GCHQ: I’m not charmed yet….

A little over a week ago, GCHQ gave us a show. A giant poppy, part of the 2014 Armistice Day appeal. It was spectacular – and, for me at least, more than a little creepy.

GCHQ poppy

The poppy display seems to have been part of something bigger: the term that immediately sprang to mind was ‘charm offensive’. GCHQ has, over the last year or so, been trying to charm us into seeing them as purely positive, despite the revelations of Edward Snowden. They’re trying to appear less secretive, more something to be admired and supported than something to be concerned about and made accountable. The poppy was an open symbol of that. Look at us, GCHQ seemed to be saying, we’re patriotic, positive, part of what makes this country great. Support us, don’t be worried about it. Love us.

I assume that the speech by Robert Hannigan, the new Director of GCHQ, was intended to be part of that charm offensive. For me, however, it had precisely the opposite effect. The full speech was published in the FT here – but I wanted to pick out a few points.

Privacy an absolute right?

The first, which made the headlines in the Guardian and elsewhere, is Hannigan’s statement that ‘privacy is not an absolute right’. He’s right – but we all know that, even the staunchest of privacy advocates. Privacy is a right held in balance with other rights and needs – with freedom of expression, for example, when looking at press intrusions, with the duty of governments to provide security and so forth. That’s explicitly recognised in all the relevant human rights documents – in Article 8 of the European Convention of Human Rights, for example, it says of the right to a private life that:

“There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others”

So we already know that privacy is not an absolute right – so why is Hannigan making the point? It’s hard to see this as anything but disingenuous – almost as though he wants to imply that foolish privacy advocates want to help terrorists by demanding absolute privacy. We don’t. Absolutely we don’t. What we want is to have an appropriate balance, for the interference in our privacy to be lawful, proportionate and accountable. At the moment, it’s not at all clear that any of that is true – there are legal challenges to the surveillance, deep doubts as to its proportionality and little evidence that those undertaking the surveillance are properly accountable. On the accountability front, it’s interesting that he should make such a speech at a time when the Intelligence and Security Committee of Parliament, are undertaking a consultation – it made me wonder whether he’s trying to steer the committee in a particular direction.

Facebook – a tool for terrorists?

The other headline from the speech is the way Hannigan seems to be attacking Facebook and others for being too helpful to terrorists – which is an interesting reverse from the more commonly held view that they’re too helpful to the authorities. The argument seems to go that the ‘old’ forms of terrorists, exemplified by Al Qaeda, use the ‘dark web’, while the ‘new’ forms of terrorists, exemplified by IS, are using the social media – Facebook, Twitter and so forth. It’s an interesting point – and I’m sure there’s something in it. There’s no doubt that ‘bad guys’ do use what’s loosely called the dark web – and the social media activities of ‘bad guys’ all around the world are out there for all to see. Indeed, that’s the point – their visibility is the point. However, on the face of it, neither of those ‘facts’ support the need for the authorities to have better, more direct access to Facebook and so forth. Neither, on the face of it, is any justification for the kinds of mass data gathering and surveillance that seem to be going on – and that GCHQ and others seem to be asking us to approve.

By its very nature, the ‘dark web’ is not susceptible to mass surveillance and data gathering – so requires a more intelligent, targeted approach, something which privacy advocates would and do have no objection to. Social media – and Facebook in particular – don’t need mass surveillance either. To a great extent Facebook is mass surveillance. All that information is out there – that’s the point. It’s available for analysis, for aggregation, for pretty much whatever the authorities want it. And if Hannigan imagines that the secret activities of IS and others are undertaken on Facebook he’s more naive than I could imagine anyone in the intelligence services could be – they can’t have chosen to use Facebook and Twitter instead of using the dark web, but in addition to it. The secret stuff is still secret. The stuff on Facebook and Twitter is out there for all to see.

What’s more, there are already legal ways to access those bits of Facebook and Twitter than are not public – which is why the authorities already request that data on a massive scale.

Charming – or disarming?

Hannigan must know all of this – so why is he saying it? Does he think that the charm offensive has already worked, and that the giant GCHQ poppy has convinced us all that they’re wonderful, patriotic and entirely trustworthy? They may well be – I’m no conspiracy theorist, and suspect that they’re acting in good faith. That, however, is not the point. Trust isn’t enough here. We need accountability, we need transparency, we need honesty. Checks and balances. Not just charm.

What makes journalists special?

The news that the Sun were supporting an application to the European Court of Human Rights over the Met’s gathering of the communications data of the Sun’s political editor, was greeted with more than a few raised eyebrows. The levels of irony and hypocrisy here are almost magnificent in their chutzpah. The Sun, central to a Murdoch empire that has been mired in scandals over phone-tapping, furious at one of their own having his phone calls (and more, to be fair) looked at – the communications data surrounding them at least. The Sun, whose close links to the Met were a part of the whole scandal that brought about the Leveson Inquiry, calling the Met out for unethical procedure. The Sun, who just days before had been railing against the whole European Human Rights regime, and the court itself, trying to use those very rights to defend themselves.

Despite this, and despite my dislike of the Sun, I, and many others, would support the Sun in their action. Journalists do need protection from surveillance. They do need privacy. They do need to be able to protect their sources. As the Sun said:

“A free press is fundamental to all of our other freedoms. And to have a free press reporters need to be able to protect the identity of their sources.”

It’s a bold statement and one worth further examination. The role of the ‘free press’ can sometimes be understated, particularly when we look at the excesses of the current crop of tabloids. Anyone who followed the Leveson Inquiry knows quite how badly the press can and do behave. Desperate, despicable stuff at times – cruel, selfish, manipulative, voyeuristic, racist, sexist, homophobic, transphobic, divisive, misleading (or worse), doing their best to bring out the worst in people. Just plain nasty in so many ways – but that should not blind us to the importance of at least something of a free press. Without the press, things like the MPs expenses scandal would never have come to light. Without the press, Edward Snowden would have found it far harder to get his information out – and would have been far less likely to be believed. There are many more stories like this – too many to count.

So a free press is important – and for that reason, the press get privileges. They do get – and might well deserve, though more of that later – better protection for privacy and confidentiality. They get more access to information – through briefings from politicians and others or from ‘press-only’ events, through networks of sources and supporters and so forth. They have an audience that ‘ordinary’ people find it very difficult to reach. They have even had specific legal protections – against defamation, for example, in what used to be known as the ‘Reynolds Defence’, though since the Defamation Act 2013 came along, that has broadened a little so as to be potentially accessible to non-journalists.

All this has historically been entirely right and proper – but there’s something of a deal going on here. Why should journalists get special protection, above and beyond that of ordinary people? What makes the ‘professional’ journalist special – and different from that increasingly common species, the ‘citizen journalist’? What makes a columnist in a newspaper different from a blogger? The unspoken deal was, just as with lawyers and doctors (and even priests) who also make claim to special rules on confidentiality, journalists were bound by different ethics, and had been properly and professionally trained so they could be more trusted – at least to do things like protect their sources. Journalists get protection, and in turn they protect us – and they need to behave ethically in response. Just as lawyers and doctors have ethical guides (which they may or may not follow) press journalists have their own ethical guides. In the past, as far as UK press journalists were concerned, this was the Code of Practice of the Press Complaints Commission – what it is now is still up in the air, and the new regulator IPSO tries to assert itself whilst the supporters of the Royal Charter try to bring about implementation of the Leveson Report. Either way, most journalists would claim that they have ethics.

The real question, then, is whether they follow these ethics – because if they don’t, there’s far less to differentiate them from the rest of us. I write a blog, have had a few pieces published in magazines and on newspapers’ websites – am I a journalist? Should I have the same rights as journalists do? My suspicion is that the lines between ‘real’ journalists and ‘citizen’ journalists, bloggers and so forth will if anything get more blurred. There are already many people on the borderlines, many who sometimes act as journalists, other times as bloggers and so forth. Where does that leave journalistic ethics, and where does that leave journalistic protections for privacy, freedom of expression and so forth?

There are two very different possible approaches. One is to strip away journalistic protections – the other is to broaden them to cover the rest of us too. Personally, I much prefer the latter. Now that technology has given us the capacity to exercise our freedom of expression, the law should help protect our ability to do so. I may not be a journalist, but I do want confidentiality, and I think I have the right to it.

In the meantime, though, we should rally behind journalists in their fight against intrusion. We should, however, also expect them to understand the deal that is going on – and to understand that the pressure is on them to behave more ethically. The less ethically they behave, the less responsibly they behave, the harder it is to justify a special deal. One particularly painful story this week has made this point to me: the death of Brenda Leyland, the women accused of being a ‘Twitter Troll’ towards the parents of Madeleine McCann. This is a story that has almost nothing good to be said about it. What actually constitutes a ‘troll’ is subject to a great deal of doubt, and even if some kind of definition is settled upon, whether Brenda Leyland fits it is another matter. These are complex questions. For better or worse, the law has been getting increasingly involved in activity on social media, whether for malicious communications, bullying, public order offences or defamation – and as the number of people participating in social media has grown, the incidents have similarly grown.

I’m not in any way a defender of ‘trolling’ – but neither am I a supporter of ‘counter-trolling’. Trolling the trolls does go on – and on my Twitter timeline (I follow a lot of people) I’ve seen people make deeply passionate arguments both in favour of the McCanns and defending Brenda Leyland and others. I don’t want to get into that argument – other than to say that I don’t know what happened to Madeleine McCann, and I’m a believer in the presumption of innocence – but the actions of the press, and Sky News in particular, are another matter. We don’t necessarily expect ordinary people on Twitter to behave responsibly, let alone to a special, higher standard of ethics and responsibility. We should, however, have higher expectations of the press. That’s part of the deal. Was the doorstepping of Brenda Leyland appropriate, ethical or well considered? Was it necessary? I hope Sky News is considering these questions – because press ethics matter, just as protection of the press matters. We need a free press – but we need a responsible press too.

 

UPDATED TO MAKE CLEAR THAT IT WAS TOM NEWTON DUNN’S COMMS DATA GATHERED BY THE POLICE, NOT HIS CALLS LISTENED TO.

Censorship and surveillance…

Today’s ‘Internet Injunctions’ case in the high court (Cartier vs BSkyB) highlights one of the inherent problems with the kind of ‘porn-blocking’ censorship system that the current government has effectively forced ISPs to comply with: when you build a censorship system for one purpose, you can be pretty certain that it will be used for other purposes. As David Allen Green, who tweets as @JackofKent described it today:

Screen Shot 2014-09-25 at 15.06.55

 

 

Screen Shot 2014-09-25 at 15.07.13

 

 

 

Screen Shot 2014-09-25 at 15.07.20

 

 

Screen Shot 2014-09-25 at 15.07.34

 

 

 

I’ve argued this before – it’s question five in my ‘10 Questions about Cameron’s ‘new’ porn-blocking‘, but here it is in action, being argued in court. It was inevitable that it was going to be argued. Though people tend to deny it, ‘function creep’ or ‘mission creep’ is a reality, not a dream of the paranoid tin-foil hat brigade.

It’s not an argument restricted to censorship systems – the same applies to surveillance, and should remind us of the links between the two, and the need to oppose both. Just as advocates of censorship start with child-abuse imagery and then move on through ‘ordinary’ porn to other kinds of ‘offensive’ material, and then to copyright infringement, advocates of surveillance start with catching terrorists and paedophiles, through catching more ‘ordinary’ criminals, to finding people who are ‘offensive’ in some other way, through to those suspected (and it is generally based on suspicion, not proof) of infringing copyright. And from there, who knows where?

The links between surveillance and censorship are strong and multifaceted – though the motivation, in the end, is the same: control over people and restriction of freedom. Surveillance can be used to support censorship – watch everyone to see where they’re going, what they’re watching and reading, who they’re meeting, so that you can shut down their websites, close their meetings, track down the people they’re listening to, and so forth. Censorship can be used to support surveillance – particularly with things like the current ‘opt-out’ internet filters, where if you opt-out of censorship, that automatically makes you suspicious, and a target for surveillance. Anyone using a pseudonym, or trying to be anonymous, is already marked down as suspicious – anyone using TOR or an equivalent, for example.

This is one of the many reasons we should reject both censorship and surveillance. We should understand that the two are linked – and that there are slippery slopes associated with both. And they really are slippery, as today’s case in the High Court should help us to see.

For more details of the case, see David Allen Green’s piece for the Open Rights Group here, and the Open Rights Group press release here.

The Resurrection of Privacy?

The video below is the slideshow of my presentation this morning at the Society of Legal Scholars conference in Nottingham – and what follows it are some brief notes to support it. Some of this is speculative and some of it is contentious – particularly in relation to the relative importance of corporate and governmental surveillance – and this is an early stage of this research, though it builds on the work in my book, Internet Privacy Rights. I should also note that this is a development of the paper I gave at BILETA earlier this year: ‘who killed privacy?’

 

The Resurrection of Privacy?

In 1999, Scott McNealy, then CEO of Sun Microsystems, famously said:

“You have zero privacy anyway. Get over it.”

Events and developments since 1999 have hardly improved the prospects for privacy: the growth of social networking, technological developments like smartphones, geo-location, business ideas such as behavioural tracking and, most recently, the revelations from Edward Snowden about the near universal surveillance systems of the NSA, GCHQ and others. If privacy was in trouble in 1999, the argument that it is at least close to death in 2014 is much stronger.

That brings two questions:

  • If privacy is dead, who killed it? Did we kill it ourselves? Is it the activities of government agencies like the NSA and GCHQ, or of businesses like Google and Facebook?
  • If if privacy is in fact dead, is there a possible route towards its resurrection?

Suspect 1: us!

On the face of it, it might appear as though we ourselves have simply given up on privacy. We’ve killed it ourselves by embracing all the privacy-invasive technology that’s offered to us, by failing even to read privacy policies, by allowing the intelligence services to do whatever they want, with barely a murmur of protest. More than a billion of us have joined Facebook, for example, a service based at least in some ways on giving up on privacy, sharing our most intimate information.

That, however, is not the whole story. In many ways it appears that what we have done has been through a lack of awareness rather than by deliberate decisions. The extent to which people understand how systems like Facebook work is hard to gauge – but the surprise that people show when bad things happen suggests that there isn’t a great deal of awareness. It also appears that people are becoming more aware – and as they become more aware, they’re making more privacy-based decisions, taking control of their privacy settings and so forth.

Further, when we’re given the chance to see how intelligence agencies work, we don’t seem to be happy about it – though less, it has to be acknowledged, in the UK than in many other countries. Even so, when the Communications Data Bill was put under full scrutiny, it was rejected – in part because of the public reaction. Further, studies show that people don’t like behavioural advertising – and dislike it more when they learn more about how it works.

All this suggests that we aren’t really the key to the death of privacy: we’re more like unwitting accomplices.

Suspect 2: the NSA and GCHQ

The revelations of Edward Snowden about the surveillance activities sent shockwaves through the internet. Many people had already believed that the NSA, GCHQ and other agencies performed surveillance on the internet – Snowden’s revelations seemed to prove it, and to suggest that the level of surveillance was greater even than that feared by the more extreme of conspiracy theorists. Not just had they been gathering telephony and internet data and building (in the US) massive data centres, but they’d been accessing the servers of the big commercial internet providers, tapping into undersea cables, intercepting traffic between server sites and undermining encryption systems – and much more. The level of privacy invasion is extreme.

However, until Edward Snowden revealed all of this, the agencies were working largely in secret – and while this still constitutes a major invasion of privacy, the impact on people’s behaviour is much smaller. If we don’t know we’re being watched, our actions aren’t chilled – and our beliefs about privacy are not changed. Moreover, the kind of harms done to people by surveillance by the NSA and GCHQ are indirect, at least for most people. Finally, and most importantly, if it were not for the commercial operators’ surveillance, the NSA and GCHQ would have far less to ‘feed’ on.

All this is not to dismiss the role of the intelligence services or indeed the impact of their surveillance activities – they should be resisted with the utmost vigour – but in terms of the death of privacy, they can be seen more as opportunist accomplices, rather than instigators.

Suspect 3: businesses like Facebook and Google

The role of the commercial operators on the internet, on the other hand, is both deeper and more significant either than is often believed or than the role of governments and government agencies on their own. The commercial entities have contributed to the decline of privacy in three kinds of ways:

  • Systematic – commercial entities have undermined privacy both in technological and business model senses, developing technologies to invade privacy and business models that depend on systematic and essentially covert gathering of personal data. Businesses have also lobbied strongly to reduce the effectiveness of legal privacy protection. In Europe they have done their best to undermine and weaken data protection – including the on-going reform process. They continue to do so, for example in relation to the right to be forgotten. In the US, they have contributed to the effective scuppering of the Do Not Track initiative.
  • Cooperative – businesses have been working with governments, sometimes willingly, sometimes unwillingly, sometimes knowingly and sometimes unknowingly. The extent of this cooperation and the extent to which is has been willing is unclear – though recent statements from the NSA have suggested that they did know about it and did cooperate willingly. Further, they kept this cooperation secret – until it was revealed by the Snowden leaks.
  • Normative – businesses have been attempting to undermine the idea that privacy is something to value and something of importance. Mark Zuckerberg’s suggestion that ‘privacy is no longer a social norm’ is reflected not just words but actions, encouraging people to ‘share’ information of all kinds rather than consider the privacy impact. Further, they continue to develop technologies that invade privacy inherently – from geo-technology to wearable health monitoring and things like Google Glass.

All this combines to make the role of the businesses look most significant – if anyone is guilty of killing privacy, it is Facebook and Google rather than the NSA and GCHQ. Moreover, the harms to most people possible from corporate surveillance are both tangible and more likely than harms from the NSA and GCHQ: impact on things like insurance, credit ratings, employability, relationships and so forth are not just theoretical.

As Bruce Schneier put it:

“The NSA didn’t wake up and say, ‘Let’s just spy on everybody.’ They looked up and said, ‘Wow, corporations are spying on everybody. Let’s get ourselves a copy.’”

And as Timothy Garton Ash said when considering the Stasi:

“…the Minister for State Security observed that the results achieved by his ministry ‘would be unthinkable without the energetic help and support of the citizens of our country’. ‘For once,’ I comment, ‘what the Minister says is true.’”

Where the Stasi needs the citizen informers, the new surveillance programmes need the ISPs and the internet giants – the Googles, Facebooks, Microsofts, Yahoo!s, Apples and so forth. That is what makes their role in the reverse so important.

The resurrection of privacy

In the post-Snowden environment, at least on the surface, businesses have started to take a more ‘pro-privacy’ stance. Whether that meaningful, or they are just paying lip service to it, has yet to be seen. Their role, however, is crucial.

Reversing the three roles noted above – systematic, cooperative and normative – could produce a positive impact for privacy, effectively being a part of the ‘resurrection’ of privacy:

  • Systematic – businesses could play a part by building more robust technology and developing more privacy-friendly business models
  • Cooperative – and Resistant. Businesses could cooperate more with civil society and academia in working towards privacy – and could do more to resist being co-opted by governments, not just being more transparent in their dealings with governments but acting as a barrier and protection for their users in their dealings with governments.
  • Normative – businesses could play a part in changing the message so that it becomes clearer that privacy is a social norm.

At the moment it seems unlikely that businesses will do very much of this – but there are a few signs that are positive. Real names policies have been relaxed on Google +, and even Facebook has shown some moves in that direction. All the big companies are doing more to secure their systems – encryption is more common, both in the infrastructure and in user systems. Google does at least seem to be making some attempt to cooperate with the right to be forgotten – though whether these attempts are being done in good faith has yet to be seen.

It will probably take a miracle – resurrections generally do – but miracles do sometimes happen.

Who needs privacy? All of us….

A couple of privacy stories have been making big news over the last few days. The first is the ‘celebrity photo’ saga – naked photos of Jennifer Lawrence and others have been ‘leaked’ onto the net. The second is the revelation that the Metropolitan Police obtained the telephone records of Tom Newton Dunn, the political editor of the Sun, in connection with the ‘Plebgate’ saga. Between them, the two stories highlight some of the ways in which privacy matters – and at the same time some of the misunderstandings, some of the hypocrisy, and some of the complexity of privacy.

Celebrities and privacy

The relationship between celebrities and privacy is a complex one. At one level – the level usually argued by the press (including the Sun) – celebrities have less of a right to privacy than the rest of us. After all, they put themselves in the public eye. They open their doors to the likes of Hello magazine – and they make millions from us, from our attention, so doesn’t that mean they have to sacrifice a bit of their privacy to us? The put themselves in the public eye – doesn’t that mean their lives are ‘public’, and drawing attention to them is in the ‘public interest’? This brings into play the classic question of what the difference is between what ‘interests the public’ and what is ‘in the public interest’. They’re certainly not identical – but there is a degree of fuzziness at times.

At another level – the level argued by the celebrities themselves – celebrities need more protection, and if not a stronger right of privacy then a stronger way to enforce that right than the rest of us. After all, celebrities are more likely to have their private lives intruded upon by the press. Paparazzi will point their long lenses into celebrity houses, pursue celebrities down the street, rifle through celebrities’ dustbins, much more than they will for the rest of us. A naked picture of Jennifer Lawrence will get a lot more clicks on the net than a naked picture of a ‘non-celebrity’. The phone hacking saga (of which more later) is just one example – and it’s no coincidence that many of those at the forefront of the campaign to implement the Leveson report are celebrities such as Hugh Grant and Steve Coogan.

There’s strength in both perspectives – and as both are regularly argued by people who are both articulate and very ‘media-savvy’ it is often hard to navigate between them. The courts try – but all too often, whatever they decide is damned by one side or the other.

The Press and Privacy

The Sun are justifiably angry about the revelation that their political editor’s phone records have been accessed by the Metropolitan Police – not least because the story being investigated actually concerned the activities of the police. There are conflicts of interest all over the place here – but also a much bigger point.

For the press to function well, it needs to have privacy. That is, it needs to be possible for the press to keep its sources secret, to protect those people who reveal the key information. If they can’t protect their sources, there’s a very direct chilling effect – people who might come forward with information will be afraid to do so, so that information will never be uncovered, and all kinds of stories that are very much in the public interest will never see the light of day. Members of the press need to have confidentiality – so that they are able to do their job, a critical job in holding the powerful to account. That means the police and the politicians for a start.

Hypocrisy and Privacy

And yet, the stench of hypocrisy is almost overwhelming here. This is the Sun, getting outraged about a breach in privacy. The same Sun who were part of the phone hacking saga, who regularly invade the privacy of all and sundry – celebrities are just one example – often claiming it is in the public interest, but still invading privacy.  The same Sun who were part of an often vicious onslaught on the Guardian in connection with the Snowden revelations. The Sun who often seem to operate as though no-one has any right to privacy – except their own journalists.

This kind of hypocrisy is matched by that of some of the hackers and champions of internet freedom who feel it’s OK to obtain and then release, gleefully, naked pictures of Jennifer Lawrence. Some seem to want their own anonymity and privacy, and think the NSA and GCHQ are nightmarish oppressors – but think that Jennifer Lawrence only has herself to blame for even having those photographs in the first place.

It’s a sadly common set of double standards – privacy doesn’t seem very important, indeed it often seems like something bad (‘privacy is for paedos’, in the words of Paul McMullan, former News of the World journalist) until it has an impact on you. The Sun’s outrage is particularly hypocritical, but at times almost all of us are guilty of it.

We all need privacy

The truth, at least as I see it, is that we all need privacy. We all need our privacy protected – and invasions of privacy should never be done lightly, without a thought for the consequences. Jennifer Lawrence – and all of us – should be able to take whatever photos we want of ourselves, however intimate. Members of the press should be able to communicate safely and securely with their sources. And we, ordinary people, should be able to go on with our ordinary lives without fear of their being exposed. Our lives aren’t any less important than those of celebrities or the press – and though the impact of privacy invasions on our ordinary lives may not be as earth shattering or newsworthy as those of celebrities, politicians and so forth, to us they matter. The revelation that NSA operatives thought looking at nude and sexual photos found by surveillance was fun, and sharing them with colleagues was just a perk of the job should repel us.

There are many other ways that invasions of our privacy have an impact upon us – things like affecting our job prospects, our insurance premiums, our credit ratings, our relationships – but there’s a bigger point here. These are our lives. This is part of our human dignity. Privacy is part of that, and it matters.  We should try to remember that for other people – and celebrities are people too.

Privacy invasive law in Mexico – guest post by Lisa M Brownlee

I’ve written about this before – but things have moved on, and not in a good way. Some aspects of the law discussed are deeply troubling, and privacy activists around the world should be concerned. The following is by Lisa M Brownlee – an information security/privacy and intellectual property legal scholar and author residing in Mexico, and someone whose work is well worth following, as is Lisa herself, on Twitter, where her tag is @lmbrownlee1. Her work on an early version of the law being discussed was published in ArsTechnica.


 

Mexico’s new telecommunications law – including controversial surveillance and data retention provisions.

On Wednesday, August 13, in a 4-3 vote, Mexico’s personal data protection authority, IFAI, (Federal Institute for Access to Information and Data Protection) considered and voted against challenging the constitutionality of Mexico’s new telecommunications law, the Federal Telecommunications and Broadcasting Act (FTBA).

The National Human Rights Commission (CNDH) was also empowered to block the legislation on constitutional grounds but failed to do so by Wednesday’s challenge deadline. The Mexican legislature’s Chamber of Deputies, also empowered to prevent the law’s taking effect, was 12 signatures short of a vote to block the FTBA. FTBA therefore took effect on August 13.

Shortly after the vote, Mexico’s Secretary of Communications and Transport (SCT), Gerardo Ruiz Esparza welcomed the new law and hailed, among other provisions, the law’s authorization of SCT to establish new Internet connections in over 40,000 public places nationwide.

IFAI is mandated to protect the privacy and personal data of citizens, and thus had the authority to challenge the constitutionality of the data collection, retention and access provisions of FTBA Articles 189 and 190. During the hearing, IFAI members stated that the data collected and retained under the FTBA was not “personal data”, and that IFAI therefore lacked standing to bring the suit.

FTBA Article 189 requires telecommunications licensees and Internet service providers to provide real-time geographic location of any type of communication device to public servants and security officials at their request, without warrant. Article 190 provides for the collection of data pertaining to communications, including the-origin of calls, duration, location, text messages metadata, activity on the network, and for the retention of such data for up to 24 months. Both provisions provide warrantless access by a broad range of government and law enforcement personnel.

Human rights activists fighting the constitutionality of the FTBA’s geolocation and data retention and access provisions were disappointed in IFAI’s failure to take action. The Twitter hashtag #IFAIL arose shortly after the no vote, the tag being a play on IFAI’s name, designating failure to carry out its privacy and data protection authority.

The digital rights group R3D Mexico decried as indefensible the statement made by IFAI president Ximena Puente that the data retained by the telecommunications companies was not “personal data”, and later criticized the failure of IFAI, CNDH and the Chamber of Deputies to act.


 

We need to watch this space!

DRIP: web-mail and web-browsing….

One of the big questions concerning data retention and the hastily-passed DRIP is whether it applies to web-browsing activities. Indeed, Julian Huppert MP asked the question during that all-too-brief debate in parliament, and was assured that it did not. I was far from convinced by the answer, and remain far from convinced, particularly given the idea that this ‘update’ to powers is intended to cover activities like webmail and social networking messages. Some colleagues have been asking questions, and a reliable source within one of the US companies that operates webmail (amongst other things) told us that they don’t expect the data retention powers to apply, given that they have never done so and the government made clear that there was no change in that through DRIP. They added further that as a US company, they are in a very different situation to UK providers.

That leaves us in a very interesting situation. If you’re communicating by webmail or social networking, how can your activities be caught? I can see only two ways: directly from the webmail company, or by capturing web-browsing through the ISP. If there are other ways, I’d like to know… because in the current circumstances I can see only three options:

  1. That webmail and social networking will not be covered by DRIP. That’s almost inconceivable, given the intentions of DRIP and the extent to which communications of the kind that those behind DRIP want to capture take place on webmail and social networks; or
  2. That the non-UK webmail and social network providers have been misled, and DRIP will be used to compel them to gather and hold communications data concerning activities on their services; or
  3. That Julian Huppert – and parliament, and the people of the UK – has been misled, and DRIP will be used to gather web-browsing activities.

If there’s another option, I’d like to know it. It’s entirely possible, as I’ve been wrong often before, but I can’t see it immediately.

My instinct is that the third option is the most likely – and that the intent of DRIP was always to gather web-browsing activity. If we’d had proper time for scrutiny of the bill, and to get experts to ask questions in committee, we might know the answers – and make sure that appropriate balances and controls are put in place. We didn’t. I have a strong suspicion that was entirely intentional too.