CCDP First impressions: A bill with too few safeguards

The draft Communications Data Bill has, at last, been published. We can finally debate what has been written down, rather than what the Home Office have been telling people in off-the-record briefings. Julian Huppert MP has an excellent post on safeguards which might be worth a look first, as those are the principles I would like to see in the Bill. Sadly, the draft bill falls down on several counts.

Firstly, we did point out quite forcefully in early debate that the police and security services were asking for powers that they did not have over the postal service. They’ve fixed that in the draft… by granting themselves powers over post too. Under the draft bill, the Royal Mail would need to scan and store the outside of every envelope that goes through the postal system if the Secretary of State asked them to.

Secondly, the vast majority of requests would still not require any form of judicial warrant. Instead, the police would still retain the ability to authorised themselves to go after communications data.

Finally, (for the major concerns), clause 1 which places the obligations on ISPs to collect data is still far too broad. “Interception” is not allowed, but that would seem to only rule out real-time monitoring as it uses the previous RIPA definition. ISPs could still be mandated to look at the content of all traffic to try to drag out “communications data”.

Internet traffic is not like the post, with the addressee neatly written on the outside. Instead, the outer envelope (IP) contains another envelope (TCP). You need to collect together all the IP envelopes in order to make sense of the TCP conversation. Once you have that, you need to open the TCP envelopes to see if they contain little Instant Message, Club Penguin, World of Warcraft or Facebook envelopes. Then, we need to read the data off that envelope, no mean feat given that World of Warcraft envelopes will be written in whatever language makes sense to them, not to us as service providers.

By the time you’ve built this system, even assuming you figure out how, you have something that is required to read the entire content of everyone’s communication to figure out where the envelopes stop and the letters start.

All this is before anyone puts wax seals on their envelopes encrypts their data, which I suspect will start happening quite widely should this bill pass.

How are the Home Office going to do this anyway? Black Boxes. Clause 1(2) allows the Home Office to impose “requirements for telecommunications operators… to acquire, use or maintain specified equipment or systems“. The Home Office might not operate the black boxes, but by mandating the supplier they’re not far off having complete control. I rather suspect ISPs will have very limited information on or access to any mandated systems, which will limit technical oversight.

Even then, Labour’s original “central database” idea isn’t far off, courtesy of clauses 14 to 16 which talk about “filtering” systems operated not by service providers but by the Home Office. There are no safeguards proposed to stop the Home Office from simply demanding all data held by an ISP as part of a trawl for interesting information.

There are a few other holes that need addressing too, but I would expect them to be tightened up in the usual course of events. For example, if you’re given a notice saying your data might be needed for a court case, you have to keep it until you are told it is no longer needed. However, there is no provision, requirement or obligation for the scope of the retention to be limited. Given how long court cases can take, this could mean that an ISP ends up storing all of it’s communications data for years.

It still needs a little more scrutiny. I notice they’ve slipped in powers to allow snooping to collect unpaid fines and taxes, but I forget if that’s still in RIPA. No doubt as people pour over this more, we’ll get better and better breakdowns of what it all means.