sorry, but ...

[Roland Perry]

In article <50153B63.6030602 at zen.co.uk>, Peter Fairbrother
<zenadsl6186 at zen.co.uk> writes
>>> RIPA S.20: “external communication” means a communication sent or
>>> received outside the British Islands;
>[..]
>>> [ In fact any in-transit message has not been received yet, obviously,
>>> as it is still in transit;
>>
>> That's over-analysing the situation. And in any event a transmission by
>> TCP/IP involves a handshake, so the message is provably partly received
>> even before the transmission has complete.
>
>The RIPA word is "communication" not message (my fault), and I do not
>think the communication (as opposed to the packets or bits) is received
>until it has all reached some destination.

A communication is a flow of information, not a lump of information. As
with earlier discussion of social networking communications they are
more analogous to phone calls than postal items. No-one would say a
phone call wasn't received until the caller put down the phone. Not
fully received, perhaps, but the conversation could have gone on for
hours.

>Otherwise we could talk about each and every switch in the network,
>which is probably not what was meant. If it was you could intercept at
>telephone exchanges without a warrant ..

There's no loophole for intercepting at switches (either TCP/IP or POTS)
because RIPA 1(1) says: "... at any place in the United Kingdom, any
communication in the course of its transmission..."

Which is one of several references to "course of its transmission"
indicating that this is a continuous (flowing) process.

>However I can't find a definition for "communication" in RIPA or elsewhere.
>
>[..]
>> It's not useful to think about posting to/from a social network site as
>> emails, in general they are much more like Instant Messaging.
>
>In general there is also a "fetch-it-later" facility for those who are
>not logged in, which is very like web-based email.

There's a mixture; but in terms of being received immediately, that can
also apply to webmail - my Googlemail pops up an alert as soon as one
has been received. Other modes which need taking account of are the
"don't store (nor forward)", essentially peer-to-peer only, method used
by Skype, where the message is saved on the sender's machine until the
recipient is online.

What's important here is (legislatively) coping with a process which is
a flow, not as a series of hops. Although the law needs to be equally
applicable to both.

>>> Now suppose Bob is in the UK. They may know whether Bob receives
>>> Alice's post, But what they will not know is whether Charles in
>>> Pakistan has also received it. We know Charles hasn't, but they never
>>> will - is it okay for them to assume that Charles has {or rather he
>>> will}, and thus that it's an external communication?
>>
>> Once you have IM and one-to-many messaging, simple questions such as
>> these don't make sense any more.
>
>I don't know what officially happens when the law stops making sense,
>but I think most often Judges just make it up.

My position on this is that when I raised such issues immediately
post-RIPA the feeling was that they could be tackled at the first major
revision. Which is now. And is doubly important to do so, because the
communications the revisions are aimed at have this very same
one-to-many characteristic.

Again, many recipients in many countries. Needs to be reflected in the
law.

>> Indeed, numerous social networking sites are one-to-everyone (eg anyone
>> who has my "Wall" open in front of them, and I post a public 'status
>> update'). For emphasis, that's everyone everywhere [apologies to T-Mobile].
>
>The web itself does much the same. As do blogs etc..

Indeed, and even though it's possible to argue that a public web page
doesn't contain any secrets, the transmission to any one recipient is
still (and rightly so) a protected activity. Even the traffic data
element - which brings us full circle back to the 21(6) tailpiece, viz:

        "but that expression includes data identifying a computer file
        or computer program access to which is obtained, or which is
        run, by means of the communication to the extent only that the
        file or program is identified by reference to the apparatus in
        which it is stored."

>>> I can see a Judge just throwing his hands up at this point and saying
>>> "Alice's communication is to Facebook".
>>
>> That's one solution, but it needs to be reflected in the legislation, so
>> we all know where we stand.
>
>Yes. It's probably to Bob too, but that doesn't mean it isn't to
>Facebook. Clearing that up would be good.
>
>And clearing up the stored comms NTL vs Ipswich question would be good
>too - the Police need a warrant from the HS to intercept telephone
>calls, but not to intercept email? Where's the sense in that?

I continue to think that the decision in NTL was flawed. Remember that
it wasn't about intercepting emails as such, but revolved around a
provision enabling a "preservation order" [my words] for evidence that
was likely to be destroyed before that evidence could be obtained with a
production order.

Some background: We know that "stored messages" are protected (although
it would do no harm to amend the legislation to make it clearer whether
it's intended that 'saved' email/SMS/voicemail etc are supposed to have
the full protection of RIPA, or a watered down version once they have
been first received but are available for second and third receipt) but
this has the awkward side effect that if the police seize a PC or
server, which happens to include some stored emails, they would be
conducting an illegal interception, were it not for the provision that
the conduct is lawful if...

1(5)    "it is in exercise, in relation to any stored communication, of
        any statutory power that is exercised (apart from this section)
        for the purpose of obtaining information or of taking possession
        of any document or other property".

But it wasn't intended, allegedly, allow the police to grab all stored
messages going through a CSPs servers for (eg) a period of 10 days, in
the hope that some of those messages might be useful. That's what's
known in the trade as a fishing expedition. (And so is a classic
interception warrant, but the safeguards for obtaining one are much
stricter).

On the other hand, if the police knew about some specific emails which
needed to be preserved, then the preservation process they went through
was the right one, but I'd be happier if I understood what data they
collected, and how they justified it to a possibly different court, when
the production order (that required the pre-emptive preservation in
order to be effective) was finally drawn up.

>However I'm pretty sure that that is where we stand, and it's not a
>comfortable place to be. It means they can eg see all Facebook traffic,
>including all content. And that is not obvious from reading the Bill.

Any communications system that is "intercept ready" (and that includes
most telephone exchanges, and a lot of carrier-grade routers I expect)
can do this already.

The main difference is that if the "intercept ready" paraphernalia
allows for pre-filtering of the data stream, then you are less likely to
get an unmanageably large amount of product.

>wading through pages and pages of
>
>"I'm on the train"
>"I'm on the train too"
>"I'm in carriage B"
>"So am I"
>"Yes, I can see you"
>"So, when does the concert start?"
>...
>
>(wiht typos wtc) might get a bit boring

Filters don't get bored.
-- 
Roland Perry