Spy Blog - SpyBlog.org.uk

My congratulations to the team who obviosly have spent many hours researching this. A wonderful article.

This I fear will be level of attention from all the government departments collecting information about us, we already know that our DNA records are kept by 3rd parties.

I think the biggest threat to the UK now is the mass of spam that will hit us over the coming weeks and months, headed M15 Threat Level, coming from clever marketing companies in the US, dropping cookies, viruses, bugs, trojans etc onto unsuspecting machines, knowing that everyone who has signed up to this will be expected to open it, just in case its the real thing......

If you worried about botnets, I suspect you aint seen nothing yet....courtecy of the UK security services. Not fit for purpose.... not fit full stop.

OH, and by the way, Mozilla have been publishing a UK version of an RSS feed plugin for security level for 6 months, taking its feed from the Home Office Homepage, called UK threat level, available on https://addons.mozilla.org/firefox/extensions/
which IS at least a secure site.

RSS extentions from Mozilla.

Threat Level UK
https://addons.mozilla.org/firefox/3396/

Homeland Security Threat Level
https://addons.mozilla.org/firefox/1586/

@ IanP- the article took much longer to try to format properly, than to research !

The insecure web form script took literally about 30 seconds to find, and the US location of the server, about 5 minutes to confirm.

Setting up some email accounts and subscribing to the email alert lists and examining the responses took a bit longer.

The risk from spammers targeting the lists of people who have subscribed is, as you point out, a very real one.

Will the other Home Office and MI5 stories in the news at the moment bury this one ?

I sent the following to a list of MP's this morning, perhaps we need to get them on our side to put some pressure on the government to stop this madness, before no-one in britain has a unique and safe ID anymore.

Sirs,

If you have not yet had an opportunity to read the article in Spy Blog this morning, can I please suggest that you
take a look.

I would like to ask that you can all use your influence on behalf of the british public to get the programme of databases
stopped or halted in order to conduct proper evaluations on what data is being collected, what it is to be used for, where
its is to be held, who will have access to it, and an assurance to the public that our information is safe, which in the case
of the M15 database it clearly is not.

http://p10.hostingprod.com/@spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html


I thank you all for your attention in advance.

many thanks
regards

+++

Do you think that the people at WhatCounts Inc. are actually aware that they are, via one of their customer's or OEM partners, hosting an email service for a foreign intelligence agency and prime terrorist target ?

Good analysis. I like this site a lot - but I'm struck by how such a tech-savvy blog can have such ugly permalinks.

@ Chris R - what would you suggest to improve the permalinks ?

It would appear that MI5 are not the only public body to use US hosting. Comments below taken from the Privacy Policy page on the Nick Robinsons Newslog. This one is registered in Delaware, where the privacy laws are the laxest in the US.

quote
You should be aware that this blog site is currently being hosted by Six Apart Ltd on behalf of the BBC and if you send an e-mail comment into the blog your e-mail address will be held by Six Apart Ltd on web servers in the USA.

Your e-mail address will only be held by the BBC and Six Apart Ltd and will be used for the purpose of administering this blog site.
unquote

Does no-one use UK companies anymore.?

@ IanP - when this blog had to move from its former UK webspace provider, since they imposed arbitrary process memory limits, which prevented Movable Type from re-building indices etc.. The current US hosting deal seemed attractive - offering more bandwidth, more disk space, more administration tools, for less money, so it seemed worth giving it a try.

The vague plans by the UK Government and the European Union to censor web sites containing "dangerous knowledge", was also a factor in deciding to move this webspace to the USA for now.

There is no good reason why some UK Government websites or email services or public sector ones like the BBC (which, of course has an international presence in many countries) should not be hosted in other countries, especially the European Union, and vice versa, except where National Security is a factor, as in this MI5 example.

In which country is the Home Location Register of the 3G mobile phone which you happen to be using ? It is not necessarily in your home country.

One of the many scandals involving the bankrupt and then revived WorldCom telcomms and internet company, was that they were selling the US Government supposedly private telecomms circuits, but were actually least cost routing the calls and data traffic through arbitrary foreign countries if it was marginally more profitable to do so, with similar security and privacy worries for the customer, just like the MI5 e-mail list situation
.

The e-mail terror alert was obviously a rushed job, as your excellent analysis points out.

One can spot the classic news management technique of synchronized information release. The e-mail terror alert information was released as the following two pieces of information were also aired:

1) The Mi5 head told senior MPs (on the morning of 6th July 2005) that there was no imminent terrorist threat to London or the rest of the country less than 24 hours before the events in London on July 7th 2005.

2) Mi5 had Mohammad Sidique Khan, and fellow accused Shehzad Tanweer under surveillance (& had audio & video recordings of at least Khan) around the time of 'Operation Crevice'. [The 'Crevice' trial is currently ongoing and there are hints of more revelations re Mi5's prior contact with those accused of the 7the July events.]

The e-mail terror alert news item was picked up on by the mainstream media, rather than the two more damming pieces of information.

RELEASE THE EVIDENCE
====================

1) MI5 Email List

I'm at a lost as how to explain the shabbiness of this system. I'm guessing one of two things has happened:

MI5 considers the whole concept of the Terrorometer to be a cynical exploitation of people's fears. MI5 were requested by Commissar Reid to create this mailing list. Being dutiful civil servants, they complied with his request but implemented it with as little effort as possible, thus freeing their time and resources to concentrate on more important things.

-- or --

MI5 doesn't care about the privacy of those subscribing.

-- or --

The people responsible for the security of my beloved country have implemented a system to the best of their abilities.

---

In 1997, I'd have said it was the first one but now I'm not so sure. We're all completely fucked if it's the latter.

2) Compliance with the DPA.

So MI5 has contracted out the work for maintaining this mailing list to Mailtrack, who have then subcontracted the work to US-based WhatCounts.

Mailtrack has 6 Purposes registered with the ICO for using of personal data, all marked "Transfers: None outside the European Economic Area"

WhatCounts have no EU Safe Harbor Principles listed on their site, so I can only assume they do not comply with them.

Dont know the legalities of this... sure the ICO could help though.

The announcement by MI5 that they will start issuing terror alerts via email is worrying. The ramifications have not been properly thought through - email is a very poor medium to choose for an alerting mechanism.

The average person will not be able to tell if an email sent to them is really from MI5 or not - which will predictably lead to a lack of trust in whether or not any MI5 email alert can be trusted.

More here:

http://blogs.authentium.com/sharp/?p=37

[moved from a different comment thread]

@ Sharp - MI5 is only issuing e-mail alerts about the infrequent changes to the official Terrorist Threat Alert Status, which for the foreseeable future only seems to have two states, either SEVERE or CRITICAL.

Nobody really knows what they should or should not be doing differently, under either Threat Level. e.g. when the Level was declared CRITICAL in August, over the alleged they binary liquid explosives on airliners plot, all the security procedures which had been planned for at Heathrow Airport etc. were very different to what people had been trained and equipped for previously, since they also, very arbitrarily, changed the hand luggage rules and the frequency of pat down searches of passengers.

If the UK Government were to ever issue actual targeted alerts about specific threats, then one would hope that would use Digital Signatures.

However, that seems to be well beyond their managerial capabilities at the moment.

They do appear to have vague plans for sending these status change alerts via the equally potentially insecure method of SMS text messages to mobile phones.

On the permalinks, the link for this item is:

http://p10.hostingprod.com/@spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html

So it would be nice if it started with spyblog.org.uk and even nicer if the 'slug' was shorter, e.g. like this:

http://spyblog.org.uk/blog/2007/01/mi5_email_alert_signup_shambles.html

[quote]I'm at a lost as how to explain the shabbiness of this system. I'm guessing one of two things has happened:

MI5 considers the whole concept of the Terrorometer to be a cynical exploitation of people's fears. MI5 were requested by Commissar Reid to create this mailing list. Being dutiful civil servants, they complied with his request but implemented it with as little effort as possible, thus freeing their time and resources to concentrate on more important things.

-- or --

MI5 doesn't care about the privacy of those subscribing.

-- or --

The people responsible for the security of my beloved country have implemented a system to the best of their abilities.

---

In 1997, I'd have said it was the first one but now I'm not so sure. We're all completely fucked if it's the latter.[/quote]

J7 Truth,

I agree.... and it could even be worse than we think for the Intelligence being used mightn't be True Blue but more Star Spangled

I hate to agree with a foilhat but it'd say 'J7 Truth' is right.

A system implemented, in a rush, to media manage a bad story

From Mailtrack spokesperson:

Mailtrack Ltd does not have a contract with MI5 and has not produced any of the web forms being discussed here.

We have advised all parties that these web pages should be removed until all necessary security measures have been implemented.

Can WTWU confirm this is Mailtrack in a call / email to their press department?

If this is Mailtrack, MI5's attempt to bury bad news with Terrorometer emails has just backfired.

You have provided a most comprehensive overview of some serious issues. I represent WhatCounts and would be happy to answer any specific questions you or any other people directly involved may have. MI5 is not our direct client and until just now I was not aware of these uses of our platform. We always prescribe rigid security measures but it's entirely up to our clients to fashion different uses of our technology. While I agree with most of your analysis, I don't believe it's entirely fair or accurate to assume that sending subscription signup data in an insecure manner puts at risk the entire body of information stored on our servers (or our clients servers since we offer those as well). It certainly could expose that individuals email address, but not others. And none of this should suggest some new, greater potential of spam. We don't allow our clients to send unsolicited email and take measures to remove them from our services if we discover abuses. Again, happy to discuss further in email or by phone, should anyone so desire. I'm GMT +8. Again, great analysis of what seems like an important issue.

@ChrisR,

This works if you also take out the "blog/" part of the url, so a permalink to this page can be constructed by hand as:
http://spyblog.org.uk/2007/01/mi5_email_alert_signup_shambles_email_subscriptions_sent_to_the_usa_without_encr.html

But yes it would be nice to have that generated automatically!

br -d

@ David Geller - please check your email for some more Questions

@ David Mery & Chris R - surely you do not re-type any URLs letter by letter, rather than using "Copy Link Location" & "Paste" ?

Would you prefer shorter, more cryptic titles to these posts ? One of the advantages of a blog over a newspaper is the ability to use much longer titles.

@ anonymongo - MI5 "The Security Service" has only 3 Purposes registered:

1. Staff Administration

   Transfers: Worldwide

2. CONCLUDING AND PERFORMING COMMERCIAL AGREEMENTS

Transfers: None outside the European Economic Area

3. PROPERTY MANAGEMENT (CCTV COVERAGE OF THAMES HOUSE

Transfers: None outside the European Economic Area

and also -

Statement of exempt processing:

This data controller also processes personal data which is exempt from notification.

The latter means their actual intelligence databases, which is not what the e-mail notification list subscription personal data is about.

@wtwu,

Of course I use copy/paste.

In case you may change hosting service at some point in the future it makes sense to delete the fist part of the URL. What is ennoying but not such a big deal is that in the path to the page there's blog/ present in one case and not in the other.

All the recent links to this blog I made on my site have been of the form http://spyblog.org.uk/yyyy/mm/long_title_is_fine_though_sometimes_a_short_title_is_also_unfortunately_appropriate_such_as_the_last_entry_on_my_blog_have_a_good_night

br -d

@ David Mery & Chris R - ok, will see what can be done, when the current high level of traffic dies down a bit.

@wtwu
No hurry - keep on posting good stuff here!

Normally I don't really care what URLs look like, but I was putting a link to your posting elsewhere (Schneier.com) and it just looked really incongruous pasting a URL over 140 characters into it, especially beginning with the name of a hosting company.

In fact it began a whole slew of comments about using tinyurl.com to wrap up long URLs:
http://www.schneier.com/blog/archives/2007/01/mi5_terror_aler.html

The MI5 email list subscription system has been modified.

See: MI5 e-mail list subscriptions now more secure than at launch

Has anyone looked at how/where the No 10 Petitions site stores user data?

@ Ian - petitons.pm.gov.uk appears to be hosted on Easynet here in the UK.

The mysociety.org developers have published a schematic diagram of how the system works, and how it is designed to to cope with large volumes of sign ups and emails, in case a large NGO motivates its membership to sign a particular petition:

http://www.mysociety.org/2006/12/08/under-the-bonnet/

Ir would be better if this data, which does seem to be all within the UK, was protected through SSL, but publicly identifying yourself as demanding, say, that Tony Blair stands on his head and juggles ice cream etc. (an actual petition) is of a lot less interest to spammers and terrorists and foreign intelligence agencies, then who has signed up for information from MI5.

Although much thought out and very well investigated, I would guess (and this is only a guess) that providing something as trivial as an email based alert system would have been delt with non technical departments within MI5. Infact in most cases public facing information services would be controlled by PR departments set up specifically for this kind of requirement. However if such concentration alerts those to government agencies and their practises, may it not also be a warning to those who sign up for commercial organisations alerting services, who will gain less attention from the media but will also follow similar cost saving practises in order to set up mass mailing systems to alert people of products or services that they offer.

I noticed that, once some has subscribed to the MI5 alert service, the confirmation text is CHANGED.

This article report:

"You will receive an e-mail shortly asking you to click on a link to confirm
your subscription."

But today I just read THIS text:

"We will send you an e-mail in the next few days asking you to click on a link to verify your subscription request."

Something at MI5 has moved?

@ Rodri - yes, some changes were made on Friday night - see the more recent blog articles:

• "MI5 e-mail list subscriptions now more secure than at launch"

• MI5 email subscription data scandal - misleading Mail on Sunday article
• Cabinet Office media spin over the MI5 email subscription data affair
  

The system seems to be in limbo "for a few days" and, although it is still not fully hosted on secure UK Government infrastructure, it is no longer sending your personal details unencrypted to various third parties in the USA.

There are lots of questions about who exactly ordered this system to be rushed online, circumventing the normal security review "sanity checks" and usability testing.

Why did the system have to go live at this particular time in such a hurry ?

I have worked for UK-based ISPs and hosting companies for the last 10 years and, I must ask, what is the specific point your article is trying to make?

sending all our personal details (forename, surname and email address)

You can send completely fake details for the first two and the email address can be a hotmail (or similar) account set up with fake details too.

unencrypted

Encryption is normally only used when personal details such as credit card numbers, bank details or addresses are involved. It's rather unusual for it to be used for simple email subscription forms. You have probably given your email address away hundreds of times before on similar forms (or by using the Out of Office reply feature in MS Outlook).

The only risk you take is getting spam, and any ISP worth its salt already has an effective spam blocker in place... and any decent email client can mop anything mnissed by that.

to commercial third party e-mail marketing and tracking companies

Again, this is standard practice for email subscriptions. Such companies keep their clients' data separate and use it in accordance with their respective briefs. I wouldn't trust such a company any less than I would trust any other company.

which are physically and legally in the jurisdiction of the United States of America

What are you implying? That this somehow means that the hosting company they used just allows marketing companies access to email subscriptions lists? That is no more likely in the US than in the UK.

What would you prefer? Would you rather that all of this data you consider to be confidential to be managed by the underpaid IT monkeys that work for the UK Government? Would you rather it was all stored on some cheap, nasty, cobbled-together, in-house server solution?

It seems as if you have got your wish. Hope you feel warm and secure now.

@ RC -

I have worked for UK-based ISPs and hosting companies for the last 10 years and, I must ask, what is the specific point your article is trying to make?

One would have expected someone with your experience to have grasped the problems almost immediately.

Many people signing up to those email lists, do not have the option of using a pseudo anonymous email address, e.g. if they work for a Government department, the armed forces, the Police, the other Emergency Services, the NHS etc.

The modified system does mention that you can sign up anonymously, the original one did not.

You should perhaps re-read the definition of Personal Data under the Data Protection Act 199, which both the original and the modified sign up forms gave the impression that they were compliant with. That was simply not the case with the system as launched.

It seems as if you have got your wish. Hope you feel warm and secure now.

What sort of a "shoot the messenger" comment is that ?

You were the one that made the sensational claim that MI5 "sending all our personal details" abroad. An email address hardly constitutes all of my personal details.

What do you think you can get from an email address, or even an email address with a name (if someone actually gave their real name?

Well, you have my personal email address, and the IP address assigned by my ISP will be somewhere in your webserver logs. Tell me what further information you can get, beyond what I have already revealed in my posts? Can you get my bank or credit card details? Can you get my home address?

No. All you could possibly do is sign me up for spam and phishing emails, but I'm already likely to be on every spam list out there already, as I have a relatively common first and last name, and the domain part of my email address is extremely well-known.

Do I worry that your own site is not SSL encrypted? Do I worry that someone is snooping this post I've just sent? No, not really. I only make sure that a site is SSL encrypted when I am giving out sensitive data, such as credit card details, bank details or my home address.

As for my "shoot the messenger" comment, it is paranoid hysteria built around misconceptions about computer security that sometimes force companies to abandon one perfectly reasonable approach in favour of another that is more politically sensitive, but not necessarily any more sound.

Many people signing up to those email lists, do not have the option of using a pseudo anonymous email address, e.g. if they work for a Government department, the armed forces, the Police, the other Emergency Services, the NHS etc.

Anyone can sign up for a hotmail.com email address and give false details; their occupation has nothing to do with it. All you need is a computer with access to the Internet. Microsoft require no verification of any of the details you give when creating a hotmail account.

You should perhaps re-read the definition of Personal Data under the Data Protection Act 199, which both the original and the modified sign up forms gave the impression that they were compliant with. That was simply not the case with the system as launched.

As a security consultant, I am well aware of the scope of the Data Protection Act. You should re-read the section on "Sensitive Personal Data" (http://www.opsi.gov.uk/ACTS/acts1998/80029--a.htm#2), as well as the definition of the more generic term "Personal Data" (http://www.opsi.gov.uk/ACTS/acts1998/80029--a.htm#1).

The only "personal" data you can get from someone's email address is their ISP (and possibly their name), and the only data you can get from an IP address is a crude geographical location, that isn't necessarily accurate.

@ RC - a hotmail or other private email account is not an option for many people working in say, the Police or the Military, or even in many private sector companies, not because they cannot sign up for one privately, but because they are simply not allowed to use such an account from their work computers, as a matter of organisational or security policy

It is likely that the people who have a professional interest in subscribing to the MI5 email lists, the ones who may need to take some specific actions when the Terror Alert Level changes to CRITICAL, will need to do so from their work email addresses.

Signing up via a web form gives out a bit more information than just your IP address, there are also details of any proxy servers and of the web browser software details, some of which are characteristic of particular organisations, e.g. a certain Police force is readily distinguishable from other users of the Police National Network.

Spy Blog is just a blog, and is nowhere near as worthwhile a target for foreign intelligence agencies or terrorist sympathisers as the MI5 email lists are.

If we ever did ask for user registration details on Spy Blog, something which would reduce the number of comments substantially, it would be done via an SSL / TLS encrypted web form.

a hotmail or other private email account is not an option for many people working in say, the Police or the Military, or even in many private sector companies, not because they cannot sign up for one privately, but because they are simply not allowed to use such an account from their work computers, as a matter of organisational or security policy

It is likely that the people who have a professional interest in subscribing to the MI5 email lists, the ones who may need to take some specific actions when the Terror Alert Level changes to CRITICAL, will need to do so from their work email addresses.

What a absurd statement. Of course people working in any of those sectors already recieve email alerts about changes to the threat levels.

This email service you are lambasting is purely for the general public as a government information service. They are simply offering an aIternative method to viewing the same information that's on their website?

I'm starting to think that you've got hung up over the MI5 name here. Do you really think MI5 have anytthing to do with the MI5 website? Do you think MI5 IT staff had any involvement in this system you are criticising? Perhaps you thinnk that www.mi5.gov.uk is a server on MI5's network?

Spy Blog is just a blog, and is nowhere near as worthwhile a target for foreign intelligence agencies or terrorist sympathisers as the MI5 email lists are.

Again.. you seem to assume that a terrorist is desperate to obtain email addreses of people who want information that is already publically available on government internet websites.

@ RC

Perhaps you thinnk that www.mi5.gov.uk is a server on MI5's network?

Obviously not, but that does not make it any less of a symbolic target for terrorists, or the email list data of any less interest to foreign intelligence agencies.

You're still putting two and two together and getting five, as you have consitently done throughout your little 'investigation'. And I really don't think you have any idea how IT systems are managed by the UK Government.

You've certainly proved the old adage that "a little knowledge is a dangerous thing". All you've done is hysterically wield a few very crude investigatory network tools (traceroute, whois, et al.) like a child with his dad's magnifying glass, and suddenly you think you're Clifford Stoll, hot on the trail of some terrible hole in our country's security, and all because you're looking at a website that has the word MI5 on it.

Well you're not. You've got absolutely nothing, and in each successive post you reveal to me how little you know about commercial IT systems, how little you know about the UK Security Services and how little you know about terrorists or terrorism. The only people you'll ever convince are people who are similarly ignorant. Don't worry though... that's the vast majority of this country, including that gullible 'Technology Correspondent' from the BBC News website.

All you've started to uncover is simply the way the vast majority of companies and governments run their IT systems. Systems that contain sensitive data are protected as well as can be afforded and systems that contain benign data are not. Some systems are managed in-house and others are farmed out to third parties.

That email list you're so concerned about will only ever contain the email addresses of civilians who are interested in getting updates from a government website. Big deal. Such a list is of absolutely no use to a terrorist whatsoever. The information being mailed out is public domain, and the only people who would sign up to such an email list are the eternally paranoid tin foil hat brigade. Hardly terrorist targets. Normal, mentally balanced members of the public have no idea what the current (supposed) 'threat level' is and couldn't care less.

@ RC - insulting people is not the way to win an argument.