![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2016\/01\/3029613413_145219499e_b.jpg?w=738\")
<\/p>\n<\/p>\n
A little more\u00a0detail has emerged about how\u00a0a key component\u00a0of the\u00a0controversial UK surveillance law<\/a>, the Investigatory Powers Act, which was passed at the end of last year, is likely to\u00a0function \u2014 after a government consultation document on so-called Technical Capability Notices was published by the digital rights organization Open Rights Group yesterday<\/a>.<\/p>\n Technical capability notices refer to\u00a0the statutory instrument\u00a0by which the UK government will be able to place obligations on ISPs and communications services providers to ensure government surveillance\u00a0capabilities\u00a0set out in the legislation are able to\u00a0function.<\/p>\n The draft document\u00a0sets out requirements for communications services providers to maintain a capability to be in a position to hand over de-encrypted data in \u201cnear real time\u201d when served a warrant by a government agency, and to have the capability to intercept simultaneously comms and metadata for up to 1 in 10,000 of their customers.<\/p>\n The regulation also specifies that ISPs must consider the \u201cobligations and requirements imposed by any technical capability notice when designing or developing new telecommunications services or telecommunication systems\u201d.<\/p>\n It\u2019s not clear when the requirements\u00a0will come\u00a0into force. The document notes the regulations may be cited as \u201cthe Investigatory Powers (Technical Capability) Regulations 2017\u201d \u2014 but a place for\u00a0a date for when they come into force\u00a0remains blank, presumably as the consultation, which runs until May 19, continues.<\/p>\n As the Register<\/a> reported yesterday, this is\u00a0a\u00a0targeted consultation, focusing on the industry entities\u00a0likely to be subject to such notices. The document<\/a> has also already been seen by the Home Office Technical Advisory Board \u2014 whose members include individuals from Lockheed Martin International, O2,\u00a0BT, BSkyB,\u00a0Cable and Wireless, Vodafone, and Virgin Media \u2014 as well as certain unnamed government\u00a0agencies who would be making use of the powers.<\/p>\n Some\u00a0of these details were already teased out during a committee session on the Investigatory Powers bill\u00a0in the House of Lords last summer<\/a>. Speaking on behalf of the government then, Lord Howe said:\u00a0\u201cLaw enforcement and the intelligence agencies must retain the ability to require telecommunications operators to remove encryption in limited circumstances. Subject to strong controls and safeguards to address the increasing technical sophistication of those who would seek to do us harm.\u201d<\/p>\n However now, as then, it\u2019s still not clear whether or not\u00a0the government is explicitly\u00a0outlawing\u00a0end-to-end encryption, given that\u00a0a provider that\u00a0does not hold encryption keys (e.g. WhatsApp) would not be able to hand over de-encrypted data (and would therefore, at least\u00a0technically, be falling outside the law) \u2014 and thus whether or not it will try to use the Technical Capability Notices\u00a0to force companies not to use E2E encryption, or else build in backdoors (as critics have\u00a0warned<\/a>).<\/p>\n While the vague wording of the legislation, and the equally vague responses of government ministers, suggests it could technically<\/em> be outlawing E2E encryption, the government\u00a0has not\u00a0explicitly stated that is the intention.\u00a0So,\u00a0as UK cyber security professor\u00a0Eerke Boiten<\/a>\u00a0puts it: \u201cWe\u2019re still stuck on whether \u2018applied by or on behalf of\u2019 covers E2E where the \u2018relevant operator\u2019 doesn\u2019t have the keys.\u201d<\/p>\n Speaking to TechCrunch, Boiten\u00a0added: \u201cI agree that the best and likeliest interpretation of that is that they do have the power to tell \u2018relevant operators\u2019 not to use E2E\u2026 \u00a0but there\u2019s no final answer from government.<\/p>\n \u201cIt\u2019s very important to note that the question got asked and asked again [during bill committee sessions], and that the answer was avoided, but the net effect is that we don\u2019t know any better whether they hold the view that they could use it to ban E2E or not.\u201d<\/p>\n And the net effect of that fuzziness is continued uncertainty for UK citizens and businesses, and a knock-on erosion of trust in the security of domestic digital services if people think they might come with government-mandated, exploitable backdoors.<\/p>\n Nor is that the only potential collateral damage here; democracy is also taking a hit if we can\u2019t decrypt\u00a0the legislation on encryption.<\/p>\n Making this point, Boiten flags prior comments made by QC David Anderson, the government\u2019s independent reviewer of terrorism legislation,\u00a0on the older patchwork of UK surveillance legislation (RIPA) that the IP Act was intended to update and replace. In a\u00a02015\u00a0report<\/a> on government surveillance capabilities, Anderson\u00a0wrote: \u201cThe desire for legislative clarity is more than just tidy-mindedness. Obscure laws \u2014 and there are few more impenetrable than RIPA and its satellites \u2014 corrode democracy itself, because neither the public to whom they apply, nor even the legislators who debate and amend them, fully understand what they mean.\u201d<\/p>\n The key line there being: \u201cObscure laws\u2026 corrode democracy itself.\u201d And when it comes to encryption, UK politicians have been failing to make<\/a> their intentions clear<\/a> for years now<\/a>.<\/p>\n Which sure looks like\u00a0intentional and undemocratic obfuscation.<\/p>\n The current UK government also only recently published what appear to be the final versions of its operational cases<\/a> setting out justification for the intrusive\u00a0surveillance powers set out in the IP Act \u2014 likely putting these\u00a0online ahead of civil service purdah after the Prime Minister called a surprise election for June 8.<\/p>\n Commenting on the\u00a0operational cases, the Open Rights Group\u2019s executive director Jim Killock objected to\u00a0another lack of specificity:\u00a0\u201cThe updated operational case for communications data shows again just how extensive the government\u2019s surveillance regimes is, with a large number of government organisations and local authorities being able to access our personal communications data.\u201d<\/p>\n Last month the\u00a0group also\u00a0called on the government<\/a> to state how it will respond to a ruling by the European Court of Justice (CJEU)\u00a0last December<\/a> that general and indiscriminate retention of comms data is illegal\u00a0\u2014 which ORG\u00a0argues calls into question the legal basis for the current data retention regime. (The CJEU ruling pertains to\u00a0a legal challenge brought against\u00a0DRIPA, an earlier piece of surveillance legislation that\u00a0sunsetted at the end of 2016, but which\u00a0the IP Act\u00a0was introduced\u00a0to replace.)<\/p>\n The UK\u2019s new surveillance regime\u00a0includes a provision requiring ISPs to collect and retain comms data on all their users for a period of 12 months \u2014 effectively logging the web browsing activity of all UK citizens in order that individual warrants could\u00a0be served against this data up to a year afterwards. So, once again, that\u2019s a general and indiscriminate data retention requirement.<\/p>\n \u201cThe CJEU said that blanket data retention was not permissible and should only be used for serious crime. It also said that there needed to be independent authorisation for access to communications data. The government has yet to respond publicly to this ruling. It\u2019s vital that the government clarifies its position before the election,\u201d said Killock last month.<\/p>\n It does not appear that\u00a0the government has clarified its position on that front either.\u00a0We\u2019ve reached out to the Home Office to ask for its response to the ruling\u00a0and will update this story with any response. But with the Brexit negotiations for the UK to leave the European Union having been started\u00a0this spring, the government\u00a0may now be hoping to kick the CJEU ruling\u00a0into the long grass as it works\u00a0to take the UK out of\u00a0the jurisdiction of the court.<\/p>\n Featured Image: Harshil Shah<\/a>\/Flickr<\/a> UNDER A CC BY-ND 2.0<\/a> LICENSE<\/small><\/p>\n","protected":false},"excerpt":{"rendered":"![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2016\/01\/3029613413_145219499e_b.jpg?w=680\")
A little more detail has emerged about how a key component of the controversial UK surveillance law, the Investigatory Powers Act, which was passed at the end of last year, is likely to function — after a government consultation document on so-called Technical Capability Notices was published by the digital rights organization Open Rights Group yesterday. Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-340196","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=340196"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340196\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=340196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=340196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=340196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}