Privacy International slams government data sharing law

....
The organisation said, "Of the hundreds of issues engaged each year by Privacy International, a small handful stand out because of the fundamental risk they pose to the foundations of privacy protection.

"The UK government's proposal to legislate, in its 'Coroners and Justice Bill', for wide-scale sharing of personal data is one such instance, and internationally is the first occasion in recent months that we have seen an example of risk at such a fundamental level."

It said, "The mass exchange of personal information has the potential to deliver some benefit however, it also presents vast risks associated with governance, privacy, security and human autonomy. In the rush to institute data sharing, these aspects have largely been ignored."

Privacy International has published a report on the threats it says the bill poses to privacy.

According to Privacy International, the problems with this law are:

-It is based on an illegitimate consultation process over a ten-year period, created to justify whatever the government drafted into law. Even the Information Commissioner's Office has been compromised.
-It avoids parliamentary scrutiny by pushing orders through secondary legislation.
-It consists of meaningless protections and oversight, where the ICO may provide comments to parliament in a process where parliament is not permitted to amend the order.

Zhou_Enlai wrote:

ibis wrote:

I hate to say it, but reasons for acceding to the Charter of Fundamental Rights no.101 - Articles 7 and 8. Currently we have no firm basis for challenging this at a European level.

Also, we would be able to see what went on in the Council meetings on these issues: "The European Union's Council of Ministers has decided to adopt a plan that would allow member states to expand the potential scope of remote warrantless surveillance of PCs; it would also allow other member nations to request such surveillance from UK police."

There are some interesting posts on the Libertas - Pan European thread here today on how the US oppose Lisbon as it would override homeland security agreements with individual EU states in favour of a more considered/consistent EU agreement.

cactus flower wrote:

Zhou_Enlai wrote:

I'd say that facebook gets the info from cookies facebook has previously stored on your computer. No need for p.ie to have any personal info for facebook to automatically direct you to your page.

I heard google are going to launch a service where you can see people's locations based on their mobile phone but that it won't be available in Ireland. Surely that is made up?? I wouldn't like to pollute the Surveillance Society thread with Orwellian hoaxes.

I heard that too an it is believable.

That's been a possibility for about...mm...a decade? The hardware & software necessary to turn the base-station registrations of your phone into a lat/long are Ericssons. Last time I asked, Vodafone had such equipment, but nobody could be arsed using it. I presume that's still the case, and that's why the service isn't available in Ireland.

It's permission-based, though - you have to opt in. That's not to say that they don't know where you are - they know where your phone is at any time if they choose to find out.

GPS phones, of course, make it even easier.

Why do you think Hamas use land lines ?

How is it done - cookies or IPs ?

ibis wrote:

Last time I asked, Vodafone had such equipment, but nobody could be arsed using it. I presume that's still the case

You presume incorrectly, Irish Garda, emergency and security services have been using this technology for mm... about a decade. Detectives requisition user co-ordinates & info all the time. It’s run o’ the mill stuff.

snapple drinker wrote:

ibis wrote:

Last time I asked, Vodafone had such equipment, but nobody could be arsed using it. I presume that's still the case

You presume incorrectly, Irish Garda, emergency and security services have been using this technology for mm... about a decade. Detectives requisition user co-ordinates & info all the time. It’s run o’ the mill stuff.

Fair enough - engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done. I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware. It certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

Will come back to this over the weekend, but just to register a really major House of Lords report on "The Surveillance Society".

http://www.guardian.co.uk/uk/2009/feb/06/surveillance-freedom-peers

The Constitution Cttee of the House of Lords - which includes one former Lord Chief Justice and two former Attorneys General - have conducted a major report into this issue and concluded that we do indeed have reasons to be concerned.

Says one - "The huge rise in surveillance and data collection by the state and other organisations risks undermining the longstanding traditions of privacy and individual freedom which are vital for democracy".

The report highlights how technological advances can sometimes - in this case, actually have - totally realigned the position of the citizen vis-a-vis the state. It is almost a process of osmosis, if you like, a drip-drip processwhich is not fully appreciated until it is too late.

Will post more on this. This is a really significant report.

Sex offenders are the worst of a bad lot possibly, but tagging them electronically here in a pilot project .... ??

Sex offenders face electronic tagging in pilot project - Irish Times

ibis wrote:

snapple drinker wrote:

ibis wrote:

Last time I asked, Vodafone had such equipment, but nobody could be arsed using it. I presume that's still the case

You presume incorrectly, Irish Garda, emergency and security services have been using this technology for mm... about a decade. Detectives requisition user co-ordinates & info all the time. It’s run o’ the mill stuff.

Fair enough - engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done. I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware. It certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

I don’t want to cause a fuss ibis, but your statement is almost entirely untrue.

ibis wrote:

engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done.

I lived with a … network engineer for three years (2003-2006), during that time he described routine requests to locate mobile signals (using base station coordinates) for the Garda etc. On one occasion he located, tracked and helped to apprehend an armed robber who had stolen a car somewhere in Dublin. He described such occurrences regularly so perhaps your engineers didn’t know what they were talking about.

ibis wrote:

I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware.

Incorrect, allow me to broaden your awareness.

Emergency operators MUST record and sign-off on details of all 999 calls they receive (mobile or not), we’ve been doing this for at least a decade now. We are also required to resolve problematic calls (where a customer is unable to describe the emergency or location) by ‘locking’ the call and forwarding such caller’s details to our team-lead. The team-lead then calls the Garda who in turn call the service provider, who in turn translate caller data into address, name, location etc. This is standard procedure on an ongoing basis for high-priority emergency calls and has been since I started as an operator in 2001.

ibis wrote:

{base station data} certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

Well that may be, but the service provider’s data WAS available, it just wasn’t available to you.

There are times when it is better to admit ignorance than to dress opinion up as fact

snapple drinker wrote:

ibis wrote:

snapple drinker wrote:

ibis wrote:

Last time I asked, Vodafone had such equipment, but nobody could be arsed using it. I presume that's still the case

You presume incorrectly, Irish Garda, emergency and security services have been using this technology for mm... about a decade. Detectives requisition user co-ordinates & info all the time. It’s run o’ the mill stuff.

Fair enough - engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done. I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware. It certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

I don’t want to cause a fuss ibis, but your statement is almost entirely untrue.

ibis wrote:

engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done.

I lived with a … network engineer for three years (2003-2006), during that time he described routine requests to locate mobile signals (using base station coordinates) for the Garda etc. On one occasion he located, tracked and helped to apprehend an armed robber who had stolen a car somewhere in Dublin. He described such occurrences regularly so perhaps your engineers didn’t know what they were talking about.

Perhaps not! Such things do happen. However, since the point I was making was that the data wasn't available to a commercial enterprise, I'm not sure what relevance the ability of internal personnel to use such data has. Perhaps I should have used the term 'automatically' or 'continuously' instead of 'routinely' - to clarify, I mean that the base station location information was not automatically translated to lat/long for every phone. Even the way you describe it there - "he located, tracked...for the Gardai". If such information were available automatically, and outside the network, there would be no need to take up an engineer's time doing the locating and tracking. [EDIT]Actually, I see I did clarify that at the time.[/EDIT]

Do you see what I'm saying? You can't run a location-based mobile service of the kind Google is offering outside Ireland when tracking a single phone requires an engineer.

snapple drinker wrote:

ibis wrote:

I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware.

Incorrect, allow me to broaden your awareness.

Emergency operators MUST record and sign-off on details of all 999 calls they receive (mobile or not), we’ve been doing this for at least a decade now. We are also required to resolve problematic calls (where a customer is unable to describe the emergency or location) by ‘locking’ the call and forwarding such caller’s details to our team-lead. The team-lead then calls the Garda who in turn call the service provider, who in turn translate caller data into address, name, location etc. This is standard procedure on an ongoing basis for high-priority emergency calls and has been since I started as an operator in 2001.

ibis wrote:

{base station data} certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

Well that may be, but the service provider’s data WAS available, it just wasn’t available to you.

There are times when it is better to admit ignorance than to dress opinion up as fact

I don't claim to know the ins and outs of what data is available to you inside the network. I know what I was told in respect of getting and using the data externally for a commercial location-based service at the time I was attempting to get that to happen. That may not be correct, and I welcome any information you're prepared to share - although I would have welcomed it a good deal more five years ago.

There's a huge practical difference between a situation where engineers or operators inside the network can routinely retrieve location data, and a situation where such data is automatically available all the time rather than on request, and easily and automatically transferable outside the network. The former seems to be the situation you are describing, and there seems to be an element of crossed wires here, since that doesn't change the situation I am describing. All the Irish location-based mobile services I am aware of are GPS based - as far as I know, that's because the mobile operators are either unwilling or unable to offer base-station to lat/long translation on an automated basis outside their own networks.

If that's not the case, do tell!

cactus flower wrote:

Why do you think Hamas use land lines ?

Because a few years ago, Mossad managed to infiltrate a particular group and get a mobile phone with a genuinely explosive battery to a Palestinian bombmaker. The story went that the head of Mossad rang the mobile and on confirming that the person answering was the target, told him to listen very carefully. He then pressed a button and blew the target's head off. Or at least that was the story. The other reason is that a mobile phone can be used as a targeting device. (The Russians used a satellite phone to eliminated on Chechen leader with a missile strike.)

Regards...jmcc

ibis wrote:

Fair enough - engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done. I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware. It certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

The problem back then was that the size of the cells varied and most of the non-targeted tracking was done by monitoring the target as it moved from cell to cell. Most of the telcos at the time did not want to provide a list of their base stations and their coverage as they considered it very commercially sensitive information.

Quote :

Do you see what I'm saying? You can't run a location-based mobile service of the kind Google is offering outside Ireland when tracking a single phone requires an engineer.

I was working on designing a location based system 2003. However it did not have the granularity of Google's system. The limiting factor was the size of the cells.

Regards...jmcc

jmcc wrote:

ibis wrote:

Fair enough - engineers I spoke to at the time (2003/2004) said that the translation of cellphone location to lat/long wasn't being routinely done. I'm aware the information was used in court cases, but it wasn't being automatically translated on an ongoing basis, and still isn't, as far as I'm aware. It certainly wasn't available outside the companies concerned - I say so, because I was involved in discussions for a location-based mobile service that had to be shelved because that data wasn't available.

The problem back then was that the size of the cells varied and most of the non-targeted tracking was done by monitoring the target as it moved from cell to cell. Most of the telcos at the time did not want to provide a list of their base stations and their coverage as they considered it very commercially sensitive information.

Quote :

Do you see what I'm saying? You can't run a location-based mobile service of the kind Google is offering outside Ireland when tracking a single phone requires an engineer.

I was working on designing a location based system 2003. However it did not have the granularity of Google's system. The limiting factor was the size of the cells.

Regards...jmcc

Any idea what the situation is now in Ireland? I still don't see a location-based mobile industry of any kind here - do we still have the same limitations?

ibis wrote:

Any idea what the situation is now in Ireland? I still don't see a location-based mobile industry of any kind here - do we still have the same limitations?

Not sure. I haven't done any work on mobile technology since 2004 as the domain stats and tracking work took over. The number of cells would have increased and their general size would probably have decreased. I don't know if the cities are using microcells yet. It would be possible to build up a city map quite easily without the cooperation of the telcos.

Regards...jmcc

jmcc wrote:

ibis wrote:

Any idea what the situation is now in Ireland? I still don't see a location-based mobile industry of any kind here - do we still have the same limitations?

Not sure. I haven't done any work on mobile technology since 2004 as the domain stats and tracking work took over. The number of cells would have increased and their general size would probably have decreased. I don't know if the cities are using microcells yet. It would be possible to build up a city map quite easily without the cooperation of the telcos.

Regards...jmcc

I notice your assumption, though, is that you'd need to do it without the cooperation of the telcos....

ibis wrote:

I notice your assumption, though, is that you'd need to do it without the cooperation of the telcos....

If the telcos would not cooperate then it could be done by other means. Naturally it would be easier if the telcos cooperate.

Regards...jmcc

Frightened Albanian wrote:

Thank you jmcc , that was efficient of you.

It is amazing what you find on the web these days.

Quote :

Info derived from IP address details, real identities of users and contents of PMs are all used there inappropriately. There is no privacy statement from what I can tell.

The info from IP addresses is generally of little value. Most of the Irish internet uses dynamically assigned IPs that change periodically or when the user connects to the ISP. The most you would get from them is the address and contact details for their ISP. With businesses and organisations, you may get the name of the business and a contact or two. Some of the early DSL accounts had their own permanently assigned IPs and these would have had the address and contact details of their owners.

Regards...jmcc

True jmcc but if say you knew that a guy lived in Leixlip and you suspected that the style of a poster bore the guy who you knew lived in leixlip's hallmark you have an extra piece of info to confirm suspicions as it will show the locality of the ip etc
re

Quote :

" Most of the Irish internet uses dynamically
assigned IPs that change periodically or when the user connects to the
ISP. The most you would get from them is the address and contact
details for their ISP"

Not necessarily the case.

jmcc wrote:

Frightened Albanian wrote:

Thank you jmcc , that was efficient of you.

It is amazing what you find on the web these days.

Quote :

Info derived from IP address details, real identities of users and contents of PMs are all used there inappropriately. There is no privacy statement from what I can tell.

The info from IP addresses is generally of little value. Most of the Irish internet uses dynamically assigned IPs that change periodically or when the user connects to the ISP. The most you would get from them is the address and contact details for their ISP. With businesses and organisations, you may get the name of the business and a contact or two. Some of the early DSL accounts had their own permanently assigned IPs and these would have had the address and contact details of their owners.

Regards...jmcc

Actually, FA has a fair point there - you can usually get the local node for their ISP. You can also backtrack to civil service departments and universities.

ibis wrote:

jmcc wrote:

Frightened Albanian wrote:

Thank you jmcc , that was efficient of you.

It is amazing what you find on the web these days.

Quote :

Info derived from IP address details, real identities of users and contents of PMs are all used there inappropriately. There is no privacy statement from what I can tell.

The info from IP addresses is generally of little value. Most of the Irish internet uses dynamically assigned IPs that change periodically or when the user connects to the ISP. The most you would get from them is the address and contact details for their ISP. With businesses and organisations, you may get the name of the business and a contact or two. Some of the early DSL accounts had their own permanently assigned IPs and these would have had the address and contact details of their owners.

Regards...jmcc

Actually, FA has a fair point there - you can usually get the local node for their ISP. You can also backtrack to civil service departments and universities.

Plus news outlets and many private companies ids are registered so they come up. EU, EU Parliament, US Gov etc all come up

Frightened Albanian wrote:

True jmcc but if say you knew that a guy lived in Leixlip and you suspected that the style of a poster bore the guy who you knew lived in leixlip's hallmark you have an extra piece of info to confirm suspicions as it will show the locality of the ip etc

It is rarely that simple.

Quote :

Not necessarily the case.

Actually it is. Most of the Irish internet still uses dynamically assigned IPs.

Regards...jmcc

[quote="jmcc"]

Frightened Albanian wrote:

True jmcc but if say you knew that a guy lived in Leixlip and you suspected that the style of a poster bore the guy who you knew lived in leixlip's hallmark you have an extra piece of info to confirm suspicions as it will show the locality of the ip etc

It is rarely that simple.

Quote :

Quote :

Not necessarily the case.

Actually it is. Most of the Irish internet still uses dynamically assigned IPs.

Regards...jmcc

tell us more

ibis wrote:

Actually, FA has a fair point there - you can usually get the local node for their ISP.

However the local node may not be quite as local as people think because of the rather interesting method of how Irish ISPs operate.

Quote :

You can also backtrack to civil service departments and universities.

A lot of universities tend to web proxy their students. (Private IP ranges internally with only a few external real IPs seems to be the standard.) Lecturers and admins can sometimes have their own IPs but this is rare. The CS tends to be more opaque and some departments use web proxies.

Regards...jmcc

Frightened Albanian wrote:

tell us more

By Irish internet, I am referring to Irish internet users. Most of them would be using a combination of dialup (typically a new IP from a limited pool of IPs on every connection) or retail broadband (dynamic IP assigned for a limited period, again from a pool of IPs). Some of the more expensive DSL packages can assign a fixed IP and most business DSL packages tend to allocate a few fixed IPs.

At the moment, I'm actually updating the global IP ranges databases here so I actually have a snapshot of all Irish IPs in additon to those of other countries. Some other databases here track all active domains in com/net/org/etc and their movements.

Regards...jmcc