Seriously thoughtful UK launches massive, one-year program to archive every email

[Wario]

The data they are collecting isn't that big of a deal. If it help to get to terrorists and organised crime, all the better.

The only problem is the the UK goverment are useless when it comes to protecting the data they have collected.

[Sparrow]

Originally Posted by HarryT

Traffic analysis is an important tool in tracking down the connections between criminals, terrorists ,etc. That is the reason for this. The data will ONLY be available to law-enforcement officials with a court order. I have no problem with this myself. What is your issue with it?

I'm not a criminal or a terrorist - why is my government treating me like one??

They don't need to worry about who I do or don't send email to. I resent their arrogance in thinking they do, and I resent the government demanding that I pay for my own shackles.

It is putting every British citizen in jeopardy of a miscarriage of justice.

Yet another debacle yesterday:
http://news.bbc.co.uk/1/hi/uk/7991307.stm

[ruskie]

Easy to bypass and avoid:
http://www.torproject.org/

And there are such things as anonymous remailers and other anonymous proxies that one can use easily. This will only hurt the people that lack the skills to do so. Criminals and terrorists that you claim this will catch is complete rubbish.

As for how much is there to store:
130M exim

Those are the logs from 2008-11-22-01 'till 2009-04-09-01 of my own personal mail server that also hosts 5 other people. Now extrapolating this to a bigger amount of people one would get:
1000 - 20G and that's for what 6 months worth of email traffic.

And it just get's higher and higher. Even if people claim storage is cheap it's not really to store anything like this effectively one needs to have a very large storage array and those don't come cheap.

And before calling me a hypocrite I respect my users right to privacy(yes this isn't all family members but friends and so on). I do not go through this or their emails etc. I don't care about it. The only analysis I do run against this is where most rejected emails come from. And for that I do not need either sender or receiver.

Yes I would give this information to the police provided they give a warrant for the person and even then I would only provide them the information for only that person and nobody else.

Also:
from http://www.telegraph.co.uk/sciencean...or-a-year.html

Police and the security services will be able to access the information to combat crime and terrorism.
Hundreds of public bodies and quangos, including local councils, will also be able to access the data to investigate flytipping and other less serious crimes.

Nowhere does it say anyone will need a warrant to access this data. And I believe I've read somewhere to that effect that a warrant is not necessary to get access to this data.

EDIT
I knew I spoted something to that effect:
http://en.wikipedia.org/wiki/Mass_su...European_Union

There are other interesting things on that page as well
END EDIT

Sometime I get the feeling that one side of the EU doesn't know what the other side is doing.

http://www.theregister.co.uk/2009/03...a_behavioural/

Then there's this fine jewel:
http://www.theregister.co.uk/2009/03..._surveillance/

There are also various anonymous VPN services available like:
http://www.ipredator.se/

I agree that this "_*might*_" help catch criminals but I strongly believe that this will be used more to monitor peoples habits and their social circles. Hell this would be a gold mine to ID thieves. Just pull out 1000 random logs and start mailing the stuff. And no security isn't absolute so this will leak out sooner rather than later.

The thing with totalitarism so far was "Your doing it wrong". This is how it happens:
totalitarism 2.0 the new world order

a) establish big states without any geographical or national boundries
b) establish various bodies in those states some that do good but most that do bad
things
c) pull in as many real states as you can either by hook or crock
d) pass through various directives and such like that need to be transposed to national
law and so on while putting a bit of liberty and/or privacy eroding into each one
e) treat people as that they still have control and let them vote even if you fix the
voting outcome - nobody will question it
f) get people disinterested in politics and more into sensationalistic news or the
weather or reality TV etc...
g) pass laws that says if you don't vote you lose the right to do so for certain things
h) as more and more people become disinterested with politics more and more lose
their right to vote
i) start making "partnerships" with other political parties first as cooperation then as
mergers etc...
j) after a few generations there is nothing left but a single party with everything in
their hands and no way to get out of it

And yes this is how I see the future if nothing is done.

[HarryT]

Originally Posted by Sparrow

I'm not a criminal or a terrorist - why is my government treating me like one??

They don't need to worry about who I do or don't send email to. I resent their arrogance in thinking they do, and I resent the government demanding that I pay for my own shackles.

It is putting every British citizen in jeopardy of a miscarriage of justice.

It's no different to the phone company keeping records of who you make calls to, and those records being available to the police with a court order. This has always been done, and most people would accept that this does not constitute "treating you like a criminal".

As the internet replaces the telephone for many everyday communications, it seems emminently reasonable to me that e-mails should be "logged" in the same way that telephone calls are - and always have been.

[deltop]

How exactly is this going to catch criminals? Or even help catch them?

Anyone up to anything even remotely dodgy will be running their own smtp server (for sending emails) and pop3/imap server for receiving them. Meaning their emails won't appear in any logs. All isp's can do is monitor their own servers which a potential terrorist or criminal will NOT be using.

Even using any standard free webmail sevice based outside of the eu will mean they can't monitor your emails.

[LazyScot]

Originally Posted by HarryT

I'm afraid I don't share your cynicism of the aims of government. Like it or not, surveillance techniques are vital for law enforcement: eg the arrest of the chaps who attempted to bomb the London Underground a couple of years ago was almost entirely down to CCTV and tracking mobile phones. The police NEED such facilities as the internet becomes used more and more by terrorists and organised crime.

Like HarryT, I tend to mostly trust the intention's of today's government. I expect I will trust the next one as well. However, who knows what will happen in future years?

Also, whilst I trust the intention of the government, I am not sure that I entirely trust all the police not to abuse the powers they are being given, and to only use them where they are not intended, especially given some of the developments of late. (Note: again generally I think the police are perfectly honest and work with the spirit of the law, but a few do abuse their powers, and I am reluctant to give them excessive powers without being sure they are justified and appropriately controlled.)

Any law like this is a trade-off; I'm concerned that a tradeoff worthwhile for, say mass-murdering terrorism, isn't worth it if it ends up, say, stopping people protesting.

Originally Posted by HarryT

It's no different to the phone company keeping records of who you make calls to, and those records being available to the police with a court order. This has always been done, and most people would accept that this does not constitute "treating you like a criminal".

As the internet replaces the telephone for many everyday communications, it seems emminently reasonable to me that e-mails should be "logged" in the same way that telephone calls are - and always have been.

There are differences between email and phones -- I can get lots of spam emails from very dodgy sources. It is also possible that the likes of viruses may infect my machine and send emails to dodgy sources. Generally this doesn't happen on the phone. People need to understand

Originally Posted by deltop

How exactly is this going to catch criminals? Or even help catch them?

Anyone up to anything even remotely dodgy will be running their own smtp server (for sending emails) and pop3/imap server for receiving them. Meaning their emails won't appear in any logs. All isp's can do is monitor their own servers which a potential terrorist or criminal will NOT be using.

Even using any standard free webmail sevice based outside of the eu will mean they can't monitor your emails.

As HarryT has mentioned, traffic analysis would, I guess, show a lot of interesting things. Operating an SMTP server would not "hide" what you are doing as the data is still carried over the network, and I guess they can pick up the traffic as it flows across the network, identifying where the data is going.

That said all that, what do I think of the trade-off? Well, since all they are storing is just who the messages are sent/received from, and they claim they have safeguards in place, I don't see a real problem with the law at present. It does seem much the same as they have for the telephone. And I can always just write a letter if I want (I'm sure I have a pen somewhere in my house....)

What intrgiues me is given how automated the postal services are now, that they don't require them to keep logs of every item delivered, related to the point it entered the postal system....

[pilotbob]

Originally Posted by HarryT

The data will ONLY be available to law-enforcement officials with a court order. I have no problem with this myself. What is your issue with it?

Well, there's the problem right there. Under the patriot act no court order is needed. The FBI only needs to submit a "national security letter". The patriot act pretty much shreds all of your constitutional rights. Now, tell me there is no abuse of this "power" to perform witch hunts.

BOb

EDIT: I see that this is a UK thing. So patriot act doesn't apply I guess.

[Sparrow]

Originally Posted by LazyScot

Also, whilst I trust the intention of the government, I am not sure that I entirely trust all the police not to abuse the powers they are being given, and to only use them where they are not intended, especially given some of the developments of late.

But when the UK government uses 'anti-terrorist' legislation against Icelandic banks - doesn't that undermine their credibility?

[LazyScot]

Originally Posted by Sparrow

But when the UK government uses 'anti-terrorist' legislation against Icelandic banks - doesn't that undermine their credibility?

Yes.

That's why I said intention.

It's the old "when all you have is a hammer, everything looks like a nail" situation. Essential when a problem arises, the powers look in their legal toolbox and pull out whatever is to hand, without thinking about if it is appropriate. Hence, the problem is with the oversight of the powers to make sure they are used correctly. I personally have a lot of problems with the terrorism laws and they ways they are used, not least the extended detention before charge clauses. And that applies even when they are used on terrorists (I prefer the word "coward" here, but for clarity I'll stick with terrorist).

[deltop]

Originally Posted by LazyScot

As HarryT has mentioned, traffic analysis would, I guess, show a lot of interesting things. Operating an SMTP server would not "hide" what you are doing as the data is still carried over the network, and I guess they can pick up the traffic as it flows across the network, identifying where the data is going.

Using encryption (SSL) means your isp can't tell what kind of traffic is passing over their network. They can't tell if it's web traffic, ftp, bitorrent, a connection to a usenet server, OR email traffic. Only that's it's ssl and that there is traffic coming and going. And using SSL is very easy to do. Again anyone up to anything remotely dodgy would be using their own servers with encryption. So I can't see how traffic analysis would work. They'll be analyzing email traffic and that won't show up with ssl in use.

Heck I use a commercial email provider (who's servers are in New York) with imap and ssl. So my email simply won't show up in their new monitoring system at all! (I'm in the uk).

Utterly pointless.