URLs, IPs and interception
Peter Fairbrother
ukcrypto at chiark.greenend.org.uk
Sat, 01 Mar 2008 00:43:27 +0000
James Cox wrote:
>
> On 29 Feb 2008, at 23:02, Peter Fairbrother wrote:
>>
>>
>> Part II doesn't make it an offence to give out traffic data, and it
>> has been assumed that giving out traffic data is not interception, but
>> I've just had a look at the relevant part of Part I again.
>>
>> S.2(5) says:
>> " (5) References in this Act to the interception of a communication in
>> the course of its transmission by means of a postal service or
>> telecommunication system do not include references to—
>>
>> (a) any conduct that takes place in relation only to so much of the
>> communication as consists in any traffic data comprised in or attached
>> to a communication (whether by the sender or otherwise) for the
>> purposes of any postal service or telecommunication system by means of
>> which it is being or may be transmitted; or
>>
>> (b) any such conduct, in connection with conduct falling within
>> paragraph (a), as gives a person who is neither the sender nor the
>> intended recipient only so much access to a communication as is
>> necessary for the purpose of identifying traffic data so comprised or
>> attached. "
>>
>>
>>
>> So afaict ISPs giving out or using _any_ traffic data, in any manner
>> or form, is interception unless it is "conduct [...] for the purposes
>> of any [...] telecommunication system".
>>
>> And, afaict (see 2(1)), that's only for purposes that facilitate the
>> transmission of communications.
>>
>>
>>
>> So Phorm is out. And so is giving clickstream or URL data, or traffic
>> data, to anyone unless authorised elsewhere.
>
> i wonder how much t&c of your contract with the isp override the conduct
> in the act...
Not at all.
And t&c's can't override RIPA anyway.
Consensual interception is only lawful if _both_ parties agree to the
interception, which is generally impossible (as, for instance, I don't
agree to anyone intercepting my websites, and Phorm don't check whether
I have given permission, as they are required to do under RIPA).
-- Peter Fairbrother