Communications data privacy and the Queen’s Speech

As we expected, the Queen’s Speech yesterday did not include a revised “snooper’s charter“. Well, mostly – the Guardian thinks otherwise, but whilst there are areas where the Civil Service are still pushing for better tools to tackle the war-on-terrorists-and-paedophiles they’ve chosen a different tack this time.

The general impression I’ve received from the briefing notes is that whoever prepared them has no idea what they are asking for.

Here is the except from the Queen’s Speech Briefing Notes (PDF link, page 74). I am quoting this at length because the language is important to the following discussion.

When communicating over the Internet, people are allocated an Internet Protocol (IP) address. However, these addresses are generally shared between a number of people. In order to know who has actually sent an email or made a Skype call, the police need to know who used a certain IP address at a given point in time. Without this, if a suspect used the internet to communicate instead of making a phone call, it may not be possible for the police to identify them.

The Government is looking at ways of addressing this issue with CSPs. It may involve legislation

Firstly, let’s look at the notion that a network can associate an IP address with a person. This is fairly easy to refute, because you just have to consider most households have shared computers. So, what about at a computer levels? Well, many households have a single account on a computer and many devices (e.g. iPads, phones, Gaming Consoles) and older operating systems do not have the ability to handle multiple users at all.

This problem is relatively easily solvable, technically. Simply require service providers to operate gateways that end users must log into individually using centrally-issued ID prior to accessing the internet. The technology is there because many large companies run such systems to track abuse and this is certainly a much simpler challenge to solve than previous suggestions around logging everything that happens on the internet. Politically however, such measures would be suicidal. I don’t believe this what is being proposed.

Rather more likely it seems, is the ability to identify an end device, rather than end user. The current generation of IP addressing – IPv4 – does not have enough address space to do this, hence the deployment of Network Address Translation (NAT) to share an IP address between multiple users. Your home broadband probably uses a single public IP for everyone in the house, and large organisations will also use one or a very few public IP addresses for all of their corporate traffic. This is necessary because there are just over 4 billion addresses theoretically available and significantly less than that by the time all the overheads have been taken into account. Ignoring that organisations like Facebook, Twitter and so on need IP addresses themselves to host their content, that’s still less than the number of people on the planet. And many of us have more than one device needing an address.

The next generation of IP, IPv6, has rather more addresses. (Just over three hundred trillion trillion trillion) But IPv6 is not ready yet, and mandating that everyone in the UK use it and could not ever use the older version again would cut us off from large portions of the internet. Economic suicide this time. Even if we could do this, privacy concerns with IPv6 have already been of concern to the technical community. Originally, under a system called EUI-64, the last part of your address was the hardware MAC address of your computer, a unique number rather like a serial number. People realised this allowed devices and users to be tracked rather easily, so they came up with a simple solution – every time your computer connects to an IPv6 network, the last bit of the address is random and changes each time.

As a result, if IPv6 is the solution the mandarins are thinking of, they’ll need to have a specific UK version of computers with this privacy feature disabled. Possible, but difficult to enforce even if they find a way of forcing IPv6 deployment.

There is only one interpretation of the briefing notes that remains that makes sense and the clue is in the last line regarding legislation and service providers. What they are concerned about is large scale address sharing, referred to as Carrier Grade NAT. (CGN) With this, millions of users, such as on Vodaphone or O2, are behind a single IP address. As old-school IPv4 addresses run out, big broadband operators may roll this out for those on fixed lines too. (BT are currently trialling this, for example) The police and security services want to make sure the providers not only log all the technical information for these so they can identify a single household or mobile device, but that they keep the data for long enough to be useful. Where such data is logged by service providers, it is typically only kept for long enough to generate capacity planning reports and handle network abuse – hours or days. Law enforcement works on a much longer timescale, typically weeks or months by which time the data has been thrown away.

However, it would appear the powers required to do all this are already enshrined in the existing Data Retention Directive. So it’s still a little unclear why all this needs to appear in the Queen’s Speech.

As is typical with internet policy matters coming from the government, it’s all a bit vague.