Hacker News Reader

Comment by TheOtherHobbes | Hacker News Reader

The irony - if that's the word - is that a site visit history is largely useless as metadata.

Only the most stupid people are going to visit "verydangerousterrorismsite.com" without going through a VPN. And visits to Facebook or Google are just noise without the details.

It's hard not to suspect that the real reason for the legislation is to legitimise dissident profiling, voter sentiment analysis, and thoughtcrime tracking.

I'm expecting an attempt to ban personal use of VPNs (without a commercial license) by around 2020.

View on HN

"Largely useless" only to fight external threats. As you say, it's invaluable for controlling internal dissent and abuse the system. Knowledge of a visit to AshleyMadison or YouPorn becomes instant blackmail material, regardless of contents.

Note for Eurosceptics: you know what the last bastion against this autocratic movement is? Yup, the European Court of Justice, backed by all those highly-worded treaties. Lose that, and you'll get back being hostage of your national elites.

you know what the last bastion against this autocratic movement is? Yup, the European Court of Justice, backed by all those highly-worded treaties. Lose that, and you'll get back being hostage of your national elites.

Yet here we are, anyway.

Remind me which government gave us the Data Retention Directive?

Vote Pirate in the EU elections.

And which tribunal struck it down?

From https://en.wikipedia.org/wiki/Data_Retention_Directive :

> On 8 April 2014, the Court of Justice of the European Union declared the Directive invalid in response to a case brought by Digital Rights Ireland against the Irish authorities and others.

If the Snooper's Charter makes it through, the ECJ is the only hope to strike it down and keep it down, considering how Labour is hardly free of authoritarian tendencies. That's the truth, as uncomfortable as it might be for eurosceptics.

And which tribunal struck it down?

Only several years late, of course. It's a bit weak to suggest that the EU is our saviour when it comes surveillance.

I'd rather place my faith in the ECtHR.

No, I'm just saying that removing the EU layer you lose another chance of fighting against the current (and/or future) wave of power-crazy national elites.

I don't see how a supranational government is any better than a national one, though. If anything, they're more remote and intransigent, and pretty much have a revolving door between the two. I trust neither when it comes to this issue.

The EU is historically influenced by "virtuous" countries, which have little interest in signing bad laws; "bad" countries benefit as a result. The European Parliament, with its proportional representation system and loose alliances, can often be more easily influenced on big, visible issues, than the hardcore-conservative first-past-post Westminster (where party loyalty is paramount).

The EU is not perfect (the Commission in particular is the root of a lot of "evil" activity), but if you believe in checks and balances, it's yet another power you can appeal to when things look dire on the home front.

The ROI of banning VPNs is very minor...What would they get in return? Providing investigators with easier access to information they can already get? Whereas banning VPNs would be an expensive legal and enforcement hurdle and has the potential to cause media/civilian backlash.

So why ban VPNs when they are already expanding they're existing ability to:

a) get access to information held by service providers (which include VPNs)

b) "remote access to computers to downloading covertly the contents of a mobile phone during a search."

In practice, a VPN does nothing to prevent them from accessing the sites you visit. Other than requiring some additional paperwork to send an information request to VPN (not even a warrant) to fill in the gaps which passive surveillance can't provide. Plus the VPN will give people a false sense of security... so they wont think twice about visiting [verybadsite.com].

It's more along the lines of using that metadata to know what time you visited a website so they can match activity on the website to your timestamp. This is also how they have in the past found you're responsible for something without having to get logs from your VPN. Another usage where this will be useful will be for peer to peer networks, now police can easily find out exactly what you have downloaded via bittorrent. And if tox.im type of 'p2p chat networks' become used, that would help them more than it would if you used a centralized chat service as it's previously been stated that the metadata (who communicates with who) is more useful than the contents.

On another note, do we know yet whether the police could bulk ask for everyone's connection history or do they need 'reasonable suspicion of a crime'?

As far as I can tell, bulk collection does require a warrant (as per the bulk powers section) and is limited to security / intelligence agencies (does that include police?).

Police have to request the ICRs for an individual on a case-by-case basis, going through a 'senior officer' who takes advice from a single point of contact (SPoC), although I can't find any criteria for SPoC selection.

In any case, there's no judicial oversight on ICR requests as far as I can see.

Reply on news.ycombinator.com