Snoopers Charter:the technical challenges of spying on anation

Many critics have moral judgements against the Investigatory Powers Bill, but experts argue it isn’t even technically feasible. Nicole Kobie explains their concerns

THERE ARE MANY issues surrounding the so-called Snoopers’ Charter, but one that experts are trying to answer is whether it’s even possible. The latest version is the Investigatory Powers (IP) Bill, which is currently working its way through parliamentary committees as a draft. A vote is due in 2016. Key aspects include provisions to collect communications metadata, such as who you email and when, but not the content of the message; the ability for police to hack computers and bug phones; and provisions to potentially insert backdoors into encrypted messaging systems

In last month’s issue of PC Pro, we examined the plans behind the draft bill and criticisms of it. This month, we consider the technical challenges, from the security and network issues to costs and jargon.

But there’s a catch: although the bill runs to 299 pages, the technical details are vague, making a consideration of the practical feasibility difficult. “When you’re trying to get a proper technical analysis of the bill, at the moment it’s very hard to do that,” Andrew Kernahan, public affairs manager at the ISP Association (ISPA), told PC Pro. “I think the industry has been quite clear, and ISPs have been quite clear, that we need more information to be able to do this, because the internet is not so straightforward.”

There’s good reason for fuzziness on some details, as the government is hoping to future-proof the law. “It’s been explained to us that this is a once-in-a-generation attempt to pass a new law that works,” said Kernahan. “While we welcome that, unfortunately, passing technical legislation like that doesn’t quite work. So it’s hard to get real technical analysis of the proposals until more information is forthcoming from the government.”

The parliamentary Science and Technology Committee has been calling in experts to give their thoughts on the technical aspects of the draft bill. Here’s what they’ve said so far, and what it means for the feasibility of the Snoopers’ Charter.

Legal jargon

Much of the confusion is due to jargon. Antony Walker, deputy CEO of industry body TechUK, told the committee: “Often language used in the course of a technological discussion changes when it is used in a more legal context.” Walker mentioned certain phrases such as “communications service”, “internet connection records” (ICR) and “equipment interference” – the latter a euphemism for hacking – saying that how such terms are interpreted in a practical way has “technical implications”. He added: “The industry view is that we could certainly benefit from perhaps examples or clearer suggestions as to what is and is not included.” Mark Hughes, head of security at BT, pointed out that his company must know if the law applies only to public networks or also to the private networks it supplies to companies, while Walker noted that equipment definitions must be clarified to reveal whether they include Internet of Things gadgets, smart toys or even connected cars. “In theory, the manufacturer of the products could

be subject to a warrant to enable interference with those devices,” he noted, adding that all of this affects whether or not the plans are technically feasible

Logging web pages One of the more controversial aspects of the IP Bill is ICR and messaging data, which Adrian Kennard, head of ISP Andrews & Arnold, noted in a written submission makes a fundamental mistake about how the internet works. He argued such data should be logged at browser or server level, saying it makes no sense to log web-page visits at the network level. “This is because, like any ‘over the top’ service, the browser and computer breaks down what it is doing in to packets of data, and sends these over the internet… the ISP sees just the packets in between,” he said.

“It is a bit like saying that the postal service has to log letters sent, but they are thwarted by the fact that every sender puts the letter through a shredder first and each shredded bit of each letter is being delivered, mixed in with every other letter, to a destination where it is glued back together,” he added.

Technical costs

The money available also affects the technical feasibility of the project. The government has set aside £174 million to pay for data collection, but ISPs argue that’s insufficient. “You can do most things if you put enough time and effort into it, and if you buy the best kit and put a lot of resources into it,” said Kernahan. “But that’s not necessarily what the bill is going to allow in terms of the sort of money that they have available.”

That view was echoed by Mark Hughes, who told the committee that BT would“incur significant cost if you implement the intent and assumptions behind the internet connection records part of this bill”. He added that the cost would either have to be paid by government or passed on to customers.

End of encryption

The IP Bill doesn’t outright ban encryption, but it does provide a means for authorities to require communications companies to collect users’ data. For an encrypted system, that could mean creating backdoors. Companies wouldn’t be able to tell users they were under such an order. “What is not completely transparent is what happens where a third party has implemented end-to-end encryption themselves and it would not be technically feasible for the service provider to remove that encryption,” Walker said.

The requirement that companies keep quiet about these backdoor orders is especially challenging for open-source companies, with Walker pointing to Firefox-maker Mozilla. “The very nature of its business, which is based on inputs from the open-source community, means that a lot of its code has to be out in the open,” he said. “Therefore, meeting any of the equipment interference requirements would be something it could not conceal from the people who provide the open-source software. A company like that would face very real, specific problems

BT’s Hughes pointed out that future encryption systems, notably Transport Layer Security 1.3, “will have a big impact on the ability of internet connection records to be useful”, as it will encrypt transactions earlier in the process, making it to see what people are to online.

Security concerns ICR and other message metadata collection requirements mean ISPs, particular, will be building large databases of sensitive information. Keeping that safe will be difficult if impossible – just ask TalkTalk, which was hacked last year. “It’s never going to completely foolproof in terms of security… and there’s potentially more risk with more data that’s made available,” Kernahan said. “The example that was given at the evidence session last week was the NSA themselves – which is probably one of the most secure organisations in the world – had this known data leakage.

Walker also raised the spectre of authorities hacking devices, especially at a bulk level. “That is regarded by a lot of people across the industry as opening up the potential for the maintenance, or addition, of vulnerabilities in networks or services that should in reality be patched,” he said.

While that may leave an email client with a flaw that could be used by criminals, as well as spies, it could have even more dramatic repercussions on future devices such as connected cars. “In a much more connected world, with many more connected devices on which we all rely for our security and safety, we have to think carefully about taking that additional step