Slashdot Mirror
Ask Slashdot: Jamming UK Metadata Collection?
AmiMoJo writes: It looks likely that the UK will try to require ISPs to collect metadata on behalf of its security services, and various other agencies will have access to this vast, privacy- and security-destroying database.
How can individuals resist? Some metadata is trivial to hide, e.g. much email is encrypted between the user and server, but a record of an access will still exist. Would there be much benefit to creating fake traffic, say by sending dummy emails to yourself? What about fake browsing, or keeping TOR running 24/7 (not as an exit node, just a client)?
The goal is to make the data less useful and harder to tie to an individual or separate from fake data, and to increase the cost of collecting and storing such data. Don't worry, I'm already on the list of known dissidents anyway.
How can individuals resist? Some metadata is trivial to hide, e.g. much email is encrypted between the user and server, but a record of an access will still exist. Would there be much benefit to creating fake traffic, say by sending dummy emails to yourself? What about fake browsing, or keeping TOR running 24/7 (not as an exit node, just a client)?
The goal is to make the data less useful and harder to tie to an individual or separate from fake data, and to increase the cost of collecting and storing such data. Don't worry, I'm already on the list of known dissidents anyway.
Use pen and paper. Personal papers have more legal protection than digital data that cross over the ether.
People forget how this data is really collected. They aren't looking at packets and breaking encryption between the client and server. They are tapping into the endpoint. They are accessing the Gmail/hotmail server endpoint databases. I am in the network monitoring field and I can tell you there isn't enough horsepower to do packet based monitoring of large numbers of people. They are getting the data because Google. Microsoft, Apple, etc are giving them access to their datastores.
If you run an exit node you will generate lots of useless data for them to collect. Just dont forget to blacklist all the popular torrent sites that are blocked in UK in the tor config file, otherwise unsuspecting TOR users will get the 'this site is blocked' message. There are no laws against running an exit node, I did run one before in Ireland and had no trouble, although they are more fussy in UK mainly due to a difference in mentality - the powers that be think they are actually stopping real terrorists with the work they do.
Simple. If you use a phone, you use someone else's network, and do things that are impossible for them to let you do without them knowing what you're doing. You can't call someone without the phone company knowing who you're calling.
And the internet is a public place, period. Don't do anything on the internet that you wouldn't do in your front yard, with the neighbors watching.
If you don't like it, tough. The rules of reality don't need your approval.
TrackMeNot is a browser-extension for Firefox and Chrome that sends semi-random search requests to several search engines with the goal of disrupting this sort of tracking. Well, it's more aimed at preventing commercial entities from creating an accurate picture of your web-browsing habits, but it probably adds some noise to the intelligence gathering too. By default it pulls random keywords from newspaper headlines, but you can configure it to use (or avoid) certain keywords, as well as tweak the frequency of the requests. It runs automatically in the background whenever your browser is open.
TrackMeNot isn't really useful in hiding your behavior; it just throws in spurious data that makes legitimate data look less accurate. It's really aimed more at devaluing marketing databases with the (admittedly vain) hope that they'll give up on the whole thing ;-)
Note: it does use extra CPU cycles and bandwidth, so if you are constrained in either this tool may not be for you. Also, tweak the timing of those search requests carefully or the search engines might blacklist you as a bot. Having said that, I've been using this plug-in for several years now and it's rarely caused me any problems.
Here is a new form, the same as the fighting spam one with minor changes. Feel free to use it as most of the measures proposed to fight surveillance fail for the same reasons.
Your only option is to have your own email server at home which requires encryption on both ends.
Hillary? Is that you?
Have gnu, will travel.
Back in the nineties, I discovered the internet and its freedom as a wonderful tool that proved the freedom-based values of the Western society. Moreso, as I was (and am) living in a former communist country in Eastern Europe. Imagine my delight, coming from a closely monitored society to such a wonderful and open global community!
However, I have noticed a worrying trend, mostly in opinions posted in forums or other places by Westerners (American and European alike), that too easily dismissed any threats to the personal freedom in various topics. From trivial but excessive forum moderation (which to me resembled too much to the communist censorship) to political issues where leaders pressed and were allowed to limit liberties such as the freedom of speech, for dubious reasons (political correctness, security in matters presented by exagerating imaginary threats, etc.). I understood one thing then: your society was utterly vulnerable to becoming a closed one, even to transform into an oppresive one, for one very simple reason: you didn't see first hand how a dictatorship works, how the officials' behavior in an oppresive state behave, and how they talk. We've seen those and painfully endured their effects, over a long time. I was able to detect the signs of the emerging surveillance society in the West since those times. I tried to express my concerns in open forums, and been bashed by the all-knowing arrogance of those who thought nothing bad can happen with the civil rights.
They were wrong. And now it's too late. You are asking what you can do as an individual. You can't do anything at this point, all you'll achieve will make you look suspicious, and they will monitor you even closer. Individuals can no longer make any difference, we would need a miacle to prevent the Western world repeat all the mistakes of the dictatorships in the Eastern Europe. It would involve a huge community coherence in working to change the laws, and only voting for those who don't want to control us all (although they are becoming an extinct species). And fighting with all available *legal* means against surveillance and control, without being tempted by using non-democratic shortcuts (such as voting for populists that only tell you what you want to hear). Very, very hard.
So, yeah, you won't like my response to your topic, but hopefully you do at least understand.
When you're not browsing run a script that will surf random web sites for you, go to bbc.co.uk and you'll find hundreds of links, follow them, find more links, follow them, etc. Occasionally pull a word from a web page and do a google search, then follow a bunch of the search results, and follow links on them, etc. Build in a random timer function so it looks like a human surfing. The idea is to make the haystack bigger so the needle is harder to find.
Then do all of the surfing you don't wan them to know about from a WiFi hotspot with a spoofed (random) IP address using a virtualized OS incidence that is scrubbed afterwards.
"Grab them by the pussy" -- President of the United States of America
This answer, like almost all the other answers in the discussion is an answer to the question
that's not the question the article asked. The question was
It's a completely different thing. The aim of reistance is to create consequences and problems for the authorities and visible protests shown to other people. It's something completely different. You do not resist by being entirely hidden. That makes no difference to other people. You resist by making things more costly / dlfficult / complex for the security services.
It's probably also not a good idea to resist the wrong things. The ostensible aim of surveillence is to stop terrorism. If you actually or apparently make investigation of terrorism difficult that won't work out for you. Instead you probably want to resist something different; e.g. deliberate spying for non-terrorist crimes (and keep paedophilia out of it too).
One example that makes metadata collection much more difficult is Bitmessage. Its main feature is uncensorability rather than anonymity, but it scores very high on the anonymity scale as well. Its metadata is encrypted, so additional actions and costs are necessary to deanonymise the users. It also has uncensorable shared communication feature called chans. There are gateways that provide connectivity to email. Disclaimer: I am one of the developers of Bitmessage and I also operate one such gateway, https://mailchuck.com.
I plan to pay a few quid a year for a VPN. My ISP can then collect my metadata, it won't be terribly useful having only a single IP address and port.
It really depends who is getting the keys to the many months of ISP log retention databases without court oversight as part of their everyday tasks. :)
NGO's, trusted and cleared US brands in the UK helping with all image tracking, comparing image content, file names, government workers with a task to find financial, gambling issues over all UK data sets. Even local government can request cleared staff track images, messages back to people and then log their internet use with few or no court supervision.
Insiders who sold to the press or anyone with cash got to be a huge issue in the UK in the 1980-2010's within UK telco and computer systems.
A few attempts got made to try and re secure the most sensitive court computer networks but the amount of data been sold was so politically sensitive that investigations had to be re focused or stopped or blocked.
The UK tried with Operation Nigeria (1999), Operation Glade (2003), Goodman inquiry (2006), Yates review, Operation Weeting (2011), Operation Elveden (2011) other Select Committee questions.
The data flow out from secure systems and networks was vast and ongoing that further questions just showed more issues. Collect it all has always been open to anyone with a lot of cash and a few contacts
Domestic spying is now "Benign Information Gathering"
Actually with the data ISPs will collect and given that all of those providers use https for the webmail, your ISP will only know you accessed gmail, but have no idea of the contents of your mail