Debate on oversight of intelligence & security services Part 2

With the exception of The Guardian the silence in the UK media about the parliamentary debate last week on oversight of intelligence & security services has been deafening. It is interesting to see the Independent in the past couple of days headlining UK spying in Berlin on the front page, though I doubt this is a harbinger of the cracking of the UK media dam on the subject.

Part 1 of my report on the surveillance debate ended with Dominic Raab's excellent contribution, so I'll pick it up from there. 

Labour MP David Winnick (anti mass surveillance) followed Mr Raab and opened by emphasising "the need for the security and intelligence agencies to work as required" even were we not faced by the threat of terrorism. He highlighted some past unsavory practices of government and the security services including the farcical censorship of Peter Wright's Spycatcher book, the security services culture of treating readers of the Daily Mirror as a threat and the more recent case of Binyam Mohamed, who had been subject to extraordinary rendition and torture. The Master of the Rolls,Lord Neuberger, concluded in 2010 that “Some Security Services officials appear to have a dubious record” on human rights.

An apparently angry red faced MP (according to Hansard this was Adam Holloway) jumped up at this point to demand whether, if there'd been a terrorist nuclear explosion in past few weeks, "the hon. Gentleman’s constituents" would change their minds about thinking Snowden was a traitor. Unfortunately that kind of distorted appeal to emotion was an all too common feature in the debate. Mr Winnick didn't accept that the Guardian's actions would lead to a nuclear attack or that there was the remotest shred of evidence that they had helped terrorists.

Mr Winnick then asked how the monitoring of world leaders phones helps the fight against terrorism and admonished the prime minister, David Cameron, in the strongest terms for his thinly veiled threat against the Guardian the same week.

"Going back to The Guardian, during Monday’s debate on the Prime Minister’s statement on the European Council, he said:

“I do not want to have to use injunctions, D notices or other, tougher measures; it is much better to appeal to newspapers’ sense of social responsibility. However, if they do not demonstrate some social responsibility, it will be very difficult for the Government to stand back and not to act.”—[Official Report, 28 October 2013; Vol. 569, c. 667.]

That is the most blatant threat to the press in recent times. It says in effect, “Do as I say or the Government will take the necessary measures.” That is all the more unfortunate while we are debating a royal charter that is being described as no threat to the press"

He finished with an emotional table thumping appeal for the Guardian to stand its ground in publishing material in the national interest and for parliament to support them in that endeavour.

Julian Smith MP (pro mass surveillance) who has demanded the Guardian be formally investigated for breaching official secrets and compromising national security then rose to his feet. He opened with his belief that "in Britain we have one of the best oversight regimes in the world."Strange that one of GCHQ's senior legal advisers has told the NSA exactly the opposite. He emphasised how much he likes the Guardian (in spite of labelling them "guilty... of treasonous behaviour" and demanding their prosecution) but the paper had admitted to sending detailed data about GCHQ internationally.

He couldn't resist a swipe at Tor -  a free open network that helps you defend against surveillance - which he labelled "the black internet—where child pornography, drug trafficking and arms trading take place". I know he only used 3 but I'm really tired of the 4 horsemen of the infocalypse ruse. Is it ever going to go away?

Next  - David Miranda's data, seized during his schedule 7 of the Terrorism Act detention at Heathrow, was, Mr Smith claimed, on a games console and "hackers" claim they have access to it. I'm afraid my fear mongering nonsense alarm was hitting overdrive at this point.

He concluded by urging the Guardian editor to be a good little boy, admit his appalling wrongdoing, throw himself on the mercy of the government and hand his data dumps back to the grown ups.

George Howarth, a Labour MP and member of the Intelligence & Security Committee (ISC), then opened with high praise for Mr Smith's "measured, thoughtful speech." No kidding. That's a direct quote and no prizes, therefore, for guessing Mr Howarth is in the pro mass surveillance lobby. He was involved in the ISC review and there was no evidence any laws had been broken - he seemed to be confirming that the mass surveillance was being done within the letter of the Regulation of Investigatory Powers Act (RIPA) and the Intelligence Services Act. He also denied the UK intelligence services had been circumventing the law by "by using the NSA’s PRISM programme".

Tom Watson intervened to ask if the ISC knew anything about the NSA's PRISM programme before the Guardian wrote about it and Mr Howarth, to the background laughter of the anti mass surveillance lobby, admitted they did not.

Mr Howarth went on then to say the ISC concluded with a "high degree of confidence" that there was no law breaking going on; and that "there might a case for trying to persuade the interception commissioner to become slightly more outward facing". At this point he was unceremoniously cut off by Chair Riordan declaring his time up and reducing time limit on further speeches to eight minutes.

Next up was Conservative MP Ben Wallace (pro mass surveillance and who I mis-identified in some tweets as Dominic Raab - apologies to both for that). Mr Wallace said the UK does intelligence and security better than anyone else. He was the first to run with the major of theme of 'how can all you silly beggars be surprised that spies actually engage in spying?' Mr Wallace has had the benefit of being an insider, having "worked in intelligence in Northern Ireland before half the legislation, which the hon. Member for Cambridge [Dr Huppert] seems to have missed, came into play." He did make the particularly salient point that no one was trying to regulate excess surveillance on the part of the private sector

"I have heard no criticism of the fact that we do not regulate the private sector. No one has expressed fear about that or demanded that we do so. The big capitalist companies in America—the Googles and the Facebooks—harvest our data without a by-your-leave, sell it on and on through intermediaries and make billions of pounds. However, I have not yet heard anyone mention that they all keep their servers offshore to avoid tax. That is the area that needs regulating to protect people."

Mr Wallace is proud the security services are regulated and would rather have the state than the international private sector controlling his personal data. RIPA is much criticised and it is not perfect but prior to its introduction he, as an intelligence officer, didn't have to "keep a log or register with anybody the things that I wanted to do." His former colleagues still hate RIPA but that's a good sign because it's an indicator they are accountable.

Sadly he then blots his copybook by insinuating the Guardian are tainted by associations with the KGB.

Mr Winnick interrupted noting the unconscionable abuse and torture of Binyam Mohamed and Mr Wallace agreed there "have been failures". He rounded off by implying Edward Snowden was clearly a traitor for choosing to travel to Hong Kong and Russia rather than Switzerland; And since he risked his life in Northern Ireland and opposed ID cards, 28 or 90-day detentions without charge and detention without trials that implied his views should carry some weight.

John McDonnell (anti) then got his chance, declared that the Guardian had been heroic and it was ludicrous that anyone should accuse them of treason.

He was followed by Martin Horwood (pro mass surveillance in spite of being a Lib Dem MP), popularly known as the MP for GCHQ since he represents Cheltenham and both his parents worked in the security services (Bletchley Park and GCHQ). He pointed out that staff at GCHQ find it difficult to forgive accusations of bad faith and illegality. Understandable perhaps. On mass surveillance:

if it was really taking place, it would—apart from being wildly impractical—be straightforwardly illegal. In his statement to the House, the Foreign Secretary made it clear that he still regarded the situation in this way:

“To intercept the content of any individual’s communications in the UK requires a warrant signed personally by me, the Home Secretary, or by another Secretary of State…Warrants are legally required to be necessary, proportionate and carefully targeted, and we judge them on that basis.”

Actually it is only necessary under RIPA that the minister believes a warrant to be necessary and proportionate. Far be it from me to cast aspersions but politicians, as a class, do seem to have a well honed talent for believing whichever story happens to support the agenda du jour. In fairness, this is an element of human nature and many of us, not just our much maligned politicians, are guilty on that score. I certainly can't claim careful and consistent cultivation of critical thinking/objectivity in all areas of life.

Mr Horwood was amongst the constituency of MPs who have absolute faith in the notion that there is no surveillance going if the information is merely collected and processed by computers but not actually physically read by a human being. That constuency is fundamentally wrong in that belief and have been for nearly 250 years, since the case of Entick v Carrington (1765) 19 Howell’s State Trials 1029, 2 Wils 275, 95 ER 807, Court of Common Pleas.

When Mr Horwood insisted on implying that there was little question but that Edward Snowden was a traitor, David Winnick, who was getting well warmed up at this pass, intervened to draw parallels with Daniel Ellsberg and the Pentagon papers which exposed US government lies about the Vietnam war. Ellsberg was called a traitor by the Nixon administration but "is now considered to be a hero who did a great service for his country."

Mr Horwood brushed him off suggesting UK checks and balances are so good, any lying or abuse on the part of the government or the security services would be reigned in by the Investigatory Powers Tribunal. I can't help but refer the honourable gentleman, as just one of many critical exhibits, to the JUSTICE all-party law reform and human rights organisation report of 2011, Freedom from Suspicion. They concluded (see the press release at the time for the short version):

• Since RIPA came into force in 2000, there have been 20,000 interception warrants (e.g.secretly listening to phone calls and reading emails), more than 30,000 authorisations for directed surveillance (e.g. following someone in public), and more than 2.7 million requests for communications data (e.g. access to phone bills). The true extent of surveillance activity since 2000 is unknown because full numbers have never been published;
• Of the nearly 3 million surveillance decisions taken by public bodies under RIPA since 2000, fewer than 5,000 (or 0.5%) were approved by a judge;
• The highly secretive Investigatory Powers Tribunal, the main complaints body under RIPA, has only dealt with 1,100 complaints since RIPA began. In the last decade, it has only upheld ten complaints;
• RIPA is poorly-drafted and lacks sufficient safeguards against abuse. This has contributed to the failure of the Metropolitan police to properly investigate phone-hacking, the illegal recording of privileged conversations between lawyers and clients, the spread of CCTV cameras, and the use of snooping powers by local authorities.

So his suggestion that the Investigatory Powers Tribunal's oversight regime is robust is, at least, questionable.

Michael Meacher then got his turn criticising RIPA which he considers so broadly drafted it enables governent to do whatever they like. He is also largely skeptical of the 'trust us' approach of government on surveillance matters since they have repeatedly been shown to have breached that trust. Malcolm Rifkind, chairman of the ISC (pro mass surveillance and a signed up member of 'it's not surveillance if it's only seen by computers' club) jumped up, apoplectic at Mr Meacher's claims that parliament has no say on who sat on the ISC. He neglected to say that parliament only got to say yes or no to the Prime Minister's picks for the committee. Mr Meacher with Dr Huppert's help then suggested the members of the ISC should be selected by parliament not the Prime Minister.

The Prime Minister also gets a veto on ISC reports, "can modify the report in any way he or she chooses and then publish it without any indication of the changes, or publish it in redacted form, or not publish it at all. That is not serious scrutiny."

Mr Rifkind (pro) got his official turn when Mr Meacher sat down. He couldn't help himself. He had to start by noting Edward Snowden now has a job working for a website in Russia but we were not allowed to know what the job was for security reasons. Unspoken - He has a job. In Russia. With Computers. Therefore he's a Russian spy. QED.

Mr Rifkind was adamant that the ISC do report to parliament under the "new legislation" (by which I assumed he meant the Justice & Security Act 2013) and the ISC is now newly constituted. Under these new regulations the Prime Minister won't get to select the chair. S/he will be elected by ISC members. The new rules also require intelligence services to supply "all information regarding nationally significant operations" to ISC. That's "a cultural revolution". Critics that claimed the ISC didn't know about the Tempora (GCHQ undersea fibre optic cables interception) programme did "not have the faintest idea whether the Committee was aware of programmes of any kind."

It is at this point that the honorable chairman of the ISC then demonstrated his serious misunderstanding of technology and its use. He declared that computers are clever and can sort data so 99.99% of it is never looked at. Therefore we are not subject to mass surveillance. To be fair to Mr Rifkind I will quote him in full on this:

"mass surveillance”. If that means anything, it is an accusation: the implication is that all our e-mails are or will be examined by GCHQ—as it chooses and by its own methods—as though something like that was now available. They seem totally to misunderstand or not to refer to the reality of what happens with modern technology, so in the brief time available, I will share with them what they ought to know. It is not secret, but is in the public domain.

Modern computers, which can indeed digest vast amounts of e-mails or communications data, are programmed to run using certain selectors, such as an e-mail address that might belong to a terrorist or some other information relating to terrorism. They are programmed to go through millions and millions of communications and to discard, without their having been looked at—no human eye looks at any of the e-mails—all those to which selectors are not attached.

Of the totality processed by computers, perhaps 0.01% will have selectors that the computer has been programmed to look for. The communications of the other 99.99%— covering virtually every citizen of this country, bar a very small number—are never even looked at by the computer, other than in relation to a selector, such as an e-mail address. Even for the tiny minority identified by the computers as potentially relevant to terrorism, if GCHQ, MI5 or MI6 want to read the content of any of the e-mails, they have to go to the Secretary of State for permission. Under the law, only if they are given permission can the content be read.

To say that we are living in a mass surveillance society is to make a wonderful allegation that sounds vaguely sinister, but the reality is that the e-mails of pretty well everyone in the Chamber are not being intercepted or read."

Ok some comments and questions for Mr Rifkind -

•  "Modern computers... are programmed to run using certain selectors" - who programs the computers and what are the specific 'selectors'/filters? Who decides what the selectors should be? Who decides who decides what the selectors should be? The chair of the ISC doesn't understand computers, so how can he effectively and his committee scrutinise the technical aspects of this work? How do you measure the efficacy of these filters given it is widely known in the tech community how ineffective electronic filters can be? How, when someone is tagged as suspicious via these secret algorithms, does the information on that individual then get further processed? What happens when someone is wrongly tagged and how do they retrieve their innocence and clean bill of electronic health? Are you aware of the nature of false negative results and false positive results?
• do you really believe there is no interception of communications if the interception is only done by computers and not seen by a human being?
• I'm going to do some very rough maths here in an attempt to explain the problem with your point that only 0.01% of communications data is looked at. 0.01% of 60 million people in the UK implicates 6000. Now the pattern flagging will be nowhere near as simple as that but just run with it as a crude estimate. We know from the deputy director of the NSA testifying before the House Judiciary Committee that you don't need to be a terrorist or have contact (deliberate or inadvertent) with a terrorist to be flagged as suspicious. The NSA (and presumably GCHQ?) is allowed to travel “three hops” from its targets – who could be people connected to people connected to people connected to you. 0.01% of the UK population or 6000 people are 2 degrees of separation from about 160,197,360 and 3 degrees of separation from over 26 billion others (about three and a half times the population of the world). Even limiting suspicion to two hops, your 0.01% of data on UK residents, Mr Rifkind, implicates more than 2.6 times the entire UK population, the equivalent of the more than 160,000,000 people in India are considered untouchable and dehumanized by the caste system. I'm not trying to equate the mass surveillance of affluent UK computer users with the plight of the poorest people in the world but just trying to give some idea of the numbers we are talking about here. So the question for Mr Rifkind is that, given that we are all suspects, who decides which suspects the intelligence services' limited resources should be deployed to further investigate and pursue, once the computer algorithms have worked their magic? 

Mr Rifkind, you are absolutely right that the intelligence services have more important things to be doing than looking at data not "directly relevant to a terrorist threat or serious crime." However these gigantic data haystacks will put everyone 3 degrees of separation from multiple terrorist threats or serious crimes. Intelligence services and public officials with access to this data will have the capacity to deeply mine anyone's digital life once an algorithmic flag of suspicion is raised, even if they don't have the capacity to do so with everyone. That should give you pause for thought as to whether the "revolution in oversight" you have such faith in will be up to the task of controlling the mass surveillance monster that has been unleashed.

Could I also remind you that as long ago as 1765 Lord Justice Camden declared personal communications to be one’s “dearest property” and mass data collection fishing expeditions to be at odds with the rule of law.

Not only that but better intelligence, crime detection and prevention will be done through intelligent, targeted, proportionate, meta data collection & analysis; and intelligence led, targeted substantial content acquisition. The blanket collection and retention of data you currently seem to support will just allow the real criminals to lose themselves in the electronic noise whilst the security services are run ragged chasing innumerable false leads.

Part 3 of my thoughts on the UK parliament surveillance debate is now here.

Debate on oversight of intelligence & security services Part 1

The UK parliament finally got round to debating the implications of the Snowden revelations on Thursday afternoon, 31 October. The Hansard record of the debate is now available. Thanks to the Open Rights Group for pointing out TheyWorkForYou.com also have a transcript of proceedings. With a handful of exceptions it was depressingly ill-informed and two dimensional. Contributors were either

• Against mass surveillance - and make no mistake that is what this blanket electronic data collection, processing and retention is, even if you, as so many of the pro faction did, contend that there is no surveillance if only the computers 'see' the data - and, sadly, for "balancing" privacy and security, the false underlying assumption being that these are opposites; whilst insisting that doesn't mean they don't support the hard working intelligence & security services; and noting that the brave Guardian has done us all a public service and it was appalling they were accused of undermining national security when they hadn't

Or

• For mass surveillance in the mistaken belief that it will help our hard working boys and girls in the security services to catch those bad bad bad terrorists; and anyone who has the appalling cheek to question the integrity of the security services is just a lover of pedophiles, terrorists, drug dealers and other criminals; and by the way the Guardian are treacherous traitors who had undermined national security because the anti mass surveillance crowd had no proof that they hadn't; with the occasional dose sarcasm from those who could not muster up sufficient pompous indignity - why are you fools so shocked that spies are doing their job and spying?

Julian Huppert (anti) opened the debate.

"As technology changes and the capacity of the state and companies to collect and analyse data grows massively, we are in danger of sleepwalking into a surveillance society on a scale that peacetime Britain has never seen. It is not planned, and nor is it the actions of malevolent individuals; it is merely the natural trend of what will happen if nothing is done to stop it.
It can be argued that the definitions of war and peace are no longer the same, and that our enemies are faceless and splintered and will attack our way of life if we give them an inch—that argument is often made by Prime Ministers and Home Secretaries—but if we shape our laws solely in response to that fear, chipping away at our own liberty and privacy, those enemies have already won.
The key questions of security, privacy and liberty in a digital age will come to define the 21st century. The world is changing. All of us carry around tracking devices, in the shape of our mobile phones, wherever we go. We carry devices that can be activated and controlled remotely and that store much of our most personal information. Who can read it? Who has access to that information? How do we want to protect it? We have to agree the rules now, before we lose control completely."

Julian Smith (pro), who else, interrupted to say

" Does my hon. Friend agree that the very people about whom he is talking have been put under grave threat by some of the reporting, particularly by The Guardian newspaper, of the leaks?"

D Huppert responded:

"No, I do not. I understand that the secretary who looks at the defence advisory notices has confirmed that nothing has been published in The Guardian that suggests a risk to life. The Guardian has not published photos on its website of anybody who works in the area without pixellating their faces."

Touché! That'll be a reference to Mr Smith publishing a photo on his official website of staff from Menwith Hill without pixellating their faces.

Caroline Lucas (anti) stepped in to make the point that the obsession with the Guardian was extraordinary. Wide ranging debates about mass surveillance were taking place all over the world and the UK is trying to stifle discussions and shoot the messenger.

Mr Huppert went on to suggest the UK sign up to the International Principles on the Application of Human Rights to Communications Surveillance. He also asked if we would be concerned if we found out the Chinese were tapping the prime minister's phone and by the way a Chinese company, Huawei, supply a lot of the equipment that makes up the core of our network infrastructure.

"I suspect that our intelligence agents would not miss the chance to install some equipment if we were given the chance to put in the backbone of the Chinese internet, so we should not assume that the Chinese would miss such an opportunity...

Individual surveillance is one thing, but the mass hoovering up of information enabled by new technologies has changed the system completely. It means that suspicion no longer comes first. I think that very few people think it inappropriate to target individuals where there is a serious suspicion of wrongdoing, but in the new approach, we are all suspects whose personal histories can be foraged through if ever there is interest in us later."

ID card cheerleader and former Home Office minister Blears popped up to give us the benefit of her er wisdom - mass surveillance was essential and stopped loads of terrorist plots in her day. The usual vague claims of secret amazing success and no mention of the flawed decision making leading to the shooting of innocent men and the killing and maiming of hundreds of thousands of innocents in Iraq and Afghanistan.

Once Julian Huppert concluded his contribution the chair of the session, Linda Riordan, said 12 people wanted to speak so she'd be imposing a 10 minute limit on each. Just think of that. On something as important as the operating and oversight of an infrastructure of mass surveillance, only a dozen of our 650 members of parliament could be bothered to show up with some prior preparation.

Tom Watson was next up and, disappointed he was only getting 10 minutes, posted the full speech he would have made on his website.

"At the heart of this cross party debate today is GCHQ’s own big data programme, Tempora, and its impact upon our citizens’ fundamental rights. It’s a new and profoundly challenging issue for policy makers. We have to answer questions about the nature, the scale and the depth of surveillance that should be tolerated in our democracy...

And let us be clear, if the Minister is telling us that the law permits such fundamental abuse of liberty, then the law is wrong, and the law must be changed.
I suspect the minster may point to section 16 of RIPA to suggest the Tempora programme is legal.
Interpreting S.16 of RIPA requires unravelling a triple-nested inversion of meanings, across six cross-referenced sub-sections, linked to a dozen other cross-linked definitions, and all dependent on a highly ambiguous “notwithstanding”.
It is probably the single most confusing and complex drafting ever put on the statute book, and I have heard that a former GCHQ Director said that it was drafted this way intentionally...

There is not a snowball’s chance on a hot day in Strasbourg that this will pass the tests of foresee ability and quality of law required by the European Convention (of Human Rights)"

I can't disagree with him about the spaghetti code of s16 of RIPA. Mr Watson's other significant contribution was in noting the practice of stripping citizenship from individuals with suspected terrorist connections.

"The Bureau of Investigative Journalism has highlighted the uneasy relationship between deprivation of citizenship, intelligence sharing with US, and targeting of former British citizens in drone strikes in Somalia. The concern is that citizenship may remove one obstacle on information sharing for the purpose of targeting British people...

David Ormand ex head GCHQ...mentioned the ‘ethically ambiguous position of the British public’ here because, he said, people here had benefited from the US drone programme, even though it would not be permitted in the UK. This can’t be right – the British public would surely be alarmed to hear that data collected in UK or on British citizens (or indeed anyone else) might end up being used to implement the US targeted killing programme – described as war crimes by Amnesty international."

Next up was the third co-sponsor of the debate, Dominic Raab (anti mass surveillance). He paid tribute to MI5 Director Andrew Parker for an under-reported aspect of his recent speech.

"While discussing trying to reduce the terrorist threat, he observed:

“In a free society ‘zero’ is of course impossible to achieve...A strong record of success risks creating an expectation of guaranteed prevention. There can be no such guarantee.”

Similarly, any democratic Government must be accountable to their citizens, particularly if they impinge on their citizens’ freedoms in the necessary pursuit of security. In recent years, UK surveillance of its citizens has increased exponentially, and the legal basis has sometimes, and now regularly, appeared strained at best. Oversight is frayed and legitimate debate is at risk of being drowned out by frankly untested assertions of national security.

In June, The Guardian published revelations by US National Security Agency whistleblower Edward Snowden that GCHQ was clandestinely tapping transatlantic fibre-optic cables, giving almost unfettered access to people’s phone call records, e-mails, Facebook entries and the like. The legal basis for Operation Tempora looks thin at best, and Parliament certainly had no idea of the scale of the use of those powers.
We also learned that Britain receives data from the US Prism surveillance programme, which appears to allow GCHQ to dilute—not circumvent entirely, but dilute—the safeguards that would apply if the same agencies were to gather the information themselves."

Mr Raab was particularly robust in rebuking the fear mongering of an intervening MP who was implying that terrorists are everywhere

" I thank my hon. Friend for his intervention, but he is wrong as a matter of fact. According to the terrorist threat assessment given publicly in annual speeches by successive director-generals at MI5, there was a spike—

My hon. Friend is shaking his head, but this is what the MI5 director-general said, so we ought to pay it some heed. There was a spike after 9/11, but it then dipped. In the most recent speech, given this month, the director-general said that the threat had not got worse...

In this month’s speech, the MI5 director-general also lambasted The Guardian for handing terrorists a “gift”—he used a potent word. More recently, Ministers have claimed that the disclosures have put lives at risk. I want to take that seriously, because Mr Parker claimed that making public

“the reach and limits of GCHQ techniques”

breaches national security. To be clear about what was being discussed, the newspaper was not disclosing interception techniques—the technical aspect—or revelations of sources or operatives, which would clearly be a major source of concern, but simply revealing our intelligence “reach”. I find the assertion that was made difficult to take at face value. The contention may be true, but it cannot be taken on mere assertion.

Any serious terrorist groups assume that their phones, e-mails and internet use will be monitored. That is no secret, and learning that Western spies drain the swamp of their own citizens’ data in the process does not aid terrorists in any tangible way. If national security had been materially breached, why has no one at The Guardian been charged or even arrested since the search of its offices back in July? Why was David Miranda not arrested and bailed, following his detention for several hours at Heathrow, in August?

Either UK law enforcement is surprisingly slow—given the assertions—or national security is being used as a fig leaf to muzzle disclosures that are just plain embarrassing.
I accept, by the way, that the disclosure that 850,000 contractors can access data from Project Tempora represents a security concern, but of course that vulnerability is entirely of the Government’s own making.

I am prepared to be proven wrong about all that, but Ministers and intelligence chiefs need to understand that the bald assertion of national security cannot be used to guillotine all debate. We are here to correct that understanding. Without revealing details that would prejudice the work of the security services, we need a coherent explanation of the damage to national security, not only vague and opaque assertions.

From reports in The Guardian, we also know that the Government are concerned about the legality of the powers that they are using—fears that public debate might lead to litigation, fears about legal challenge under the Human Rights Act. Those are legitimate concerns. I recall similar ones from my own experience of working with the agencies as a Foreign Office lawyer. Those, however, are altogether more nuanced concerns than the shrill and unsubstantiated suggestion that we have somehow lost track of terrorist plotters as a result of the revelations."

Very well said. He went on to assert with some justification that successive governments have been remiss in pushing and deploying mass surveillance, that the Intelligence & Security Committee charged with overseeing the security services is not fit for purpose and that, as Karl Popper said

“We must plan for freedom, and not only for security, if for no other reason than only freedom can make security more secure.”

He then concluded:

"We need to pursue our security in a way that respects our freedoms, limits incursions to genuine cases of national security and does so under a regime that commands the rule of law. Failing to do that would be the real gift to the terrorists—a victory for everything that they believe in and a blow against everything we stand for."

Mr Raab is to be congratulated for one of the few thoughtful and balanced contributions to the debate and his speech should be read in full by anyone with a serious interest in or commitment to democracy. And thanks to him, Dr Huppert and Mr Watson, who were also reasonably well briefed (though I'd encourage Dr Huppert to avoid repetition of the security v privacy balance false dichotomy), for finally getting the matter raised in a parliamentary debate. It was a shame though not unexpected that the debate itself, with some exceptions, descended into little more than sales pitches and sniping from opposite sides, the anti mass surveillance crowd being marginally the better informed of the two.

I'll post some further thoughts on the debate when I get the chance.

Update: Part 2 and Part 3 now done.

Oversight of the intelligence and security services

Parliamentary debate on oversight of the intelligence and security services started 1.30pm, Thursday, 31 October 2013.

Beware the kite-flyers on surveillance, legal aid, judicial review

Retired Appeal Court judge, Stephen Sedley, is always good value. I'd recommend his "Beware Kite-Flyers" piece in the London Review of Books Vol. 35 No. 17 · 12 September 2013 pages 13-16. It is ostensibly a review of The British Constitution: A Very Short Introduction by Martin Loughlin
Oxford, 152 pp, £7.99, April, ISBN 978 0 19 969769 4.  

Particularly astute is his observation in the light of the Edward Snowden leaks that the intelligence and security services may be threatening the separation of powers by operating in:

"a statutory surveillance regime shrouded in secrecy, part of a growing constitutional model which has led some of us to wonder whether the tripartite separation of powers – legislature, judiciary, executive – conventionally derived from Locke, Montesquieu and Madison still holds good. The security apparatus is today able in many democracies to exert a measure of power over the other limbs of the state that approaches autonomy: procuring legislation which prioritises its own interests over individual rights, dominating executive decision-making, locking its antagonists out of judicial processes and operating almost free of public scrutiny. The arbitrary use of sweeping powers of detention, search and interrogation created by the (pre-9/11) Terrorism Act, which recently made headlines with the detention of David Miranda at Heathrow, illustrates a long-term shift both in what is constitutionally permissible and in what is constitutionally acceptable. The former may be a matter for Parliament, but the latter is still a matter for the rest of us."

He is also scathing about the Blair government's "making the Lord Chancellorship a secondary occupation of the new secretary of state for justice" and the current government's cynical exploitation of that change to dismantle our legal aid and judicial review processes.

"The decision in 2012 to put a political enforcer, Chris Grayling, in charge of the legal system carried a calculated message: the rule of law was from now on, like everything else, going to be negotiable. The incoming legal aid reforms were introduced by a consultation paper which gave a dismissively short time for responses and parodied its own case for attenuating legal aid by pointing out that people affected by unlawful state action ‘may represent themselves in court, seek to resolve issues by themselves, pay for services which support self-resolution, pay for private representation or decide not to tackle the issue at all’.​＊ This is an argument not for modifying or reducing legal aid but for abolishing it, something the Treasury has wished it could do for half a century, but which the consultation paper, describing legal aid as a ‘hallmark of a fair, open justice system’, purports not to support.Instead, Grayling’s proposal is to undermine judicial review by starving claimants of legal aid on several fronts...

In recent years a practice has developed – routinely denied by ministers but privately confirmed by their civil servants – of flying kites as lightning conductors: a consultation paper or a bill will include an outrageous proposal which government neither needs nor particularly wants (an example in the legal aid consultation was the proposal, now dropped, to deny criminal defendants any choice in the lawyer to represent them). When it has served its purpose of distracting attention from other objectionable provisions, it can be abandoned. The trouble is that there are so many other objectionable proposals in the current legal aid consultation, it’s not easy to know which, if any, of them are kites. What we do know is what the 145 barristers who, as members of the attorney-general’s panels, argue cases on behalf of the central state, wrote to him in their joint letter: ‘We consider that the proposals in the consultation paper will undermine the accountability of public bodies to the detriment of society as a whole and the vulnerable in particular.’"

Schneier and Drake at the Stop Watching Us rally

Bruce Schneier and Thomas Drake talking sense at the Stop Watching Us rally in Washington DC on 26 October 2013.

Jesselyn Radack reads Snowden statement at Stop Watching Us rally

Jesselyn Radack, the Government Accountability Project's National Security & Human Rights Director, read the following statement from Edward Snowden at the Stop Watching Us rally today:

In the last four months, we’ve learned a lot about our government. We’ve learned that the US Intelligence Community secretly built a system of pervasive surveillance.

Today, no telephone in America makes a call without leaving a record with the NSA. Today, no Internet transaction enters or leaves America without passing through the NSA’s hands. Our representatives in Congress tell us this is not surveillance. They’re wrong.

We’ve also learned this isn’t about red or blue party lines. Neither is it about terrorism.

It is about power, control, and trust in government; about whether you have a voice in our democracy or decisions are made for you rather than with you. We’re here to remind our government officials that they are public servants, not private investigators.

This is about the unconstitutional, unethical, and immoral actions of the modern-day surveillance state and how we all must work together to remind government to stop them. It’s about our right to know, to associate freely, and to live in an open society.

We are witnessing an American moment in which ordinary people from high schools to high office stand up to oppose a dangerous trend in government. We are told that what is unconstitutional is not illegal, but we will not be fooled.

We have not forgotten that the Fourth Amendment in our Bill of Rights prohibits government not only from searching our personal effects without a warrant but from seizing them in the first place. Holding to this principle, we declare that mass surveillance has no place in this country.

It is time for reform. Elections are coming and we’re watching you.

Letter to MP re parliamentary debate on surveillance

Following a prompt by the Open Rights Group I have written to my MP asking she intervene positively on the side of privacy or at least follow her conscience rather than party orders in the debate on mass surveillance in parliament next Thursday. Copy of my note below.

Dear Ms Blackwood,

As you know, MPs Tom Watson, Julian Huppert and Dominic Raab have secured a 'Westminster Hall' debate in Parliament next Thursday, on 'oversight of intelligence and security services.'

Intelligence agencies have significant powers to collect and analyse private information. It is Parliament's responsibility to ensure these are necessary, proportionate and that they are not abused.

We now know from Edward Snowden's leaks that GCHQ has developed a range of mass surveillance programmes, for example the tapping of undersea fibre-optic cables under the codename 'Tempora'. From the information published so far, it seems clear that surveillance law is unfit for the digital age and that significant reforms are needed.

Debates about the limits of surveillance and the oversight of intelligence agencies are being held in America and across Europe including potentially historic hearings on the matter in the EU parliament LIBE civil liberties committee. Whether the latter hearings come to be seen as historic will largely, of course, depend on the change they can effect.

MPs in the UK, however, have seemed reluctant to take the initiative and discuss mass surveillance by UK intelligence services. And so far the Government have only seemed worried about whether newspapers should have told us anything about the surveillance.

It is high time a substantial debate took place in the UK too. The debate next Thursday will be the first substantial debate in Parliament about the mass surveillance revealed by Edward Snowden. It is an opportunity to begin the process of updating our surveillance laws so they better respect our privacy and are more fit for purpose in facilitating targeted electronic surveillance with the appropriate checks, balances and oversights to inhibit the abuse of such laws.

I'm writing to ask you to speak up about this issue in the debate. There is a long and a short articulation of why this issue is one of the most fundamental questions of the information age. I appreciate you are busy so I'll use the short version. Simply speaking the evolving infrastructure of our surveillance state represents a clear and present danger to our democracy. If that sounds like hyperbole then I would just ask you to take some time to read two essays on the subject by hugely respected commentators - Bruce Schneier's Power in the Age of the Feudal Internet available at http://en.collaboratory.de/w/Power_in_the_Age_of_the_Feudal_Internet and Evgeny Morozov's The Real Privacy Problem at http://www.technologyreview.com/featuredstory/520426/the-real-privacyproblem/

I would ask that you consider the issues carefully and draw your own conclusions rather than follow the party line. The matter is far too serious to be in the business of just following orders.

If you would like some further details don't hesitate to get in touch. I'd leave you with one final thought. Nearly 250 years ago, Lord Chief Justice Camden decided that government agents are not allowed to break your door down and ransack your house and papers in an effort to find some evidence to incriminate you (the case of Entick v Carrington (1765) 19 Howell’s State Trials 1029, 2 Wils 275, 95 ER 807, Court of Common Pleas).

The good judge also declared personal papers to be one’s “dearest property”. I suspect he might view personal data likewise in the internet age. I understand Lord Camden's reasoning in Entick became the inspiration behind the 4th Amendment to the US Constitution which offers protection from unreasonable searches and seizures. For a quarter of a millennium, fishing expeditions of the type that the GCHQ and NSA are engaged in have been considered to fundamentally undermine the rule of law. It's time Parliament brought these modern practices into line with that rule of law.

Thanks for your time and consideration.

Regards,

Ray Corrigan

Tapping Merkel's phone and other stories

It's been a bumper week for Snowden revelations and EU reactions to them.

Monday
The French government expressed their disapproval via Prime minister Jean-Marc Ayrault and President Hollande of the industrial scale tapping of French telephones by the US.

Former editor of The Times and the Sunday Times, Harold Evans, felt compelled to defend the Guardian in the face of government and other news outlets accusations that the paper was undermining national security.

"No editor in his right mind wants to give aid and comfort to murderous enemies, but every editor is duty-bound to scrutinise the use of power – responsibly but fearlessly"

The EU Parliament LIBE Committee on Civil Liberties, Justice and Home Affairs voted through the complex 'General Data Protection Regulation' (Rapporteur: Jan Philipp Albrecht) and the 'Protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data (Directive)' (Rapporteur (and former Greek foreign minister): Dimitrios Droutsas). Those MEPs sure know how to coin a catchy title. The associated press release painted a rosy picture of how the new regulations are going to put people

"in control of their personal data while at the same time making it easier for companies to move across Europe...

Responding to mass surveillance cases, MEPs inserted stronger safeguards for data transfers to non-EU countries. They also inserted an explicit consent requirement, a right to erasure, and bigger fines for firms that break the rules."

In the US the vote was seen as a stick to beat the US with in the wake of the Snowden leaks on the NSA.surveillance.

Unfortunately, in spite of the best intentions of MEPs, no one can possibly know the effect of the regulations even if they were to see the light of regulatory day in the form the LIBE committee approved them.

Firstly they are hugely complicated.

Secondly they were subject to 3999 amendments, tabled in various EU committees, the highest number with respect to a single legislative file ever in the parliament's history.

Thirdly because Article 6 of the proposed data protection regulations drives a coach and horses through all of the protections:

"Article 6

Lawfulness of processing

1. Processing of personal data shall be lawful only if and to the extent that at least one of the following applies:

[...]

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the a controller or in case of disclosure, by the third party to whom the data is disclosed..."

Seriously? All those words, clauses, pages, negotiations and protections and buried in the midst of it there is a gigantic get-out-of-data-protection-free provision like this. The government and associated public services can process your data "in the exercise of official authority"; and commerce (including 3rd parties) can do so for the purpose of their own "legitimate interests"? With a loophole that enormous it's hard to believe the UK government are still fighting tooth and nail against the package.

Evgeny Morozov did a lovely job of outlining the clear and present danger to democracy posed by the voracious appetite of government and commerce for personal data when combined with privacy blind unrestrained information consumerism.

The Irish High Court granted Maximilian Schrems leave to pursue a judicial review case against the Irish Data Protection Commissioner. Schrems alleged that that esteemed body's refusal to investigate his complaint in June 2013 in relation to Facebook's actions in connection with the NSA PRISM program was unlawful.

Tuesday
Reporter Glenn Greenwald labelled Julian Smith, the MP who is demanding the Guardian gets prosecuted for endangering national security, an authoritarian functionary.

Mr Smith and security minister James Brokenshire shamefully used the platform of a parliamentary committee to abuse Guardian. All attempts at debate in the committee were curtailed by the chairman.

Privacy International wrote to NSA chief, Keith Alexander regarding their unauthorised access to the international financial messaging system, SWIFT.

A powerful cast of US dignitaries noted their objections to mass surveillance via a very well produced EFF video.

Wednesday
The European Parliament voted to suspend the Terrorist Finance Tracking Program (TFTP) agreement with the US - the transfer of the SWIFT finance data of European citizens to the US.

Dutch MEP Sophie in t Veld was pleased

YESSSS!!! EP votes to suspend Swift agreement (and my tweet on this victory gets stuck....NSA? ;) ;)
— Sophie in 't Veld (@SophieintVeld) October 23, 2013

The Commission in the form of Commissioner Malmström rapidly moved to calm US and UK jitters on the matter by issuing a statement saying they would "take note" of the vote and that they "have no indications that the TFTP Agreement has been violated" by the NSA. The Commission have asked for assurances that the agreement has not been violated and

"In the meantime, the provisions of the TFTP Agreement that clearly regulate the transfer of personal data, and that provide effective safeguards to protect the fundamental rights of Europeans, will remain in place."

MEPs also voted for enhanced whistleblower protections but Commissioner Malmström scuppered that notion too:

"For the time being, the commission does not however intend to propose new legislation on the definition of corruption or approximations of statutes or limitations of corruption offences or protection for whistleblowers," 

She's of the opinion that there are adequate international standards in place which will be why Edward Snowden is holed up in Russia of course.

Peter Sommer produced a succinct blueprint of how to engage in better oversight of security and intelligences agencies, specifically GCHQ.

Keith Alexander, head of the NSA, continued to defend his right to defend America in cyberspace.

Thursday
German Chancellor Merkel was reported as being rather upset that the NSA had been bugging her phone since at least 2006. Even the Taoiseach thought it might be a good idea to speak up against such misbehaviour.

So with France and Germany now less than enamoured with US digital shenanigans, the best laid plans of officials for the EU leaders' meeting got slightly sidetracked.

Friday
It wasn't just you Ms Merkel - the NSA monitored the calls of 35 world leaders. So Ms Merkel and Mr Hollande are agreed then that they should have a chat with the US government and that they might well be, contrary to popular belief, undermining the fight against terrorism.

Even David Cameron can't find a way out of signing a relatively innocuous statement from the EU leaders complaining about US surveillance. He hasn't changed his mobile phone though, so I assume he's got nothing to hide...

Some consolation for Mr Cameron was that he may have managed, with Chancellor Merkel's support and the disapproval of certain members of the Commission, to scupper the data protection package until 2015, i.e. beyond the next EU parliament elections, the deadline being pushed by the LIBE committee to get the provisions passed.

The EU Commission proposed a comprehensive reform of data protection rules to increase users' control of their data and to cut costs for businesses. They kinda agree with the LIBE committee but not really.

A study done for the EU parliament LIBE civil liberties committee on National Programmes for Mass Surveillance of Personal Data in Member States and their Compatibility with EU Law looks like a fascinating read.

"In the wake of the disclosures surrounding PRISM and other US surveillance
programmes, this study makes an assessment of the large-scale surveillance
practices by a selection of EU member states: the UK, Sweden, France,
Germany and the Netherlands. Given the large-scale nature of surveillance
practices at stake, which represent a reconfiguration of traditional intelligence
gathering, the study contends that an analysis of European surveillance
programmes cannot be reduced to a question of balance between data
protection versus national security, but has to be framed in terms of collective
freedoms and democracy. It finds that four of the five EU member states
selected for in-depth examination are engaging in some form of large-scale
interception and surveillance of communication data, and identifies parallels and
discrepancies between these programmes and the NSA-run operations. The
study argues that these surveillance programmes do not stand outside the
realm of EU intervention but can be engaged from an EU law perspective via (i)
an understanding of national security in a democratic rule of law framework
where fundamental human rights standards and judicial oversight constitute key
standards; (ii) the risks presented to the internal security of the Union as a
whole as well as the privacy of EU citizens as data owners, and (iii) the potential
spillover into the activities and responsibilities of EU agencies. The study then
presents a set of policy recommendations to the European Parliament."

Finally, for now, has the Guardian just got its own back on Julian Smith MP by accusing him of endangering national security? Apparently Mr Smith posted a picture on his official website of him posing with staff from the high-security US base in the UK, Menwith Hill. Mess with the press at your peril.

Stop watching us: the US video; now where's the UK version?

The EFF has produced a nice video with an impressive cast of characters demanding a halt to mass suspicionless surveillance.



Now how about a UK version with an equally heavyweight cast? There is at least a debate up and running in the US.

MP & Minister "debate" aka accuse Guardian of breach of national security

The terms and conditions for embedding video of exchanges in the UK Parliament state that sites that "Lower the dignity of either House or that of individual members" are excluded from posting the recordings. You can judge for yourself whether this site or the particular MP and minister are the ones lowering the dignity of the House or its members in this "debate" on whether Guardian damaged national security.

Just for the record and so no one is in any doubt about my perspective - I believe it was an utter disgrace:


The Guardian bashing starts at 16:30:11. There follows 30 minutes of prepared speeches by Julian Smith MP and security minister James Brokenshire with all efforts to "debate" blocked by the session chairman. This is despite several MPs desperately trying to intervene. David Winnick makes a number of heckling interventions accusing Mr Smith in particular of McCarthyism and of making a "disgraceful speech". Mr Smith responds that Mr Winnick is "a rude man". As soon as Mr Brokenshire finishes his speech the chairman closes the session.

Mr Brokenshire allowed David Davis to make a single intervention to ask if it was so clear that the Guardian has broken the law and endangered national security why has there been no prosecutions? The minister dodged the question saying it was a matter for the police and CPS and continued with his pre-prepared speech.

That a parliamentary debate about one of the most fundamental issues in an information age should be orchestrated in such a manner is contemptible and inexcusable. That most people still won't care is, as John Naughton put it in the Observer this week, is really scary.

Update: the Guardian's own reserved report on Messrs Smith & Brokenshire's performance is now available.
I also recommend Evgeny Morozov's MIT Technology Review essay on how the erosion and neglect of privacy is putting democracy at risk. Extract:

"we can now be pinged whenever we are about to do something stupid, unhealthy, or unsound. We wouldn’t necessarily need to know why the action would be wrong: the system’s algorithms do the moral calculus on their own. Citizens take on the role of information machines that feed the techno-bureaucratic complex with our data. And why wouldn’t we, if we are promised slimmer waistlines, cleaner air, or longer (and safer) lives in return?
This logic of preëmption is not different from that of the NSA in its fight against terror: let’s prevent problems rather than deal with their consequences. Even if we tie the hands of the NSA—by some combination of better oversight, stricter rules on data access, or stronger and friendlier encryption technologies—the data hunger of other state institutions would remain. They will justify it. On issues like obesity or climate change—where the policy makers are quick to add that we are facing a ticking-bomb scenario—they will say a little deficit of democracy can go a long way."

ORG interviews, the ISC inquiry & Benkler re the Snowden leaks

The Open Rights Group has done a series of interviews about the Snowden leaks with such luminaries as former GCHQ chief David Omand, human rights and freedom of information campaigners Peter Tatchell and Heather Brookes and the former Conservative foreign and defence secretary, Malcolm Rifkind.



Particularly telling is Mr Omand's point that we've got to grow up and have a public debate about the powers of the intelligence services to engage in operational surveillance, what that means in practice and what the boundaries, checks and balances of such powers should be.

Mr Rifkind, comes across as believing in the magic powers of computers, given enough personal data about everyone, to point out the bad guys. It doesn't matter, you see, that the data of the rest of us is in there too; because as long as it's only seen by the computer which grades us as innocents then there is no harm done.

His lack of understanding might not be a problem except for the fact that he is chairman of the parliamentary  Intelligence and Security Committee (ISC) charged with overseeing the work of the intelligence services. The ISC is also the committee that has announced it will look into the Snowden leaks. Unfortunately Mr Rifkind is also framing this inquiry as examining

"the appropriate balance between privacy and security in an internet age...

There is a balance to be found between our individual right to privacy and our collective right to security.

Wrong, wrong, wrong.

It is not about "balancing" privacy and security. They are not opposite sides of the same coin. More privacy does not mean less security any more than more security means less privacy. Door locks and strong fences provide privacy and security. Security gets pitched against privacy in the context of mass surveillance and identity; and the anti-privacy security measures like mass surveillance and identity cards not only don't work but can undermine security. (All the 9/11 attackers had their photo identities checked before boarding their planes.)

If Mr Rifkind does not understand that he should not be chairing such an influential parliamentary committee in this area. If he does understand it he's engaging in manipulative politics, framing the "inquiry" to get pre-ordained "answers".

Even if we did have Mr Rifkind's magic terrorist catching machine and it was 99.9% accurate (no existing surveillance system comes close to this) it would be still be useless.

Why?

Because even if the machine was watching only the 60 million people in the UK, it would wrongly accuse roughly 600,000 innocent people of being terrorists every time it was asked for a suspect. That’s a lot of false leads for the police and security services to follow whilst the bad buys get lost in the noise.

So even if there were 1000 terrorists (unlikely), our 99.9% accurate terrorist catching machine would be wrong more than 99.8% of the time (599,000/600,000).

Yet the machine still might miss the terrorist! Because not only will it wrongly identify innocent people as bad guys, it will also identify real bad guys as innocents.

Tuning the machine to accuse fewer innocents will make it more likely that it will miss the bad guys.
Finding a terrorist is a needle in a haystack problem. You don’t find the needle by throwing more electronic data hay on the stack. It requires targeted, intelligence led surveillance and investigation - targeted intelligence led data preservation not blanket data collection and mass surveillance.

So not only does the Rifkind-approved mass surveillance apparatus not work, it blows a hole in the constitutional, common law, statutory and international protections for privacy.

Yochai Benkler spelt it out nicely in yesterday's Guardian:

"Pervasive surveillance proponents make two core arguments.

First, bulk collection saves Americans from foreign terrorists. The problem with this argument is that all publicly available evidence presented to Congress, the judiciary, or independent executive branch review suggests that the effect of bulk collection has been marginal...

The second argument that defenders of mass surveillance offer is that detailed, complex and faithfully-executed rules for how the information that is collected will be used are adequate replacements for what the fourth amendment once quaintly called "probable cause" and a warrant "particularly describing the place to be searched, and the persons or things to be seized". The problem with this second argument is that it combines two fundamentally incompatible elements.

Mass surveillance represents a commitment to near-universal all-seeing gaze, so as to assess and respond to threats that can arise anywhere, at any time. Privacy as a check on government power represents a constitutional judgment that a limited government must have limited power to inspect our daily lives, and that an omniscient government is too powerful for mere rules to restrain. The experience of the past decade confirms this incompatibility...

Technology has enabled government to have investigative and situational awareness on a scale and scope that were science fiction when the Stasi shut its doors. The "state of emergency" mindset necessary to justify the program in the first place drives those charged with assuring the safety of Americans to always use this technology to its full potential; it also gives them an independent source of legitimacy for their actions – the fierce urgency of necessity.
Their mission clashes with the fundamental premise of privacy as a civil right: that state power is best contained by making the overwhelming majority of what goes on in society invisible to the state. As Justice Alito put it in the supreme court's decision to strike down GPS tracking:

[Historically] the greatest protections of privacy were neither constitutional nor statutory, but practical.

Once the state knows about behavior, it is hard to rely on rules alone to bear the full burden of preventing overreach by those who wield its awesome power...

Rules alone cannot hold back the millions of potential abuses of an omniscient state.

As long as government is allowed to collect all internet data, the perceived exigency will drive honest civil servants to reach more broadly and deeply into our networked lives. Bringing an end to mass government surveillance needs to be a central pillar of returning to the principles we have put in jeopardy in the early 21st century."

Mr Tatchell and Ms Brookes, as you would expect, are articulate on the need to protect human rights, expose wrong doing on the part of government, protect whistleblowers and wax skeptical about the constant 'trust us it's a matter of national security' refrain on the part of governments.

Machon & Drake at EU LIBE hearing on mass surveillance

Further essential viewing from the LIBE committee hearings on electronic mass surveillance - MI5 whistleblower Anne Machon on Mon, 30 Sep 2013 15:00 - 18:30. If you're watching via the EPTV site Ms Machon's evidence begins at 17:08:50. YouTube copy of Ms Machon's statement and Q&A with her and Tom Drake, whistleblower and former NSA senior executive:



Ms Machon and Mr Drake got several rare rounds of applause from the assembled MEPs. Ms Machon's recommendations to the committee:

• Mean­ing­ful par­lia­ment­ary over­sight of intel­li­gence agen­cies, with full powers of invest­ig­a­tion, at both national and European levels.
• These same demo­cratic bod­ies to provide a legit­im­ate chan­nel for intel­li­gence whis­tleblowers to give their evid­ence of mal­feas­ance, with the clear and real­istic expect­a­tion that a full inquiry will be con­duc­ted, reforms applied and crimes punished.
• Insti­tute a dis­cus­sion about the legal defin­i­tion of national secur­ity, what the real threats are to the integ­rity of nation states and the EU, and estab­lish agen­cies to work within the law to defend just that. This will halt inter­na­tional intel­li­gence mis­sion creep.
• EU-wide imple­ment­a­tion of the recom­mend­a­tions in the Ech­elon Report (2001):

1. to develop and build key infra­struc­ture across Europe that is immune from US gov­ern­mental and cor­por­at­ist sur­veil­lance; and
2. “Ger­many and the United King­dom are called upon to make the author­isa­tion of fur­ther com­mu­nic­a­tions inter­cep­tion oper­a­tions by US intel­li­gence ser­vices on their ter­rit­ory con­di­tional on their com­pli­ance with the ECHR (European Con­ven­tion on Human Rights).”

• The duty of the European par­lia­ment is to the cit­izens of the EU.  As such it should act­ively pur­sue tech­no­logy policies to pro­tect the pri­vacy and basic rights of the cit­izens from the sur­veil­lance of the NSA and its vas­sals; and if it can­not, it should warn its cit­izens abut this act­ively and edu­cate them to take their own steps to pro­tect their pri­vacy (such as no longer using cer­tain Inter­net ser­vices or learn­ing to use pri­vacy enhan­cing tech­no­lo­gies). Con­cerns such as the trust Europeans have in ‘e-commerce’ or ‘e-government’ as men­tioned by the European Com­mis­sion should be sec­ond­ary to this con­cern at all times.
• Without free media, where we can all read, write, listen and dis­cuss ideas freely and in pri­vacy, we are all liv­ing in an Orwellian dysto­pia, and we are all poten­tially at risk. These media must be based on tech­no­lo­gies that empower indi­vidual cit­izens, not cor­por­a­tions or for­eign gov­ern­ments. The Free Soft­ware Found­a­tion has been mak­ing these recom­mend­a­tions for over two decades.
• The cent­ral soci­etal func­tion of pri­vacy is to cre­ate the space for cit­izens to res­ist the viol­a­tion of their rights by gov­ern­ments and cor­por­a­tions. Pri­vacy is the last line of defense his­tor­ic­ally against the most poten­tially dan­ger­ous organ­isa­tion that exists: the nation state. There­fore there is no ‘bal­ance between pri­vacy and secur­ity’ and this false dicho­tomy should not be part of any policy debate.

Ms Machon's point in the Q&A session that she signed the Official Secrets Act to save lives and protect official secrets was particularly well made - she did not agree to protect unofficial secrets and cover up the criminal acts of spies which caused the deaths of innocent people.

The official version of Mr Drake's statement to the committee is at http://www.europarl.europa.eu/document/activities/cont/201310/20131001ATT72162/20131001ATT72162EN.pdf. The video of his statement is available on Youtube and I posted a copy here yesterday. He is a terrifically compelling witness.  Any politician, media commentator or anyone else seeking to excuse mass surveillance and secret illegal, criminal or unethical government behaviour in this context should be compelled to explain themselves under Mr Drake's questioning glare. We could call it the Tom Drake test.

Tom Drake statement to LIBE Committee Mass Surveillance hearings

NSA mass surveillance whistleblower Tom Drake's statement to EU Parliament LIBE Civil Liberties, Justice and Home Affairs committee hearing on mass surveillance on Monday, 30 September, 2013:



The Government Accountability Project has published an almost complete transcript of Mr Drake's statement which will probably be a relief to the interpreters at the committee who were finding it difficult to keep up with Mr Drake's fast talking, intense, potent delivery. The sense of justifiable controlled anger and determination emanating from Mr Drake is palpable, even to an observer in a foreign land viewing through the grace of the internet.

Snowden statement to EU LIBE Committee

Edward Snowden's statement to the EU Parliament LIBE Civil Liberties, Justice and Home Affairs committee on Monday, 30 September, 2013:

"I thank the European Parliament and the LIBE Committee for taking up the challenge of mass surveillance. The surveillance of whole populations, rather than individuals, threatens to be the greatest human rights challenge of our time. The success of economies in developed nations relies increasingly on their creative output, and if that success is to continue, we must remember that creativity is the product of curiosity, which in turn is the product of privacy.
A culture of secrecy has denied our societies the opportunity to determine the appropriate balance between the human right of privacy and the governmental interest in investigation. These are not decisions that should be made for a people, but only by the people after full, informed, and fearless debate. Yet public debate is not possible without public knowledge, and in my country, the cost for one in my position of returning public knowledge to public hands has been persecution and exile. If we are to enjoy such debates in the future, we cannot rely upon individual sacrifice. We must create better channels for people of conscience to inform not only trusted agents of government, but independent representatives of the public outside of government.
When I began my work, it was with the sole intention of making possible the debate we see occurring here in this body and in many other bodies around the world. Today we see legislative bodies forming new committees, calling for investigations, and proposing new solutions for modern problems. We see emboldened courts that are no longer afraid to consider critical questions of national security. We see brave executives remembering that if a public is prevented from knowing how they are being governed, the necessary result is that they are no longer self-governing. And we see the public reclaiming an equal seat at the table of government. The work of a generation is beginning here, with your hearings, and you have the full measure of my gratitude and support."

The statement was read on Snowden's behalf by Jesselyn Radack, the Government Accountability Project's Director of Security and Human Rights and a former ethics adviser to the United States Department of Justice. GAP was an early supporter of Edward Snowden following his revelations of secret US and UK government mass surveillance programs.



Jesselyn Radack's full statement to the LIBE committee is also available on YouTube.



It's powerful stuff and well worth setting aside 15 minutes to pay attention to, from the charge that the Bush administration crossed the rubicon with an attack on whistleblowers, in particular Tom Drake, which amounted to a criminalization of the truth, to the fact that in less than a year the Obama administration indicted more people under the Espionage Act than all previous US presidents combined. She respectfully requests that the committee strengthen laws to protect whistleblowers, laws to protect privacy and laws to protect the rights of publishers in the EU to disseminate revelations like those Snowden has exposed without fear of criminal penalty.

BBC Newsnight, Greenwald, Snowden & Entick v Carrington

The BBC finally got round to doing what they might consider an in-depth feature on the Edward Snowden affair last night on Newsnight. I came across it by accident since I rarely watch Newsnight any more but I'd recommend watching it in full before it times out on the iPlayer in 7 days for three reasons -

• firstly Glenn Greenwald's powerful and passionate critique of the behaviour of the UK & US governments and the weak journalism of the BBC on the Snowden affair
• secondly it is a classic example of the BBC's determination to report in a way that they perceive to exhibit "balance" i.e. that there are two and only two diametrically opposed sides to every story. The God of 'balance', it seems, trumps objectivety and evidence at the beeb.
• Ross Anderson's contribution

Kirsty Wark, opening the programme by asking if Snowden's action was "a noble strike against an authoritarian establishment OR an act of vandalism against our national security", gave a taste of things to come. The introductory sequence of the show (I use that word deliberately) goes on to present a video extract of former GCHQ chief, Mr David Ormand, breathlessly saying "not even the KGB in its heyday of  Philby and Burgess and Maclean in the 1950s could have dreamt of acquiring 58,000 highly classfied intelligence documents." With the theme music still running Ms Wark then says they have an exclusive interview with Glenn Greenwald, visible on the studio screen in the background.

There follows 11 to 12 minutes of BBC "balanced" reporting by security correspondent Gordon Corera. You know the sort of thing. Is Snowden the good guy or the bad guy? Are the UK & US governments doing mass surveillance as the good guys to protect us all or the bad guys and spying on us all? All sadly rather superficial.

Ross Anderson is very clear in pointing out that the NSA's actions have more than undermined internet security, they have threatened to break the internet; and quite amusing when explaining that security experts around the world have been astonished that the UK and US governments have managed to build big complex information systems that actually work.

Actually Ross's contribution to that first 12 minutes is probably the one bit of that part if the show worth retaining. Though in fairness to David Ormand, when he says the police and intelligence services need a powerful capability to get at the communications of terrorists, pedophiles and other nefarious actors he's absolutely right, they do. But you don't make that job easier with a mass surveillance - blanket data collection & retention - approach. It has to be done through an intelligence led, targeted data preservation regime. Gordon Corera didn't even present this question to Mr Omand or if he did it didn't make the final cut of the show.

Ross Anderson also explains that the Guardian "revelations in early September that the NSA had had a major covert programme to compromise internet security standards and products were a 9/11 moment" for security specialists globally; and the the goal of the NSA and GCHQ is to ensure they can break anyone's privacy at any given time and interfere with any transaction at any given time. In order to do this they have compromised in various ways many of the protocols on which the internet relies. Yet when you introduce these vulnerabilities they are not just available for the spies to use, they are available to the bad guys too. You can't make people safe by making the communications infrastructure they rely on less secure.

I think Ross is worth quoting in full over his and others' surprise at the NSA and GCHQ's apparent technical competence.

"They pushed it even further than we thought they would. The surprising thing to us was that there appear to be occasional pockets of competence within the NSA and GCHQ. Many of us thought for many years that the real secret was that, like other large public sector IT projects it didn't work; and there was really nobody there. But to find that they had built this machine and got it working was an eye opener."

Glenn Greenwald is introduced at 12 minutes 35 seconds into the programme. It's difficult to capture the passion and power of Mr Greenwald's contribution in a blog post, so I'm not going to try. Instead I'll just point you to the video on YouTube and the Newsnight website. Just to be clear, I don't agree with or endorse the YouTube video poster's opprobrious labelling of Ms Wark or former security minister, Pauline Neville-Jones, as apologists. Given how badly prepared Ms Wark came across in the Greenwald interview, I'm not sure how long the BBC will allow it to remain available on YouTube but here it is for now:



Do watch the 25 minute or so full segment on the Newsnight website whilst it remains available.

Just some final thoughts for readers who are seduced by the argument that the only way for governments to catch the bad guys is to vacuum up the comms data of everyone, could I refer you to the case of Entick v Carrington (1765) 19 Howell’s State Trials 1029, 2 Wils 275, 95 ER 807, Court of Common Pleas.

Nearly 250 years ago, Lord Chief Justice Camden decided that government agents are not allowed to break your door down and ransack your house and papers in an effort to find some evidence to incriminate you.

The short version of the story is that a member of the government, Lord Halifax, had taken a dislike to Mr Entick and ordered Mr Carrington and some of his king’s messengers buddies to dig the dirt to bury the problem with a charge of seditious libel. In court, government lawyers argued that most people subjected to the kind of over-exuberant behaviour exhibited by Carrington & co. were happy to comply and it was rather irritating that Mr Entick was complaining about it. And besides, if the government didn’t have the authority to forcibly extract evidence how could it possibly be expected to deal with terrorists, or in the parlance of the time, purveyors of sedition?

Lord Chief Justice Camden, who had form having sided with another government labelled terrorist, MP John Wilkes, 2 years earlier, didn’t buy the argument. “This power” said he “so claimed by the Secretary of State is not supported by one single citation from any law book extant.”

The good judge also declared personal papers to be one’s “dearest property”. I suspect he might view personal data likewise in the internet age.  I understand Lord Camden's reasoning in Entick became the inspiration behind the 4th Amendment to the US Constitution which offers protection from unreasonable searches and seizures.  The point is, however, that fishing expeditions of the type that the GCHQ and NSA are engaged in fundamentally undermine the rule of law.

Update: Early editions of Bailey, Harris & Jones: Civil Liberties Cases, Materials and Allen, Thompson & Walsh Cases and Materials on Constitutional and Administrative Law, real old books I still have on my shelf, were the sources I referred to in order to double check my ancient memories of Entick v Carrington.

Update 2: BBC Newnight has now posted the full 33 minutes 26 seconds of the Snowden report and interviews to YouTube. Kudos to them



Newsnight's editor Ian Katz has responded to Jay Rosen's criticism of the piece. Former BBC news chief Richard Sambrook also thought "it was an ill-thought through interview and consequently weak. More broadly, for at least 25 years British broadcasting has been enthralled by the adversarial, devil’s advocate, form of interview. Journalists careers have been made and interviewees careers destroyed by it. Personally, as a form, I think it is all but exhausted and is increasingly tiresome – and seldom reveals as much as a more forensic approach could achieve."