Data Retention – Its Not Where You Go, But Who You Talk To

Doug

Who is Doug talking to, and will Australia’s proposed metadata retention scheme be able to find out? Flickr/Doug, CC BY-NC-ND

This article, by Luke Heemsbergen was originally published at The Interdisciplinary Internet Institute. It has been edited slightly to better address a domestic audience. See the original article.

Data retention may well be a valuable resource to fight serious crime and terrorism, but it’s not, when, if you decide to be a terrorist, you can also decide to evade the whole system by using Gmail. The purpose and implementation of the Australian government’s proposed metadata retention scheme is making less sense as political pressure mounts to get the legislation passed.

So what’s going on?

Recently, Tony Abbott explicitly used the “you’re with us or with the pedophiles” argument to push the legislation ahead. However, the bill as written and explained in committee suggests it’s laughably easy for criminals to ‘opt out’ of data collection, while the rest of Australians still have their communications spied on, retained for two years, and kept in commercial data centres at tax payers’ expense with no assurances of security.

The Australian Greens senator Scott Ludlam recently poked glaring holes in the bill which has already met strong opposition from privacy advocates.

[You should really watch these videos, they sting]

Yet even before the PM dropped the pedo-bomb, he had urged the opposition leader Bill Shorten to quickly pass the bill in parliament, before its cost or data scheme are finalised.

Why?

It doesn’t seem to be to catch child abusers or terrorists. To be blunt, people who abuse children and share that online use Tor hidden services to do so, not the open web.

Further, as written, the bill’s worth as a tool to specifically fight terrorism, or any other serious crime, seems dubious. Anyone in Australia can easily ‘opt out’ of having their data retained simply by choosing any internet messaging service where the persons operating the service do not own or operate “in Australia, infrastructure that enables” that service.

So what does that mean for the apps commonly used on smartphones today?

Whatsapp, the popular mobile messaging app with 700 Million users, around 10% of which come from the Middle East, or Viber, a similar app with 20 Million users in Pakistan alone, are both excluded from data retention. These are some of the apps that David Cameron recently mused about baning in the UK.

According to answers given by Australian Attorney General’s (AG) department staff during the Senate Legal and Constitutional Affairs Reference Committee, the ‘in Austrlia’ provision also means that even Gmail is excluded.

With all these reports of what the bill leaves out or doesn’t do, no one seems to acknowledge what is actually in the draft bill, and how that language might affect policing, government, and privacy. The bill, good for nothing, bad for most things, presents a bit of a puzzle.

There are a few explanations for this puzzle.

The first explanation, is that the AG department literally has no idea how the Internet works. This is more plausible than you’d imagine (see below). But performances such as AG staffer Anna Harmer’s frenetically precise attempts to prove the contrary show that stiff minded people are thinking hard about data retention. (Bless you Anna, you won my moot at ‘I don’t know that its quite as simple as that for the reasons I set out previously, in relation to the provision of telecommunications services’, as delivered in less than 0.73 seconds. Full video here).

The second explanation, suggests that Australia is carrying out its obligations as part as a member of the five-eyes network of English speaking intelligence partners (you remember POMs right?).

In this scenario, instead of the expensive “collect it all” mentality of the NSA under Gen. K Alexander, Australia’s AG department is pushing the political costs of data-retention schemes onto Australian corporations.

The logic here is that it makes economic and political sense to have Australian Internet service providers such as Telstra and iinet retain what’s theirs, rather than have the NSA hoover it up via a special collection service. Then, once data is stacked up in Telstra for two years, it becomes easier to institute backdoor access when the five-eyes require a peak. Not that the NSA and its partners are doing that anymore, right?? Nothing to see here comrade, move along.

The third explanation is more plausible, but is worse for Australians. It suggests, that contrary to the PM’s politiking, the data to be retained is not valued by the government for its national security or anti-child abuse value.

Instead, Australians are spied on for data that will become valuable for other state functions including the expanded reach of civil litigation. This includes “normal” policing, civil subpoenas, and even copyright disputes.

So, let’s detail why, while the first explanation might be plausible, it hides serious security and privacy concerns that expose how data retention will affect Australians in their everyday life.

(Mis)understanding the internet

It has been six months since the Australian Attorney-General’s catastrophic interview on the Sky News made international headlines. This is the interview in which the Attorney-General George Brandis attempts to explain how web browsing habits will not be captured, even though, in the words of Brandis:

[…] what will be caught is the, um, is is, is the, um, is the, is the web address they communicate to.

Regardless of the then communicated confusion (between URLs and IP addresses?), the current draft of the bill actually proves the Attorney-General half right! By doing so, the bill’s language provides insight to why this data retention scheme offers an palpable loss of privacy, and creates a significant ‘gold mine’ for hackers and civil litigants alike. Apparently, the Australian government is not explicitly interested in IP addresses that you visit. The bill in its current form states in section 187A that the government:

[…] does not require a service provider to keep, or cause to be kept […] [information that] states an address to which a communication was sent on the internet, from a telecommunications device.

In more detail, the helpful “explanatory memorandum” codifies that:

Under proposed paragraph 187A(4)(b), the retention obligation is explicitly expressed to exclude the retention of destination web address identifiers, such as destination internet Protocol (IP) addresses or uniform resource locators (URLs).

Fine. What are we talking about then?

It’s all about the destination

What the government does seem to be after is “destination” data that basically amounts to an assortment of ‘dummy’ variables that help identify you, and who you are communicating with. Instead of IP address or webpage, they are interested in retaining email accounts, and Skype handles, and phone numbers, etc. for the connections you have made. The government’s definition of “destination” is multiple (click here, search for “destination”), but we can isolate a key phrase:

This information can then assist with determining the subscribers who sent or received relevant communications.

That is to say, who you’re talking to online, not where you went. The government’s “destination” is in many ways more invasive than IP addresses or web URLs alone. For instance, think about how each person in Australia connects to the IP address 69.63.176.13. That’s Facebook.com. Retaining the metadata of time spent at that address would not produce much actionable intelligence on you or the other 8 million Australians who browse Facebook each day. Nor would it be all that invasive to privacy. “Destination” data is different. “Destination” data seeks to capture who, specifically, you’re spending time with online; who is the destination that you are messaging through email, Skype, or possibly even Facebook’s real-time apps and services? Think of it this way: two ‘destinations’ pass data through the same communications service at a series of very specific times, again, again and again. No other two ‘destinations’ share this unique pattern of time and confection. Analysing how these ‘destinations’ link together with other metadata (eg. geo-location, device type/operating system, etc.) allows the government – or anyone else who snoops in on the retained data – to predict, for instance, that these communications were yours, and whether you targeted them to, let’s say, your spouse, or an “old friend” across town. And whether you meet up with that person from time to time. And where. And for how long. Geolocation data alone is incredibly powerful when we all carry devices that connect to the internet in our pockets. And the Australian press is just starting to understand how powerful metadata is. Retaining all of that metadata provides an incredible amount of information for civil litagants that can ask for it through a subpoena. As an former iiinet lawyer wrote:

The Data Retention Bill does not impose any limitation on access to the retained data by other legal avenues. This means there’s nothing stopping your ex-husband, your employer, the tax office or a bank using a subpoena to get access to that data if it is relevant to a court case.

All this data aslo creates a very valuable target for hackers, including ‘adversarial intelligence agencies’ trying to infiltrate your identity, ransom you for your secrets, or run some form of economic espionage. I hope Australian service providers can keep all the data safe once they’ve accumulated two years worth of intimate connections for each Australian who uses any sort of telecommunications device. Sadly, recent security breaches at companies as diverse as AppleTarget, and the latest 1 Billion (that’s a B) USD heist from ‘100 banks and other financial institutions in 30 nations’ suggest otherwise. This leaves the current idea of ‘Made in Australia’ data retention a seemingly disproportional mix of intrusion and risk, for minimal gain. The need for such blanket spying on Australians that may or may not have conducted crimes, or may or may not be thinking of doing so, seems drastically oversold, while the consequences to privacy, and potential for abuse is very real.

If you’re concerned about indiscriminate mandatory data retention in Australia, please support this campaign.

Posted in Data Retention Tagged with: , , , ,

CitizenFour: Why it’s already the movie of the year

By Alex Schlotzer, EFA Board Member

rogerebert.com, "The Movie of the Century"Less than two weeks after its Australian release, CitizenFour today received the Academy Award for Best Documentary Feature. The film had previously won the British equivalent (BAFTA) as well as a long list of awards from film festivals and critics societies.

I was fortunate enough to catch the Melbourne preview screening earlier this month organised by EFA, Madman and civil liberties councils across Australia and supported by Greens Senator Scott Ludlam.

If you don’t know about Citizenfour let me give you a quick breakdown of this remarkable documentary (from the CitizenFour official website:

“CITIZENFOUR is a real life thriller, unfolding by the minute as Edward Snowden as he hands over classified documents providing evidence of mass indiscriminate and illegal invasions of privacy by the National Security Agency (NSA).”

The documentary is excellent in its use of raw footage. The director uses the very real emotions captured in that raw footage to tell the story. As an observer you’re given front row seats to the events as they unfold from Snowden’s hotel room in Hong Kong.

Rather than inserting herself too much into the documentary, Laura Poitras, becomes the ultimate story teller using raw footage with interesting ways of keeping the narrative moving. The use of music is powerful and seriously contributes to the sense of tension. Even though we already know what happens, it’s a documentary remember, you still feel the urge to call out ‘stay away from the windows and doors”.

You might have remembered reading all about the revelations at the time as stories were being reported in The Guardian and then across the world. This movie gives you an insider’s view of what happened and how.

And more importantly it is a powerful reminder of how governments around the world are capturing more and more of our data and telecommunications without our consent or a warrant. While Australia isn’t mentioned by name in Citizenfour, our governments have been cooperating in global surveillance through the Five Eyes program.

With the Abbott Government attempting to rush through mandatory, society-wide data retention laws, this movie couldn’t have been released at a better time.

You’ll be motivated to take action to make sure your federal Member of Parliament opposes the data retention laws; whether Labor or Liberal/National.

Watch the trailer; then go and you’ll see why Citizenfour is already movie of the year.

CitizenFour is currently showing in Sydney, Melbourne, Brisbane, Adelaide, Hobart, Perth and Canberra (and New Zealand!). See a full list of cinemas.

For guidance on contacting your parliamentarians, see our Take Action page.

Support this campaign for your chance to win a double pass to see CitizenFour!

 

Posted in Data Retention, Encryption, International, PRISM, Privacy, Surveillance Tagged with: , , , , , ,

Ludlam demolishes data retention bill

Scott LudlamAt the end of January, the Parliamentary Joint Committee on Intelligence and Security (PJCIS) held two days of hearings into the government’s data retention legislation (transcripts here and here).

These hearings were at times a testy affair, with a number of Coalition members particularly being openly antagonistic to privacy advocates, including EFA’s Jon Lawrence (see the transcript of EFA’s testimony), while accepting, almost completely uncritically, the largely unsupported assertions of law enforcement agencies, ASIO and the Attorney-General’s Department.

Thankfully, some genuine scrutiny was applied to this legislation at a separate hearing held on Monday 2nd February by the Senate’s Legal and Constitutional Affairs References Committee (transcript here). EFA also testified to this Committee (see transcript).

Committee Chair, Greens Senator Scott Ludlam did a particularly excellent job of highlighting some of the very significant weaknesses in the legislation, in terms of its coverage and likely effectiveness, and in the justifications presented for it.

His questioning of the representatives from the Attorney-General’s Department is well worth viewing. The highlights are:

Or, if you’ve got a spare 90 minutes, you can watch the whole session.

Posted in Data Retention, Encryption, Surveillance Tagged with: , , , , , ,

Five things we learned about the Government’s data retention regime in 2014

By Alex Schlotzer, Board Member – Electronic Frontiers Australia

NoMDRRight now the Government is proposing to introduce a mandatory, society-wide regime for the retention of communications data (‘metadata’) for two years. In the latest public hearing into the Government’s proposed legislation a number of important matters were revealed by the Attorney-General and Australia’s law enforcement and intelligence agencies.

If you weren’t paying attention to the workings of Parliament in the lead up to the festive season then you may have missed a crucial public hearing by the Parliamentary Joint Committee on Intelligence and Security (PJCIS), held on 17th December. This hearing delved into the Government’s proposed mandatory, society-wide data retention regime. It was a crucial hearing because from it we learned five things.

  1. There remains no final definition for the data set and what exactly will or won’t be retained. In fact the hearing revealed continuing confusion about what the Government and the law enforcement and intelligence communities consider to be relevant data.
  2. The Government doesn’t know how much it will cost to implement the Government’s mandatory, society-wide data retention regime, and they won’t be able to make meaningful estimates until they’ve finished defining the data set. What we do have are estimates about the costs to telcos and ISPs for implementing the regime, which the industry has already admitted will be passed on to consumers. So, you’ll end up paying more through higher connectivity charges, through your taxes, or probably both.
  3. The Government and the Australian Federal Police cannot say how many times existing surveillance laws and the subsequent data collected have contributed to intercepting criminal activity or successfully prosecuting suspects.
  4. There were no new details provided about the circumstances under which access to data is granted or what it will be used for. This is particularly interesting given the recent passage of laws enabling the AFP and ASIO to delete, add or change data on computers of people who are not ‘persons of interest’.
  5. It was confirmed that the mandatory, society-wide data retention regime could be utilised to pursue civil legal actions, particularly copyright infringement actions, and admitted that the regime represented a security risk as personal user data would be centrally stored for two years; offering a tempting target for crackers to steal data.

For some, the public hearing confirmed our worst fears about the mandatory, society-wide data retention regime. As coincidence would have it the PJCIS public hearing happened only days after the terrible café siege in Sydney played out with three people losing their lives.

And sadly the siege in Martin Place was used to justify the need for the additional powers that will see Australians treated as suspects, not citizens. The PJCIS heard how the siege could’ve been prevented if Australia’s law enforcement and intelligence agencies had such powers. As it turns out the suspect at the centre of it all was already on numerous watch lists, was well known to NSW and Federal police and has previously been under surveillance.

The same unfortunate situation occurred with the bombers of the Boston Marathon in April 2013 and this week’s attacks in France. In each case the perpetrators were well-known to police and intelligence agencies, who had for whatever reason neglected to watch these individuals closely or had stopped watching them. Having more data about their communications would have made no difference whatsoever as they were not being actively watched. Australian police and intelligence agencies already have extremely broad powers to request information about the communications (and the content) of specified individuals (persons of interest) be retained to support their investigations.

What they want now is for that information to be retained for two years for ALL Australians, even if you’re not being investigated or considered a person of interest. The regime represents a massive invasion of the privacy of all Australians, while subverting a fundamental principle of our legal system – the presumption of innocence – by treating all of us as suspects.

And we the public will get the privilege of paying for it all as telcos and ISPs will pass on the costs of implementing the regime to customers. While the telcos and ISPs have been measuring the possible cost of this poor policy, the Government has yet to work out how much it will cost taxpayers to implement it.

In addition, it was confirmed during the PJCIS public hearing that the laws pave the way for the pursuit of civil legal actions, especially related to copyright infringement, but also potentially unfair dismissal and in many other contexts. This means a new threat to the public who aren’t persons of interest as ordinary Australians get caught up in civil actions because they downloaded some movies from the net.

It’s up to people like us who want to be treated like Citizens, Not Suspects to stand up and demand our Government drop its plans to massively invade the privacy of all Australians. It’s not too late to turn it around.

Electronic Frontiers Australia (EFA) has been actively working to ensure together we can stop this assault on our rights; and the fundamental principle that underpins our legal system. But as we come into 2015 our time to turn it around is running out. EFA needs your help and support right now.

Take action

Write a submission

We’ve prepared a detailed guide to help you prepare a submission to the Parliamentary Joint Committee on Intelligence and Security, but time is short – the deadline for submissions is 5pm AEDT on Monday 19th January.

See our Data Retention Submission Guide

Sign our Petition

Join the thousands of concerned Australians who have already signed on to call on the Government to drop its proposed mandatory, society-wide data retention regime: Sign Now.

Contact your MP and Senators

See our helpful guide.

Support Us

This week marks EFA’s 21st birthday. We’ve been fighting against (and often winning) government overreach throughout that time. We survive on membership subscriptions and donations, so if you support our work, please:

DONATE today.

Posted in Uncategorized

The 90s and Now: FBI and its Inability to Cope with Encryption

Fialka M125-3MN cypher wheel. By Paul Hudson [CC-BY-2.0], via Wikimedia Commons

Fialka M125-3MN cypher wheel. By Paul Hudson [CC-BY-2.0], via Wikimedia Commons


This post, by Amul Kalia, was originally published on EFF’s Deeplinks blog on 29th October 2014.

Australian authorities are using many of the same arguments, including to justify the mandatory data retention legislation introduced into parliament last week.

Recently, FBI Director James B. Comey, along with several government officials, have issued many public statements regarding their inability to catch criminals due to Apple and Google offering default encryption to their consumers.

We at EFF have been around long enough to see these nearly identical statements being made in the past, and have simultaneously witnessed law enforcement agencies not rendered obsolete. In fact, we’ve seen the exact opposite. The tools available to the law enforcement today are expansive and are much scarier, and require close scrutiny to ensure that civil liberties of millions of people are not jeopardized in the process of catching a few bad guys.

But we certainly felt a bit of déjà vu when we saw current FBI Director Comey’s statements, since they sound eerily like the sentiments expressed by then FBI Director Louis J. Freeh in front of the Senate Judiciary Committee in July 1997.  Specifically:

Founding Fathers Wouldn’t Want Us to Have Encryption

A repeated talking point is that the Founding Fathers of America would side with the law enforcement in finding a ‘balance’, that ensures government access to all communications.

In 1997 former Director Freeh said:
… the framers established a delicate balance between “the right of the people to be secure in their persons, houses, papers, and effects (today we might add personal computers, modems, data streams, discs, etc.) against unreasonable searches and seizures.” Those precious rights, however, were balanced against the legitimate right and necessity of the police, acting through strict legal process, to gain access by lawful search and seizure to the conversations and stored evidence of criminals, spies and terrorists.
In 2014 Director Comey said:
But the way I see it, the means by which we conduct surveillance through telecommunication carriers and those Internet service providers who have developed lawful intercept solutions is an example of government operating in the way the founders intended…

This is striking to us because even a minimal glance at history reveals that the opposite is true.Thomas Jefferson invented (and used) a wheel cypher. More importantly, it was reportedly frustration with the British resolution of 1785 authorizing the Department of Foreign Affairs to open and inspect any mail related to the safety and interests of the United States that led James Madison, Thomas Jefferson and James Monroe to write to each other in code.

In fact, in the 1999 decision throwing out the government’s export regulations on encryption in EFF’s case Bernstein v. Department of Justice, the Ninth Circuit Court of Appeals noted:  “The availability and use of secure encryption may…reclaim some portion of the privacy we have lost. Government efforts to control encryption thus may well implicate not only the First Amendment rights…but also the constitutional rights of each of us as potential recipients of encryption’s bounty.”

Private Companies Providing Strong Encryption are Ignorant and Dangerous

Private companies and actors, when providing robust privacy and security for their consumers, need to be educated about their responsibilities to help law enforcement, and Congress and other regulatory bodies should step in.

1997 Freeh:
Encryption is certainly a commercial interest of great importance to this great nation. But it’s not merely a commercial or business issue. To those of us charged with the protection of public safety and national security, encryption technology and its application in the information age–here at the dawn of the 21st century and thereafter–will become a matter of life and death in many instances which will directly impact on our safety and freedoms. Good and sound public policy decisions about encryption must be made now by the Congress and not be left to private enterprise. Legislation which carefully balances public safety and private enterprise must be established with respect to encryption.
2014 Comey:
We understand the private sector’s need to remain competitive in the global marketplace. And it isn’t our intent to stifle innovation or undermine U.S. companies. But we have to find a way to help these companies understand what we need, why we need it, and how they can help, while still protecting privacy rights and providing network security and innovation. We need our private sector partners to take a step back, to pause, and to consider changing course.We also need a regulatory or legislative fix to create a level playing field, so that all communication service providers are held to the same standard and so that those of us in law enforcement, national security, and public safety can continue to do the job you have entrusted us to do, in the way you would want us to.

Similar arguments are also made in conjunction with the FBI’s desire to turn companies into an extension of the agency by pushing for unraveling the protections provided to companies and free and open source projects to make strong tools under CALEA.

FBI Needs Weak Encryption Because of Terrorism

And despite the 17 year time gap, both men gave very similar reasons for trying to discourage companies from offering their customers tools to protect themselves, playing the politics of fear.

1997 Freeh:
We believe that unless a balanced approach to encryption is adopted… the ability of law enforcement to investigate and sometimes prevent the most serious crimes and terrorism will be severely impaired. Our national security will also be jeopardized.
2014 Comey:
Those charged with protecting our people aren’t always able to access the evidence we need to prosecute crime and prevent terrorism even with lawful authority…. And if the challenges of real-time interception threaten to leave us in the dark, encryption threatens to lead all of us to a very dark place.

Yet instead of giving any actual examples of terrorism cases, both men could only muster edge cases in their pitch for weakening encryption. The Intercept did an analysis of some of the examples given by Comey, and the results were less than convincing; in none of the cases was the absence of encryption the key to solving the crime.

Finally, Comey makes a plea to have an open and honest debate about liberty and security because ‘post-Snowden pendulum has swung too far in one direction—in a direction of fear and mistrust (of Government).’ But this framing of the debate is somewhat dishonest given that not a single legislation has been passed by Congress to curtail the dragnet surveillance of millions of innocent Americans and the only entities that have taken significant action to curtail mass surveillance on a national level have been private companies.

So the FBI is just running the same old line against encryption. Luckily, the nation didn’t fall for it in the 1990s and we shouldn’t fall for it now.

Posted in Data Retention, Encryption, Privacy, Surveillance Tagged with: , , , , ,

Sign up