Internet Disaster Looms For New Zealanders

Posted 27th February 2001
by Alan Marston

The New Zealand Swain Crimes Ammendment Bill, like all moral interventions pushes different individual's personal and commercial advantage meters in partisan ways plus touches on society wide moral and ethical codes. The affects are contradictory and create personal and social dilemmas, such is life. However this particular piece of social engineering is economic suicide and ineffective at targetting evil. The interception of telephone calls and postal mail on an as-and-when necessary basis requiring separate permit each time, can be understood and accepted if monitored. The Swain Bill proposal for internet interception will inevitably be trawling, un-targetted or at the very least, perceived as such by users. This is a huge change in interception activity and one which appears to have escaped the understanding of politicians and police. The Internet is not untouchable, but it needs a finer more sophisticated touch than the sun-glassed eye of the traditional snoop.

Ineffective:

The proposed snooping won't work. Criminals, can easily evade the interceptions by using untraceable email addresses (any web-page based email, eg hotmail), encryption, words that hide their criminal intent, and re-routing systems that don't go through normal internet service providers. The UK demonstrates this. A House of Lords forum has learned that attempts by the police to gain information from ISPs was inept and potentially illegal. Tim Snape, spokesman for the ISPA (Internet Service Providers' Association) said: "It's a problem. It's always a problem. We've had a request for a subscriber's address and a list of all websites accessed based simply on a Hotmail account. You have to tell the police that that's just not how it works." Other members of the forum, the fifth annual Parliamentary ISPA forum had similar tales to tell. Rachel Basger, regulatory manager of World Online reportedly told of a request based on the postcode of someone who wasn't even a customer. Snape said the police currently lack the training and expertise to make a sensible use of the powers under the RIP Act (Regulation of Investigatory Powers). Further, he points out that the code of practice for investigations has yet to be agreed, let alone published. He said: "The code has been developed for six months and should be out fairly quickly. But it will be the end of the year before forces are trained enough to make a proper use of it. ISPs are willing to cooperate with the police but it's a bit wearing to get all these silly questions." The code is expected to require a 'spoc', a single point of contact for information requests from ISPs which will be able to weed out unrealistic requests. But the ISP's particular fury was directed at potential plans by the National Criminal Intelligence Service to require them to store all internet traffic for up to seven years. Snape said: "It's the one thing that everyone is unanimous on. It would place an intolerable commercial burden on ISPs and they would simply relocate their servers to Europe or the US. People are already abandoning - or refusing to set up in Belgium because there is a requirement to hold the data for 12 months. "Our members are quite willing to help by retaining data on a user or a system but forcing us to save everything will just force the industry offshore," he added.

There are three areas of risk to personal and business privacy:

* the interception of electronic mail;
* the seizure of or cracking into information on a user's computer
* the seizure of encryption keys (encryption scrambles information to make it unreadable except for those who have a key code.

But the most insidious and dangerous implication of the Swain Bill relates to the commercial effects of trawling the internet by secret service agencies, who may or may not even be New Zealand agencies. Currently e-commerce is perceived as an economic dynamo, not only by the USA, but by the New Zealand Government hoping to turn New Zealand into an information economy and regenerate economic prosperity. E-commerce, like all commerce, relies heavily on security of transactions and security of business intelligence. Society wide, security and privacy of information flow on the Internet is very beneficial. Secure Internet services touche on:

* The privacy of people and organisations.
* Less restraint on dissenting views being exchanged via email and the internet - democracy.
* Better e-commerce with less spying on firms and their customers.
* Not placing on internet service providers the burden of compliance costs in enabling police and intelligence agency to conduct the interception of messages.

The fact is, snooping on the Internet won't stop it being used for social or economic crimes. There are multiple ways the digital-rich can get around snooping.

1. Use of foreign mail-servers in countries which are interception free
2. Choosing a small ISP who is too small to justify cost of interception
3. Put in direct digital data circuits that don't involve any ISP
4. Use secure communications protocols and/or encryption.
5. Steganographic File System' (SFS) in which the filing system on a computer is set up in such a way that the existence of files can be hidden by a password.

The technical thinking behind the Regulation is inept. Criminals can easily circumvent the measures envisaged and the ways in which they are likely to react will actually pose much more serious problems forlaw enforcement authorities than the problems the legislation is intended to solve. At the same time the measures will damage confidence in cryptography and this will be detrimental to the privacy, safety and security interests of honest individuals and businesses and to NZ's aspirations to be an information economy. One thing is certain, the Swain Bill, if passed into law will punish businesses, the economy and the digital-poor. Hardly what the Labour Party/Alliance coalition was elected for. Any business relying on Internet stands or falls on the security of its data transmission.

Any moves to interfer with that security will cause rapid migration of custom to servers anywhere else in the world that offer secure transmission at reasonable prices. The demise of the California State Internet Tax is a transparent message to all state authorities who feel they can blunder into the Internet like they do into an illegal casino. The Swain Bill is blunder and bluster. New Zealand businesses and the economic future are on the line. The digital-poor will not be able to afford or even be aware of anti-snooping measures. It is the digital-poor who will be compromised. Yet again, the rich get away and the poor get the blame. The Labour Party and its Alliance supporters would do well to re-think and then have a strong word with Mr Swain before its too late. There's no second chances in the global village..