Feed Aggregator Page 5

Rendered on Thu, 15 Dec 2016 22:00:12 GMT  newer latest older 

My Priorities for the Next Four Years

via Schneier on Security by Bruce Schneier on Thu, 15 Dec 2016 09:50:58 GMT

Like many, I was surprised and shocked by the election of Donald Trump as president. I believe his ideas, temperament, and inexperience represent a grave threat to our country and world. Suddenly, all the things I had planned to work on seemed trivial in comparison. Although Internet security and privacy are not the most important policy areas at risk, I...

Let's Encrypt Is Making Web Encryption Easier

via Schneier on Security by Bruce Schneier on Wed, 14 Dec 2016 12:46:26 GMT

That's the conclusion of a research paper: Once [costs and complexity] are eliminated, it enables big hosting providers to issue and deploy certificates for their customers in bulk, thus quickly and automatically enable encryption across a large number of domains. For example, we have shown that currently, 47% of LE certified domains are hosted at three large hosting companies (Automattic/wordpress.com,...

Hiding Information in Silver and Carbon Ink

via Schneier on Security by Bruce Schneier on Tue, 13 Dec 2016 12:21:11 GMT

Interesting: "We used silver and carbon ink to print an image consisting of small rods that are about a millimeter long and a couple of hundred microns wide," said Ajay Nahata from the University of Utah, leader of the research team. "We found that changing the fraction of silver and carbon in each rod changes the conductivity in each rod...

Ransomware Meets Multi-level Marketing

via Schneier on Security by Bruce Schneier on Mon, 12 Dec 2016 12:51:52 GMT

A new ransomware, Popcorn Time, gives users the option of infecting others in lieu of paying the ransom. Related: a good general article on ransomware....

Cybersecurity Fantasy Role-Playing Game

via Schneier on Security by Bruce Schneier on Sat, 10 Dec 2016 15:00:29 GMT

It's called Cryptomancer. Think computer hacking plus magic. I know nothing about it, but it feels reminiscent of Shadowrun. Reddit thread. RPG.net thread....

Friday Squid Blogging: Electronic Screens Inspired by Squid

via Schneier on Security by Bruce Schneier on Fri, 09 Dec 2016 22:11:11 GMT

Squid-inspired electronic screens. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....

Enigma Machine Sold for Almost Half a Million Dollars

via Schneier on Security by Bruce Schneier on Fri, 09 Dec 2016 17:55:24 GMT

A fully functional four-rotor Enigma machine sold for $463,500. Wow....

New NSA Stories

via Schneier on Security by Bruce Schneier on Thu, 08 Dec 2016 17:04:46 GMT

Le Monde and the Intercept are reporting about NSA spying in Africa, and NSA spying on in-flight mobile phone calls -- both from the Snowden documents....

WWW Malware Hides in Images

via Schneier on Security by Bruce Schneier on Wed, 07 Dec 2016 14:06:45 GMT

There's new malware toolkit that uses stegaography to hide in images: For the past two months, a new exploit kit has been serving malicious code hidden in the pixels of banner ads via a malvertising campaign that has been active on several high profile websites. Discovered by security researchers from ESET, this new exploit kit is named Stegano, from the...

Building Syria’s surveillance state: new Privacy International investigation launched today

via News by editor on Tue, 06 Dec 2016 12:10:25 GMT

Date: 
Monday, December 12, 2016

The Arab Spring of 2011 transformed the political landscape of the Middle East and Gulf. The scale of the popular uprisings seemingly caught off guard the governments of Syria, Egypt, and Libya among others, leading to brutal crackdowns, civil wars and instability that continue to this day.

Yet in the years leading up to the sweeping civilian revolt across the region, these governments spent millions of dollars developing sophisticated surveillance systems that they deployed against their citizens.

Today, Privacy International launches a new investigative report, Open Season: Building Syria’s Surveillance State, based on hundreds of original documents and pieces of correspondence related to the surveillance trade in this region leading up to and during the Arab Spring. Among these documents is evidence of the Syrian government’s ambitious plans and projects to monitor the national communications infrastructure, the technical details of which are revealed for the first time.

From 2007-2012, the Syrian government built nationwide communications monitoring systems through at least four ambitious projects, the technical specifications of which are revealed in this report. Western businesses, including RCS SpA (Italy) and VASTech (South Africa), were important contributors to Syria’s repressive surveillance state and other companies, including Amesys (France), competed for the opportunities on offer.

This report also examines the vital role of middleman companies in the surveillance trade. These companies act primarily as resellers, brokers, logistics coordinators, and intermediaries between the surveillance technology manufacturers and their clients. They court and secure clients on the ground, smooth over logistical difficulties, and provide other services for a percentage of the total profit. This report closely examines one such company, Dubai-based Advanced German Technology (AGT), in supporting the construction of surveillance systems in Syria and further afield in the decade leading up to the Arab Spring revolts of 2011 and 2012.

In one transaction from 2008 and 2009, RCS and AGT proposed the use of US-origin equipment in a project to intercept the communications networks on of a satellite internet service provider, Aramsat, according to documents analysed by Privacy International. US sanctions and export control regulations in force at the time of this project restricted the exportation or re-exportation of certain US-origin goods to the country including communications interception equipment of the type provided by the AGT and RCS partnership. All responses received by PI by the time of publication are included in the annex of the report.

The Syrian government of president Bashar Al-Assad was intensifying its repression against dissidents and opposition groups at the same time as it was consolidating its surveillance capacities. Surveillance by both human and technological means was an important contributor to the repression that culminated in the 2011 crisis and ensuing civil war. To date, Al-Assad’s government reportedly continues to maintain control over access to the internet and broadband, and some of the surveillance architecture from these projects remains in place. The roles of several Western companies including AREA SpA (Italy) and Qosmos (France), who have been identified as selling surveillance technology to Syria have been the subject of inquiries in the US and France, respectively.

Neighbouring governments engaged in repression of domestic political dissent also purchased similar technologies. AGT facilitated a particularly lucrative contract for the Libyan government of Colonel Muammar Gaddafi on behalf of South African surveillance company VASTech through a complex web of consultants and companies. Funds from this single-most profitable project financed much of AGT’s affairs. Over a period of years, AGT paid the personal expenses of the managing director’s family (many of whom were hired as consultants for the firm) and his business associates. The company was nevertheless deeply in debt to various investors and unpaid suppliers, and losing staff over its poor employment practices.

The lead up to the Arab Spring was open season for surveillance companies – they provided technologies to eager government clients widely known to be publicly engaged in repression. They should share some responsibility for how their technologies are used.

Privacy International calls on export authorities to make all exports of the surveillance technologies discussed in this report conditional on rigorous, independent human rights impact assessments, so as to minimize the potential that these technologies will be abused. 

Some thoughts moving forward..

via News by editor on Mon, 05 Dec 2016 16:04:22 GMT

Date: 
9 November 2016
Authors: 

The elections in our midst here, there, and everywhere are increasingly resulting in governments who introduce policies that result in leaps backwards for dignity, equality, civil liberties, and the rule of law. Whether it is Poland or the Philippines, governments are overriding essential safeguards.

This week Britain’s proposed surveillance legislation took another step toward normalising mass surveillance. The United States of America has long promoted mass surveillance and maintains its authority to spy on the whole world.

The US now faces a time of uncertainty with a new President. How will he use those powers? If he abuses them, will governments everywhere follow his lead?

The international community of rights organisations has its work cut out for it. Just as we demand our constitutions can withstand populist politics, we must ensure that our governments are building laws, safeguards, and protections into systems that are able to weather changing political agendas.

Privacy International remains committed to fighting for the right to privacy everywhere. Now, and into the future.

Privacy International calls on UK government to reveal secret intelligence sharing arrangements with the United States

via News by editor on Mon, 05 Dec 2016 15:54:05 GMT

10 November 2016

Privacy International has today written to government ministers, members of the opposition, and oversight bodies reaffirming its call for the UK government to reveal secret intelligence sharing arrangements with the United States.

The original UKUSA agreement — drafted shortly after World War II — allows UK and US agencies to share, by default, any raw intelligence, collection equipment, decryption techniques, and translated documents.

Current arrangements also allow US intelligence agencies to collect intelligence and operate from within the UK, reportedly including in support of special operations involving lethal force.

Disclosures from former NSA contractor Edward Snowden in 2013 drew the world’s attention to the staggering scale of surveillance permitted by the global internet infrastructure, allowing intelligence agencies to intercept the communications of hundreds of millions of people on a daily basis.

Except for the decades old UKUSA agreement, no information about the rules governing the extent of this sharing were publicly available prior to a 2013 challenge brought Privacy International and nine other human rights organisations at the Investigatory Powers Tribunal (IPT), a government body which hears complaints about surveillance activities in the UK empowered to accept evidence from government in secret.

Aside from a few paragraphs summarising its approach to obtaining information from the US released during the lawsuit, the UK government has consistently refused to reveal to the public details about intelligence sharing practices and policies. It has also argued that such intelligence sharing should not be subject to the same safeguards as its own interception powers.

The IPT rejected the majority of Privacy International’s claims in judgments in December 2014 and February 2015, although it found the complete lack of publicly available rules on intelligence sharing prior to the lawsuit to be problematic. Privacy International and the nine other human rights organisations have appealed the IPT’s judgments to the European Court of Human Rights.

In its letter, Privacy International has called for the UK government to release key documents outlining the UK’s intelligence sharing arrangements. The government has already presented many of those documents to the IPT in a closed hearing, but has so far refused to make them publicly available.

Privacy International has also forwarded reports detailing the extent of what is publicly known about intelligence sharing with the U.S. Government, and concerns about the existing lack of details, adequate safeguards, and oversight mechanisms.

The letter has been sent to the UK Secretary of State for Defence, Home Secretary, and Secretary of State for Foreign and Commonwealth Affairs, their parliamentary opposition, as well as the Intelligence and Security Committee of Parliament and the Interception of Communications Commissioner’s Office.

International Phone Fraud Tactics

via Schneier on Security by Bruce Schneier on Tue, 06 Dec 2016 12:15:03 GMT

This article outlines two different types of international phone fraud. The first can happen when you call an expensive country like Cuba: My phone call never actually made it to Cuba. The fraudsters make money because the last carrier simply pretends that it connected to Cuba when it actually connected me to the audiobook recording. So it charges Cuban rates...

Voynich Manuscript Facsimile Published

via Schneier on Security by Bruce Schneier on Mon, 05 Dec 2016 20:20:41 GMT

Yale University Press has published a facsimile of the Voynich Manuscript. The manuscript is also available online....

Guessing Credit Card Security Details

via Schneier on Security by Bruce Schneier on Mon, 05 Dec 2016 12:25:02 GMT

Researchers have found that they can guess various credit-card-number security details by spreading their guesses around multiple websites so as not to trigger any alarms. From a news article: Mohammed Ali, a PhD student at the university's School of Computing Science, said: "This sort of attack exploits two weaknesses that on their own are not too severe but when used...

A 50-Foot Squid Has Not been Found in New Zealand

via Schneier on Security by Bruce Schneier on Sat, 03 Dec 2016 00:18:03 GMT

A 50-foot squid has not been found in New Zealand. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....

Auditing Elections for Signs of Hacking

via Schneier on Security by Bruce Schneier on Fri, 02 Dec 2016 12:39:17 GMT

Excellent essay pointing out that election security is a national security issue, and that we need to perform random ballot audits on every future election: The good news is that we know how to solve this problem. We need to audit computers by manually examining randomly selected paper ballots and comparing the results to machine results. Audits require a voter-verified...

Analyzing WeChat

via Schneier on Security by Bruce Schneier on Thu, 01 Dec 2016 15:29:13 GMT

Citizen Lab has analyzed how censorship works in the Chinese chat app WeChat: Key Findings: Keyword filtering on WeChat is only enabled for users with accounts registered to mainland China phone numbers, and persists even if these users later link the account to an International number. Keyword censorship is no longer transparent. In the past, users received notification when their...

Surveillance as a Feminist Issue

via News by editor on Thu, 01 Dec 2016 11:26:22 GMT

Date: 
Thursday, December 1, 2016

Digital Rights Foundation is a Pakistan-based NGO working on issues of privacy, surveillance and online harassment. We are monitoring the surveillance by service providers in Pakistan and have issued a White Paper on Surveillance in Pakistan (See here: http://jasoosibandkaro.pk/whitepaper/). The Hamara Internet Project is aimed at educating young women about digital security and online harassment. DRF is due to launch its Cyber Harassment Hotline soon to provide assistance to victims of online harassment.

Surveillance in digital spaces is the policing and monitoring of activity of those occupying these spaces. Surveillance affects free speech, privacy and behaviour of digital users. Feminism and a feminist approach to surveillance puts marginalised communities, those that are victims of class discrimination, racial and patriarchal structures, at the centre of discourse around privacy and surveillance.

Surveillance in Pakistan is often seen as an issue of national security. With the National Action Plan (NAP) [1] forming the primary framework for discourse around surveillance and human rights, it comes as no surprise that those defending or opposing surveillance by the state are often focused on the imperatives of the security state and counter-terrorism. Implicit in this discourse is the conceptualisation of surveillance as uniform and the ‘surveiled’ subject as exclusively male. Thus, while the current critiques of surveillance and the augmented powers of the state in the present discourse have been extremely important, they would benefit from taking a feminist approach to surveillance and state control. A feminist approach to surveillance will expand the very definition of surveillance to include both state and private surveillance by showing the disparate impact of surveillance and the connection between the technologies of state surveillance and harassment of women.

The spectre of 1984-esque critiques simply do not account for the disproportionate impact of surveillance on the oppressed groups in society and the complex intersectionalities that inform that oppression. The feminist project, built on many feminist concepts such as the male gaze and self-regulation of gendered stereotypes has been applied to the surveillance and control by technology (see: “Feminist Surveillance Studies”, edited by Rachel  E. Dubrofsky, Shoshana  Amielle Magnet), mounts a damning critique of our increasingly “watched” world by emphasising the differentiated impact of surveillance technologies based on racism, genders, sexualities, LBGT-identities, consequently deepening our understanding of surveillance. [2]

Online harassment and surveillance directed largely at marginalised groups, such as religious minorities, women and young people, is slowly being recognised in the mainstream as a problem that needs legislative intervention. For instance, the newly passed Prevention of Electronic Crimes Act (PECA) 2016 contains sections on hate speech (section 11) and sexual cyber harassment (section 21 and section 24). However, the gendered use of technology and surveillance is not a new phenomenon as there is a clear line of continuity in the forms of oppression, control and surveillance from the past and in offline spaces. Existing forms of violence are replicated online in many of the same ways as they are present offline; the same patriarchal norms, exclusions and violence form a link into the digital age. In Pakistan this continuity is all the more glaring in light of evidence that the presence of women online, or transgressions from societal norms in the cyber realm, has direct and immediate repercussions offline and has resulted in instances of honour killings, violence, social ostracism and application of discriminatory laws to regulate speech of marginalised communities.

Furthermore, while the NAP and terror framework might seem contemporary in its language and posturing, there is another trend of continuity inherited from the British Raj. The regulatory and surveillance mechanisms in place to control the colonial subject in the form of documentation, classification and criminalization of certain races and tribes was constitutive of the colonial surveillance state. [3] The impact of surveillance was also differentiated, as the colonial apparatus targeted and controlled certain communities [4], while patronising others. The colonial state applied different legal regimes to some groups, while applying a wholly different set of laws and logics of control to others. This history of surveillance is an important one when contextualising privacy and state surveillance in the Pakistani context as the state machinery has a legacy of differentiated and discriminatory control and oppression.

The Male Gaze

DRF’s “Hamara Internet” (“our internet”) project reaches out to young women in colleges across Pakistan. These women open up about the fear of constantly being monitored online by their partners or family members, or fear of having their online presence and activities being ‘outed’. Two layers of surveillance experienced by young women thus emerge: one stems from the realisation that the information they put on the internet can be used against them and will have repercussions according to gender norms; and the other layer comes in the form of state surveillance of their online activities. It is important to recognise that women’s experiences of technologies and surveillance is vastly different than the dominant, cis, male experience. This experience however does not simply add on to the examples of the effects that surveillance has, it fundamentally changes the concept of surveillance: not only is state surveillance a non-uniform experience, it should also be expanded to give equal importance to surveillance of women as given to traditional forms of political surveillance.

Many women experience, and are conscious of, the ‘male gaze’ when they enter physical spaces that are traditionally male-dominated, such as public streets. Feminist perspectives on surveillance connect being “leered” to that of being “watched” by surveillance state. [5] This perspective posits that the feeling of being watched, an experience shared by many in online spaces, is an essentially female experience. The male gaze, lurking on the female body, is not dissimilar to online users feeling like they have to modify their behaviour under the gaze of surveillance. [6] There is a strong nexus between the surveillance technologies used by the state and those used to ‘monitor’ women online. Online harassment is not a separate concern from surveillance, the two are deeply interconnected in both their logic and the techniques they employ.

Since the passage of the PECA in August 2016, there has been some concern about the state policing online spaces. The combined glare of the male gaze and state surveillance is feared to result in disproportionate chilling effect leading to self-censorship by members of less dominant groups in both cyber and offline spaces and force them to police their behaviours according to expected ‘normal’ online behaviour. Problematic provisions in PECA allow for expansive and arbitrary surveillance, including through data retention (section 32 of PECA makes it necessary for the data retention of traffic data for a minimum period of one year by service providers) and increased powers of the Pakistan Telecommunications Authority (PTA) to remove content. The gaze of the state, using its power to remove material it deems objectionable, has similar effects on online spaces as the male gaze offline. [7] Arbitrary and expansive interpretations of what constitutes obscene and objectionable content will disproportionately capture those groups that deviate from gender norms e.g. LGBT groups. Political censorship and removal of content on the basis of vague criteria like “glory of Islam” and “integrity, security or defence of Pakistan” will silence voices of religious minorities and disenfranchised ethnic populations who do not conform to the narrative of the nation-state and NAP.

Applications for Women: Friend or Foe?

“Placing marginalized, stigmatized and often criminalized women at the centre of feminist surveillance studies reveals that technologies aimed at the protection from individual abusers, and the arrest of perpetrators, does not work for all cases of violent practices”. [Source: Mason, C. and Shoshana Magnet. 2012. Surveillance Studies and Violence Against Women. Surveillance & Society 10(2): 105-118. http://www.surveillance-and-society.org | ISSN: 1477-7487. P. 115.]

It is the experience of women in many countries, including Pakistan, that the same technologies associated with generalised surveillance are employed to harass or silence them. Tracking devices used to locate individuals have been used by families and abusive partners to monitor women and perpetuate violence against them. Apart from seemingly benign technologies used to control women, the history of some technologies themselves are often problematic to begin with. As Mason and Magnot point out, “SpyWare and other types of computer monitoring programs were developed for the purposes of consumer surveillance, their extension to other types of stalking are unsurprising.” [8] With the passage of the Punjab Protection of Women Against Violence Act 2015, DRF has found in its analysis that the provision requiring perpetrators to wear ‘ankle or wrist bracelet GPS trackers’ runs into issues of privacy as it uses broad language to grant surveillance powers to the government without any corresponding measures to ensure that it achieves its objective of stopping violence.

This begs the question, is the solution to surveillance and the subsequent insecurity even more surveillance? There is an entire industry of applications and services that promises to keep us safe and protect our data, with a niche of applications emerging that cater particularly to women. These apps often involve women having to provide extensive amounts of personal information, such as real-time location and contacts of friends and family, and forego some of their privacy for increased protection. That protection is ceded to tech-based systems that have the potential to replicate the same oppressions that gave rise to the need for applications in the first place. Many of the concessions women get from these services are dependent on a ‘benefactor’ company to use their information for ‘good’. Furthermore, in the absence of data protection laws in Pakistan, even privacy policies ring hollow and are voluntary gestures on part of tech companies and application developers. In recent months, Pakistan has seen the launch of Uber and Careem, mobile application-based taxi services, which were initially welcomed by women as ‘safe’ options given the option to track their rides and have drivers connected to a company that could hold them accountable. However, there have been instances of personal data of customers, phone numbers and names, remaining with the drivers after the ride is over. Furthermore, despite assurances by these companies that their drivers receive anti-harassment training, several cases are emerging where the phone numbers shared in the apps are used to harass women. 

There are no clear-cut answers here, but this contradiction of application aimed at and claiming to ‘protect women’ need to be further reassessed as women try to create themselves safer spaces online and offline.

Conclusion

A gendered critique of surveillance is important as advocacy groups and human rights activists are beginning to oppose the PECA and monitor its abuses. Voices of dissent and the focal point of reform should emerge from the most marginalised among us. Surveillance mechanisms proposed by the PECA, and the anticipated rules under the Act, are being justified in the name of national security—however the question of whether these systems conform to human rights needs to take into account the experiences of women and minorities and the impact of state surveillance and privacy regimes on them.

As the conversation around surveillance technologies develops and expands, privacy as a concept itself should be extricated from its articulation of ‘chaar diwari’ (the four walls) that is often used to oppresses and police women. It should be clear that the layer of privacy we are advocating is conceptually distinct from its traditional, regressive manifestation. These intellectual distinctions are not important merely for the sake of conceptual clarity, but can have real consequences as judges pass judgements under the newly drafted PECA. Feminists find themselves in a confusing corner, whether to oppose the PECA and increasing state surveillance when it comes in a package of anti-online harassment laws. Digital Rights Foundation advocated for a gendered critique of the Bill in its amendment stages, and that such a critique should not be confined merely to the harassment specific sections of the Bill, but in fact even to the seemingly ‘gender-neutral’ parts that expanded the reaches of state surveillance. It is important to see surveillance as a feminist concern and to oppose laws that chip away at privacy as part of a holistic gender-sensitive approach to law, regulation and legislation.

As it currently stands, the PECA is handicapped by an executing authority that does not have the resources to respond to complaints around online harassment in a timely manner. Thus, the impact of the law in making online spaces safer for women and minority groups has been negligible. Additionally, the regulatory and surveillance mechanism in place holds the potential of replicating the same inequalities that exist offline. Furthermore, the impact of the law on marginalised communities is being monitored and studied to apply an experience-based as applied challenge to the problematic sections of the PECA. Digital Rights Foundation is advocating for corresponding legislation that develops a digital rights regime based on principles of privacy, free speech and equality.

Notes:

[1] The National Action Plan (NAP) was established by the government in January, 2015 following the gruesome attack on the Army Public School (APS) in Peshawar December, 2014. Formulated in a moment of national crisis and across party support, the NAP framework encompasses the Twenty-first Amendment (establishing military courts), lifting of the seven-year-old moratorium on the executions of prisoners sentenced to death, and the passage of the Prevention of Electronic Crimes Act (PECA) 2016 (commonly known as the Cyber Crimes Bill).

[2] This emphasis on difference and varied experiences of the surveillance gaze is a hallmark of feminist analysis. See: Abu-Laban, Y, “Gendering Surveillance Studies: The Empirical and Normative Promise of Feminist Methodology”, Surveillance & Society 13(1), 2015., pg. 44-56.

[3] “The categorisation and enumeration of the population [“colonial knowledge”] in pre-colonial India was carried out by local elites, and subsequently modified and implemented by the British for the purpose of ruling and taxation.” Elina Zureik, “Colonial Oversight’, Red Paper, October/November 2013, pg. 46-7.

[4] The Criminal Tribes’ Act, 1871. Act XXVII was passed by the British colonial state and it classified certain marginalised groups as “criminal”. This categorization led to surveillance, geographical segregation and restrictions on movement of members of these “criminal tribes”.

[5] David Lyon argues that “Underlying claims about gender-based surveillance is the unwanted male gaze”, David Lyon, “Surveillance as Social Sorting”, p. 50.

[6] “Surveillance can be understood as the ‘re-embodiment’ of women, as ‘an extension of male gaze’”, Hille Koskela, ‘The gaze without eyes’: video-surveillance and the changing nature of urban space, Progress in Human Geography 24,2 (2000) pp. 243–265, 256.

[7] Section 37 of the PECA allows for the removal of “unlawful content” that is against the “glory of Islam or the integrity, security or defence of Pakistan or any part thereof, public order, decency or morality, or in relation to contempt of court or commission of or incitement of an offence”.

[8] Mason, C. and Shoshana Magnet. 2012. Surveillance Studies and Violence Against Women. Surveillance & Society 10(2): 105-118. http://www.surveillance-and-society.org| ISSN: 1477-7487.

Feature Reference: 
Mass Surveillance
Written by: 

Privacy International asks Intelligence Agencies about existence of secret oversight regime

via News by editor on Wed, 30 Nov 2016 17:12:17 GMT

28 November 2016

For further information please contact PI Legal Officer Millie Graham Wood: camilla@privacyinternational.org

For media enquiries please contact press@privacyinternational.org

Documents obtained by Privacy International reveal the existence of a secret oversight function given to the Intelligence Services Commissioner (ISC), in operation since at least 2014. The details of this function, referred to as the ‘third direction’, remain redacted and only came to light following disclosure of the confidential annex of the Intelligence Services Commissioners’ 2014 report. Privacy International is calling for clarity around the previously undisclosed third direction, especially since the first two directions concern controversial functions of the intelligence services — the collection of bulk personal datasets and the detention and interviewing of detainees overseas.
 
 The Prime Minister can ‘direct’ the ISC to keep under review any aspect of the functions of the Intelligence Services. This power, at section 59A of the Regulation of Investigatory Powers Act (“RIPA”) 2000, was introduced by the Justice and Security Act 2013 and until recently the public and Parliament were led to believe the Prime Minister had only issued two directions. 
 
 The importance of this revelation is underscored by the nature of the two previously secret directions, both referred to in the 2014 confidential annex. The first direction governs the oversight of the highly controversial bulk personal datasets, whose existence was not known until March 2015, despite being in operation for over a decade. Bulk personal datasets are any data sets that are held by companies, organisations, and individuals, such as library card holders or patients with the NHS, that the government requests, copies, and looks through. The government describes such datasets as personal information from citizens who are “unlikely to be of intelligence or security interest”. The second direction relates to the Agencies’ “Consolidated Guidance” regarding the Detention and Interviewing of Detainees Overseas and has been the subject of concern relating to risks of UK action resulting in torture or other ill-treatment.
 
 The disclosure was made by the Security and Intelligence Services during Privacy International’s Bulk Personal Dataset legal challenge. Sir Mark Waller, ISC, states in the Confidential Annex to the Intelligence Services Commissioner’s Report for 2014 at page 4 of the Report:
 

 “Under paragraph 59A of RIPA, inserted by the Justice and Security Act, the Prime Minister may direct me to keep under review the carrying out of any aspect of the functions of the intelligence services. 
 
 The Prime Minister has now issued three such directions placing all of my oversight on a statutory footing. Two of the directions are set out in my open report:
 
 · The acquisition, use, retention, disclosure, storage and deletion of bulk personal datasets including the misuse of data and how this is prevented
 
 · Compliance with the Consolidated Guidance.
 
 · [redacted]
 
 [redacted]”

 
In the quote above, Sir Mark Waller reveals that there are in fact three directions, as opposed to the previously disclosed two. Given that the existence of a third direction has now been made public, Privacy International believes there is no reason why the full explanation of the third direction cannot be published publicly as well. This will ensure that its legal basis and legal interpretations adopted by the Agencies and Commissioner can be analysed and subjected to challenge, if appropriate. 
 
Millie Graham Wood, Legal Officer at Privacy International said:
 
“It is wrong in principle for there to be an entire area of intelligence oversight — and potentially of intelligence activity — about which the public knows nothing at all. The risks of such a position are obvious, given that the Commissioners have previously adopted legal analysis provided by the Agencies in secret, which has turned out to be incorrect. This includes the incorrect conclusion of the Interception of Communications Commissioner that Article 8 ECHR did not apply to the obtaining of Bulk Communications Data and the failure of the Intelligence and Interception of Communications Commissioners to appreciate that the internal arrangements of the handling of legally privileged material by each of the Agencies was plainly defective.”
 
 “The Investigatory Powers Bill was lauded as an attempt to ensure intrusive surveillance powers were subject to robust safeguards and visible, effective oversight. Yet days before the Investigatory Powers Bill it is enacted, we learn of yet another secret power. We invite the Prime Minister to publish the third direction — redacted, summarised or gisted as appropriate — and to republish the open reports of the Intelligence Services Commissioner, to reflect the facts that the existence of the third direction has now been disclosed.”
 
 — ends — 
 
Notes to editors
Privacy International’s letter to the Intelligence Agencies seeking publication and the confidential annex can be found here.

The ISC’s disclosed functions are listed here: http://intelligencecommissioner.com/content.asp?id=4 
 
 Section 59A RIPA was inserted into the Act by the Justice and Security Act 2013. It allows the Prime Minister to expand the statutory oversight functions of the Intelligence Services Commissioner by issuing a direction. Section 59A(5) requires the publication of such directions, subject to limited exceptions:
 
 59A Additional functions of the Intelligence Services Commissioner
 
 …
 
 (5) The Prime Minister must publish, in a manner which the Prime Minister considers appropriate, any direction under this section (and any revocation of such a direction) except so far as it appears to the Prime Minister that such publication would be contrary to the public interest or prejudicial to — 
 
 (a) national security, 
 
 (b) the prevention or detection of serious crime,
 
 (c ) the economic well-being of the United Kingdom, or
 
 (d) the continued discharge of the functions of any public authority whose activities include activities that are subject to review by the Intelligence Services Commissioner.’
 
 
 To date, two section 59A directions have been published:
 
 (a) The Intelligence Services Commissioner (Additional Review Functions) (Consolidated Guidance) Direction 2014 came into force on 28 November 2014. It requires the Commissioner to review compliance with what is known as the “Consolidated Guidance”.
 
 (b) The Intelligence Services Commissioner (Additional Review Functions) (Bulk Personal Datasets) Direction 2015 came into force on 13 March 2015. It requires the Commissioner to review the use of bulk personal datasets by the Security and Intelligence Agencies and the adequacy of safeguards against their misuse.

 newer latest older