Skip to main contentSkip to navigationSkip to navigation
An aerial view of the Government Communications Headquarters (GCHQ) in Cheltenham, Gloucestershire
An aerial view of the Government Communications Headquarters (GCHQ) in Cheltenham, Gloucestershire. Photograph: -/AFP/Getty Images
An aerial view of the Government Communications Headquarters (GCHQ) in Cheltenham, Gloucestershire. Photograph: -/AFP/Getty Images

GCHQ's 'jihad on tech firms' can only fail

This article is more than 9 years old

Bullying the US tech firms could disrupt constructive ways to track terrorism - and force companies to channel requests through lengthy international legal processes


Some will have assumed this week’s headlines blaming Facebook for Lee Rigby’s murder were just the usual spin, diverting the attention from the agencies’ own incompetence. Yet it is part of a growing pattern.

When Robert Hannigan took over as GCHQ chief he wrote in the FT claiming of the internet that “some technology companies were in denial about its misuse”. And never mind that Google and Microsoft each spend five times as much as the UK government on fighting cybercrime; other governments are singing from the same hymn sheet.

The typical problem facing an internet company in 2014 is this. Suppose a family court in India orders Google to hand over copies of the gmail of a Canadian citizen, and imposes a secrecy order. How can a company simultaneously trade in India, and give believable assurances of privacy to users in Canada?

The current solution is to route everything past US lawyers. A policeman in Oxford or Bogota or Cairo who wants electronic evidence from a US firm has to file a request under a mutual legal assistance treaty (MLAT), which is scrutinised by both countries’ authorities and by the service provider’s lawyers. This can take ages; the US Justice Department has a backlog that Congress won’t give it the money to clear.

The world’s policemen (and spies) would love an engineering log on to Google, Facebook and Microsoft, so they could just rummage around to their hearts’ content.

But the prospect that the US government will allow random foreign policemen, let alone random foreign spies, to have even the limited access the FBI had under PRISM, is zero. And the companies are pushing back hard on what the FBI does get, as well as encrypting the traffic between their data centres so that the NSA can no longer hoover up their data without a warrant.

The British reaction was the Data Retention and Investigatory Powers Act (DRIP). This gave Teresa May the power to issue secret regulations to firms like Facebook and Google to hand stuff over to the police and intelligence agencies, by serving warrants on their premises in London, rather than having to go through MLAT to their headquarters in California.

But other countries have laws guaranteeing the privacy of their citizens’ email; these include not just Germany and Switzerland, but also the USA. So what happens when MI5 demands a US citizen’s messages from Facebook? A prudent CEO will ensure that the abuse team is never on UK soil, so they can’t be thrown in jail.

We have seen this pattern before, when the Regulation of Investigatory Powers Act gave chief constables the power to demand passwords or cryptographic keys from suspects, while at the same time Swiss law prevented banks from handing over such keys to any third parties.

US investment banks simply moved their key management operations to Zurich or Frankfurt rather than be caught in a conflict of laws. This time round, the tech companies don’t have to do much; Facebook’s abuse teams are already in Ireland and California.

But there will be real damage to operations. At present, the abuse teams collaborate voluntarily with police forces, and often make material available instantly ‘on an intelligence basis’ while waiting for the paperwork. This depends on a network of individuals who know and trust each other.

Hannigan’s new jihad on tech looks set to tear that up. If he tries to bully US companies into breaking US law, exasperated tech CEOs will just route all requests through the lawyers.

In short, the current mechanisms for delivering lawful access to content at global service firms don’t scale, and are breaking down in the face of selfish and aggressive behaviour by officials like Hannigan and his counterparts in China, Russia, India and elsewhere.

The internet has brought their agencies a cornucopia of new intelligence and evidence. They say they want more. But for that, there will need to be some rules, and rules that other countries can agree to.

What’s really needed is a proper international treaty on mutual legal assistance that sets out transparent global standards for the interception of communications and of traffic data.

This could require each signatory state to maintain a 24x7 operations centre at its justice ministry to expedite urgent warrants. To be acceptable to the USA and Germany, it would have to meet high standards; warrants would have to be signed by a judge (rather than by a policeman or a minister, as in Britain).

Intercepted content would be digitally signed, so company engineers don’t have to hang around in court all day waiting to testify that it’s a true copy. Users would be notified of interception, or of metadata collection, within a fixed period of time, or when they were charged, or when the investigation was abandoned.

An international regime for warranted interception would also have to deal with the question of what happens when some behaviour is illegal in one jurisdiction but not in another.

There are more than twenty years of legal disputes, over everything from videos poking fun at Mustafa Kemal Atatürk through writings critical of scientology to sado-masochistic pornography that’s legal in California but not in Tennessee.

We could try a dual-criminality rule, as in extradition; but experience there suggests it would be complicated and expensive.

So given that we will need uniform procedural rules to make a global system scalable and capable of automation, we should aim for a global system of norms too.

We’ll just have to tell the Saudis that the rest of the world doesn’t consider adultery to be a crime, and if they don’t like it that’s just too bad. And it might do no harm if the Americans were to tell the British government that we’ll just have to accept the idea of free speech online, with no prior restraint.

After all, it’s worked for them for 223 years.

  • Ross Anderson is professor of security engineering at Cambridge University

Most viewed

Most viewed