Industrial espionage by TLA's

[Peter Fairbrother]

On 28/01/14 19:57, Charles Lindsey wrote:
> On Tue, 28 Jan 2014 10:16:54 -0000, Peter Fairbrother
> <zenadsl6186 at zen.co.uk> wrote:
>
>> I was wondering whether GCHQ did the same, and came to the conclusion
>> that they do - it is specifically allowed under RIPA.
>>
>> The Secretary of State (the Foreign Secretary in this case) can issue
>> a single certificated warrant to allow interception and examination of
>> any and all "external" [1] communications  "for the purpose of
>> safeguarding the economic well-being of the United Kingdom".
>>
>> See RIPA 8(4)(b)(ii) and 5(3)(c).
>
>>
>> [1] "external" communications are communications where either the
>> sender or the intended recipient, or both, are outside the UK.
>>
>> It is uncertain whether this applies to eg an email which is sent from
>> a person in the UK to another person in the UK, but which is sent via
>> a foreign country - a not uncommon happening, eg mail to and from all
>> Google mail, Gmail and Hotmail addresses will pass through servers in
>> the US.
>
> But there the sender and (usually) the intended recipient will both be
> in the UK, so it is not an "external" communication. How they filter
> those out is their problem - somehow they have got to do it.
>
> I suppose they might argue that Google is one of the "intended"
> recipients, since it is well-known that Google et al scan all messages
> to assist with directed advertising, but I doubt the courts would accept
> that :-).
>

That's one legal theory - another is that the actual communication in a 
hop is between the two servers, with server 1 as the sender and server 2 
as the recipient.

As a variation, if the two servers are run by different people, they 
might even be considered as two different public telecommunication systems.


A fourth legal theory is that they don't have to bother to filter the 
"unintended" recipients out anyway:

5(6) The conduct authorised by an interception warrant shall be taken to 
include—  (a) all such conduct (including the interception of 
communications not identified by the warrant) as it is necessary to 
undertake in order to do what is expressly authorised or required by the 
warrant

and once they have the intercepted product, they may claim not to need 
any further authorisation in order to look at it for whatever reasons 
they like. I'd disagree there, but they may well make that claim.

Even if they don't make the larger claim, they may say that it's easier 
to eg scan the whole for keywords rather than seperating out what may be 
non-external content. I think that may be more likely to be acceptable 
to a Court (though again I'd disagree).

And if they find plans to commit a terrorist act, well, this isn't the 
US and evidence isn't inadmissible because it has been illegally 
collected - furthermore as it's intelligence collected under an 
interception warrant it can't be used in evidence anyway, and we'd never 
find out about it, or know if it's happening.


All four theories are at least debatable, which is why I said the 
position is "uncertain".




To get back to the main point, it's quite interesting that we can see 
what GCHQ are doing by analysing the law which allows them to do things 
- some may consider that a security loophole.

-- Peter Fairbrother