'Snoopers' charter' changes put forward | Hacker News Reader

'Snoopers' charter' changes put forward

bbc.co.uk

126 pointscolinscape70 comments

Finally, some good news. Nowhere near enough, and they were told about these problems before making it law, and once they leave the EU they won’t even have this level of oversight, but it’s better than nothing.

I know from trying and failing to convince two MPs that they absolutely do not understand the danger they introduce by forcing the ISPs to have the ability to snoop on users instead of banning ISPs from doing so.

Let's see how they will make IPA compatible with GDPR.

British law may temporarily comply, then once out of the EU, they could roll back the changes and collect everything for law enforcement use.

On recent performance, they’ll scream about how unfair it is until they’re blue and then give in completely.

Unfortunately, the GDPR (while mostly brilliant) contains pretty extensive "national security" carve-outs, as I understand it.

What's that?

Did the MPs you contact at least get back to you, even with a form letter toeing the party line? I wrote to my MP and tried to contact him through Twitter and, at the time, made my letter public. I never got a response.

My MP would get back to me, but as she was a party whip the toeing of the party line wasn’t just expected but mandatory. A mostly pointless exercise.

I don't think it's pointless.

When your job is "representing" a group of people, you'll take notice when a pile of those people disagree with what you are doing.

We can't break the camel's back if we don't add straw.

I wrote directly to mine via email (after being told by party campaigners on the street that it was the best way to get his attention and being given his email address by them) and never got a response either.

Met my local MP in person, stereotypical level of nodding and seeming to listen followed by voting the party line. However, she did point me at another MP who was chairing a committee on the bill, which was good of her. The chair, however, didn’t respond at all.

I got a cookie cutter response back.

I went to see mine and got the same as @ben_w. Sympathetic nodding but voting along the party line; some interest in economic issues (how it might affect consulting work for overseas clients) but none whatsoever in privacy. Wrote a long followup email explaining the issues, which went ignored.

Altogether a demoralising experience.

I got a tailored response from my (Labour) MP at the time of the snoopers' charter passing. He largely agreed with the substantive points I put forward against the surveillance regime, but felt unable to vote against because (IIRC) the government had structured the legislation in such a way that if it didn't pass all authorisation for interception would have ceased as the previous regime expired. I thought that was a price worth paying; he didn't. He was properly scathing about the process, though.

My MP just responds to me using copy/pastes from David Cameron/Theresa May. Sorta like a ransom note, only able to talk in phrases already said. Maybe they're being held captive by the whip?

In my limited experience (I've only voted in two constituencies during my life) MPs are actually pretty good about responding to comms. Now the cynic in me says it probably isn't them, but I've had an email back and forth with my current MP (Nick Brown, Newcastle East) during the past year, so it can't just be canned responses.

Whether you every actually influence an MP's position, or compel them to action on the basis of such a letter is a different matter entirely however.

It basically comes down to whether the amount of noise is enough to lose them their seat. Majority of 10000 and 10 letters - they don't care. Majority of 10 and 10000 letters - they will pay attention.

I got a letter addressed from House of Commons when I was moaning about snoopers charter or it's ilk a few years back. I was on holiday and it was waiting for my return.

Generic Response. I binned it and decided never to waste my time again.

Despite the generic response, your letter was probably noted. MPs & their offices might not have time to respond individually to every letter, but they usually do keep track of the issues being raised by constituents and in what volume.

They greatly expanded the definition of what's a "serious crime" - any crime for which you could get 6-months in prison.

Also, I don't understand why they act so surprised that it wasn't in accordance with the EU ruling. The EU ruling happened like 6 months before they passed Snooper's Charter. They didn't even bother to consider the ruling before passing the law?

I also don't think this solves that issue with the judge having to give warrants for surveillance requests. When they passed it they allowed a single permanent judge to "review" the order passed by the Home Secretary after the fact, and I don't think that judge can even ask for more details about the requests.

Not to mention pretty much all surveillance requests are "thematic" aka mass surveillance, and they're both both against EU's Fundamental Charter of Rights and ECHR's right to privacy rulings.

The "due process" in Snooper's Charter is an absolute joke. The new changes won't stop the GCHQ from doing mass surveillance at all. This is mainly about the police not being able to do the same level of mass surveillance, too, which was beyond ridiculous and extremely anti-democratic to begin with. People like Theresa May should be put in prison for even proposing anti-democracy laws like that, not be the PM of the country. May is an enemy to democracy in the UK.

The U.S. isn't far off right now, thanks to Obama signing an order allowing 17 law enforcement and intelligence agencies to access upstream cable-tapping data before any minimization procedures are done - all in his last 4 days in office.

The new FISA renewal is also about to make such shameless domestic mass surveillance law, too.

The only way MP's would understand is if we make all their Internet activity public. Lets see if they have anything to hide.

If? https://www.theguardian.com/commentisfree/2017/dec/01/the-gu...

This appears to not affect programs like Tempora operated by the GCHQ (the British NSA), which intercepts all internet traffic in Britain. Instead, local & federal police are the ones who will have their own mass spying programs slightly impinged, with a new agency called the Office for Communications Data Authorizations taking requests and vetting them.

Now, this could go one of two ways. Hopefully, OCDA will thoroughly vet each request, rejecting most of what is currently rubber stamped and do limited interception of specific citizens connections for short durations.

Alternatively, this could become another rubber stamp FISA kangaroo court, where the OCDA doesn't have the manpower, tooling nor the inclination to do much more than sign nearly every interception request form.

I'm hoping for the former, but betting on the latter. Despite that, Brits are still having their data stolen by the GCHQ.

The historical problem in the UK has been that surveillance powers that were rushed through parliament to tackle "terrorism" have ended up being made available to every single branch of government. And 99.9% of the time they're used for petty, local government issues, like collecting council taxes or speeding fines, often by people without any law enforcement training at all.

Even if the OCDA ends up rubber stamping requests from the police, it'd be a huge improvement on the complete free-for-all there has been in the past. If they at least reject requests from a guy in the council refuse collection department who wants to spy on his ex-wife, then that'll be an improvement.

The vast majority of RIPA applications are made by Police, not local councils.

Where is that information available? AFAICT local authority requests are via JPs in local courts and no centralised numbers exist?

They are in the OSC's annual report, for example. [1]

Councils also sometimes respond to FOI requests, although they don't have to. e.g. over a three year period this council [2] made 11 requests for Call Data Records (who somebody phone) and 29 applications for in-person surveillance (checking people who claim to be unemployed are actually unemployed).

In 2015-2016 (the most recent OSC I can find) there were, for example, 9147 applications for Directed Surveillance of which a MAXIMUM 8.5% were possibly by local councils.

Do you have any evidence that suggests, it is, in fact, 99.9% from local councils?

[1] https://osc.independent.gov.uk/wp-content/uploads/2014/09/An...

[2] https://www.whatdotheyknow.com/request/use_of_the_regulation...

The even more historical problem is that surveillance powers were operated under the royal prerogative with no oversight of any kind. RIPA (that, correctly, much maligned predecessor to the Snoopers' Charter) was in one sense a step forward in that it at least put the surveillance that had always gone on onto a statutory basis.

Same with local councils. They'd always carried out some physical surveillance (benefit fraud and lying on school application forms being the main scope IIRC) but without oversight.

Unfortunately, the oversight regime sucks. But as you say, it's an improvement on a complete free-for-all.

The point of RIPA is not to allow surveillance, but to disallow most of the surveillance that was being carried out unless clear proceedures were followed.

RIPA wasn't a snoopers charter, it was designed to limit the amount of snooping that was happening and to bring it under some kind of regulatory framework.

It's not a very good law, and it's too generous to people wishing to carry out surveillance. But it's better than the uncontrolled surveillance that was happening before.

> local & federal police

If only such a thing existed. We don't have any of this pesky federalism in the UK. The police are supposed to be local, but they are ultimately under the control of the Home Office.

I'm pretty sure Police Scotland are under the control of the Scottish Government, not the Home Office:

https://en.wikipedia.org/wiki/Police_Scotland

Influence, certainly, but not exactly control. When the Home Office did semi-nationalise the police against the miners' strike in the 80s it was rightly something of a scandal.

Don't forget the National Crime Agency.

One of the many reasons we should remain within the EU. Time and time again EU law has stopped our government in its tracks or forced it to change direction on overreaching or just plain stupid policy like this.

Why do you think Theresa May is so keen to leave?

Because if she said now what she was saying two years ago, she'd be out of a job.

She isn't "so keen" to leave, she campaigned for Remain.

Time and again though, people manage to paint things like this as foreign bureaucrats interfering in our sovereignty. So many people I know, it seems that if you tell them not to step in front of a bus they will shout "DON'T TELL ME WHAT TO DO" and do it anyway. I despair.

I mean, yes. Both are true. The EU is both interfering undemocratically in the UK, _and_ making better decisions than our politicians. I noticed this during the referendum. A lot of the pro-remain arguments weren't to do with the abstract advantages of being in or out of the EU, but rather just that they preferred the current EU politicians to the UK ones.

I'm not sure it is entirely undemocratic. The EU is a institution of various parts. Not all parts can interfere in the same way.

I'm not totally versed in the details, but I think in this story would be related to Britain making laws that break the European convention on human rights (echr) that Britain agreed to abide by in a fully democratic way following our system of parliament. The European court of justice (ecj) is then the high court responsible for ensuring that countries stick to the agreements they have agreed to stick to. Which we didn't. So they are enforcing that we do.

Now I don't think that's undemocratic. We (as a country) democratically signed a convention, and then future governments failed to uphold that. The ecj stepping in is exactly right.

Like I say, not an expert, but just how I understand it.

Somewhat ironically, the European Convention on Human Rights was very much a British supported thing and largely drafted by a British Member of Parliament: https://en.wikipedia.org/wiki/David_Maxwell_Fyfe,_1st_Earl_o...

Really? ..... Really?

I ... you want an external actor, over which you have no control, to have judicial power over your government, because right now the decisions go the way you want them to?

Last I checked, we get to vote for MEPs. So we do have control. And we have (had) representation on the European Council. And we had representation on the ECJ.

The EU will still be there when we've left. And wether we're in the single market or not, we'll still have to play by their rules on most things. Brexit gives us less control, not more.

And don't get me started on how the US and China are going to make us dance to their tune. And we certainly don't have any control over those two juggernauts.

Turnout at EU Parliament elections in the UK is dismal, and many (over a quarter in 2014) turnout only to lodge protest votes for UKIP, the BNP, etc.

The EU certainly suffers from a ‘democratic deficit’. It’s a highly complex bureaucracy and the average British person’s knowledge of its institutions, officials, powers, etc. is woeful.

It is really complicated and that is a serious problem, even if you are in favour of the EU. We already have a confusing mess of different levels responsible for different things. I wonder if it would have helped to rationalise that so people could have been less overwhelmed and be more open to the EU. Simplicity is a feature.

> to have judicial power over your government, because right now the decisions go the way you want them to?

Very few[1] cases that go to ECHR from the UK are sucessful, because ECHR sees the UK as strongly protective of the human rights of its citizens. If the UK stops being protective of my human rights I absolutely want an external actor to have some control. Why wouldn't I?

[1] https://fullfact.org/law/uks-record-human-rights-cases/

It is good to note that Brexit isn’t automatically an exit from European Court of Human Rights, if I read this correctly. These are separate institutions.

http://www.e-ir.info/2017/07/27/implications-of-brexit-for-t...

That's true, but the current PM has long been opposed to the ECHR. Even when apparently in favour of the EU.

With the overpowered repeal bill, she can use Brexit to get us out of anything with 'E' in the name, without bothering to put it to parliament.

This article is about a ruling from the ECJ, not the ECHR, although the ECHR are also looking at the UK's surveillance regime.

It's precisely these complexities which lead to the perception, held by many British people, that European courts are foreign, and shouldn't have the power to overrule British courts.

The EU is far from perfect, but the UK government has proven time and time again it requires oversight. The UK governments stance on e.g. encryption is nothing short of an international embarrassment. I am woeful for the future of this tiny island (I am a UK citizen).

So, I repeat in slightly different words:

You want an external entity to have control over my democratically elected government because right now the decisions aren't your personal preferences.

Yes, that is sort of the point of the EU. Whatever I wanted though, the vote has already happened, and the leavers won. We'll all be seeing what happens to the UK as a result.

The EU operating against the will of the people is why Leave won.

In what sense is the EU a foreign actor? The EU is a union of nations of which the United Kingdom is a member, and (up until it started to chop its own dick off) one of the most powerful members at that.

Votes in the EU are weighted by population

Germany 82,114,224

U.K. 66,181,585

France 64,979,548

Italy 59,359,900

Spain 46,354,321

So, yep. Most powerful being about 15% of the votes.

Still doesn't make the EU a domestic political institution.

Meanwhile there is a miserable little controversy running over Damien Green having porn on his Westminster PC, supported by Nadine Dorries saying "you can't prove it was him we all share passwords with our interns."

Nobody in government understands information security.

What's wrong with porn?

The issue IIRC is [extended] use of work computer, during work time, for porn. That would get you sacked from most corporate jobs; it seems being an MP shouldn't be an automatic pass from such scrutiny.

How about playing games while being paid to legislate?

http://zeus-origin.snopes.com/photos/politics/solitaire.asp

I think the issue is with accessing pornography on a parliamentary computer, potentially during working hours.

Nevertheless, it is shameful that an ex-police officer is allowed to make such allegations.

Yes to both of these points. The police tactical leaking is out of order, and I'd be a lot more cross about it if I wasn't hoping for the government to collapse.

The hilarious part is that the people trying to defend Green are simultaneously saying he shouldn't be leaking confidential information and saying it never happened.

One would think it'd be better to say said police officer shouldn't be making things up if their story is that it never happened.

There is also the related issue about Police releasing the results of items found on someone's computer during an unrelated investigation (and a search that was a bit dodgy in the first place).

Which should make it easier to convince MPs to change things, a little thing like showing all of their dirty linen to the public. Though being a US citizen, all of this is coming here soon as well.

In related news, GCHQ are still trying to wriggle out of oversight: https://news.ycombinator.com/item?id=15842969

I am constantly surprised how I appear to live in the same society as the people suggesting these clearly undemocratic efforts to sidestep the democratic oversight. But, they think it is ok and I think it really isn’t, at all. I am surprised our world views differ that much.

None of this matters as long as Technical Capability Notices are still part of snoopers' charter. TCNs are basically National Security Letters with even less accountability and limitations. It's extremely ripe for abuse.

If you create a secure communication platform startup in the UK, you will receive a TCN and you will be forced to subvert your platform for government data collection. You can't tell anyone about the TCN and you have no recourse other than going to prison for failure to comply. At least in the US when you receive an NSL you can talk to a lawyer to potentially contest an unreasonable or unlawful order.

I just totally dispair when it comes to this. I feel powerless to stop my country becoming the distopia imagined in V for Vendetta. Both main parties are supporting legislation beyond the wildest dreams of 20th century despots..

I have no way of directly knowing anything about situations like these. But I suspect that no matter what they say, they're collecting the data. I don't want to hear about court rulings, I want to hear that their hardware has been removed from the telco rooms, and that facilities like Bluffdale have been dismantled. I feel that there is quite a bit of theater going on where the various surveillance monsters acknowledge getting caught and act as if they got spanked and reigned in, when in fact they're just getting bigger and more capable every day.

To recap: the problems are that data is accessed without independent permission, and data is collected for reasons other than serious crime.

So the solution is to create a government body to rubberstamp access requests, and reclassify more crimes as serious?

Reply on news.ycombinator.com