Comment by lordnacho | Hacker News Reader

Comment by lordnacho | Hacker News Reader

Sounds like it is both intrusive and useless at the same time.

If you're not going to see what people did on a site, what's the point? Presumably nefarious stuff like pedo rings and dark markets will not stay in the same place very long.

At the same time, people can see what kind of politics you're into. Or porn. Or dating. Which is not terribly useful for the public interest, but you can see a cop abusing this for personal gain. I think Snowden mentioned his colleagues used to stalk their exes.

Also, anyone who's accidentally left WireShark open will know how much data you're sucking up. It's not actually a small amount, and it compounds if you're an ISP. And it sure isn't easy to filter huge pcap files, which you'll have to do if you want to find something specific. And then you have to glue the clues together, totally non trivial.

Last, how will this be used in court? Knowing what sites someone visited is not evidence they did something. Some guy visits an ISIS homepage, is that because he's curious or he's getting bomb manuals? At best you can use it to suggest some guy is a sympathiser, when he might well not be.

> I think Snowden mentioned his colleagues used to stalk their exes.

It's a matter of public record that MI5 staff have been abusing their powers and had to be disciplined:

http://www.thetimes.co.uk/article/mi5-misuse-of-surveillance...

Yep and if you think 50-200,000 civil servants/others are going to be any better behaved you'd have to be very optimistic!.

That's before some idiot walks out the door with the entire database for an ISP and leaves it on a train.

> If you're not going to see what people did on a site, what's the point?

Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about.

If you are emailing certain people, or tweeting them or whatever, GCHQ can build a social graph of people you know, who they know, etc. If you are the friend (or friend of a friend) of a person of interest, you're more likely to be of interest yourself. There are not many criminals like the una-bomber working entirely on their own - most of us need encouragement and/or provocation, and nowadays much of that happens online.

If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from?

Metadata is important for identifying "interesting" people. When you have found them, you "zoom in" and start hoovering up all the information you can find, not just the metadata. It's the greatest spying tool ever, and a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions.

http://ghanadailies.com/2016/11/22/uk-government-plans-porn-...

https://www.theguardian.com/commentisfree/2016/nov/23/niche-...

This illustrates how slippery the distinction between communications data and metadata really is. The examples in the first paragraph would all just record that you had been to www.reddit.com.

It's quite to look at your history and determine that you visited /r/The_Donald often, with good likelihood, automatically.

Seriously, nobody at GCHQ cares that you support Donald Trump.

It was my slightly flippant example. I'm sure everyone knows that.

SELECT * FROM dudes_with_doubleplusbad_opinions;

It's about profiling, how that profile is determined, and who accesses it under what circumstances.

Doesn't that social graph require them to know what you're doing on a given site?

I suppose they already have that power, otherwise we wouldn't have what you describe.

But the article says they're only gathering connection metadata, this law anyway. I guess they're already doing even more intrusive things, at least as a way to know who to get "legit" evidence on.

> Because you are not a unique and special snowflake. If you regularly go to /r/The_Donald, it says something specific about your politics (probably). Same for /r/LateStageCapitalism or /r/trees. It might not say much, but it adds up to a profile of who you are and what you think about.

They won't be collecting that information though. They'll only see that you visited reddit.com in all those cases.

Bad news for https://howtoopenanumberedaccount.com visitors (Host header in plaintext) and people who click on links to http://ponies.net from https://reddit.com/r/LaunderYourCash (Referer header in plaintext)

Presumably the non-https assets which get pulled in when the main request is fulfilled could also act as a "fingerprint" of the page you are visiting?

AFAIK browsers will not provide a referrer if the previous page in case you go from https to http. Firefox has an option to disable https to https referer sharing btw.

Excuse my ignorance but won't they have access to the whole URL?

As long as the site uses https (reddit does), then the path is encrypted, the only part of the URL thing they'll have access to is the host.

For http sites they have access to whole url and everything that is submitted, for example all commments you write.

For https sites (green lock icon) they only know domain name, for example reddit.com

From the article: "Those ICRs in effect serve as a full list of every website that people have visited, rather than collecting which specific pages are visited or what's done on them."

And from another site on the same issue: "When you visit a website you usually start at the websites homepage such as www.bigbrotherwatch.org.uk/ the Government define this part of a website address (the part before the first forward slash) as communications data which they consider to be non-intrusive information." (https://www.bigbrotherwatch.org.uk/wp-content/uploads/2016/0...)

In fairness the law mandates they record the domain, it doesn't say anything about capturing more it just sets a standard for the minimum.

Given that the ISP's have now been given cart blanche to collect data that is very commercially valuable I can see some of them doing it with the hope they can sell it later.

> I wonder where the information about these searches came from?

I've also wondered about that. Presumably it could simply be from the browser history of a seized computer. But now, who knows?

Will it become standard practice to look up the internet history of anyone accused of any crime? Who decides whether this stuff is admissible as evidence?

a way to implement highly repressive government too - just start monitoring people with different lifestyles or "way out" opinions.

Or even better start using it to monitor opponents and discover their weak points and alliances. If you wanted a recipe for tyranny when a vindictive leader comes to power, this is it.

This is really a legalisation of the law-breaking that has been going on for decades from GCHQ, and the expansion of their data out to a huge number of government departments. There will be abuse of this system at all levels.

> If your search phrases include things like "how to make a bomb", you're probably going to be on a database somewhere. There have been numerous serious court cases (e.g. murder trials) where the prosecution have presented evidence that the accused's search history included phrases like "how to dispose of a body" or "how to poison someone". In other cases, jurors have been dismissed for using Google to research the background to the case they are serving on. I wonder where the information about these searches came from

Google tracks it.

And you can get that straight out the history on the browser of the suspect as well, someone daft enough to google something that incriminating from a machine they own on a connection they own is possibly daft enough to not delete the damn search history.

It's amazing how bad some people are with computers, like astoundingly bad, It's easy to forget as techies/developers that not everyone even understands crudely how a computer works.

As everything else, it takes step at a time... first they will record a website address, the people will calm down and get used to it, ISPs will implement the storage. Then they will find a reason to implement another law that will require to record what we do on the websites. There is no coming back. It will evolve as everything else humans touch.

Reply on news.ycombinator.com