Watch how you go! - part two

We kick off this second instalment of a two-part feature on security issues surrounding using the internet with a look at the Regulation of Investigatory Powers Bill.

Kyle MacRae

At the time of writing, the UK government's infamous Regulation of Investigatory Powers Bill (the so-called Snooper's Charter or RIP, in common parlance) is still undergoing considerable changes. This is largely as a result of its rocky ride through the House of Lords, but also a response to the howls of derision and cries of foul play from just about every group with an interest in the internet - from civil rights groups to the British Chamber of Commerce. Quite what will emerge as law from the present debacle is uncertain.

RIP is essentially a measure that gives the authorities new powers to monitor what the 'baddies' get up to online. These measures include installing 'little black boxes' within ISPs so that internet traffic may be intercepted, and the right to demand that people who use encryption technology to protect their data must decrypt on demand. So what's wrong with that, you may wonder? Surely only those with something to hide need fear such powers?

Advertisement

Well, it's a big subject - too big to cover here in great detail, but quite aside from concerns about censorship, security and privacy, the biggest flaw with any system on the RIP model is that it's bound to be ineffective.

On one hand, those who really are of criminal intent can always find ways to evade surveillance (it's really not very hard to do). On the other, those caught red-handed with seriously incriminating material on their computers are not likely to decrypt it on pain of a two-tier jail sentence if, by complying, they might expect a much longer term inside.

For full coverage of RIP and its many ramifications, see the Foundation for Information Policy Research website at www.fipr.org/rip. The Campaign Against Censorship of the Internet in Britain is self-explanatory and well worth a browse (www.liberty.org.uk/cacib).

Know your cyber-rights
Yaman Akdeniz is the founder of Cyber-Rights & Cyber-Liberties UK (www.cyber-rights.org), a non-profit civil liberties organisation - or pressure group - devoted to free speech and privacy on the internet.

"I have always thought that the internet is an amazing and positive development," says Yaman. "But there are negative aspects, too. In my view, online privacy is by far the most important issue in the Information Age. Unfortunately, technology is constantly used by governments and organisations to invade the privacy of those who use it."

But surely there needs to be some way of keeping tabs on criminals? "Of course it is wrong to believe that the internet should be free from government reach or regulation, and I have no objection to laws dealing with child pornography," says Akdeniz. "But just because criminals and paedophiles misuse this medium does not mean that the authorities should seek or be granted what they call 'new powers' to turn this country into a surveillance society. All initiatives should be proportionate and effective."

There is, in fact, every chance that RIP, if it survives, will be tested in court and ruled in breach of the Human Rights Act.

Keys to encryption
The key to modern encryption (see Pretty Good Software section below) is keys, and that's what all the fuss is about. This is how it works: say you want to send Igor at DodgyArmsDealers.com a purchase order for a dozen Kalashnikovs. First, you get hold of his public key, which is just a big software-generated number, and use it to scramble the message.

Now you can send the order by email secure in the knowledge that anyone intercepting it will see only garbled gobbledegook within. Igor, on the other hand, simply has to run the encrypted order through his private key - another big number, but known only to him - for all to be revealed.

Note a couple of interesting features about this system: if the RIP police suddenly come beating on Igor's door, he might quickly encrypt all his records with the first public key that comes to hand. Now it's no longer in his power to open his files to scrutiny.

Consider the related scenario in which you receive an encrypted message from you know not whom. The authorities show up and demand that you decrypt it while they wait. Would you hesitate? What if you're being cleverly framed? In effect, you have lost the right to silence.

The Human Rights Act will undoubtedly safeguard our right to privacy, but it's a true optimist who imagines that electronic communications will ever be truly private and secure. So treat email like an open line to Spy Central and don't hesitate to indulge in some strong encryption if you have confidential information to protect.

Protect and survive
Your own dear disloyal desktop PC will happily spill the beans about you to all and sundry. Here are some simple but effective tips for covering your tracks:

Tracks and trails
One of the enduring misconceptions about the internet is that it offers complete anonymity. It may feel that way but you can't help but leave footprints as you weave your merry way around the web. For a simple but vivid example, drop in on Privacy.net (www.privacy.net) and see how much the site knows about you already. Scary, huh? This is also a good starting point for learning how to keep a low profile online, as is Anonymizer (www.anonymizer.com).

We'd also recommend Cookie Central (www.cookiecentral.com) for every last crumb of cookie folklore. If you post messages in newsgroups, did you realise that every word you write is preserved for posterity? Just try searching for yourself with Deja.com's Power Search utility at www.deja.com/home_ps.shtml. The same is usually true of mailing lists, where every ill-conceived or embarrassing message may be archived on a website for all the world to dredge up and use against you in the future.

Of course, it's possible and often desirable to use a false name and secondary email account for newsgroups and mailing lists, if only to deflect the inevitable spam and flames, but a remarkable number of people are apparently quite happy to include their real address and phone number in their email signature. This is not to be recommended, in our view, not least because there are plenty of sneaky software programs out there busily scanning public forums for just such information. Your phone will soon be ringing off the wall with exclusive offers for double-glazed mobile kitchens or whatever it is they try to sell you halfway through dinner.

Pretty Good Software
The best-known encryption software - Pretty Good Privacy, or PGP - was developed by Phil Zimmerman, an achievement which led to him being persecuted for three years by the US Customs department.

As he stated in his unapologetic address to the US Senate: "The only way to hold the line on privacy in the Information Age is strong cryptography - cryptography strong enough to keep out major governments." A freeware copy of the program can be downloaded from his website - www.pgp.com - but the commercial release is considerably easier to use.

However, there's nothing like suspicious behaviour to draw suspicion upon oneself, and a PGP-encrypted message is quite clearly hiding something. An alternative approach is to use a program such as Steganos Security Suite. This not only encrypts files but hides them within others. What appears to be an innocent family snapshot might conceal your company's accounts or the battle plan for the revolution.

PGP is distributed by Network Associates and costs £20. Call 01753 217500 or visit www.mcafee.com.

Steganos Security Suite is distributed by Pow! and costs £40. Call 01202 716726 or visit www.pow-dist.co.uk.

Spooky stuff
As the dispute over the legalities and technicalities of RIP rages, we can just imagine the tittering in the smoke-filled rooms of the secret services. After all, they've been systematically monitoring every electronic communication under the sun for years.

Enemies and allies alike are spied upon. Secrets are traded across battlelines. Word recognition software filters emails to identify conspirators. Industrial espionage enables companies in the spy ring loop to secure orders. It's a global conspiracy, it's called Echelon, and there's nothing you can do about it.

Far fetched? Well, while we await the findings of a European committee's investigation into whether Echelon does in fact exist and, if so, whether its methods are legal (a clue: yes and no).

Here's a fun game you can play at home. Strike up an email correspondence with a friend and include some or all of the following key words and phrases in your messages: heroin, hacker, bomb, anarchy, subversion, fifth columnist, David Shayler. Then get under your bed and stay there. On second thoughts, perhaps it's safer to follow the Echelon saga from a distance.

Should you be inclined to let rip against RIP, pay Stand a visit at (www.stand.org.uk) and make your voice heard.

  • Have your say
  • Send to a friend
  • Print
  • Digg
  • Reddit
  • Share

Tags:

Do you agree?

Further reading

Online privacy: who's using your data?

Online privacy is becoming an increasingly hot topic as internet users become more and more worried about what information companies are collecting, buying and holding about them. Also of concern is how they use that information, and whether or not they need to ask permission to do so. We take a look at the issues.

A year in the life of ane-minister

UK e-minister Patricia Hewitt talks exclusively to Computing about her first year in office, the RIP Act, IR35 tax regulations and the skills shortage.

Watch how you go! - part one

Few PCs are now being operated without at least occasional connection to the internet. We look at some of the menaces attached to internet access.

Related whitepapers

Related jobs

Most watched

V3.co.uk weekly debrief, 13 Nov 09

This week we discuss the inaugural V3.co.uk Summit

Summit: Salesforce.com on SaaS and information overload

How web services contribute to data headaches

Analysis and Reports

Remote access - Three steps to getting connected

3.4 million UK professionals now work from home – is your company equipped?

Cost benefits of a global collaboration network

This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications

Poll

Impact of Information Overload poll

Impact of Information Overload poll

What is the biggest problem your firm faces as a result of the data explosion?

View poll results

Advertisement

White paper library

Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.

Advertisement

Newsletter signup

Sign up for our range of FREE newsletters:

Existing User

Newsletter user login:

Enter email address to edit your newsletter preferences

Job of the week

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Hiring now on ComputingCareers:

Related IT jobs

Search thousands of IT jobs :

Search thousands of IT jobs:

Advanced search

Advertisement

Spotlight

V3.co.uk weekly debrief, 13 Nov 09

This week we discuss the inaugural V3.co.uk Summit

Fingers on keyboard

New Flash vulnerability discovered

Web sites could be vulnerable to Flash attacks

Chris Adams

Summit: Microsoft Office to the rescue

Chris Adams, Office Client product manager for Microsoft UK, explains...

Illegal downloader

Industry and human rights campaigners united in opposition to "three strikes" plan

Critics says government proposals to curb illegal downloading are unworkable...

Primary Navigation