Investigatory Powers Act - Government mandated backdoors

[Roland Perry]

In article <397e3c8b-6c7d-2714-7952-051c99e0af77 at zen.co.uk>, Peter 
Fairbrother <zenadsl6186 at zen.co.uk> writes
>On 19/12/16 11:17, Roland Perry wrote:
>> In article <e7d0ee3b-6153-172a-e7a9-15f6a1491eb4 at zen.co.uk>, Peter
>> Fairbrother <zenadsl6186 at zen.co.uk> writes
>>[..]
>>> I was thinking more - Plod intercepts an IP (with a warrant) - gets
>>> ciphertext - asks a relevant operator, eg Googlemail, to decrypt.
>>>
>>> RO says "no I can't, I used forward secrecy and both the keys and
>>> plaintext are gone".
>>>
>>> HO says "you must maintain the capability" (under s. 254, with the
>>> relevant authorisation in Ss.254(1)(a) being a putative but not extant
>>> S.16(1)(a) warrant). See [2] below.
>>
>> I'm not going to check the sections quoted with a fine toothed comb, but
>> in principle the Act can attempt to place such a duty on a carrier to
>> help provide the plaintext of *future* transmissions, if all the normal
>> conditions of practicality etc are met.
>
>We furiously agree.
>
>> The fun will start when
>> jurisdictional issues arise.
>
>Jurisdictional issues? SoS's in sekkrit midnight duels? Judges passing 
>the port to the right? Enquiring minds ..

Telcos providing services from overseas.

>>>>> Of course there is a small problem for the SoS and/or Plod here - if
>>>>> an effect of the modification to the system, eg removing the deletion
>>>>> of keys, makes any of the content available to a person other than the
>>>>> sender or recipient then it would be interception, and unlawful.
>>>>
>>>> Only if you don't have a relevant warrant to hand.
>>>
>>> [2] aiui, the relevant authorisation in Ss.254(1)(a) in regard to
>>> which HO can issue a technical capability order is any relevant
>>> authorisation of the types in Ss.254(1)(a) which might reasonably come
>>> along in future.
>>>
>>> There doesn't have to be, indeed there cannot reasonably be expected
>>> to be, any specific authorisation covering everything the order might
>>> involve at the actual time the order is served.
>>>
>>> However as there is no actual authorisation in existence for
>>> everything the technical capability order might cover, if the
>>> behaviour the order requires involves interception then it would be
>>> unlawful.
>>
>> Interception requires making the material available to someone, simply
>> making one's equipment intercept-ready is not interception.
>
>Tricky. The wording includes "modifying equipment ... as to ... make 
>available"
>
>AFAICT, available means that a person could see it, or have it in his 
>possession - not that he necessarily does.

No, there's an invisibly "potentially" before "make available".

>So, as we have discussed before, placing a tap controlled by the the 
>CSP might not be interception, whereas placing a tap controlled by eg 
>GCHQ would be interception, whether it was used or not, and could not 
>lawfully be done under a maintenance order.
>
>[Placing such a tap on a cable leaving the country might be lawful 
>under a bulk access warrant, if the warrant was for "all traffic on the 
>cable" - but I don't know whether that's allowed. Placing a tap 
>controlled by the ISP would be more likely to be lawful.
>
>Even an internal ISP tap might be considered interception; though I 
>doubt many Courts would do anything serious about it, even if they 
>agreed.]

These days you don't need "taps", you just have to deploy 
intercept-ready equipment, which one would expect the main ISPs to have 
already courtesy of RIPA.

>> When a target uses the system, *and* there's a relevant warrant in
>> force, *then* handing over the product is a *legal* interception.
>
>My point is that an interception may also have already occurred, eg 
>when the system was modified, before any material was handed over.

Tapping [into a black hole] =/= interception.

>[...]
>
>>> Roland, do you have any historical view on the meaning of 262 (11)
>>> “Telecommunications service” means any service that consists in the
>>> provision of access to, and of facilities for making use of, any
>>> telecommunication system [...]?
>>
>> It's 261(11)
>>
>>> There seem to be two separate requirements, firstly the provision of
>>> access, and secondly the [provision of] facilities for making use of -
>>> but I cannot make any sense of that.
>>
>> Perhaps the bit you left out can assist us:
>>
>>  "(whether or not one provided by the person providing the service)"
>>
>> and noting that a telecommunications system is:
>>
>>  " a system ... for the purpose of facilitating the transmission of
>>    communications"
>>
>> I think it becomes clear that we are talking about connectivity (transit
>> from the user to the destination server) and an invisible "hence" after
>> the "and".
>
>I don't follow. Connectivity in the first part, "provision of access", 
>maybe, though I don't see how that becomes clear; and something else in 
>the second part, "provision of facilities for making use of, "invisible 
>hence [1] or no.
>
>[1] afaics the invisible hence doesn't make any difference: to be a 
>telecomms service operator you still have to do both parts.

I don't think this is drafting which involves a policy choice of "and" 
vs "or"[2], rather it's saying that [if not a completely walled garden] 
by providing access then the telco is inevitably providing facilities to 
make use of other people's systems. If it doesn't provide facilities to 
make use of its own systems, it's basically a nullity.

[2] A rather more technical, in the drafting sense, indication is that
     ss11 isn't split after the word "and", in the way that ss10 is
     (after both of its "or").

>> eg. A worked example: Vodafone provides a service which provides access
>>     via GSM and backhaul to the PSTN and hence to BT's network which is
>>     a system for contacting BT's phone subscribers.
>
>Doesn't help my understanding any.
>
>Trying to follow your reasoning, with a different example: BT "provide 
>access" to the PSTN, a telecommunications system, in the form of copper 
>connectivity.

Yes.

>BT also provide "facilities for making use of" that service in the form 
>of billing, routing, directories etc.

I don't think the facilities are of that nature. It's to do with 
providing telephone exchanges [aka systems] to allow me communicate with 
other BT subscribers, as well as providing access to the telephone 
exchanges of (say) Sky and Talktalk [again those are systems] to allow 
me communicate with *their* subscribers.

>But Googlemail? Now here's a rub. If you are right then perhaps 
>Googlemail do provide "facilities for making use of" the Googlemail 
>system [which afaict is a telecomms system], but they do not provide 
>access to it, ie connectivity.

Yes, they do provide connectivity, for example it might be a leased line 
from Telehouse to their server(s), otherwise they'd be isolated from the 
outside world.

>And therefore Googlemail are not relevant operators, and not subject to 
>a maintenance of capability order.
>
>Maybe? Be nice if it was so.

The practical difficulty arises if Googlemail was one server in 
California and Google raised two fingers when asked. even worse when 
it's a cloud of servers all over the world (this latter more from the 
purely practical point of view).

But of course, Googlemail will already have the capability to deliver 
copies of emails to law enforcement, all they need is the right[3] 
paperwork.

[3] In the sense that they recognise its validity.
-- 
Roland Perry