Kitz Forum
Announcements => News Articles => Topic started by: Bowdon on November 25, 2016, 01:57:27 PM
-
I haven't seen this posted in the news section.. so thought I'd post.
Here is some other sources though.
Everyone who can now see your entire internet history, including the taxman, DWP and Food Standards Agency (http://www.independent.co.uk/life-style/gadgets-and-tech/news/investigatory-powers-bill-act-snoopers-charter-browsing-history-what-does-it-mean-a7436251.html)
Organisations including the Food Standards Agency and the Department for Work and Pensions will be able to see UK citizen's entire internet browsing history in weeks.
The Investigatory Powers Bill, which was all but passed into law this week, forces internet providers to keep a full list of Internet Connection Records (ICRs) for a year, and make them available to the government if it asks. Those ICRs effectively serve as a full list of every website that people have visited, not collecting which specific pages are visited or what's done on them but serving as a full list of every site that someone has visited and when.
Snooper's Charter is set to become law: how the Investigatory Powers Bill will affect you (http://www.wired.co.uk/article/ip-bill-law-details-passed)
After more than 12 months of debate, jostling and a healthy dose of criticism, the United Kingdom's new surveillance regime is set to become law.
Both the House of Lords and House of Commons have now passed the Investigatory Powers Bill – the biggest overhaul of surveillance powers for more than a decade.
Now the bill has been passed by both of these official bodies, it is almost law. Before it officially is adopted, however, it will need to receive Royal Assent, which is likely to be given before the end of 2016 (to match the government's intentions and ahead of existing surveillance laws expiring).
'Extreme surveillance' becomes UK law with barely a whimper (https://www.theguardian.com/world/2016/nov/19/extreme-surveillance-becomes-uk-law-with-barely-a-whimper)
A bill giving the UK intelligence agencies and police the most sweeping surveillance powers in the western world has passed into law with barely a whimper, meeting only token resistance over the past 12 months from inside parliament and barely any from outside.
The Investigatory Powers Act, passed on Thursday, legalises a whole range of tools for snooping and hacking by the security services unmatched by any other country in western Europe or even the US.
British politicians sign off on surveillance law, now it's over to the Queen (http://www.theregister.co.uk/2016/11/16/british_pols_sign_off_on_surveillance_law/)
The UK's Investigatory Powers Bill has completed its passage through parliament and now only awaits Her Majesty's stamp of approval before becoming law.
Also known as the Snoopers' Charter, the legislation has been criticised as being among the most onerous in the world upon the civilian population, and will require British ISPs to retain a curtailed form of their customers' internet browsing histories – including what websites they had visited – for 12 months so that various authorities could request it for investigative purposes.
Additional powers are legislated for, including offensive hacking, despite concerns about the State finding an appropriate balance between creating and patching exploits, and the collection of bulk personal data by government spies for the sake of running enormous queries on surveillance data sets.
I also think its attached to this bill when this becomes law too;
UK Government Confirm Move to Force ISPs into Blocking “Adult” Sites (http://www.ispreview.co.uk/index.php/2016/11/uk-government-confirm-move-force-isps-blocking-adult-sites.html)
As expected the Government has officially announced that Mobile and fixed line broadband providers in the United Kingdom will soon be forced into the mandatory blocking of all “adult” websites; specifically those that fail to offer an adequate method of age-verification for their visitors.
The new approach, which was first hinted at last month after Claire Perry MP tabled several directly related amendments (here), will be officially introduced as part of a change to the forthcoming Digital Economy Bill 2016-17.
However the idea itself has been on the table since last year, which is partly because the Government need a solution to help stop the EU’s new Net Neutrality rules from effectively banning network-level blocking systems; these are used by ISPs to censor websites, both voluntarily or following a court-order.
-
Time to fire up the VPN and DNScrypt
-
Indeed.
(https://s21.postimg.org/ylvimdu47/VPN.png)
-
Big brother indeed. All they will do is force those who need to bypass this to do what has already been suggested, that is if they dont already so, all they will get it loads of useless information. Anyone who needs to perform illegal activity will not be stopped.
Stuart
-
I thought most big ISPs already kept records of all the IP addresses accessed by each account anyway, and an Internet Connection Record sounds basically the same as an IP address.
-
Exactly.
I can only think this is aimed at people who use social media or some other platforms were they are typing comments. A website address e.g. to facebook could indicate the person has an account there.
I wonder what procedures are in place to stop the abuse of these powers.
-
https://www.gov.uk/government/collections/investigatory-powers-bill
-
https://www.gov.uk/government/collections/investigatory-powers-bill
Just glancing through it seems Joe Smith has little or nothing to fear, so unless any of you are named Isil Ali Daesh, are president of Kiddifidler United F.C, or something equally undesirable just get on with life.
-
Does seem to be an awful lot of nonsense being reported.
It's not about revealing your search history, that's already collected and stored by search engines such as Google, who will provide it not just to law enforcement and government upon request, but also - I strongly suspect - to commercial organisations willing to pay for it.
It's not about revealing the IP addresses that visit illegal websites, that is already available by confiscating the servers and looking at the logs.
What it does seem to facilitate is, if you have an ISP that a allocates dynamic IPs, they will be able to resolve exactly who had the 'suspect' IP at the moment of interest. If you have a static IP, I really don't see it'll make much odds at all.
-
The weird part is the authority's only start checking into your web history after you have committed the crime so why close the gate after the horse has bolted.
Typing things into Google won't activate the snooping switch but the authority's are very good at building up a potential profile threat on extremist users which is good.
-
I think "shutting the door after the horse has bolted" may misunderstand the usefulness of looking back over a suspect's or convict's communications. As in the case of Meir, Jo Cox's murderer, surely it can be useful to help weed out his contacts for review. Antecedents!
-
dnscrypt usage soon to explode then.
Time to start a vpn business also?
-
Just glancing through it seems Joe Smith has little or nothing to fear, so unless any of you are named Isil Ali Daesh, are president of Kiddifidler United F.C, or something equally undesirable just get on with life.
Of course the problem is that what's 'undesirable' changes.
So given that, no, I will not just get on with life. This bill is state surveillance of an unprecedented level in a democracy. We already had more CCTV cameras per head than anywhere else besides China, we now have Internet surveillance akin to theirs.
You're aware that the next plan is putting barriers in place to certain content. Then of course will come barriers to more content, as the government of the day considers it inappropriate.
You may be fine with losing your liberty one step at a time and ignoring it until it's too late and you're living in a full-on Orwellian authoritarian surveillance state - I'm not. We have and continue to take huge steps towards that which is beyond alarming.
-
I agree that governments should not attempt to censure internet content.
I don't mind who sees what sites I visit, in the same way I have no objection to the bobby on the beat and traffic police (though admittedly these are rare species).
-
Am I the only person who thought all the big ISPs were already doing all the IP address logging? Were they doing it, but weren't actually required to do it?
-
Am I the only person who thought all the big ISPs were already doing all the IP address logging? Were they doing it, but weren't actually required to do it?
I'd be very surprised if they hadn't been logging IP-based activity, otherwise they'd have no way of investigating what happened when faults arise.
Every comms stack to which I personally contributed offered a pretty detailed logging mechanism that could be inspected within memory dumps if the machine crashed, or manually extracted by the user for submission with any fault reports. It probably wouldn't extend back as far as a year by default, but the better implementations allowed the user to configure the log size.
-
ISP's have kept records of who is using what I.P at specific times, including dynamic I.P's, for some time. Now they are being forced to keep records of what I.P's your I.P connects to, and various other pieces of metadata.
-
Plusnet's Privacy Policy (https://www.plus.net/help/legal/privacy-policy/) already contains "We also collect information on the websites you visit."
-
Am I the only person who thought all the big ISPs were already doing all the IP address logging? Were they doing it, but weren't actually required to do it?
To be honest they would've been extremely cautious about such things due to RIPA.
Plusnet of course are an outlier in that they freely admit to hardcore DPI.
-
Hmmmm. There's different sorts of IP logging. Every ISP will log which user get a particular IP address and when.
Ive been very quietly watching a few conversations. My impression is that as a matter of course they do not currently log which sites you visit but a few may log the protocols you use. That's easy for them if they use ellacoyas/proceras analyse by protocol type, so they can monitor how much of that type of traffic you use.
Logging every single IP address that you connect to certainly does not appear to be the norm.. far from it. Even some pretty large ISPs are in for a heck of a lot of work (and additional storage space) to comply with the new legislation.
TBH I haven't read the links in the first post, but I've been following from other sources. What is of concern to me is who has access to this data and also the possibility of hacking that data. The list that Ive seen of whom can actually (legally) access the data is worrying. Its a very long list including some gambling anonymous something.
I myself have been in the past, been in a position of trust whereby I could have directly accessed the financial records of literally anyone in the UK and full CBS data, right down to how much you spent with a catalogue. The temptation could always be there for someone who perhaps shouldn't search on say a neighbour, or even do bulk checks if the financial reward was enough. There's one heck of a lot of people on the new list who could have access to that data. Do you really want it known if say you'd been searching about abortions, or suicide or addictions and could this be ever used in an adverse way. You may just search for something out of pure curiosity to find out how something works and not necessarily to intend to do harm, yet that could be used in unrelated evidence. The more people that have access to this data then the more likely it is to leak. :'(
Yep Im not so naive as to know that google profiles users, nor that there are currently 'special forces' who can tap into the data. I know for a fact that they do, and have had first hand experience of a knock at the door when trying to track down someone whom they suspect could be a threat to 'national security'. But the latest changes seem to take it to a much higher level.
TBH its all a waste of time because anyone who was really serious would find ways around it. Next step making VPN illegal :rolls eyes:
-
I may be wrong, but I've seen nothing to suggest the new powers give access to anything you have searched for.
They merely yield the IP address to which you connected, and would be unable to distinguish whether you typed it into the address bar, or searched and clicked a link.
Moreover, all they would show is the IP address, not the full address. For example, my own record for this event would merely show that I had connected to Kitz.co.uk. It wouldn't show how I'd got there, and it wouldn't show what page I was looking at. Nor would it show any of the contents of this post or indeed whether I had actually posted anything, or even was just browsing the forums or some other part of the site, rather than the forums.
Or am I mistaken? ???
-
PS, depending on the web hosts we've used over the years, in addition to the log of source IP addresses, some have shown the search terms when the link came from a search engine.
My favourite was an individual, circa early 2000s, who hit us as a results of a search for 'world domination'. :o
It's a long (and innocent) story why that search found our site and he must have been a long way down the lists of hits, but it did amuse me. :D
-
They doing some form of logging so they can comply with copyright infringement court orders, but not on the scale that this bill seeks to introduce.
I agree with ignition that content censorship is a given now, its the next logical step. An idea what the current gov thinks is unacceptable can be seen in the current proposals, blocking porn is the obvious one right now, but it wont be limited to that. Note as well how they tried to ban encryption, that alone is a big alarm sound as to what their end game is.
-
Sorry perhaps badly worded when I said searching. I didn't explicitly mean results of searches, but rather the pages you visit after a search. From those pages its very easy to build up very detailed profiles on people.
My objection is the huge amount of people who have access to this information. If it was just say security services then I could live with it, but there are far too many organisations whom I feel have no need to access this data.
Why the likes of Gambling Commission, Ambulance services, Health & safety, food standards, NHS, DWP and Im not even sure I can find a reason why HM revenue need to know this data. The more people that have access, the more likely to be a data leak. Its the security of this data that worries me.
-
My objection is the huge amount of people who have access to this information. If it was just say security services then I could live with it, but there are far too many organisations whom I feel have no need to access this data.
Why the likes of Gambling Commission, Ambulance services, Health & safety, food standards, NHS, DWP and Im not even sure I can find a reason why HM revenue need to know this data. The more people that have access, the more likely to be a data leak. Its the security of this data that worries me.
I certainly agree on that, it is hard to understand why they thought it necessary. ???
-
There seems to be a very puritanical feeling amongst a growing number of people in our society. That they do things behind closed doors or advocate when they are in their close social circle. But when speaking in public they adopt the politically correct conventional position.
I'm not surprised at the government wanted to do something like that. About 10 or more years ago I remember the first version of this act. this RIPA is already in force. This debate bill awaiting to be stamped is extending its power. I remember the first time I heard of it. They wanted the ability to break in to your home without a warrant. Search anything you had, and also make it a criminal offence for you to speak about it. They also wanted the ability to commandeer any of your property in certain situations, and again you were forced to not speak out, a sort of D Notice would be put on you. I think the first versions were very watered down. Apparently additions have been made to this bill in December 2003, April 2005, July 2006, Febrary 2010 and now the recent updated bill was introducted in November 2015. It seems they realised they couldnt get the full original bill past the first time so have done it in steps.
Along with this bill we have the updating of Digital economy bill that says its blocking adult websites and 'think of the children'. This will be the first physical attempts by the government to block websites.
I think this past US election showed how the media wasn't just one sided. But attempted to demonize the other side. It does feel like 1984. Total censorship while propaganda reigns supreme. Except this time its not a Hitler or Stalin.. its some weak mouthed politician claiming he's for freedom.. as long as we agree with him.
-
I'll have a think about what I can and can't discuss, but I can certainly say that Kitz underestimates the abilities of the big ISPs with extensive DPI kit.
I have used such equipment and could happily drill down to the level of who visited what, when.
-
Are we talking per connection or can it even be taken as far as which device on that connection used?
-
I've received some advice suggesting it would be a bad idea for me to discuss too much more, however I can answer your specific question with that DPI can certainly separate individual devices behind NAT. Whether this is routinely done I won't comment on but the capability is there.
-
Don't start being suspicious the data collected for a user will need a warrant from the courts before the authority's can access your browsing history and there is not much change since the last Bill.
-
@NS
The most contentious part of the forthcoming law is a requirement that communication providers keep a log of their customers net browsing behaviour for a year.
This will involve ISPs keeping a record of what websites - but not specific web pages - and chat apps their customers made use of and when.
Dozens of different bodies, ranging from the police to the Food Standards Agency, will be able to request access to this information without requiring a warrant.
There has been concern that the system is open to abuse, as the requests will not be vetted by an independent body. Moreover, the database presents a tempting target for hackers.
Source: http://www.bbc.co.uk/news/technology-38134560 (http://www.bbc.co.uk/news/technology-38134560)
-
Sad situation that ignition has even been told to shut up about it.
Its probably wise to assume they can do everything that is technically possible, which is knowing results of all dns lookups, destination end points, content of unencrypted packets, encrypted packets forwarded to GCHQ for attempted decryption.
How to know source devices on ipv4 NAT?, they can scan headers of packets for identifiable patterns. IPv6 makes this easier with devices getting individual routable addresses. I think its no coincidence that uk isp's are now finally rolling out IPv6 at a time the gov wants to spy on everything.
Using a VPN on your entire WAN (router as endpoint) will likely circumvent the majority of any data collection, however with a performance hit. Dnscrypt combined with using encryption on as much stuff as possible will be much more acceptable performance.
Configuring software to make it more secure as well of course also helps, browser fingerprints and what not can be removed/spoofed, dns prefetching is something to consider if want to disable it. Prefetching has pros and cons, the cons is that it can indicate what you were doing prior to loading a page as each link on pages you viewing a dns lookup will be carried out, on the other hand prefetching can flood their logs with a ton of ip's that you never visited and could be considered if you like poisoning their logs.
The idea google and others including me are pushing is a encrypted only internet, encryption is now very cheap, cheap in financial cost and computing cost. We have aes accelerated processors, and the excellent chacha ciphers for non aes devices. http/2 can make https faster than plain http, and letsencrypt provide free certs.
Be aware IPv6 is quite effective from the off, in data volume more than 50% of EE's traffic is IPv6 and sky is about 35-40% over 6 million customers.
Also to anyone using a VPN or dnscrypt, I suggest do not use UK hosted services, which the gov will have power over.
My dnscrypt is currently hosted on a UK vps I lease, but I have managed to source hosting in france with just a few extra ms than london, so plan to move my dnscrypt endpoint to there. IN addition in the french location I lease the entire server which is somewhat more secure than just leasing a vps.
I already dont host any of my own email or www services in the uk. So e.g. I dont have to comply with uk email log retention laws. For SEO worries the french location funny enough can supply ip's registered to the UK.
-
Look there has been a lot of hysteria into this subject and the media sucks it up and blows it out of context if they did this it would come under as an abuse of human rights, but as this bill or power needs a warrant before evidence is released it's within the UK law.
What worry's me is what have you got to hide we all use facebook /social media and other stuff so we are building up are own profile for non authority's, you are most likely to be hacked and information being sent to hackers than to the UK governments MI5
-
NewtronStar, please refer to my previous post. Any government department can request access to the data WITHOUT having to obtain a warrant. Only in-depth surveillance on a particular individual or group requires a warrant.
-
NewtronStar, please refer to my previous post. Any government department can request access to the data WITHOUT having to obtain a warrant. Only in-depth surveillance on a particular individual or group requires a warrant.
That is not true, this bill is for evidence when the criminal faces the court, in many cases the criminals PC history was denied access by ISP's this bill allows access to Internet history via a warrant to gain more evidence to send the crim to prison
-
Doesn't Win10 lock to your motherboard these days?
So if they can identify the motherboard serial number then it might be possible to trace you through all the encryption? Though I guess they would have to find you first lol.
I still say the purpose of this is to harass people with opinions Big Brother doesnt like.
I know in the US if you complained about fluoride in water on social media a note was made against you by certain groups.
In this world if you start speaking a rebellious opinion you will expletive someone off.
Here is the actual bill: http://services.parliament.uk/bills/2015-16/investigatorypowers.html (http://services.parliament.uk/bills/2015-16/investigatorypowers.html)
Apparently it got royal approval today 29th of November.. so does that mean its now law?
-
Doesn't Win10 lock to your motherboard these days?
Now your going into the weird place called conspiracy theories don't go there "forever will it dominate your destiny :)
Just use your PC and Internet as you do, you won't be going to prison by looking at a KKK site,
-
For those people who don't feel comfortable with US VPNs(and their "Wild West" law enforcement and intelligence agencies) here's a list of non-US providers. I have accounts with AirVPN(who I like better than the many other providers I've used so far) and BlackVPN(though I purchased both under Black Friday discount deals) -
https://www.privacytools.io/#vpn
:)
-
The biggest issue I have with this law is that it allows mass interception of communications of everyone in the UK, without the proper oversight of the judiciary. If judges decided what could be accessed by whom I would feel slightly easier.
This could be easily abused by politicians who could use it to silence their political enemies. It's been done in the past and will no doubt continue. These techniques have been used by oppressive regimes around the world to control their citizens for years.
And for this reason I will start using a VPN when in the UK.
-
Are you aware that encryption backdoors have been made law? http://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/
-
Sorry, but at the risk of making myself
more unpopular, whenever I see a "they could do this or that" in a discussion, I wince metaphorically. There are thousands of things that benignest authorities could do, but don't.
We live under in my own opinion a benign authority, and you'd know if we didn't. So much so, that your thoughts here might lead to problems. TBAH I consider, we put ourselves in danger of having what you all definitely would not want one bit, by conspiracy theoretic opposition.
-
It's ironic that Chrysalis is using servers hosted in France. Good for you, btw. Wasn't France very anti-encryption twenty-something years ago?
-
I read that RevK of Andrews and Arnold is looking into placing VPN servers or similar in Iceland among other countries. I thought the Netherlands used to be a good bet?
I had thought about parking my spare Firebrick router at AA’s current hosting facility, then I could do all sorts of good things with it, but the monthly costs of £15 pm for hosting would, I suspect, be only the start of it, as it seems possible that I would get charged for traffic (again). (Inbound? Outbound to the device over the hosting facility's LAN ports?)
-
If you just want to stop logging and aren't bothered about your IP address being linked to you there are always 101 dirt cheap Virtual Private Server deals on the go - simple to set up a VPN server, I've done it many times - many guides on the web.
https://lowendbox.com/
-
I was / am interested in setting up a remote Firewall.
-
You don't need to be breaking the law in order for you to be surveillanced.
This is a difficult subject to talk about, privacy in public lol.
I think if you can tell your mother everything your doing online and she doesnt freak out then your probably be safe, even if your 'scanned'.
-
Web browsing is close to recording your stream of consciousness, it's far more personal than even steaming your mail open.
Anyone propagating the nothing to hide, nothing to fear, premise obviously lives in a house with no curtains, answers the front door straight from the shower without bothering to wear a towel, shows their work colleagues their payslip, etc, etc, etc ... or maybe they don't. :-\
-
It's ironic that Chrysalis is using servers hosted in France. Good for you, btw. Wasn't France very anti-encryption twenty-something years ago?
dont know and dont care about 20 years ago, only care about now, if france becomes an issue I just move it again no big deal. As I also have resources in holland, germany, sweden, romania, and poland.
-
It was of course very much not a criticism.
Twenty years ago the English government was threatening anti-encryption measures, and at work we were discussing temporarily moving staff to Dublin if HM govt turned awkward.
-
I think "shutting the door after the horse has bolted" may misunderstand the usefulness of looking back over a suspect's or convict's communications. As in the case of Meir, Jo Cox's murderer, surely it can be useful to help weed out his contacts for review. Antecedents!
What about civil liberties. Privacy. Imply that everyone should be spied on for the sake of a few cases. For the vast amount of data that is being collated it's disproportionate to the results. People will use names such as Jo cox to justify. Use words like terrorist. Censor perfectly legal sites. If this is the start where will it end?
-
If this story is accurate isn't this nice?
http://www.theregister.co.uk/2016/12/06/parallel_construction_lies_in_english_courts/
-
I was already aware of the NSA passing info to the DEA - just another example of the "culture" of American law enforcement. This is why I avoid US based VPNs as a general principle - looks like we're in a similar boat and knowing the UK's attitude to spying we'll be a lot better at it. :(
-
We may not have the resources in our own right but what we lack in those we more than make up for. Thanks to use of the NSA's processing and storage capabilities we actually have many of those, too :)
-
If this story is accurate isn't this nice?
http://www.theregister.co.uk/2016/12/06/parallel_construction_lies_in_english_courts/
Its all rather scary.
There's some meme doing the rounds atm showing George Orwells 1984 being reorganised on someone's bookshelf from fiction to fact.
If I could find it again, I'd post it. Only its not really funny :(
-
RevK’s latest blog post on the matter (a later short post) at
http://www.revk.uk/2016/12/investigatory-powers-act-devil-in-detail.html
is sort-of encouraging. A good bit less scary than it might have been. The article has a link to the text of the bill, I presume the final bill, btw.
-
http://www.theregister.co.uk/2016/12/21/eu_judgment/
The legality of the UK's Investigatory Powers Act has been called into question by a landmark EU legal ruling this morning, which has restated that access to retained data must only be given in cases of serious crime.
The landmark judgment [PDF] was handed down by the European Union's Court of Justice, setting a new precedent for EU member states' data retention regimes, stating that access to such data must be restricted to the purpose of preventing and detecting serious crime.
The judges also stated that police and public bodies should not be allowed to authorise their own access to this data, instead requiring that access requests receive prior authorisation by independent courts or similar bodies.
Note this is nothing specific to the UK, it applies to all member states.
I see nothing remotely controversial about restricting access to dipping into such data to issues around serious crime only, and would sincerely hope that authorisation would have to come from an independent body, not those seeking access to the data.