RUSI’s surveillance report

Following the publication of reports into surveillance recently carried out by Parliament’s Intelligence & Security Committee and David Anderson, the Independent Review of Terrorism, RUSI have now delivered their verdict on the current situation.  RUSI’s 20 recommendations broadly support those made in the previous reports, and they complement many of the recommendations made by the Joint Parliamentary Committee on the draft Communications Data Bill, back in 2012.

Little new material has been unearthed – which is not surprising, as all three bodies basically took evidence from the same group of witnesses. The witnesses included Caspar Bowden, who sadly died last week.Few people are likely to take the opportunity to read this particular report – after all, its not calling for a change in surveillance outcomes, but more of a tweak to the procedures that deliver these outcomes. Law enforcement investigators are likely to continue to be able to get what they currently get, although the they may be required to go through a different legal and supervisory regime to get it.

For those of us with really short attention spans, here are a few of the highlights that caught my eye as I read the report:

• Privacy policies can be really wordy, especially when compared to the works of Shakespeare. Hamlet has 30,066 words, Macbeth 18,110. Long privacy policies have been published by PayPal (36,275); Apple iTunes (19,972), Windows Live (14,714), Apple iOS 5 (13,366), Facebook (11,195), Google All-inclusive (10,640), Apple iCloud (10,742), Twitter (4,445). [2.42]

• In the past, neither the government nor the overseers had felt it necessary to provide information about how the law regarding interception was actually being applied in practice. As a result, these processes were not well understood by politicians or the wider public, which made the media’s allegations of wrongdoing (ie the Snowden allegations) all the more powerful. [3.5]

• The current Home Secretary Theresa May has said that warrantry decisions occupy ‘more of my time ... than anything else’. [3.40]

• Rather than provoking a fundamental shift in CSP and target behaviour, the disclosures by Edward Snowden have accelerated existing trends. For example, as targets are more security-aware, it has become much harder to intercept communications and to counter encryption. Of real concern is that co-operation from CSPs has reduced – a key issue for the police and the National Crime Agency as well. [3.47]

• During the Panel’s visit to the NCA, officers appeared satisfied with the current limit of twelve months for data retention. Any longer becomes unnecessary, as there are diminishing returns on data retained beyond this period; any shorter, however, would be problematic. Details from Operation Notarise – a substantial operation targeting people allegedly accessing child abuse images online – were used by the NCA to illustrate this. After 4,000 requests for communications data to trace who these individuals were, 92 per cent of suspects were identified, ultimately leading to 660 arrests. However, if the data retention period limit had been less than the current twelve-month period, the outcome would have been very different:

• Only 13 per cent of suspects would have been identified had the data-retention period been three months

• Thirty-nine per cent would have been identified had the data-retention period been six months

• Sixty-six per cent would have been identified had the data-retention period been nine months. [3.63]

• RUSI is particularly concerned that levels of technical understanding among policy-makers and legislators are seriously deficient and the best use is not being made of the technical expertise already available. Support and advisory bodies, such as the Technical Advisory Board and Communications Data Steering Group, are not being exploited to their full potential. Government officials must have sufficient understanding of relevant technical issues to both assess the needs of the agencies and provide credible oversight of their activities. [5.47]

• The [oversight] commissioners do not have a significant public profile. Despite providing substantial oversight of warrants and the activities of the agencies, the work of the commissioners does not currently translate into greater levels of public understanding. Their annual reports place a great deal of information in the public domain on the work of the agencies and their compliance with legal regulations, but these are not widely read or publicly debated. [5.64]

• The offices of some of the commissioners are very proficient (especially IOCCO). It is important to ensure that all commissioners are supported by sufficient resources to ensure the breadth and depth of investigations. These resources should comprise a breadth of expertise (to be able to consider broad, thematic issues), a depth of knowledge in certain areas (including technical knowledge of coding and algorithms to inspect methods of data collection and analysis, for example) and individuals from a variety of backgrounds (including those with technical, legal, investigative and NGO experience).

Lets see what legislative changes the Home Office now proposes, given the publication of these three reports.  

Sources:

http://isc.independent.gov.uk/committee-reports/special-reports https://terrorismlegislationreviewer.independent.gov.uk/a-question-of-trust-report-of-the-investigatory-powers-review/
https://www.rusi.org/downloads/assets/ISR-Report-press.pdf

.

In praise of Caspar Bowden

Many people are feeling pretty relieved that Caspar Bowden will no longer be challenging them on a wide range of privacy issues.  His recent death, announced yesterday, has removed one of the most robust critics of the surveillance community, a person who could be infuriatingly perceptive about the ways Governments tried to monitor communications technologies.

I first met Caspar a good few years ago – and while I could respect him for his deep understanding of so many technical privacy and surveillance matters, I found it hard to relax in his company. His passion for privacy was unequivocal. A pragmatist he wasn’t. And he didn't care who he upset in ensuring that his views were heard.

Often exasperating? Oh yes. Opinionated? Indeed, yes. I’ve heard may a conference chairman mutter a few more adjectives about him, too. In the conference arena, his message came across with uncompromising clarity. He would make his views known regardless of whether he was speaking from the podium or from the floor.

I remember one occasion a few years ago in Westminster, when I was organising a range of witnesses to address the Joint Parliamentary Committee on the draft Communications Data Bill. Early one evening I received an email from a clearly annoyed Caspar, demanding to be told why he had not yet been asked to address the Committee. He was a busy man, and needed to make time in his schedule to be available to explain some of the remarks that he had made in a detailed paper that had recently submitted for the Committee’s consideration.

I wondered whether I should point out that it was generally the case that Parliamentary Committees would decide who they wanted to hear from. It was not up to witnesses to determine whether they had a right to address a Committee.

I placated Caspar by explaining that I thought he might make the most impact by being one of the last witnesses to be called – leaving the Committee of MPs and Peers (one of whom is now the minister for Data Protection) with a much stronger impression of who he was and what he stood for.

He liked that idea – and even gave me a friendly smile the next time we met. He was determined to tell those parliamentarians a thing or two.

And he did.

. 

Leadership at the ICO

Given David Smith’s impending retirement, it won't be too long before we learn the identity of his replacement.

And what will we expect from this appointment?

Hopefully, his replacement will be a robust individual who has plenty of practical experience with data protection issues. They really need to get to know their way around the privacy field quickly. It takes time to become fully acquainted with the more arcane and esoteric aspects of data protection law, and there will be plenty of snotty data professionals who will only be too keen to trip up the newbie by trumping their own knowledge of dp gumpf.

Since 1984, the data protection community has developed an obscure language, shrouding what ought to be reasonably simple terms in incredibly complex jargon. Will the new incumbent know the difference between explicit and unambiguous consent? (Do many people care greatly about the difference between the two?) Will the incumbent know how to explain the difference between a Privacy Impact Assessment and a privacy audit? How will the incumbent explain to an incoming Information Commissioner what it is that the new Commissioner will be expected to be talking about?

And, just as importantly, how will the new incumbent deal with the constant heckling from a tiny band of tweeters whose sole purpose in life appears be to comment on just how awful and ineffective  the ICO is?

But that's only what the regulated will expect of the new incumbent.

Those actually working at the ICO will be seeking someone with additional skills. Someone whose management skills are such that things get done. Someone who ensures that people who expect to be paid fairly are put in their place. And someone who can raise the internal staff satisfaction scores to an acceptable level. In short, someone who will be an effective member of the Executive Team.

Soon, both the regulated and the staff will know who this person is.

Good luck to them.

.

Is there really a serious concern with charity fundraising calls?

I’m not an avid reader of the Daily Mail, and I approach many of the articles with a certain degree of scepticism. I’m sure that lots of their journalists are bright individuals who seek to both entertain and inform their readers. And I recognise that they’ve got a job to do – which is to provide material that is sufficiently engaging for readers to take account of the adverts that are surround their stories.

A recent campaign has caught my eye – evidently, there are unacceptable practices in the charity fundraising sphere, and the Daily Mail is leading the campaign to stamp them out.

And, apparently, the ICO has vowed to investigate immediately, saying the charities could be breaking the law.

I’m looking forward to the results of this investigation which, if true, will be yet another nail in the coffin of the cold calling industry. But I want to wait for the facts before rushing to condemn.

Many of the people I know in the charity fundraising industry adopt extremely high ethical standards. I’m sure that they would be appalled if the behaviours that have been alleged by the print media (sections of which are still reeling from phone hacking scandals that they themselves played no small part in) are indeed true.

There will always be rogue cold calling companies, and the ICO does what it can to deter them. Coincidentally, there was no direct criticism of charities in the ICO’s latest annual report, launched last week, either in the report itself or from Christopher Graham or David Smith when they spoke at the event, so I’m really not sure just how significant a problem this is.  

   

If this was a really significant problem that particularly affected the charitable sector, I would have expected to have heard more about the relevant concerns directly from the ICO well before now.

Source:

http://www.dailymail.co.uk/news/article-3151533/Shamed-charity-cold-call-sharks-Britain-s-biggest-charities-ruthlessly-hound-vulnerable-cash-try-opt-receiving-calls.html

Image credit:

http://www.tintup.com/blog/7-tips-on-how-to-cold-call-effectively/

.

Top tips for preparing PIAs

I’ve recently had one of my PIAs placed on the public record in Ireland, so I’m free to speak more generally about it. The assessment was on a programme the Irish Government hopes to implement – shortly, all postal addresses in Ireland are to be given a unique postcode.  This gave me the opportunity to assess how the programme addressed the particular challenges of Irish data protection legislation.

In a nutshell, I recommended that the Irish law be changed to reflect the obligations that would be imposed on organisations that processed Eircodes. This recommendation was accepted, and legislation is currently making its way through the Irish Parliament. It has completed its stages in the lower chamber and is now before the upper chamber.

As the Minister reported to Parliament:

“The final significant element of the project is the enactment of this legislation. It will ensure members of the public can have absolute confidence in regard to data protection. The primary purpose of this legislation is to enshrine the highest levels of data protection within the postcode system. It also provides the clearest possible reassurance that all personal data will remain secure. My Department has consistently taken a strong line on data protection in the design, implementation and operation of the project. The contract we have with Capita reflects this approach. As Minister, I have decided that this approach must be confirmed in primary legislation to ensure the greatest level of protection for citizens. My Department has had ongoing engagement with the Data Protection Commissioner.

My Department has also completed and published a comprehensive privacy impact assessment even though it is not a statutory requirement. The purpose of the privacy impact assessment is to ensure any potential privacy impact on individuals as a result of the introduction of Eircode postcodes is recognised and addressed. The assessment has concluded that the introduction of Eircode postcodes is unlikely to have any significant adverse effect on the right to privacy. All the recommendations contained in the assessment have been incorporated into this Bill. The Bill represents a sensible and pragmatic approach to data protection as it relates to postcodes. It sets out the high level principles underpinning a protective framework and strikes a balance between ensuring the commercial viability of postcodes while at the same time underpinning data protection.”

As the (36 page) executive summary of the PIA is now available, I thought it might be useful to share some thoughts with fellow practitioners who are charged with the requirement to write PIAs.

1.     Who is your audience?

a.     If the data controller is a public authority, the language used in the report should not be too technical, as Freedom of Information provisions mean that it may be made available to members of the public, and they would expect to understand it.

                                               i.     Consider incorporating in the report an annex that explains the project in non-technical language.

                                              ii.     Consider incorporating in the report an annex that defines technical terms and acronyms in plain language.

                                             iii.     Be careful when listing in an annex, the names/ job titles of individuals who were consulted as the assessment was being written – these individuals have privacy rights, too, and the more junior employees may not expect to be publicly identified with the project.

                                            iv.     Take care to ensure that the language used in describing the potential privacy risks is written in ways that make it difficult for other parties to use extracts from the PIA out of context.

b.     If the data controller is not subject to Freedom of Information provisions, the language used should still be sufficiently clear that senior managers can understand the process that was followed to reach the conclusions and recommendations in the assessment. The author can be more frank in their assessment of the project if it is clear that the document is for internal purposes only.

2.     Who should be consulted?

a.     If the data controller is a public authority, there may be a greater need to ensure, if citizens rather than employees are to be impacted by the project that is under assessment, that the concerns of citizens are properly taken into account. This is also to ensure that the project under assessment not only meets the legal conditions that are set out in the data protection legislation, but also that from a more general fundamental rights perspective, the project is likely to be socially acceptable in that it meets the legitimate expectations of the community.

b.     If the data controller is a not a public authority, there is less of an obligation to consult customers or potential customers.

3.     What role should project managers play in carrying out effective assessments?

The role of project managers is to provide factual information to the assessor. It should not be assumed that these managers have a significant amount of privacy experience. Accordingly, the task of analyising the facts from the perspective of compliance with privacy obligations and data protection legislation should be left to suitably qualified and experienced privacy professionals.

4.     How frequently should the PIA be revised?

a.     PIAs can be viewed as snapshots that are taken at a particular stage of the project. If the assessment is carried out at an early stage in the project, it is possible that quite a wide range of issues which need to be addressed will be highlighted. As the project matures, many of these issues ought to be resolved, so a PIA review mid-way through the project is useful to ensure that not only have existing risks been addressed, but that no new issues have emerged.  If new issues do emerge, these should be captured in subsequent versions of the assessment.

5.     What summaries of the PIA should be prepared?

The Article 29 Working Party has recommended that Privacy Impact Assessments should include a section to demonstrate more generally compliance with the privacy targets. Since the privacy targets are mandatory and not negotiable, assessments should describe how each target is being implemented, or explain why it has not been implemented.

Accordingly, it is useful to consider incorporate a one or two page table summarizing the issue.

Sources:

http://www.eircode.ie

http://oireachtasdebates.oireachtas.ie/debates%20authoring/debateswebpack.nsf/takes/seanad2015062500002?opendocument#R00100http://www.dcenr.gov.ie/NR/rdonlyres/7F434454-9CCB-4D0C-A04C-5E265C0B5DE6/0/PIAExecutiveSummary.pdf

http://oireachtasdebates.oireachtas.ie/debates%20authoring/debateswebpack.nsf/takes/seanad2015062500002?opendocument#R00100
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2013/wp209_en.pdf

.