giant Huawei has been repeatedly accused of being a proxy for government espionage and other practices unbecoming of a global corporation.

Now National Security Adviser Kim Darroch has called for the company to submit to an unusually high degree of intervention from the UK government.

As a condition of doing business in the UK, Darroch said, Huawei should be closely monitored by intelligence agency GCHQ. This raises new questions about the nature of cybersecurity, public-private partnerships in business and the role of the state in both. We have found ourselves monitoring a Chinese company in a way that might make us decidedly uncomfortable if the roles were reversed.

The current debate centres around the Huawei Cyber Security Evaluation Centre in Oxfordshire. This was set up in 2010 to assess the security vulnerabilities and possible exploitation of the Huawei equipment and software that has been embedded in dozens of UK critical national infrastructure systems, from power grids to telecommunications.

The centre is known as "The Cell" and is funded and staffed by Huawei, albeit under the remit and oversight of government, which decides what to examine and how this is done. This is a considerable imposition on any company, even one well used to having to prove itself. Huawei has to toe the line more than most corporations, given long-standing western perceptions that it is a front for Chinese state and commercial espionage.

Fox in the henhouse

Huawei employees at The Cell are tasked with granting Huawei systems clean bills of health so that the company can continue to access British markets, so it is unsurprising that Whitehall and the information security industry have grumbled about foxes and henhouses.

A report by the influential Intelligence and Security Committee, published in June, recommended that existing levels of GCHQ involvement with The Cell be increased.

In his review of the situation, Darroch notes Huawei staff have been "exemplary" in cooperating with the UK government. But he concurs that GCHQ – the UK's most technically adept foreign intelligence-gathering agency and guardian of the networks – needs to exert more control over this particular fox.

Darroch rejects the ISC's suggestion that all HCSEC employees be GCHQ staff but suggests that GCHQ should take control of all senior hiring and firing. He also suggests the agency should chair an oversight board which should set and evaluate all annual HCSEC objectives. This board should have a deputy from Huawei but include other Whitehall mandarins as well as the chair. The aim of all this is to further HCSEC's "continuing independence from Huawei headquarters" which, of course, are in Shenzhen, one of the fast-growing hi-tech hubs in southern China. Darroch may of course also be making a subtle allusion to Beijing.

The public-private quandary

Darroch acknowledges that HCSEC is a "model for government collaboration with the private sector". Since the 1990s, governments have been looking to collaborate with industry over information security and critical infrastructure issues that require information-sharing in pursuit of national security objectives.

These public-private partnerships have arisen because in most countries the private sector operates upwards of 85% of the infrastructure on which national and economic security rely.

But social values and market values do not necessarily correspond. Governments are unwilling to share classified information and businesses are wary of acknowledging vulnerabilities that might undercut their bottom line. States do not wish to confer strategic advantage on another party in much the same way as a company would not wish to confer competitive advantage on another by, for example, coming clean about the insecurity of its consumer data protection processes.

The HCSEC is only one model for information-sharing but unresolved dilemmas remain. Is Huawei's willingness to assent to more GCHQ infiltration of its corporate structure a justifiable cost of doing business in the UK? Does this deal represent a prototype public-private partnership set up that could be used in the future when the government wants to keep tabs on other corporations that are deemed to be less than whiter than white?

Or is Huawei an exception, a victim of what the company has previously identified as "politically-inspired and racist corporate defamation"? Can the UK government sustain a narrative of independence from Huawei, while ignoring the fact that Huawei does not appear to be independent of GCHQ? It's not as if GCHQ will reach the end of 2013 without its own reputation, post-Edward Snowden, being somewhat less polished than it was at the beginning of the year.

Public-private partnerships like the one between GCHQ and Huawei are an important component of the UK's national cybersecurity policy so these issues will continue to rear their heads.

The Huawei situation is doubtless a curious one because so few companies have received such a high level of attention from western security agencies and so few companies have bent over backwards as much as it has to prove their innocence. We don't know if other businesses will need to engage with government in the same way or, indeed if they would be willing to if asked. Such arrangements are not unprecedented – Google and Yahoo have famously played down their links with the Chinese state in the past – but were the Chinese to implement such formal arrangements for British businesses seeking access to Chinese markets, how would the British respond?

Tim Stevens does not receive funding from any external organisation.
 In its often fractious dealings with western governments, Chinese tech giant Huawei has been repeatedly accused of being a proxy for government espionage and other practices unbecoming of a global corporation… Tim Stevens, Research Associate, King's College London Licensed as Creative Commons – attribution, no derivatives.