MI5 e-mail alert signup shambles - all email subscription web forms sent to the USA, without encryption

wtwu

on January 9, 2007 9:01 PM | Permalink | Comments (42)

What a shambles over the heavily hyped "MI5 e-mail alert system", which failed to be available on Tuesday morning, as was implied in the media, but which has appeared on Tuesday evening, with all the appearance of a rushed job !

Astonishingly, MI5, the Security Service, part of whose remit is supposed to be giving protection advice against electronic attacks over the internet, is sending all our personal details (forename, surname and email address) unencrypted to commercial third party e-mail marketing and tracking companies which are physically and legally in the jurisdiction of the United States of America, and is even not bothering to make use of the SSL / TLS encrypted web forms and processing scripts which are already available to them.

Is this evidence of a rush job, to satisfy the demands of the Home Office spin doctors or is it incompetence, or indifference to the privacy and security of the general public ?

The Hype

The media were were briefed on Monday. e.g. The Register

The Security Service MI5 will announce tomorrow that subscribers to its website can sign up for email notification of changes to the current threat level.
A spokeswoman for the Home Office said: "There will be two electronic lists, one for people interested in updates to the threat level and one for changes and updates to the website. This aims to improve public understanding of the service's work and to offer faster information about threat levels."
Anyone can sign up to the lists.

The BBC News 24 devoted quite a long segment to it this morning before and during breakfast.

Patrick Mercer, the Conservative "Homeland Security" spokesman and a former Army intelligence officer praised the idea, but pointed out the same sort of problems we asked about during the "Climate of Fear" hype last summer

Despite what much of the press and bloggers are saying, it does not seem that these emails will actually give any detailed information about specific threats, or even what to do exactly before or after a threatened or actual attack. All that they will do is inform people about any change in the crude Terror Threat Alert Status, which is displayed already published on
the Home Office, MI5 and intelligence.gov.uk Cabinet Office web pages, and which is endlessly hyped by the media when it changes from one unreal state to another. e.g. Threat Level CRITICAL - now what are we meant do ?

All this publicity gave the impression that from some, unspecified time on Tuesday 9th January 2007, you would be able to sign up for the Terror Alert Status change emails and the MI5 website News alert e-mails.

What actually happened

This morning. there was no change to the MI5 website since its previous update back in mid December:

Updated 15.12.06 10:00

So all that media hype was wasted, as thousands of people were frustrated in not being able to see what was involved and to try to sign up.

There was another update:

Updated 9.1.07 10:30

This announced:

The Security Service does not have a Press Office and does not comment on intelligence matters. The Home Office issues statements relating to our work from time to time and we link to these on this page, along with any other relevant official announcements.
[...]

SECURITY SERVICE TO OFFER E-MAIL ALERTS (09.01.07)

E-mail alerts of changes to the national Threat Level and updates on the Security Service website will be available in the near future. This will enable subscribers to keep informed of major developments in national security affairs. You will be able to subscribe via a form on the Security Service website. We will publish an update shortly giving the address of the subscription form.

This does not imply some sort of last minute technical hitch, it implies that the scheme has not yet been fully designed and tested and security vetted yet ! Otherwise, why not give an expected launch time and date for the new service ?

At this point, they could have decided, without too much loss of face, to postpone the start of the e-mail alert service, for, say, a week.

However, presumably following pressure from the spin doctors, and possibly by politicians, there was yet another update:

Updated 9.1.07 17:00

which does contain a web form to subscribe to the new e-mail alert service:

http://www.mi5.gov.uk/output/Page575.html

This does also appear to be available under the SSL /TLS encrypted version of the website (but this is not linked to separately or automatically). However the Arabic, Urdu and Welsh versions of the MI5 website do not seem to have this form translated - the first sign that this project has been put together in a rush.

Looking through the source code of the web form, before deciding whether or not to trust it, it was obvious that the web form is processed by this script:

http://pmv2.co.uk/bin/listctrl

Aaaaargh ! no SSL or TLS encryption !

Aaaaargh !! this script is not on the MI5 webserver !!

Who are pmv2.co.uk ?

Xwhois query for pmv2.co.uk...
Results returned from whois.nic.uk:
Domain name:
pmv2.co.uk

Registrant:
Mailtrack Ltd

Registrant type:
UK Limited Company, (Company number: 3894107)

Registrant's address:
4th Floor King House, 5-11 Westbourne Grove
London
London
W2 4UA
United Kingdom

[...]

Name servers:
elrond.mailtrack.com
arwen.mailtrack.com
cirdan.mailtrack.com

Who are Mailtrack Ltd ?

"Mailtrack is a digital marketing solutions supplier that designs, delivers and manages digital marketing solutions designed to increase total customer value for our customers."
[...]

Telephone - 0870 742 0558

Email - website@mailtrack.com

Mailtrack Limited 4th Floor, King House
5-11 Westbourne Grove
London W2 4UA
United Kingdom

Find Us with Google Maps

Co. Reg. - 3894107
VAT - 752 509 333

Mailtrack is a registered as a Data Processor with the Information Commissioner.

So, MI5 has outsourced the e-mail subscription process to a third party commercial direct email company.

That is not necessarily a bad thing, however, the web server being used to process the e-mail subscription form is physically located in the United States of America !

http://www.pmv2.co.uk

404 Not Found
/ was not found on this server.

Resin-3.0.17 (built Thu, 22 Dec 2005 12:11:34 PST)

Note the time stamp - PST = Pacific Standard Time i.e. the west coast of the USA and Canada

http://pmv2.co.uk

takes you to

http://pmv2.co.uk/bin/login

which is an unencrypted login screen for the ProMail version 2 email list management software.

Again there is a Pacific Standard Time timestamp.

Looking up the IP addresss:

IP address: 63.211.217.146
Host name: pmv2.co.uk

Network IP address lookup:

Xwhois query for 63.211.217.146...

Results returned from whois.arin.net:

OrgName: Level 3 Communications, Inc.
OrgID: LVLT
Address: 1025 Eldorado Blvd.
City: Broomfield
StateProv: CO
PostalCode: 80021
Country: US

i.e. a large USA based internet service provider.

Traceroute to the pmv2.co.uk webserver shows it probably to be connected to the Level 3 network in the Seattle area.

7 6 6 6 4.68.110.61 te-3-1.car3.dallas1.level3.net
8 6 7 6 4.68.122.1 ae-1-51.bbr1.dallas1.level3.net
9 140 54 53 209.247.10.133 as-1-0.mp2.seattle1.level3.net
10 53 53 53 4.68.105.131 ae-12-55.car2.seattle1.level3.net
11 Timed out Timed out Timed out

No SSL / TLS encryption

Astonishingly, this

http://pmv2.co.uk/bin/login

So it is not as if they do not know about SSL encryption, they are deliberately not using it to protect the email addresses and names of the people who sign up to the MI5 e-mail alert lists.

The pmv2.co.uk server does not appear to have an SSL / TLS Digital Certificate installed

N.B.

IP address: 63.211.217.146
Host name: pmv2.co.uk

has many other aliases i.e. it serves many other websites:

IP address: 63.211.217.146 Host name: oem.whatcounts.com
Alias:
pizzazz.whatcounts.com
pizzazzemail.whatcounts.com
popmultimedia_new.whatcounts.com
tms_new.whatcounts.com
popmedia_new.whatcounts.com
wiredmessenger.whatcounts.com
shoplocal.whatcounts.com
crmgroup.whatcounts.com
redweek.whatcounts.com
brandinthebox-new.whatcounts.com
huntddb-new.whatcounts.com
maddenmedia-new.whatcounts.com
wiredmessenger-new.whatcounts.com
marketstar-new.whatcounts.com
tribalddb-new.whatcounts.com

WhatCounts.com seems to provide the back end email list marketing software on an Original Equipment Manufacturer turnkey basis, with different logos for each of their clients e.g. see the similarity between

http://pmv2.co.uk and, say, http://redweek.whatcounts.com

See more about WhatCounts Inc below

Data Protection

How does this square with European Data Protection regulations ?

How does sending our names and email addresses, for subscription or un-subscription, from the MI5 Security Service e-mail alert system in this way, unencrypted across the Atlantic, comply with the Privacy Policy and Data Protection Act policies which are mentioned at the foot of
the subscription form ?

Privacy
The personal data that you submit will be held securely and will be used to manage your subscription or un-subscription. It will be processed fairly and lawfully in adherence to the Data Protection Act 1998. We will treat your data in the strictest confidence and we will only disclose such data to any personal or organisation for the purposes for which it was collected or for the purpose of our statutory functions under the Security Service Act 1989.

Please see our Privacy Statement for further details.

This statement is simply untrue !

Any ISP or telecomms network administrators, or the Governments of the USA or perhaps also of Canada, can snoop on this MI5 e-mail subscription traffic with impunity.

The MI5 website handles its own SSL / TLS encrypted web forms already, so they know exactly what they should be doing.

Has it been a rush job ?

Has this all been done in a blind panic, because of the briefing to the media yesterday by the Home Office, and so that an insecure commercial off the shelf service was hurriedly put into place this afternoon ? Surely they cannot have been planning to use this unencrypted email list server, physically in the USA, all along can they ?

Has there only been a narrow security impact assessment on the potential risk to MI5's internal systems, rather than a wider risk assessment taking into account the privacy and security of the members of the public who subscribe to the e-mail alert service ?

Which politician, spin doctor, or civil service bureaucrat made the decision to overrule the UK IT security experts, and put our personal data at risk in this way ?

What happens if you actually sign up ?

Bearing all this in mind, we have signed up to the e-mail lists with the following result:

If you do use the encrypted version of the web form i.e.

https://www.mi5.gov.uk/output/Page575.html

which is not linked to as such from the homepage), your web browser, should, if the settings are sensible, warn you that you are about to lose the protection of the SSL/ / TLS encrypted session, so the data you are sending "could easily be read by a third party", as you press the submit button.

Then you get:

MI5 E-Mail Lists - Subscription Confirmation
Thank you for your subscription to our mailing list(s).

You will receive an e-mail shortly asking you to click on a link to confirm your subscription.

The email confirmation you get is like this:

From: "MI5"
To: [email address]
Subject: MI5 What's New - please confirm your subscription
Date: 09 Jan 2007 14:29:20 PST
MIME-version: 1.0
Content-type: text/plain
X-Mailer: WhatCounts

Security Service MI5

Thank you for your request to subscribe to the MI5 What's New e-mail list.

Your email address '[email address]'
has been submitted to be subscribed to the list. To confirm that you want to join this list, please click on this link to confirm your request:

http://www.whatcounts.com/bin/confirm?code=[22 digit code]

The whatcounts.com is also hosted by the large US ISP Level 3 communications in Seattle, in the USA

IP address: 63.211.217.130 Host name: www.whatcounts.com
TraceRoute to 63.211.217.130 [www.whatcounts.com]
Hop (ms) (ms) (ms) IP Address Host name

8 51 18 Timed out 4.68.110.61 te-3-1.car3.dallas1.level3.net
9 7 6 6 4.68.122.65 ae-1-53.bbr1.dallas1.level3.net
10 54 53 54 209.247.10.133 as-1-0.mp2.seattle1.level3.net
11 54 54 53 4.68.105.35 ae-22-52.car2.seattle1.level3.net
12 Timed out Timed out Timed out -

Xwhois query for whatcounts.com...

Results returned from whois.opensrs.net:

Registrant:
WhatCounts, Inc.
316 Occidental Avenue South
Seattle, WA 98104
US

Again. there is no encryption to protect your personal details.

WhatCounts, Inc. the a third company involved in the email subscription process, one which offers:

"The powerful WhatCounts e-Communications Suite enables marketers to build brand loyalty through enhanced communication and granular analytics."

i.e. direct marketing / junk mail or tracking and analysis of "customers".

Clicking on the URL link, to confirm the subscription returns you to the MI5 website subscription confirmation page

http://www.mi5.gov.uk/output/Page576.html

which, implies, that you are now caught in an endless email spam loop, as

"You will receive an e-mail shortly asking you to click on a link to confirm your subscription."

This error surely would have been caught, if there had actually been any proper security auditing or even usability testing, so this lends support to the idea that this is all a rush job, to placate the premature announcement of the e-mail alert service by the Home Office spin doctors.

Just for fun, we also subscribed separately to the Alert list and checked to see if SSL was available on the whatcounts.com webserver

There is a Digital Certificate for secure.whatcounts.com, which does not match, obviously,
to the www.whatcounts.com URL

Would it really have been so difficult to give the confirmation URL in this format ?

https://secure.whatcounts.com/bin/confirm?code=[22 digit code]

i.e. using encryption rather than

http://www.whatcounts.com/bin/confirm?code=[22 digit code] ?

Interestingly, but unsurprisingly, if they are using relative URLs in the scripts, this does seem to work, and takes you to the SSL encrypted version of the MI5 e-mail confirmation page as before

https://www.mi5.gov.uk/output/Page576.html

However, despite starting off with an encrypted session, and finishing with one, our personal data i.e. first name, surname and email address, were put at risk by the unencrypted hop over to Seattle in the middle.

You then get a confirmation email from whatcounts.com, with a similar, unencrypted Unsubscribe link:

http://pmv2.co.uk/bin/listunsub?id=[48 digit code]

Which is handled by exactly the same unencrypted webserver based on the West Coast of the USA, as the original subscription !

Privacy and Security Implications

There is nothing particularly wrong in using a commercial email service for these MI5 email alert lists, except for the fact that this United Kingdom National Security system is being run insecurely in a foreign country, and ignoring some of the built in standard SSL protections which these services are perfectly capable of offering.

We will not be surprised if the entire list of MI5 e-mail list subscribers is stolen in transit or by obtained by unauthorised access, perhaps by an existing customer or employee of Mailtrack, Level 3, or WhatCounts,

It is highly likely that there are logfiles of all of the transactions in this mailing list subscription, un-subscription, confirmation email and confirmation web link access process, all of which are outside of the direct control and protection
of the UK Government.

It may even be the legal property of these US Companies, which they are legally free to use for direct marketing purposes if they wish.

It is certainly at risk of being legally handed over, en masse, to the US authorities e.g.

"Hey, someone called Osama bin-Laden just subscribed to the MI5 news and alert e-mail lists - they must all be potential terrorists, let's put those names and email addresses into our database of suspects".

Why is this e-mail subscription service not being handled by purely United Kingdom based companies and computers ?

Why is this email subscription service not being handled entirely using secure UK Government computer infrastructure ?

Questions

Some Questions, which occurred to us before the web form was revealed:

Why is there no plan to introduce RSS and/or XML syndication feeds, something which these infrequent news and even more infrequent terror threat status level changes would be ideal for, especially via feed aggregators like Bloglines etc. ?
WIll the e-mail subscription services be, effectively, anonymous or will the jobsworth snoops insist on
lots of unecessary personal details ?

It turns out to ask for email address, first and second names, so in that sense, ot is easily forged.

What is the policy on storing IP addresses and other browser specific details of those signing up for the emails ?

If you believe the Privacy Policy of the website, they do not store these on the MI5 webserver. However since most of the subscription and un-subscription process is being handled in the United States of America, outside of the physical and legal control of the British Government, who knows what is being logged and retained and by whom.

What is the policy on access to these sign up forms by disabled people ?

No special provisions apparent.

What is the policy on access to these sign up forms by children ?

No warning about age of consent, or advice to get notify a parent or guardian.

What is the policy on access to these sign up forms by foreigners ?

No attempt at restrictions, which would probably be unworkable anyway.

Since there are Arabic, Urdu and Welsh language versions of the MI5 website, will these email sign up forms also be available in those languages ?

No translations of the e-mail web form available - probably a further sign of a rushed job.

Will they incompetently store such personal details so that they can be accessed as a file or an SQL query via the website and thereby give spammers and identity thieves and foreign intelligence agencies another list of people to harass ?
Will they allow the database of people signed up for these alerts to be enumerated via the error message responses or timing delays e.g. a "blind oracle" script feeding likely email addresses into the online form, to see if a particular person or email address is signed up to the scheme or not ?
Will they allow Denial of Service attacks in the form of mass un-subscriptions from the lists, e.g. through an insecure "password reminder" option, or simply by sending the word "unsubscribe" from a forged email address ?

Obviously we have not investigated this, but since the email list control software is physically hosted in the USA, outside of the UK Government's control and security standards, then we are quite worried by this shared, unencrypted form for forgotten list administrator passwords:

http://pmv2.co.uk/bin/login?cmd=forgot

If more than an email address is required to sign up e.g. a name , then what provisions are there in place to prevent "celebrity name squatting" e.g. people apparently signing up as Tony Blair or Her Majesty the Queen etc ?
How many people does the Government expect to sign up for these e-mails, and has sufficient extra money been made available in the budget ?
Have they invested in sufficient infrastructure e.g. peak bandwidth, hardware accelerators, traffic shapers, load balancers etc. to resist Denial of Service attacks on these e-mail signup forms ?
Will any of the e-mails alerts actually be Digitally Signed to assure people of their authenticity ?
All of the above points should already have been addressed during the CESG information security re-Accreditation of the MI5 website, given this major change to its configuration. Has this formal Accreditation process actually been signed off yet ?

We are not hopeful about the answers to these questions, based what looks like an rushed job, on the cheap, which was eventually launched today.

42 Comments

By IanP on January 10, 2007 8:33 AM

My congratulations to the team who obviosly have spent many hours researching this. A wonderful article.

This I fear will be level of attention from all the government departments collecting information about us, we already know that our DNA records are kept by 3rd parties.

I think the biggest threat to the UK now is the mass of spam that will hit us over the coming weeks and months, headed M15 Threat Level, coming from clever marketing companies in the US, dropping cookies, viruses, bugs, trojans etc onto unsuspecting machines, knowing that everyone who has signed up to this will be expected to open it, just in case its the real thing......

If you worried about botnets, I suspect you aint seen nothing yet....courtecy of the UK security services. Not fit for purpose.... not fit full stop.

OH, and by the way, Mozilla have been publishing a UK version of an RSS feed plugin for security level for 6 months, taking its feed from the Home Office Homepage, called UK threat level, available on https://addons.mozilla.org/firefox/extensions/
which IS at least a secure site.

By IanP on January 10, 2007 8:42 AM

RSS extentions from Mozilla.

Threat Level UK
https://addons.mozilla.org/firefox/3396/

Homeland Security Threat Level
https://addons.mozilla.org/firefox/1586/

By wtwu on January 10, 2007 9:35 AM

@ IanP- the article took much longer to try to format properly, than to research !

The insecure web form script took literally about 30 seconds to find, and the US location of the server, about 5 minutes to confirm.

Setting up some email accounts and subscribing to the email alert lists and examining the responses took a bit longer.

The risk from spammers targeting the lists of people who have subscribed is, as you point out, a very real one.

Will the other Home Office and MI5 stories in the news at the moment bury this one ?

By IanP on January 10, 2007 9:59 AM

I sent the following to a list of MP's this morning, perhaps we need to get them on our side to put some pressure on the government to stop this madness, before no-one in britain has a unique and safe ID anymore.

Sirs,

If you have not yet had an opportunity to read the article in Spy Blog this morning, can I please suggest that you
take a look.

I would like to ask that you can all use your influence on behalf of the british public to get the programme of databases
stopped or halted in order to conduct proper evaluations on what data is being collected, what it is to be used for, where
its is to be held, who will have access to it, and an assurance to the public that our information is safe, which in the case
of the M15 database it clearly is not.

http://p10.hostingprod.com/@spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html

I thank you all for your attention in advance.

many thanks
regards

+++

By wtwu on January 10, 2007 1:19 PM

Do you think that the people at WhatCounts Inc. are actually aware that they are, via one of their customer's or OEM partners, hosting an email service for a foreign intelligence agency and prime terrorist target ?

By Chris R on January 10, 2007 1:49 PM

Good analysis. I like this site a lot - but I'm struck by how such a tech-savvy blog can have such ugly permalinks.

By wtwu on January 10, 2007 1:55 PM

@ Chris R - what would you suggest to improve the permalinks ?

By IanP on January 10, 2007 3:07 PM

It would appear that MI5 are not the only public body to use US hosting. Comments below taken from the Privacy Policy page on the Nick Robinsons Newslog. This one is registered in Delaware, where the privacy laws are the laxest in the US.

quote
You should be aware that this blog site is currently being hosted by Six Apart Ltd on behalf of the BBC and if you send an e-mail comment into the blog your e-mail address will be held by Six Apart Ltd on web servers in the USA.

Your e-mail address will only be held by the BBC and Six Apart Ltd and will be used for the purpose of administering this blog site.
unquote

Does no-one use UK companies anymore.?

By wtwu on January 10, 2007 4:07 PM

@ IanP - when this blog had to move from its former UK webspace provider, since they imposed arbitrary process memory limits, which prevented Movable Type from re-building indices etc.. The current US hosting deal seemed attractive - offering more bandwidth, more disk space, more administration tools, for less money, so it seemed worth giving it a try.

The vague plans by the UK Government and the European Union to censor web sites containing "dangerous knowledge", was also a factor in deciding to move this webspace to the USA for now.

There is no good reason why some UK Government websites or email services or public sector ones like the BBC (which, of course has an international presence in many countries) should not be hosted in other countries, especially the European Union, and vice versa, except where National Security is a factor, as in this MI5 example.

In which country is the Home Location Register of the 3G mobile phone which you happen to be using ? It is not necessarily in your home country.

One of the many scandals involving the bankrupt and then revived WorldCom telcomms and internet company, was that they were selling the US Government supposedly private telecomms circuits, but were actually least cost routing the calls and data traffic through arbitrary foreign countries if it was marginally more profitable to do so, with similar security and privacy worries for the customer, just like the MI5 e-mail list situation
.

By J7 Truth on January 10, 2007 5:40 PM

The e-mail terror alert was obviously a rushed job, as your excellent analysis points out.

One can spot the classic news management technique of synchronized information release. The e-mail terror alert information was released as the following two pieces of information were also aired:

1) The Mi5 head told senior MPs (on the morning of 6th July 2005) that there was no imminent terrorist threat to London or the rest of the country less than 24 hours before the events in London on July 7th 2005.

2) Mi5 had Mohammad Sidique Khan, and fellow accused Shehzad Tanweer under surveillance (& had audio & video recordings of at least Khan) around the time of 'Operation Crevice'. [The 'Crevice' trial is currently ongoing and there are hints of more revelations re Mi5's prior contact with those accused of the 7the July events.]

The e-mail terror alert news item was picked up on by the mainstream media, rather than the two more damming pieces of information.

RELEASE THE EVIDENCE
====================

By anonymongo on January 10, 2007 6:54 PM

1) MI5 Email List

I'm at a lost as how to explain the shabbiness of this system. I'm guessing one of two things has happened:

MI5 considers the whole concept of the Terrorometer to be a cynical exploitation of people's fears. MI5 were requested by Commissar Reid to create this mailing list. Being dutiful civil servants, they complied with his request but implemented it with as little effort as possible, thus freeing their time and resources to concentrate on more important things.

-- or --

MI5 doesn't care about the privacy of those subscribing.

-- or --

The people responsible for the security of my beloved country have implemented a system to the best of their abilities.

---

In 1997, I'd have said it was the first one but now I'm not so sure. We're all completely fucked if it's the latter.

2) Compliance with the DPA.

So MI5 has contracted out the work for maintaining this mailing list to Mailtrack, who have then subcontracted the work to US-based WhatCounts.

Mailtrack has 6 Purposes registered with the ICO for using of personal data, all marked "Transfers: None outside the European Economic Area"

WhatCounts have no EU Safe Harbor Principles listed on their site, so I can only assume they do not comply with them.

Dont know the legalities of this... sure the ICO could help though.

By Sharp on January 11, 2007 2:56 AM

The announcement by MI5 that they will start issuing terror alerts via email is worrying. The ramifications have not been properly thought through - email is a very poor medium to choose for an alerting mechanism.

The average person will not be able to tell if an email sent to them is really from MI5 or not - which will predictably lead to a lack of trust in whether or not any MI5 email alert can be trusted.

More here:

http://blogs.authentium.com/sharp/?p=37

[moved from a different comment thread]

By wtwu on January 11, 2007 3:13 AM

@ Sharp - MI5 is only issuing e-mail alerts about the infrequent changes to the official Terrorist Threat Alert Status, which for the foreseeable future only seems to have two states, either SEVERE or CRITICAL.

Nobody really knows what they should or should not be doing differently, under either Threat Level. e.g. when the Level was declared CRITICAL in August, over the alleged they binary liquid explosives on airliners plot, all the security procedures which had been planned for at Heathrow Airport etc. were very different to what people had been trained and equipped for previously, since they also, very arbitrarily, changed the hand luggage rules and the frequency of pat down searches of passengers.

If the UK Government were to ever issue actual targeted alerts about specific threats, then one would hope that would use Digital Signatures.

However, that seems to be well beyond their managerial capabilities at the moment.

They do appear to have vague plans for sending these status change alerts via the equally potentially insecure method of SMS text messages to mobile phones.

By Chris R on January 11, 2007 1:51 PM

On the permalinks, the link for this item is:

http://p10.hostingprod.com/@spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html

So it would be nice if it started with spyblog.org.uk and even nicer if the 'slug' was shorter, e.g. like this:

http://spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles.html

By amanfromMars on January 11, 2007 3:18 PM

[quote]I'm at a lost as how to explain the shabbiness of this system. I'm guessing one of two things has happened:

-- or --

MI5 doesn't care about the privacy of those subscribing.

-- or --

The people responsible for the security of my beloved country have implemented a system to the best of their abilities.

---

In 1997, I'd have said it was the first one but now I'm not so sure. We're all completely fucked if it's the latter.[/quote]

J7 Truth,

I agree.... and it could even be worse than we think for the Intelligence being used mightn't be True Blue but more Star Spangled

By Anonymongo on January 11, 2007 3:30 PM

I hate to agree with a foilhat but it'd say 'J7 Truth' is right.

A system implemented, in a rush, to media manage a bad story

By Mailtrack on January 11, 2007 3:59 PM

From Mailtrack spokesperson:

Mailtrack Ltd does not have a contract with MI5 and has not produced any of the web forms being discussed here.

We have advised all parties that these web pages should be removed until all necessary security measures have been implemented.

By Anonymongo on January 11, 2007 4:33 PM

Can WTWU confirm this is Mailtrack in a call / email to their press department?

If this is Mailtrack, MI5's attempt to bury bad news with Terrorometer emails has just backfired.

By David Geller on January 11, 2007 6:16 PM

You have provided a most comprehensive overview of some serious issues. I represent WhatCounts and would be happy to answer any specific questions you or any other people directly involved may have. MI5 is not our direct client and until just now I was not aware of these uses of our platform. We always prescribe rigid security measures but it's entirely up to our clients to fashion different uses of our technology. While I agree with most of your analysis, I don't believe it's entirely fair or accurate to assume that sending subscription signup data in an insecure manner puts at risk the entire body of information stored on our servers (or our clients servers since we offer those as well). It certainly could expose that individuals email address, but not others. And none of this should suggest some new, greater potential of spam. We don't allow our clients to send unsolicited email and take measures to remove them from our services if we discover abuses. Again, happy to discuss further in email or by phone, should anyone so desire. I'm GMT +8. Again, great analysis of what seems like an important issue.

By David Mery on January 11, 2007 10:47 PM

@ChrisR,

This works if you also take out the "blog/" part of the url, so a permalink to this page can be constructed by hand as:
http://spyblog.org.uk/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html

But yes it would be nice to have that generated automatically!

br -d

By wtwu on January 12, 2007 12:42 AM

@ David Geller - please check your email for some more Questions

By wtwu on January 12, 2007 12:48 AM

@ David Mery & Chris R - surely you do not re-type any URLs letter by letter, rather than using "Copy Link Location" & "Paste" ?

Would you prefer shorter, more cryptic titles to these posts ? One of the advantages of a blog over a newspaper is the ability to use much longer titles.

By wtwu on January 12, 2007 1:10 AM

@ anonymongo - MI5 "The Security Service" has only 3 Purposes registered:

Staff Administration
Transfers: Worldwide
CONCLUDING AND PERFORMING COMMERCIAL AGREEMENTS

Transfers: None outside the European Economic Area

PROPERTY MANAGEMENT (CCTV COVERAGE OF THAMES HOUSE

Transfers: None outside the European Economic Area

and also -

Statement of exempt processing:
This data controller also processes personal data which is exempt from notification.

The latter means their actual intelligence databases, which is not what the e-mail notification list subscription personal data is about.

By David Mery on January 12, 2007 1:22 AM

@wtwu,

Of course I use copy/paste.

In case you may change hosting service at some point in the future it makes sense to delete the fist part of the URL. What is ennoying but not such a big deal is that in the path to the page there's blog/ present in one case and not in the other.

All the recent links to this blog I made on my site have been of the form http://spyblog.org.uk/yyyy/mm/long_title_is_fine_though_sometimes_a_short_title_is_also_unfortunately_appropriate_such_as_the_last_entry_on_my_blog_have_a_good_night

br -d

By wtwu on January 12, 2007 9:53 AM

@ David Mery & Chris R - ok, will see what can be done, when the current high level of traffic dies down a bit.

By Chris R on January 12, 2007 4:46 PM

@wtwu
No hurry - keep on posting good stuff here!

Normally I don't really care what URLs look like, but I was putting a link to your posting elsewhere (Schneier.com) and it just looked really incongruous pasting a URL over 140 characters into it, especially beginning with the name of a hosting company.

In fact it began a whole slew of comments about using tinyurl.com to wrap up long URLs:
http://www.schneier.com/blog/archives/2007/01/mi5_terror_aler.html

By wtwu on January 13, 2007 5:58 AM

The MI5 email list subscription system has been modified.

See: MI5 e-mail list subscriptions now more secure than at launch

By Ian on January 13, 2007 8:52 PM

Has anyone looked at how/where the No 10 Petitions site stores user data?

By wtwu on January 14, 2007 1:55 AM

@ Ian - petitons.pm.gov.uk appears to be hosted on Easynet here in the UK.

The mysociety.org developers have published a schematic diagram of how the system works, and how it is designed to to cope with large volumes of sign ups and emails, in case a large NGO motivates its membership to sign a particular petition:

http://www.mysociety.org/2006/12/08/under-the-bonnet/

Ir would be better if this data, which does seem to be all within the UK, was protected through SSL, but publicly identifying yourself as demanding, say, that Tony Blair stands on his head and juggles ice cream etc. (an actual petition) is of a lot less interest to spammers and terrorists and foreign intelligence agencies, then who has signed up for information from MI5.

By Jetso on January 15, 2007 11:26 PM

Although much thought out and very well investigated, I would guess (and this is only a guess) that providing something as trivial as an email based alert system would have been delt with non technical departments within MI5. Infact in most cases public facing information services would be controlled by PR departments set up specifically for this kind of requirement. However if such concentration alerts those to government agencies and their practises, may it not also be a warning to those who sign up for commercial organisations alerting services, who will gain less attention from the media but will also follow similar cost saving practises in order to set up mass mailing systems to alert people of products or services that they offer.

By Rodri on January 16, 2007 4:20 AM

I noticed that, once some has subscribed to the MI5 alert service, the confirmation text is CHANGED.

This article report:

"You will receive an e-mail shortly asking you to click on a link to confirm
your subscription."

But today I just read THIS text:

"We will send you an e-mail in the next few days asking you to click on a link to verify your subscription request."

Something at MI5 has moved?

By wtwu on January 16, 2007 5:31 AM

@ Rodri - yes, some changes were made on Friday night - see the more recent blog articles:

Cabinet Office media spin over the MI5 email subscription data affair

The system seems to be in limbo "for a few days" and, although it is still not fully hosted on secure UK Government infrastructure, it is no longer sending your personal details unencrypted to various third parties in the USA.

There are lots of questions about who exactly ordered this system to be rushed online, circumventing the normal security review "sanity checks" and usability testing.

Why did the system have to go live at this particular time in such a hurry ?

By RC on January 19, 2007 1:00 PM

I have worked for UK-based ISPs and hosting companies for the last 10 years and, I must ask, what is the specific point your article is trying to make?

sending all our personal details (forename, surname and email address)

You can send completely fake details for the first two and the email address can be a hotmail (or similar) account set up with fake details too.

unencrypted

Encryption is normally only used when personal details such as credit card numbers, bank details or addresses are involved. It's rather unusual for it to be used for simple email subscription forms. You have probably given your email address away hundreds of times before on similar forms (or by using the Out of Office reply feature in MS Outlook).

The only risk you take is getting spam, and any ISP worth its salt already has an effective spam blocker in place... and any decent email client can mop anything mnissed by that.

to commercial third party e-mail marketing and tracking companies

Again, this is standard practice for email subscriptions. Such companies keep their clients' data separate and use it in accordance with their respective briefs. I wouldn't trust such a company any less than I would trust any other company.

which are physically and legally in the jurisdiction of the United States of America

What are you implying? That this somehow means that the hosting company they used just allows marketing companies access to email subscriptions lists? That is no more likely in the US than in the UK.

What would you prefer? Would you rather that all of this data you consider to be confidential to be managed by the underpaid IT monkeys that work for the UK Government? Would you rather it was all stored on some cheap, nasty, cobbled-together, in-house server solution?

It seems as if you have got your wish. Hope you feel warm and secure now.

By wtwu on January 19, 2007 4:03 PM

@ RC -

I have worked for UK-based ISPs and hosting companies for the last 10 years and, I must ask, what is the specific point your article is trying to make?

One would have expected someone with your experience to have grasped the problems almost immediately.

Many people signing up to those email lists, do not have the option of using a pseudo anonymous email address, e.g. if they work for a Government department, the armed forces, the Police, the other Emergency Services, the NHS etc.

The modified system does mention that you can sign up anonymously, the original one did not.

You should perhaps re-read the definition of Personal Data under the Data Protection Act 199, which both the original and the modified sign up forms gave the impression that they were compliant with. That was simply not the case with the system as launched.

It seems as if you have got your wish. Hope you feel warm and secure now.

What sort of a "shoot the messenger" comment is that ?

By RC on January 19, 2007 9:17 PM

You were the one that made the sensational claim that MI5 "sending all our personal details" abroad. An email address hardly constitutes all of my personal details.

What do you think you can get from an email address, or even an email address with a name (if someone actually gave their real name?

Well, you have my personal email address, and the IP address assigned by my ISP will be somewhere in your webserver logs. Tell me what further information you can get, beyond what I have already revealed in my posts? Can you get my bank or credit card details? Can you get my home address?

No. All you could possibly do is sign me up for spam and phishing emails, but I'm already likely to be on every spam list out there already, as I have a relatively common first and last name, and the domain part of my email address is extremely well-known.

Do I worry that your own site is not SSL encrypted? Do I worry that someone is snooping this post I've just sent? No, not really. I only make sure that a site is SSL encrypted when I am giving out sensitive data, such as credit card details, bank details or my home address.

As for my "shoot the messenger" comment, it is paranoid hysteria built around misconceptions about computer security that sometimes force companies to abandon one perfectly reasonable approach in favour of another that is more politically sensitive, but not necessarily any more sound.

By RC on January 19, 2007 9:20 PM

Anyone can sign up for a hotmail.com email address and give false details; their occupation has nothing to do with it. All you need is a computer with access to the Internet. Microsoft require no verification of any of the details you give when creating a hotmail account.

By RC on January 19, 2007 9:35 PM

As a security consultant, I am well aware of the scope of the Data Protection Act. You should re-read the section on "Sensitive Personal Data" (http://www.opsi.gov.uk/ACTS/acts1998/80029--a.htm#2), as well as the definition of the more generic term "Personal Data" (http://www.opsi.gov.uk/ACTS/acts1998/80029--a.htm#1).

The only "personal" data you can get from someone's email address is their ISP (and possibly their name), and the only data you can get from an IP address is a crude geographical location, that isn't necessarily accurate.

By wtwu on January 20, 2007 1:12 AM

@ RC - a hotmail or other private email account is not an option for many people working in say, the Police or the Military, or even in many private sector companies, not because they cannot sign up for one privately, but because they are simply not allowed to use such an account from their work computers, as a matter of organisational or security policy

It is likely that the people who have a professional interest in subscribing to the MI5 email lists, the ones who may need to take some specific actions when the Terror Alert Level changes to CRITICAL, will need to do so from their work email addresses.

Signing up via a web form gives out a bit more information than just your IP address, there are also details of any proxy servers and of the web browser software details, some of which are characteristic of particular organisations, e.g. a certain Police force is readily distinguishable from other users of the Police National Network.

Spy Blog is just a blog, and is nowhere near as worthwhile a target for foreign intelligence agencies or terrorist sympathisers as the MI5 email lists are.

If we ever did ask for user registration details on Spy Blog, something which would reduce the number of comments substantially, it would be done via an SSL / TLS encrypted web form.

By RC on January 20, 2007 10:59 AM

a hotmail or other private email account is not an option for many people working in say, the Police or the Military, or even in many private sector companies, not because they cannot sign up for one privately, but because they are simply not allowed to use such an account from their work computers, as a matter of organisational or security policy

What a absurd statement. Of course people working in any of those sectors already recieve email alerts about changes to the threat levels.

This email service you are lambasting is purely for the general public as a government information service. They are simply offering an aIternative method to viewing the same information that's on their website?

I'm starting to think that you've got hung up over the MI5 name here. Do you really think MI5 have anytthing to do with the MI5 website? Do you think MI5 IT staff had any involvement in this system you are criticising? Perhaps you thinnk that www.mi5.gov.uk is a server on MI5's network?

Spy Blog is just a blog, and is nowhere near as worthwhile a target for foreign intelligence agencies or terrorist sympathisers as the MI5 email lists are.

Again.. you seem to assume that a terrorist is desperate to obtain email addreses of people who want information that is already publically available on government internet websites.

By wtwu on January 20, 2007 11:54 AM

@ RC

Perhaps you thinnk that www.mi5.gov.uk is a server on MI5's network?

Obviously not, but that does not make it any less of a symbolic target for terrorists, or the email list data of any less interest to foreign intelligence agencies.

By RC on January 20, 2007 7:43 PM

You're still putting two and two together and getting five, as you have consitently done throughout your little 'investigation'. And I really don't think you have any idea how IT systems are managed by the UK Government.

You've certainly proved the old adage that "a little knowledge is a dangerous thing". All you've done is hysterically wield a few very crude investigatory network tools (traceroute, whois, et al.) like a child with his dad's magnifying glass, and suddenly you think you're Clifford Stoll, hot on the trail of some terrible hole in our country's security, and all because you're looking at a website that has the word MI5 on it.

Well you're not. You've got absolutely nothing, and in each successive post you reveal to me how little you know about commercial IT systems, how little you know about the UK Security Services and how little you know about terrorists or terrorism. The only people you'll ever convince are people who are similarly ignorant. Don't worry though... that's the vast majority of this country, including that gullible 'Technology Correspondent' from the BBC News website.

All you've started to uncover is simply the way the vast majority of companies and governments run their IT systems. Systems that contain sensitive data are protected as well as can be afforded and systems that contain benign data are not. Some systems are managed in-house and others are farmed out to third parties.

That email list you're so concerned about will only ever contain the email addresses of civilians who are interested in getting updates from a government website. Big deal. Such a list is of absolutely no use to a terrorist whatsoever. The information being mailed out is public domain, and the only people who would sign up to such an email list are the eternally paranoid tin foil hat brigade. Hardly terrorist targets. Normal, mentally balanced members of the public have no idea what the current (supposed) 'threat level' is and couldn't care less.

By wtwu on January 21, 2007 6:25 AM

@ RC - insulting people is not the way to win an argument.

Name

Email Address - anon ok, obviously

URL

Remember personal info?

Comments

You may use simple HTML tags for style e.g. <strong>, <blockquote>, <em> <b> etc. URLs will be automatically converted into hyperlinks, but with the "nofollow" attribute, so they will be ignored by most search engine page ranking algorithms.

You should worry that your IP address may be snooped on, so please use anonymity enhancing tools like Tor onion routing.

This United Kingdom based blog attempts to draw public attention to, and comments on, some of the current trends in ever cheaper and more widespread surveillance technology being deployed to satisfy the rapacious demand by state and corporate bureaucracies and criminals for your private details, and the technological ignorance of our politicians and civil servants who frame our legal systems.

The hope is that you the readers, will help to insist that strong safeguards for the privacy of the individual are implemented, especially in these times of increased alert over possible terrorist or criminal activity. If the systems which should help to protect us can be easily abused to supress our freedoms, then the terrorists will have won.

We know that there are decent, honest, trustworthy individual politicians, civil servants, law enforcement, intelligence agency personnel and broadcast, print and internet journalists etc., who often feel powerless or trapped in the system. They need the assistance of external, detailed, informed, public scrutiny to help them to resist deliberate or unthinking policies, which erode our freedoms and liberties.

Please feel free to email your views about this blog, or news about the issues it tries to comment on.

blog@spy[dot]org[dot]uk

Our PGP public encryption key is available for those correspondents who wish to send us news or information in confidence, and also for those of you who value your privacy, even if you have got nothing to hide.

You can download a free copy of the PGP encryption software from www.pgpi.org
(available for most of the common computer operating systems, and also in various Open Source versions like GPG)

We look forward to the day when UK Government Legislation, Press Releases and Emails etc. are Digitally Signed under the HMG PKI Root Certificate hierarchy so that we can be assured that they are not fakes. Trusting that the digitally signed content makes any sense, is another matter entirely.

Please take the appropriate precautions if you are planning to blow the whistle on shadowy and powerful people in Government or commerce, and their dubious policies. The mainstream media and bloggers also need to take simple precautions to help preserve the anonymity of their sources e.g. see Spy Blog's Hints and Tips for Whistleblowers - or use this easier to remember link: http://ht4w.co.uk

BlogSafer - wiki with multilingual guides to anonymous blogging

Digital Security & Privacy for Human Rights Defenders manual, by Irish NGO Frontline Defenders.

Everyone’s Guide to By-Passing Internet Censorship for Citizens Worldwide (.pdf - 31 pages), by the Citizenlab at the University of Toronto.

Handbook for Bloggers and Cyber-Dissidents - March 2008 version - (2.2 Mb - 80 pages .pdf) by Reporters Without Borders

Reporters Guide to Covering the Beijing Olympics by Human Rights Watch.

A Practical Security Handbook for Activists and Campaigns (v 2.6) (.doc - 62 pages), by experienced UK direct action political activists

Anonymous Blogging with Wordpress & Tor - useful step by step guide with software configuration screenshots by Ethan Zuckerman at Global Voices Advocacy. (updated March 10th 2009 with the latest Tor / Vidalia bundle details)

Privacy International
Privacy and Human Rights Survey 2004

Cryptome - censored or leaked government documents etc.

Identity Project report by the London School of Economics
Surveillance & Society the fully peer-reviewed transdisciplinary online surveillance studies journal

Statewatch - monitoring the state and civil liberties in the European Union

The Policy Laundering Project - attempts by Governments to pretend their repressive surveillance systems, have to be introduced to comply with international agreements, which they themselves have pushed for in the first place

International Campaign Against Mass Surveillance

ARCH Action Rights for Children in Education - worried about the planned Children's Bill Database, Connexions Card, fingerprinting of children, CCTV spy cameras in schools etc.

Foundation for Information Policy Research
UK Crypto - UK Cryptography Policy Discussion Group email list

Technical Advisory Board on internet and telecomms interception under RIPA

European Digital Rights

Open Rights Group - a UK version of the Electronic Frontier Foundation, a clearinghouse to raise digital rights and civil liberties issues with the media and to influence Governments.

Digital Rights Ireland - legal case against mandatory EU Comms Data Retention etc.

Blindside - "What’s going to go wrong in our e-enabled world? " blog and wiki and Quarterly Report will supposedly be read by the Cabinet Office Central Sponsor for Information Assurance. Whether the rest of the Government bureaucracy and the Politicians actually listen to the CSIA, is another matter.

Biometrics in schools - 'A concerned parent who doesn't want her children to live in "1984" type society.'

British and Irish Legal Information Institute - publishes the full text of major case Judgments

Her Majesty's Courts Service - publishes forthcoming High Court etc. cases (but only in the next few days !)

House of Lords - The Law Lords are currently the supreme court in the UK - will be moved to the new Supreme Court in October 2009.

Information Tribunal - deals with appeals under FOIA, DPA both for and against the Information Commissioner

Investigatory Powers Tribunal - deals with complaints about interception and snooping under RIPA - has almost never ruled in favour of a complainant.

Home Office - "Not fit for purpose. It is inadequate in terms of its scope, it is inadequate in terms of its information technology, leadership, management systems and processes" - Home Secretary John Reid. 23rd May 2006. Not quite the fount of all evil legislation in the UK, but close.

No. 10 Downing Street Prime Minister's Official Spindoctors

Public Bills before Parliament

United Kingdom Parliament
Home Affairs Committee of the House of Commons.

House of Commons "Question Book"

UK Statute Law Database - is the official revised edition of the primary legislation of the United Kingdom made available online, but it is not yet up to date.

FaxYourMP - identify and then fax your Member of Parliament
WriteToThem - identify and then contact your Local Councillors, members of devolved assemblies, Member of Parliament, Members of the European Parliament etc.
They Work For You - House of Commons Hansard made more accessible ? UK Members of the European Parliament

Read The Bills Act - USA proposal to force politicians to actually read the legislation that they are voting for, something which is badly needed in the UK Parliament.

Bichard Inquiry delving into criminal records and "soft intelligence" policies highlighted by the Soham murders. (taken offline by the Home Office)

ACPO - Association of Chief Police Officers - England, Wales and Northern Ireland
ACPOS Association of Chief Police Officers in Scotland

Stand - email and fax campaign on ID Cards etc. [Now defunct]. The people who supported stand.org.uk have gone on to set up other online tools like WriteToThem.com. The Government's contemptuous dismissal of over 5,000 individual responses via the stand.org website to the Home Office public consultation on Entitlement Cards is one of the factors which later led directly to the formation of the the NO2ID Campaign who have been marshalling cross party opposition to Labour's dreadful National Identity Register compulsory centralised national biometric database and ID Card plans, at the expense of simpler, cheaper, less repressive, more effective, nore secure and more privacy friendly alternative identity schemes.

NO2ID - opposition to the Home Office's Compulsory Biometric ID Card
NO2ID bulletin board discussion forum

Home Office Identity Cards website
No compulsory national Identity Cards (ID Cards) BBC iCan campaign site
UK ID Cards blog
NO2ID press clippings blog
CASNIC - Campaign to STOP the National Identity Card.
Defy-ID active meetings and protests in Glasgow
www.idcards-uk.info - New Alliance's ID Cards page
irefuse.org - total rejection of any UK ID Card

International Civil Aviation Organisation - Machine Readable Travel Documents standards for Biometric Passports etc.
Anti National ID Japan - controversial and insecure Jukinet National ID registry in Japan
UK Biometrics Working Group run by CESG/GCHQ experts etc. the UK Government on Biometrics issues feasability
Citizen Information Project feasability study population register plans by the Treasury and Office of National Statistics

CommentOnThis.com - comments and links to each paragraph of the Home Office's "Strategic Action Plan for the National Identity Scheme".

De-Materialised ID - "The voluntary alternative to material ID cards, A Proposal by David Moss of Business Consultancy Services Ltd (BCSL)" - well researched analysis of the current Home Office scheme, and a potentially viable alternative.

National Roads Telecommunications Services project - infrastruture for various mass surveillance systems, CCTV, ANPR, PMMR imaging etc.

CameraWatch - independent UK CCTV industry lobby group - like us, they also want more regulation of CCTV surveillance systems.

Every Step You Take a documentary about CCTV surveillance in the Uk by Austrian film maker Nino Leitner.

Transport for London an attempt at a technological panopticon - London Congestion Charge, London Low-Emission Zone, Automatic Number Plate Recognition cameras, tens of thousands of CCTV cameras on buses, thousands of CCTV cameras on London Underground, realtime road traffic CCTV, Iyster smart cards - all handed over to the Metropolitan Police for "national security" purposes, in real time, in bulk, without any public accountibility, for secret data mining, exempt from even the usual weak protections of the Data Protection Act 1998.

DNA Profiles - analysis by Paul Nutteing
GeneWatch UK monitors genetic privacy and other issues
Postnote February 2006 Number 258 - National DNA Database (.pdf) - Parliamentary Office of Science and Technology

The National DNA Database Annual Report 2004/5 (.pdf) - published by the NDNAD Board and ACPO.

Eeclaim Your DNA from Britain's National DNA Database - model letters and advice on how to have your DNA samples and profiles removed from the National DNA Database,in spite of all of the nureacratic obstacles which try to prevent this, even if you are innocent.

e-nsecure.net blog - Comments on IT security and Privacy or the lack thereof.
Rat's Blog -The Reverend Rat writes about London street life and technology
Duncan Drury - wired adventures in Tanzania & London
Dr. K's blog - Hacker, Author, Musician, Philosopher

David Mery - falsely arrested on the London Tube - you could be next.

James Hammerton
White Rose - a thorn in the side of Big Brother
Big Blunkett
Into The Machine - formerly "David Blunkett is an Arse" by Charlie Williams and Scribe
infinite ideas machine - Phil Booth
Louise Ferguson - City of Bits
Chris Lightfoot
Oblomovka - Danny O'Brien

Liberty Central

dropsafe - Alec Muffett
The Identity Corner - Stefan Brands
Kim Cameron - Microsoft's Identity Architect
Schneier on Security - Bruce Schneier
Politics of Privacy Blog - Andreas Busch
solarider blog

Richard Allan - former Liberal Democrat MP for Sheffield Hallam
Boris Johnson Conservative MP for Henley
Craig Murray - former UK Ambassador to Uzbekistan, "outsourced torture" whistleblower

Howard Rheingold - SmartMobs
Global Guerrillas - John Robb
Roland Piquepaille's Technology Trends

Vmyths - debunking computer security hype

Nick Leaton - Random Ramblings
The Periscope - Companion weblog to Euro-correspondent.com journalist network.
The Practical Nomad Blog Edward Hasbrouck on Privacy and Travel
Policeman's Blog
World Weary Detective

Martin Stabe
Longrider
B2fxxx - Ray Corrigan
Matt Sellers
Grits for Breakfast - Scott Henson in Texas
The Green Ribbon - Tom Griffin
Guido Fawkes blog - Parliamentary plots, rumours and conspiracy.
The Last Ditch - Tom Paine
Murky.org
The (e)State of Tim - Tim Hicks
Ilkley Against CCTV
Tim Worstall
Bill's Comment Page - Bill Cameron
The Society of Qualified Archivists
The Streeb-Greebling Diaries - Bob Mottram

Your Right To Know - Heather Brooke - Freedom off Information campaigning journalist

Ministry of Truth _ Unity's V for Vendetta styled blog.

Bloggerheads - Tim Ireland

W. David Stephenson blogs on homeland security et al.
EUrophobia - Nosemonkey

Blogzilla - Ian Brown

BlairWatch - Chronicling the demise of the New Labour Project

dreamfish - Robert Longstaff

Informaticopia - Rod Ward

War-on-Freedom

The Musings of Harry

Chicken Yoghurt - Justin McKeating

The Red Tape Chronicles - Bob Sullivan MSNBC

Campaign Against the Legislative and Regulatory Reform Bill

Stop the Legislative and Regulatory Reform Bill

Rob Wilton's esoterica

panGloss - Innovation, Technology and the Law

Arch Rights - Action on Rights for Children blog

Database Masterclass - frequently asked questions and answers about the several centralised national databases of children in the UK.

Shaphan

Moving On

Steve Moxon blog - former Home Office whistleblower and author.

Al-Muhajabah's Sundries - anglophile blog

Architectures of Control in Design - Dan Lockton

rabenhorst - Kai Billen (mostly in German)

Nearly Perfect Privacy - Tiffany and Morpheus

Iain Dale's Diary - a popular Conservative political blog

Brit Watch - Public Surveillance in the UK - Web - Email - Databases - CCTV - Telephony - RFID - Banking - DNA

BLOGDIAL

MySecured.com - smart mobile phone forensics, information security, computer security and digital forensics by a couple of Australian researchers

Ralph Bendrath

Financial Cryptography - Ian Grigg et al.

UK Liberty - A blog on issues relating to liberty in the UK

Big Brother State - "a small act of resistance" to the "sustained and systematic attack on our personal freedom, privacy and legal system"

HosReport - "Crisis. Conspiraciones. Enigmas. Conflictos. Espionaje." - Carlos Eduardo Hos (in Spanish)

"Give 'em hell Pike!" - Frank Fisher

Corruption-free Anguilla - Good Governance and Corruption in Public Office Issues in the British Overseas Territory of Anguilla in the West Indies - Don Mitchell CBE QC

geeklawyer - intellectual property, civil liberties and the legal system

PJC Journal - I am not a number, I am a free Man - The Prisoner

Charlie's Diary - Charlie Stross

The Caucus House - blog of the Chicago International Model United Nations

Famous for 15 Megapixels

Postman Patel

The 4th Bomb: Tavistock Sq Daniel's 7:7 Revelations - Daniel Obachike

OurKingdom - part of OpenDemocracy - " will discuss Britain’s nations, institutions, constitution, administration, liberties, justice, peoples and media and their principles, identity and character"

Beau Bo D'Or blog by an increasingly famous digital political cartoonist.

Between Both Worlds - "Thoughts & Ideas that Reflect the Concerns of Our Conscious Evolution" - Kingsley Dennis

Bloggerheads: The Alisher Usmanov Affair - the rich Uzbek businessman and his shyster lawyers Schillings really made a huge counterproductive error in trying to censor the blogs of Tim Ireland, of all people.

Matt Wardman political blog analysis

Henry Porter on Liberty - a leading mainstream media commentator and opinion former who is doing more than most to help preserve our freedom and liberty.

HMRC is shite - "dedicated to the taxpayers of Britain, and the employees of the HMRC, who have to endure the monumental shambles that is Her Majesty's Revenue and Customs (HMRC)."

Head of Legal - Carl Gardner a former legal advisor to the Government

The Landed Underclass - Voice of the Banana Republic of Great Britain

Henrik Alexandersson - Swedish blogger threatened with censorship by the Försvarets Radioanstalt (FRA), the Swedish National Defence Radio Establishement, their equivalent of the UK GCHQ or the US NSA.

World's First Fascist Democracy - blog with link to a Google map - "This map is an attempt to take a UK wide, geographical view, of both the public and the personal effect of State sponsored fear and distrust as seen through the twisted technological lens of petty officials and would be bureaucrats nationwide."

Blogoir - Charles Crawford - former UK Ambassodor to Poland etc.

No CCTV - The Campaign against CCTV

Barcode Nation - keeping two eyes on the database state.

Lords of the Blog - group blog by half a dozen or so Peers sitting in the House of Lords.

notes from the ubiquitous surveillance society - blog by Dr. David Murakami Wood, editor of the online academic journal Surveillance and Society

Justin Wylie's political blog

Panopticon blog - by Timothy Pitt-Payne and Anya Proops. Timothy Pitt-Payne is probably the leading legal expert on the UK's Freedom of Information Act law, often appearing on behlaf of the Information Commissioner's Office at the Information Tribunal.

Armed and Dangerous - Sex, software, politics, and firearms. Life’s simple pleasures… - by Open Source Software advocate Eric S. Raymond.

Georgetown Security Law Brief - group blog by the Georgetown Law Center on National Security and the Law , at Georgtown University, Washington D.C, USA.

Big Brother Watch - well connected with the mainstream media, this is a campaign blog by the TaxPayersAlliance, which thankfully does not seem to have spawned Yet Another Campaign Organisation as many Civil Liberties groups had feared.

Spy on Moseley - "Sparkbrook, Springfield, Washwood Heath and Bordesley Green. An MI5 Intelligence-gathering operation to spy on Muslim communities in Birmingham is taking liberties in every sense" - about 150 ANPR CCTV cameras funded by Home Office via the secretive Terrorism and Allied Matters (TAM) section of ACPO.

FitWatch blog - keeps an eye on the activities of some of the controversial Police Forward Intelligence Teams, who supposedly only target "known troublemakers" for photo and video surveillance, at otherwise legal, peaceful protests and demonstrations.

Spam Huntress - The Norwegian Spam Huntress - Ann Elisabeth

Fuel Crisis Blog - Petrol over £1 per litre ! Protest !
Mayor of London Blog
London Olympics 2012 - NO !!!!

Cool Britannia

NuLabour

Free Gary McKinnon - UK citizen facing extradition to the USA for "hacking" over 90 US Military computer systems.

Parliament Protest - information and discussion on peaceful resistance to the arbitrary curtailment of freedom of assembly and freedom of speech, in the excessive Serious Organised Crime and Police Act 2005 Designated Area around Parliament Square in London.

Brian Burnell's British / US nuclear weapons history at http://nuclear-weapons.info

wtwu: @ RC - insulting people is not the way to read more
RC: You're still putting two and two together and getting five, read more
wtwu: @ RC Perhaps you thinnk that www.mi5.gov.uk is a server read more
RC: a hotmail or other private email account is not an read more
wtwu: @ RC - a hotmail or other private email account read more
RC: You should perhaps re-read the definition of Personal Data read more
RC: Many people signing up to those email lists, do not read more
RC: You were the one that made the sensational claim that read more
wtwu: @ RC - I have worked for UK-based ISPs and read more
RC: I have worked for UK-based ISPs and hosting companies for read more

Sun	Mon	Tue	Wed	Thu	Fri	Sat
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30

The United Kingdom suffers from tens of thousands of pages of complicated criminal laws, and thousands of new, often unenforceable criminal offences, which have been created as a "Pretend to be Seen to Be Doing Something" response to tabloid media hype and hysteria, and political social engineering dogmas. These overbroad, catch-all laws, which remove the scope for any judicial appeals process, have been rubber stamped, often without being read, let alone properly understood, by Members of Parliament.

The text of many of these Acts of Parliament are now online, but it is still too difficult for most people, including the police and criminal justice system, to work out the cumulative effect of all the amendments, even for the most serious offences involving national security or terrorism or serious crime.

Many MPs do not seem to bother to even to actually read the details of the legislation which they vote to inflict on us.

UK Legislation Links

UK Statute Law Database - is the official revised edition of the primary legislation of the United Kingdom made available online, but it is not yet up to date.

Intelligence.gov.uk - Cabinet Office hosted portal website to various UK Intelligence Agencies and UK Government intelligence committees and Commissioners etc.

Anti-terrorism hotline - links removed in protestClimate of Fear propaganda posters

MI5 Security Service - links to encrypted reporting form removed in protest at the Climate of Fear propaganda posters

Secure Your Fertiliser - advice on ammonium nitrate and urea fertiliser security

Centre for the Protection of National Infrastructure - "CPNI provides expert advice to the critical national infrastructure on physical, personnel and information security, to protect against terrorism and other threats."

Secret Intelligence Service (MI6) recruitment.

Government Communications Headquarters GCHQ

Serious Organised Crime Agency - have cut themselves off from direct contact with the public and businesses - no phone - no email

Defence Advisory (DA) Notice system - voluntary self censorship by the established UK press and broadcast media regarding defence and intelligence topics via the Defence, Press and Broadcasting Advisory Committee.

National Extremism Tactical Coordination Unit - keeps a watch on animal extremists, genetically modified crop protesters, peace protesters etc.
(some people think that the word salad of acronyms means that NETCU is a spoof website)

UK Public ~~CCTV~~ Surveillance Regulation Campaign

NO2ID Campaign - cross party opposition to the NuLabour Compulsory Biometric ID Card and National Identity Register centralised database.

Gary McKinnon is facing extradition to the USA under the controversial Extradition Act 2003, without any prima facie evidence or charges brought against him in a UK court. Try him here in the UK, under UK law.

FreeFarid.com - Kafkaesque extradition of Farid Hilali under the European Arrest Warrant to Spain

Parliament Protest blog - resistance to the Designated Area restricting peaceful demonstrations or lobbying in the vicinity of Parliament.

Data Retention is No Solution - Petition to the European Commission and European Parliament against their vague Data Retention plans.

Save Parliament - Legislative and Regulatory Reform Bill (and other issues)

Open Rights Group

The Big Opt Out Campaign - opt out of having your NHS Care Record medical records and personal details stored insecurely on a massive national centralised database.

Tor - the onion routing network - "Tor aims to defend against traffic analysis, a form of network surveillance that threatens personal anonymity and privacy, confidential business activities and relationships, and state security. Communications are bounced around a distributed network of servers called onion routers, protecting you from websites that build profiles of your interests, local eavesdroppers that read your data or learn what sites you visit, and even the onion routers themselves."

Anonymous Blogging with Wordpress and Tor - useful Guide published by Global Voices Advocacy with step by step software configuration screenshots (updated March 10th 2009).

Amnesty International's irrepressible.info campaign

BlogSafer - wiki with multilingual guides to anonymous blogging

NGO in a box - Security Edition privacy and security software tools

Home Office Watch blog, "a single repository of all the shambolic errors and mistakes made by the British Home Office compiled from Parliamentary Questions, news reports, and tip-offs by the Liberal Democrat Home Affairs team."

Reporters Without Borders - Reporters Sans Frontières - campaign for journalists 'and bloggers' freedom in repressive countries and war zones.

Committee to Protect Bloggers - "devoted to the protection of bloggers worldwide with a focus on highlighting the plight of bloggers threatened and imprisoned by their government."

Icelanders are NOT terrorists ! - despite Gordon Brown and Alistair Darling's use of anti-terrorism legislation to seize the assets of Icelandic banks.

No CCTV - The Campaign Against CCTV

I'm a Photographer Not a Terrorist !

Power 2010 cross party, political reform campaign

Cracking the Black Box - "aims to expose technology that is being used in inappropriate ways. We hope to bring together the insights of experts and whistleblowers to shine a light into the dark recesses of systems that are responsible for causing many of the privacy problems faced by millions of people."

Open Rights Group - Petition against the renewal of the Interception Modernisation Programme

MI5 e-mail alert signup shambles - all email subscription web forms sent to the USA, without encryption

Categories:

42 Comments

Leave a comment

About this blog

Email Contact

Hints and Tips for Whistleblowers and Political Dissidents

House of Lords Constitution Committee - Surveillance: Citizens and the State

Links

Privacy and Security

Human Rights

Internet Censorship

Judicial Links

Parliamentary Opposition

UK Government

Online Media

NIR and ID cards

Surveillance Infrastructures

RFID Links

Genetic Links

Miscellanous Links

Former Spies

Blog Links

Other Links

RIPA Consultations

Counter Terrorism Bills

Syndicate this site (XML):

Follow Spy Blog on Twitter

Search

Recent Comments

Recent Entries

Categories

Monthly Archives

November 2010

UK Legislation

UK Commissioners

UK Intelligence Agencies

Campaign Button Links

MI5 e-mail alert signup shambles - all email subscription web forms sent to the USA, without encryption

Categories:

42 Comments

Leave a comment

About this blog

Email Contact

Hints and Tips for Whistleblowers and Political Dissidents

House of Lords Constitution Committee - Surveillance: Citizens and the State

Links

Privacy and Security

Human Rights

Internet Censorship

Judicial Links

Parliamentary Opposition

UK Government

Online Media

NIR and ID cards

Surveillance Infrastructures

RFID Links

Genetic Links

Miscellanous Links

Former Spies

Blog Links

Other Links

RIPA Consultations

Counter Terrorism Bills

Syndicate this site (XML):

Follow Spy Blog on Twitter

Search

Recent Comments

Recent Entries

Categories

Monthly Archives

November 2010

UK Legislation

UK Commissioners

UK Intelligence Agencies

Campaign Button Links

Tag Cloud