Internet Disaster Looms For New Zealanders
Posted 27th February 2001
by
Alan Marston
The New Zealand Swain Crimes Ammendment Bill, like all moral interventions
pushes different individual's personal and commercial advantage
meters in partisan ways plus touches on society wide moral and
ethical codes. The affects are contradictory and create personal
and social dilemmas, such is life. However this particular piece
of social engineering is economic suicide and ineffective at targetting
evil. The interception of telephone calls and postal mail on an
as-and-when necessary basis requiring separate permit each time,
can be understood and accepted if monitored. The Swain Bill proposal
for internet interception will inevitably be trawling, un-targetted
or at the very least, perceived as such by users. This is a huge
change in interception activity and one which appears to have
escaped the understanding of politicians and police. The Internet
is not untouchable, but it needs a finer more sophisticated touch
than the sun-glassed eye of the traditional snoop.
Ineffective:
The proposed snooping won't work. Criminals, can easily evade
the interceptions by using untraceable email addresses (any web-page
based email, eg hotmail), encryption, words that hide their criminal
intent, and re-routing systems that don't go through normal internet
service providers. The UK demonstrates this. A House of Lords
forum has learned that attempts by the police to gain information
from ISPs was inept and potentially illegal. Tim Snape, spokesman
for the ISPA (Internet Service Providers' Association) said: "It's
a problem. It's always a problem. We've had a request for a subscriber's
address and a list of all websites accessed based simply on a
Hotmail account. You have to tell the police that that's just
not how it works." Other members of the forum, the fifth annual
Parliamentary ISPA forum had similar tales to tell. Rachel Basger,
regulatory manager of World Online reportedly told of a request
based on the postcode of someone who wasn't even a customer. Snape
said the police currently lack the training and expertise to make
a sensible use of the powers under the RIP Act (Regulation of
Investigatory Powers). Further, he points out that the code of
practice for investigations has yet to be agreed, let alone published.
He said: "The code has been developed for six months and should
be out fairly quickly. But it will be the end of the year before
forces are trained enough to make a proper use of it. ISPs are
willing to cooperate with the police but it's a bit wearing to
get all these silly questions." The code is expected to require
a 'spoc', a single point of contact for information requests from
ISPs which will be able to weed out unrealistic requests. But
the ISP's particular fury was directed at potential plans by the
National Criminal Intelligence Service to require them to store
all internet traffic for up to seven years. Snape said: "It's
the one thing that everyone is unanimous on. It would place an
intolerable commercial burden on ISPs and they would simply relocate
their servers to Europe or the US. People are already abandoning
- or refusing to set up in Belgium because there is a requirement
to hold the data for 12 months. "Our members are quite willing
to help by retaining data on a user or a system but forcing us
to save everything will just force the industry offshore," he
added.
There are three areas of risk to personal and business privacy:
* the interception of electronic mail;
* the seizure of or cracking into information on a user's computer
* the seizure of encryption keys (encryption scrambles information
to make it unreadable except for those who have a key code.
But
the most insidious and dangerous implication of the Swain Bill
relates to the commercial effects of trawling the internet by
secret service agencies, who may or may not even be New Zealand
agencies. Currently e-commerce is perceived as an economic dynamo,
not only by the USA, but by the New Zealand Government hoping
to turn New Zealand into an information economy and regenerate
economic prosperity. E-commerce, like all commerce, relies heavily
on security of transactions and security of business intelligence.
Society wide, security and privacy of information flow on the
Internet is very beneficial. Secure Internet services touche on:
* The privacy of people and organisations.
* Less restraint on dissenting views being exchanged via email
and the internet - democracy.
* Better e-commerce with less spying on firms and their customers.
* Not placing on internet service providers the burden of compliance
costs in enabling police and intelligence agency to conduct the
interception of messages.
The fact is, snooping on the Internet won't stop it being used
for social or economic crimes. There are multiple ways the digital-rich
can get around snooping.
1. Use of foreign mail-servers in countries which are interception
free
2. Choosing a small ISP who is too small to justify cost of interception
3. Put in direct digital data circuits that don't involve any
ISP
4. Use secure communications protocols and/or encryption.
5. Steganographic File System' (SFS) in which the filing system
on a computer is set up in such a way that the existence of files
can be hidden by a password.
The technical thinking behind the Regulation is inept. Criminals
can easily circumvent the measures envisaged and the ways in which
they are likely to react will actually pose much more serious
problems forlaw enforcement authorities than the problems the
legislation is intended to solve. At the same time the measures
will damage confidence in cryptography and this will be detrimental
to the privacy, safety and security interests of honest individuals
and businesses and to NZ's aspirations to be an information economy.
One thing is certain, the Swain Bill, if passed into law will
punish businesses, the economy and the digital-poor. Hardly what
the Labour Party/Alliance coalition was elected for. Any business
relying on Internet stands or falls on the security of its data
transmission.
Any moves to interfer with that security will cause rapid migration
of custom to servers anywhere else in the world that offer secure
transmission at reasonable prices. The demise of the California
State Internet Tax is a transparent message to all state authorities
who feel they can blunder into the Internet like they do into
an illegal casino. The Swain Bill is blunder and bluster. New
Zealand businesses and the economic future are on the line. The
digital-poor will not be able to afford or even be aware of anti-snooping
measures. It is the digital-poor who will be compromised. Yet
again, the rich get away and the poor get the blame. The Labour
Party and its Alliance supporters would do well to re-think and
then have a strong word with Mr Swain before its too late. There's
no second chances in the global village..
