EU Politician Wants Internet Surveillance Built Into Every Operating System

Politics

from the they-just-haven't-thought-this-through dept

“Think of the children” has become the rallying cry of politicians around the world trying to push for ever-increasing Internet surveillance powers. Since nobody wants to run the risk of being branded as soft on crimes like paedophilia, resistance to such measures is greatly reduced as a result.

This approach was used in the “Declaration of the European Parliament of 23 June 2010 on setting up a European early warning system (EWS) for paedophiles and sex offenders” which:

The two European politicians behind the Declaration, which seeks to extend the already intrusive Data Retention Directive, were Tiziano Motti and Anna Zaborska. Motti now wants to go even further by monitoring and storing all Internet activity in the European Union.

The press release about the launch of this new initiative was entitled “Data Retention Directive: the fight against paedophiles and sexual predators on the net, respecting citizens’ right to privacy“; it explained:

As this indicates, in order to forestall the usual accusations of technical cluelessness, Motti was joined by Fabio Ghioni, described by the press release as “World Expert on security and non-conventional technologies, author of the book ‘Hacker Republic'”. Ghioni’s site carries more details about the ambitious plans, reproducing an article (in Italian) that comes from the web site of Famiglia Cristiana (Christian Family).

Strangely, there Ghioni’s project is presented not as a way to catch paedophiles, but as being about keeping personal data safe. The article talks about the fact that users willingly hand over all kinds of information to Facebook but have no control over what the company’s employees might do with it. Because of this, Famiglia Cristiana says:

It’s not exactly clear from the article how a black box that logs all your online activities and stores the data for two years will ensure those fundamental rights and freedoms, but the general drift seems to be that you will have a record of everything that you did, which you could use in court, for example, if you are wrongly accused of some misuse of the computer. What this overlooks, of course, is that it will also be a tempting target for governments who want to keep a tight rein on their citizens, or for companies that want to enforce copyright laws by monitoring alleged file sharing activities.

That sounds as if a digital hash of the connection data is encrypted with one or three separate keys – it’s not entirely clear. In theory, having three different keys, all of which were required to decrypt, could be quite secure, but it’s no proof against court orders demanding your decryption key. On the other hand, having only one shared key would be an invitation for the police to snoop through your online logs all the time. And yet the article insists:

From this it seems that one of the key features of the black box is to make pseudonymous or anonymous activity online impossible. Again, it’s hard to see any benefits whatsoever for users ? in what way is this “respecting citizens’ right to privacy”? – but plenty for governments and the copyright industry.

Even more surprising is exactly how Ghioni wants the black box idea implemented:

Cost is hardly the issue. Even if the EU were to insist that Microsoft and Apple implement this black box “feature” in their products, this is simply unworkable for GNU/Linux-based systems. By its very nature, open source lets you hack the code, and so removing any such digital black boxes ? even assuming they were put there in the first place by the likes of Red Hat and Canonical ? would be relatively easy. Hacked versions would circulate online almost immediately.

The only way to stop that happening would be to forbid people from installing “unauthorised” versions or from making “unauthorised” changes to the system code once installed ? which would effectively make open source operating systems illegal in Europe. Given that the Linux kernel was created in Finland, that would be ironic to say the least.

There are other problems that will make this approach unworkable. Already people are accessing the Internet increasingly through mobile devices and e-readers; that presumably means that these too will require black boxes to track users’ every online move. In the longer term, we are moving to an Internet of things, which means that many objects in our home will have an IP address and be hooked up to the Net: does that mean there will be a black box for our toasters, perhaps?

And then there is the fact that a 2 Terabyte portable external hard drive costs around $100, making the sharing of vast numbers of files trivial even without the Internet. Do we add black boxes to hard drives? What about USB drives?

What’s worrying is that a politician can be naive enough to believe that solving this complex problem is really as easy as adding a few lines of code to an operating system ? and that he hopes to convince the European Parliament to mandate such a thing. Far better to stop invoking the “think of the children” mantra as a way to short-circuit rational discussion and instead to encourage a rational, mature debate about how these serious problems can be solved with real-world solutions.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: data retension directive, fabio ghioni, moral panic, surveillance, tiziano motti