杏吧原创

THE UK government wants your web history. Surveillance powers proposed by the Home Office last week have come under fire from privacy advocates for putting innocent people鈥檚 personal data at risk. The proposed law may even spark a wave of encryption, making it more difficult for the police and security services to find criminals and terrorists.

If passed into law, the Investigatory Powers Bill, presented to Parliament on 4 November, would require internet service providers (ISPs) to keep a record of every website their customers visit, storing each for 12 months. It would also create a legal basis for the government to survey phones and computers on a large scale, and read encrypted messages sent through online services 鈥� activities that documents revealed by Edward Snowden suggest the government was already doing.

The bill is meant to bring the power to track online communications in line with the government鈥檚 ability to monitor landlines and cellphones. 鈥淚t cannot be right that today the police could find an abducted child if the suspects were using mobile phones to coordinate their crime, but if they were using social media or communications apps then they would be out of reach,鈥� UK home secretary Theresa May said in her speech presenting the bill. Police say their inability to look into online services has already stymied some investigations.

Authorities will only be able to access internet connection records 鈥� root addresses like , along with the time and date of the visit 鈥� for three reasons: to identify the sender of a communication, to identify the apps or services they are using, and to determine whether or not someone has accessed illegal material. Once they know which sites someone is using to communicate, they can request more complete details from the site or service involved.

The goal is to apply the existing model of investigation, in which phone records are used to reveal patterns of communication, to the digital age. But of the University of Kent, UK, says the websites we visit are far more revealing than the numbers we call: 鈥淚f I go to a website about a rare disease, that says a lot more than if I have a phone call with my GP.鈥� Collecting everyone鈥檚 browsing history also puts innocent people at risk, he adds (see 鈥�Your browsing life鈥�).

It鈥檚 not even clear that the plan is technically feasible. The UK government says it will pay ISPs 拢175 million over the next 10 years to cover the cost of collecting and storing internet communication records. Sky and BT, leading ISPs in the UK, declined to comment on how this would be achieved when asked by New 杏吧原创, but Adrian Kennard, managing director of specialist ISP , says it isn鈥檛 as simple as keeping phone records.

Unlike a call routed from one person to another, accessing a website can involve sending hundreds or thousands of packets of data, and the web address won鈥檛 be in all of them.

鈥淚t鈥檚 technically very difficult to put together the sequence of packets from a customer that identifies they are visiting a website,鈥� says Kennard. 鈥淟arge ISPs have a vast amount of data going across their network. To comply with this they may have to send every single one of those packets, millions or billions a second, through some system to work out what is going on. It鈥檚 not going to be cheap.鈥�

Even with the added expense, recording web traffic may not be worthwhile. 鈥淭his will get ordinary people doing ordinary things, it will not get the serious criminals, the serious terrorists,鈥� says , who researches internet privacy law at the University of East Anglia, UK. Savvy criminals already use encryption and software like Tor to hide their online activities, so storing web records won鈥檛 help combat this.

鈥淭his will get ordinary people doing ordinary things, it won鈥檛 get the criminals or terrorists鈥�

It could also push lower-level criminals, along with people concerned about their privacy, into using encryption and Tor, making the police鈥檚 job more difficult. 鈥淚 think that鈥檚 entirely likely, 鈥渟ays Bernal. 鈥淭he more people use those, the harder it is to find people using them who are potentially dangerous.鈥�

The government has attempted to prevent this by clarifying an existing legal power requiring communication service providers to remove any encryption they apply to users鈥� messages when asked by authorities. However, it鈥檚 not yet clear what this will mean for end-to-end encryption services like the Android version of Facebook鈥檚 WhatsApp, and Apple鈥檚 iMessage. These use a long number called a key, stored on the user鈥檚 device, to scramble messages in a way that only the recipient can read. These encrypted messages cannot be decrypted by Apple or Facebook because they don鈥檛 hold the keys.

Kennard compares the government鈥檚 plan to the overuse of antibiotics 鈥� it may end up leaving only resistant strains that are harder to fight. 鈥淚f enough stupid criminals go to jail because they aren鈥檛 smart enough to use iMessage, the rest will start using it,鈥� he says. It鈥檚 also possible to run your own encryption without a service provider like Apple, so it can鈥檛 be banned outright.

These issues mean the government should abandon plans to collect web history, says Bernal. 鈥淢ass systems get the masses, they don鈥檛 get the ones they really want,鈥� he says. 鈥淭he approach should be much more intelligent.鈥�

Hacking specific phones and computers is a more precise way to intercept someone鈥檚 communications. The bill clarifies police and security services鈥� power to do this 鈥渆quipment interference鈥�. But that kind of hack, which requires a warrant, relies on fundamental flaws in software or hardware, either bugs overlooked by manufacturers or introduced at a government鈥檚 request. If the UK government finds or introduces such flaws, then others can find and exploit them too, putting everyone at risk. GCHQ, the UK鈥檚 digital spies, does assist companies in patching vulnerabilities, but Snowden鈥檚 files reveal they also keep some back for use in their hacking arsenal.

Adapting investigatory powers for the digital age is crucial, but the complexities of doing so and the potential for harm can鈥檛 be ignored. 鈥淲hat we do now will probably set the agenda for surveillance for the next couple of decades. We have to be thinking of where things are moving, not just how it is written right now,鈥� says Bernal. 鈥淲here there are gaps or vagueness in the law, the snoopers take advantage of those and stretch the limit.鈥�

(Image: Sam Edwards/Plainpicture)

This article appeared in print under the headline 鈥淓very click you make鈥�