New UK Surveillance Bill Appears In The Wake of Snowden

Critics call it a revived snooper’s charter, because the government wants police and spies to be given access to the web browsing history of everyone in Britain. However, Theresa May says her measures would require Internet companies to store data about customers that amount to “simply the modern equivalent of an itemised phone bill”.

 
The government is attempting to push into law the ability for law enforcement agencies to be able to look at 12 months of what they are calling “internet connection records”, limited to the website domains that UK internet users visit.
This is the log of websites that you visit through your internet service provider (ISP), commonly called internet browsing history, and is different from the history stored by your internet browser, such as Microsoft’s Edge, Apple’s Safari or Google’s Chrome.

It does not cover specific pages: so police and spies will not be able to access that level of detail. That means they would know that a person has spent time on the Guardian website, but not what article they read.Clearing your browser history or using private or incognito browsing modes do nothing to affect your browsing history stored by the ISP.

What will they be able to learn about my Internet activity?

Information about the sites you visit can be very revealing. The data would show if a person has regularly visited Ashley Madison – the website that helped facilitate extramarital affairs. A visit to an Alcoholics Anonymous website or an abortion advice service could reveal far more than you would like the government or law enforcement to know.
The logged internet activity is also likely to reveal who a person banks with, the social media they use, whether they have considered travelling (e.g. by visiting an airline homepage) and a range of information that could in turn link to other sources of personal information.

Who will store my web browsing data?

May wrong to say surveillance bill creates judicial authorisation for interception, says Liberty – live
Rolling coverage of the day’s political developments as they happen, including Theresa May publishing the draft investigatory powers bill.The onus is on ISPs – the companies that users pay to provide access to the internet – to store the browsing history of its customers for 12 months. That includes fixed line broadband providers, such as BT, TalkTalk, Sky and Virgin, but also mobile phone providers such as EE, O2, Three and Vodafone.

But after what happened with TalkTalk, can ISPs keep my data safe?

TalkTalk may have been hacked by a group of teenagers, going on recent arrests. The customer data targeted was not all encrypted, a practice for which TalkTalk was roundly criticised.But the most worrying aspect of the TalkTalk hack is that the company’s chief executive, Dido Harding, said the company’s cybersecurity was “head and shoulders” above its competitors.Consumers are likely to need reassurance from the companies and government that all ISPs can maintain the security of customer data.

Will that push up the prices of phone bills?

May announced that the government would cover the costs of storing internet connection records and establishing the new judicial oversight regime. She estimated it would cost between £245m and £250m over 10 years.
This includes £175m for the cost of storing everyone’s Internet records, which means ISPs should not have to put up prices to cover their costs.

Don’t ISPs already store this data?

They already store a limited amount of data on customer communications for a minimum of one year and have done for some time, governed by the EU’s data retention directive. That data can be accessed under the Regulation of Investigatory Powers Act 2000 (Ripa).
The new bill will enshrine the storage of browsing history and access to that data in law.

Can people hide their Internet browsing history?

There are a few ways to prevent the collection of your browsing history data, but each way is a compromise.
The most obvious way is the use of virtual private networks (VPNs). They channel your data from your computer through your ISP to a third-party service before immersing on the Internet. In doing so they can obfuscate your data from your ISP and therefore the government’s collection of browsing history. Companies routinely use VPNs to secure connections to services when off-site such as home workers. Various companies such as HotspotShield offer both free or paid-for VPN services to users.Using the Tor browser, freely available from the Tor project, is another way to hide what you’re doing from your ISP and takes things a stage further. It allows users to connect directly to a network of computers that route your traffic by bouncing it around other computers connected to Tor before emerging on the open Internet.Your ISP will see that you are connected to Tor, but not what you are doing with it. But not everybody has the technical skills to be comfortable using Tor.

Is there any downside to using a VPN?

In using a VPN you are placing all your trust in the company that operates the VPN to both secure your data and repel third parties from intercepting your connection. A VPN based in the UK may also be required to keep a log of your browsing history in the same way an ISP would. The speed of your Internet connection is also limited by the VPN. Most free services are slow, some paid-for services are faster.Tor also risks users having their data intercepted, either at the point of exit from the Tor network to the open Internet or along the path. This is technically tricky, however. Because your Internet traffic is bounced between computers before reaching you, Tor can be particularly slow.

Can I protest-browse to show I’m unhappy with the new law?

One way to prevent an accurate profile of your browsing history from being built could be to visit random sites. Visiting nine random domains for every website you actually want to visit would increase the amount of data that your ISP has to store tenfold. But not everybody has the patience for that.At some point it will be very difficult to store that much data, should everyone begin doing so.

What about smartphones?

Hiding your browsing history while using a smartphone or tablet is harder. Most devices, including Apple’s iPhone and Google’s Android devices can use both VPN services and Tor, but the service is at risk of slowing down and not protecting every connection made by every app.


Guardian:

 

« Russian Air Crash Investigation Changes The Encryption War
Bank of England Partners With US for Cyberattack Simulation »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ON-DEMAND WEBINAR: How to improve your security posture with a web application firewall (WAF)

ON-DEMAND WEBINAR: How to improve your security posture with a web application firewall (WAF)

Watch this webinar to discover how a WAF goes beyond a standard firewall and helps you meet security industry compliance.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ThreatSTOP

ThreatSTOP

ThreatSTOP is a cloud-based automated threat intelligence platform that converts the latest threat data into enforcement policies to stop attacks before they become breaches.

VADO Security Technologies

VADO Security Technologies

VADO Security enables the safe transfer of data between low & high security networks.

Center for Cyber Safety and Education

Center for Cyber Safety and Education

The Center for Cyber Safety and Education works to ensure that people across the globe have a positive and safe experience online through our educational programs, scholarships, and research.

Odyssey

Odyssey

Odyssey is an ISO 27001 certified, Cyber -Security, Infrastructure and Risk Management Solutions integrator and a Managed Security Services Provider.

4Stop

4Stop

4Stop is a global KYC, compliance and anti-fraud risk management company.

Infodas

Infodas

Infodas provides Cybersecurity and IT consulting / system integration services as well as a range of innovative Cybersecurity products to public sector and commercial clients.

Empiric

Empiric

Empiric is a multi-award winning technology and transformation recruitment agency specialising in data, digital, cloud and security.

Nameshield Group

Nameshield Group

Nameshield is one of most experienced domain name registrars, trademark protection specialists and managers of online reputational risk in the world today.

Nominet

Nominet

Nominet's cyber division offers network detection and response services to governments and enterprises worldwide.

Guardara

Guardara

Guardara's mission is to help our customers to continuously improve in every aspect of software development.

HB-Technologies

HB-Technologies

HB-Technologies is pioneer in Africa, in digital security, embedded electronic and IT solutions based on highly secure smart cards that comply with international standards and norms.

Foundries.io

Foundries.io

Foundries.io have built a secure, open source platform for the world's connected devices, and a cloud service to configure this to any hardware and any cloud.

Cyber Defence Solutions (CDS)

Cyber Defence Solutions (CDS)

Cyber Defence Solutions is a cyber and privacy Consultancy with extensive experience in the development and implementation of cyber and data security solutions to your assets.

Great American Insurance Group

Great American Insurance Group

Great American's Cyber Risk Division offers cyber solutions for small and medium-sized businesses.

Metabase Q

Metabase Q

Metabase Q protects you from financial and reputational losses with more efficient and intelligent cybersecurity, using the best worldwide in technologies, processes and specialists.

Center for Information Security Awareness (CFISA)

Center for Information Security Awareness (CFISA)

CFISA was formed by a group of academics, security and fraud experts to explore ways to increase security awareness among audiences, including consumers, employees, businesses and law enforcement.