Intelligence agencies are in the business of deception and misinformation. Truth has little objective meaning or value, but rather exists as it is necessary or useful. How else to make sense of the announcement earlier this week that agencies who just a few years ago railed against strong encryption and were exposed as trying to undermine it, and thus the security of the internet as a whole, are now claiming to be the internet’s protector?
On Tuesday the director of the UK’s new National Cyber Security Centre laid out vague plans to build a Great British Firewall to protect us from the dangers of cyberattacks in the digital age: “We’re exploring a flagship project on scaling up DNS filtering,” said Ciaran Martin.
Filtering, or domain name system (DNS) blocking, is controversial – especially when done by a government, as it can interfere with the essential architecture and security of the internet. In the US, bills to mandate DNS blocking such as the Stop Online Piracy Act failed after vigorous debate. Many spam and phishing attacks spoof legitimate sites or email servers, so blocking them has huge collateral damage.
This is not to say that all filtering is bad. Google has Safe Browsing, and other companies, such as Spamhaus, detect email spammers. They identify unsafe, fraudulent websites or emails and notify customers in a public way so they can protect themselves. They are information providers, and the lists of dodgy sites and servers is open for scrutiny.
What the National Cyber Security Centre proposes is a centralised system run, or at least directed by, the government. It creates a dangerous norm that it is an acceptable function of government to monitor and control the information citizens get to see and access. Will the list of suspect sites be published? Who is going to decide what gets blocked? What criteria will be used for filtering? What kind of checks and oversight will ensure the censorship capability is not abused?
In Australia, the Communications and Media Authority used DNS filtering and was found to have understated the number of banned webpages by more than 1,000 in 2009. Among the “dangerous” sites on a leaked list were two bus companies’ webpages, online poker sites, Wikipedia entries, Google and Yahoo group pages, a dental surgery and a tour operator. In the UK, the Internet Watch Foundation has faced similar criticism for keeping secret its list of websites that internet service providers must block.
Martin describes the firewall as voluntary, so there will be no need for legislation. This is not a good thing. We need only look at the defence advisory notice to see how such “voluntary” systems work in practice. The DA notice may appear gentlemanly and informal but is in fact a way for government to widen its control beyond the law. If legislation were used it could be debated in parliament and scrutinised in courts. This type of back-channel censorship is all the more insidious for its secrecy and informality.
That the firewall will be opt-out rather than opt-in shows the government’s true motivation – control. A truly democratic system would be decentralised and transparent, and the default setting would not be for all traffic to be filtered through the government system unless the user specified otherwise. Once it is rolled out there is nothing to stop it becoming mandatory – the government may even fine companies for failing to block sites.
Can we trust the government to exercise this vast power wisely and for the public good? The best way to gauge this is to examine how it has acted in the past.
In the 1990s the US government lost a very public battle to insert backdoors into all encryption. Rather than abide by this public mandate, the National Security Agency (NSA) worked with the UK’s surveillance agency GCHQ to achieve the same goal covertly. “For the past decade, NSA has led an aggressive, multi-pronged effort to break widely used internet encryption technologies,” reads a 2010 memo from the NSA to GCHQ provided by Edward Snowden.
The investigatory powers tribunal ruled that GCHQ spied on various NGOs including Amnesty International and illegally retained and examined their online traffic. Both the NSA and GCHQ had direct access to the systems of Google, Facebook, Apple and other US internet companies in a program called Prism (though these companies have denied the backdoors). Documents show how GCHQ was tapping fibre-optic cables to intercept data flowing through the global internet in a program called Tempora. They were surveilling world leaders, exploiting and hoarding software and hardware vulnerabilities in covert hacking operations, and intercepting phone data and “nearly everything a user does on the internet”. All without a clear democratic mandate.
Martin is right that “hard data and hard, credible evidence has been scarce in cybersecurity thus far”. However, we do have evidence of what security services get up to in secret, and it shows they cannot be trusted with power.
