Everyone who can now see your entire internet history, including the taxman

Don't rely on that one, google for yourself any poll in the last 10 years. In fact, think about just about any issue that you care about but is not current government policy, and google an opinion poll on it. You'll begin to see that democracy functions very effectively indeed. There are exceptions, such as the death penalty in the UK, but mostly legislation follows the opinion of the public (the voting public actually) quite closely, as we see with gay marriage and drug decriminalisation.

Maybe we do need an intrusive government? Maybe we, as a populace, believe that the data will save lives? That the cost of it existing is worth it compared to the cost of not having access to information on ~insert bad person here~. Maybe you value your privacy differently to us?

That's ok, btw, and I respect your point of view. Please, however, consider that alternative viewpoints are valid before telling everyone else what they must do to ensure their country is governed in a way that suits you.

As much as I'm strongly against this bill, that petition is so poorly worded that there's no way I'm going to sign it. I did sign a somewhat poorly worded petition before and, not unexpectedly, the condescending "response" merely addressed the more hyperbolic rantings it contained rather than any of the reasons over 100K people signed it.

There really needs to be some way to greenlight draft petitions before they start getting major traction, so that anything that makes it to parliament reads like it was written by either a lawyer or journalist and not some outraged and poorly-informed 14 year old.

I really seems like that site only serves to placate people that might otherwise write to their MP, go out and demonstrate, or take some other form of potentially effective action, while never actually achieving anything.

Write to your MP instead. And please try to present a cogent, well-informed argument that might actually persuade that MP to champion the cause. Rants like this petition might be effective when it comes to preaching to the choir, but it's never going to change anyone's mind.

* geographically

I think the best way of handling this is to have a private code of ethics in the IT industry in the UK. If you are involved in any collection infrastructure, do like a government IT project, and make a complete fucking mess of it I.e. make it cost a fortune and bring bad publicity for any sponsors. Use O(n!) algorithms, use IO heavy storage patterns, piss all over cache lines, spend the entire budget having meetings in Wagamamas, write yourself a new minivan, overestimate everything and play solitaire.

Didn't Tempora¹ achieve something very similar? This law sounds eerily similar. Still stupid and ludicrous, though.

[1] https://en.wikipedia.org/wiki/Tempora

DPI products have been doing that for years. No biggie.

The law is still stupid, but not for technical reasons, imo.

They are retrospectively making legal things which have been going on for years.

https://www.theguardian.com/uk-news/2014/jan/28/gchq-mass-su...

Programmers might help by making better tools for thinking and coordinating. Perhaps with a collective IQ boost for enough of us we can avoid the worst.

People worry about flying when stastically they are far more likely to die on the drive to the airport.

They worry about terroism when they are 50lbs overweight.

...and on and on, You'd rather hope the government would be better at assessing these risks in terms of a policy framework but they aren't they appeal to whatever the papers are focussing on and subscribe to the "we must do something, this is something ergo we must do it" school of thought.

It's worrying how far we haven't come.

"All ministers, whether senior and in the cabinet or junior ministers, must publicly support the policy of the government, regardless of any private reservations."

https://en.wikipedia.org/wiki/Cabinet_(government)

It's a matter of public record that MI5 staff have been abusing their powers and had to be disciplined:

http://www.thetimes.co.uk/article/mi5-misuse-of-surveillance...

Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about.

If you are emailing certain people, or tweeting them or whatever, GCHQ can build a social graph of people you know, who they know, etc. If you are the friend (or friend of a friend) of a person of interest, you're more likely to be of interest yourself. There are not many criminals like the una-bomber working entirely on their own - most of us need encouragement and/or provocation, and nowadays much of that happens online.

If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from?

Metadata is important for identifying "interesting" people. When you have found them, you "zoom in" and start hoovering up all the information you can find, not just the metadata. It's the greatest spying tool ever, and a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions.

http://ghanadailies.com/2016/11/22/uk-government-plans-porn-...

https://www.theguardian.com/commentisfree/2016/nov/23/niche-...

Even if, for whatever reason, you agree with governments being able to access this data in extreme cases (suspected terrorism, whatever) and even if we put aside concerns about governments misusing this power, this bill also relies on ISPs keeping data safe. That is a huge risk in itself.

Not to mention the number of government agencies and departments that can access your data [0]. Does the Department for Transport, Food Standards Scotland or the Welsh Ambulance Services NHS Trust really need access to my browsing history?

[0]: http://yiu.co.uk/blog/who-can-view-my-internet-history/

What concerns me is the sheer number of groups that are being given access from the start, not because of who is on it, but because somebody has compiled that list in the first place. It suggests that there is already a longer term plan in place for the use of this data, and these are the entities who will need access to achieve that end. Otherwise, surely the approach would be a lot more cautious - "We'll limit it to GCHQ and the Secretary of State for now, and all requestss can go through the SoS. That will give us an idea of who actually needs this data on a case by case basis, and we can tweak the legislation as necessary based on that."

Then you look a little closer at some of the entries. Why would the Fire Service need access? Nothing in their job involves anything to do with individuals, at least not to the degree that they have any requirement for access to any data about them. Well, it doesn't say Fire Service. It says "Fire and Rescue Authorities under the Fire and Rescue Services Act 2004". Take a look at that act. Unless you're in Greater London, your fire and rescue authority is your local council. Why did they feel the need to slip your council in through the back door like that? Granted, access is limited to "Watch Manager (Control)", which sort of sounds like a Fire Service position, but it's vague enough that you could legitimately assign that job title to a Traffic Warden's supervisor without anybody batting an eye.

Why do the Food Standards Agency need access? Access for them is restricted to Grade 6, which doesn't seem to have any job title definitions, only a pay range - as of August 2015 it was £54,000 to £69,500. So any person who commands that salary, regardless of whether they need it for that job, will have this access? That doesn't seem a particularly clever way to manage data access.

The TLDR is it's netflow data eg: Source IP, Destination IP, FQDN, Date, Amount of Data

I don't have anything to hide- but a malicious attacker could easily cause me to.

Step One: Maliciously cause the target to click on a link or open a url (Phishing, Exploit, RFE, XSS etc)

Step Two: With JS, one can easy introduce HTTP connections to any number of websites, such as maybe the Talibans official website (They have one!), Google Searches for (to think of a few) "Gaziantep Places to Stay", "Turkey Flights", "Opposition to the Kuffar at home", "Dabiq Magazine", "how to join the Khalifah" etc

This could easily be done in a realisic appearing manner, especially to ISP/GCHQ filters and alerts.

Step Three: If any of this tallies with any physical activity (Let's say the target wanted to go Clay Pigeon Shooting, or Visited a Gun Club because he has in interest in .22 target shooting), then they have a case.

Sure, it's defendable, and this is a really simplistic example. But it's basically ruined the target's life.

Remember, it's probably not the "Government" doing this, as this info will be leaked.

Link: https://www.dontspyonus.org.uk/

Sell a pre-loaded rpi with an automated "average user" browser that you install on your network, while you keep using VPN for everything else.

When we do it, we announce it in the Queen's speech then have a law be published, read and voted through both Houses.

As much as I don't like it, an awful lot of other people either don't care or are fine with it. I wish the result was different but this is what you can get when you have a democracy. I absolutely would not want to swap the systems.

Another option is to rent a VPS/dedicated server somewhere outside the UK, with decent bandwidth and data cap, and configure your own VPN between your systems, using the rented server as the internet gateway.

"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him".

Yes, within NI a 'southern' paper now achieves about the same circulation as one from Belfast and a considerably better reputation for journalism. Quite a remarkable failure on the BT's part.

As a result the BT has been trying to adapt by widening its news remit and shifting into the tabloid space, as a visit to one of its web pages will quickly show. But most of its 'world news' stories are just AP feed, nothing special.

My neighbour's fiance is a night-club photographer who sells to the BT; 20 years ago such a thing would have been unthinkable in that paper.

NordVPN is one I keep seeing talked about, so I'll be looking into them this weekend :)

Also important is to setup outbound firewall (or other mechanism) so that if the VPN goes down, you don't spew your traffic over the open connection [1].

I don't notice any speed difference from daily usage over the last year. Large file downloads I task my NAS to download outside the VPN.

My purpose is only to prevent the ISP from collecting logs about usage, I don't expect it to have much effect if I'm targeted for surveillance and I'm fine with that. Who knows how ISPs will handle the data (we've seen targeted advertising and content injection in the past) let alone all the agencies with less than stellar security practices.

[0]: https://github.com/thomascannon/scripts/tree/master/vpn [1]: https://github.com/thomascannon/scripts/tree/master/vpn/vpn-...

From what I gather, the ISP has to record the sites you visit—but not the specific pages. Does VPN stop my ISP from seeing the loaded sites? Or do I need Tor for that? I’m not too concerned about complete privacy, I just don’t want every website I just don’t want my browsing history to be leaked.

[1] https://security.stackexchange.com/questions/45509/are-there...

Not saying that's a correct interpretation, but that's likely the conclusion they'll come to.

The ISPs will not be compelled to store and share the full URL you visited.