Police set to step up hacking of home PCs

[Griff]

http://www.timesonline.co.uk/tol/news/politics/article5439604.ece

THE Home Office has quietly adopted a new plan to allow police across Britain routinely to hack into people’s personal computers without a warrant.

The move, which follows a decision by the European Union’s council of ministers in Brussels, has angered civil liberties groups and opposition MPs. They described it as a sinister extension of the surveillance state which drives “a coach and horses” through privacy laws.

The hacking is known as “remote searching”. It allows police or MI5 officers who may be hundreds of miles away to examine covertly the hard drive of someone’s PC at his home, office or hotel room.

Material gathered in this way includes the content of all e-mails, web-browsing habits and instant messaging.

Under the Brussels edict, police across the EU have been given the green light to expand the implementation of a rarely used power involving warrantless intrusive surveillance of private property. The strategy will allow French, German and other EU forces to ask British officers to hack into someone’s UK computer and pass over any material gleaned.

A remote search can be granted if a senior officer says he “believes” that it is “proportionate” and necessary to prevent or detect serious crime — defined as any offence attracting a jail sentence of more than three years.

However, opposition MPs and civil liberties groups say that the broadening of such intrusive surveillance powers should be regulated by a new act of parliament and court warrants.

They point out that in contrast to the legal safeguards for searching a suspect’s home, police undertaking a remote search do not need to apply to a magistrates’ court for a warrant.

Shami Chakrabarti, director of Liberty, the human rights group, said she would challenge the legal basis of the move. “These are very intrusive powers – as intrusive as someone busting down your door and coming into your home,” she said.

“The public will want this to be controlled by new legislation and judicial authorisation. Without those safeguards it’s a devastating blow to any notion of personal privacy.”

She said the move had parallels with the warrantless police search of the House of Commons office of Damian Green, the Tory MP: “It’s like giving police the power to do a Damian Green every day but to do it without anyone even knowing you were doing it.”

Richard Clayton, a researcher at Cambridge University’s computer laboratory, said that remote searches had been possible since 1994, although they were very rare. An amendment to the Computer Misuse Act 1990 made hacking legal if it was authorised and carried out by the state.

He said the authorities could break into a suspect’s home or office and insert a “key-logging” device into an individual’s computer. This would collect and, if necessary, transmit details of all the suspect’s keystrokes. “It’s just like putting a secret camera in someone’s living room,” he said.

Police might also send an e-mail to a suspect’s computer. The message would include an attachment that contained a virus or “malware”. If the attachment was opened, the remote search facility would be covertly activated. Alternatively, police could park outside a suspect’s home and hack into his or her hard drive using the wireless network.

Police say that such methods are necessary to investigate suspects who use cyberspace to carry out crimes. These include paedophiles, internet fraudsters, identity thieves and terrorists.

The Association of Chief Police Officers (Acpo) said such intrusive surveillance was closely regulated under the Regulation of Investigatory Powers Act. A spokesman said police were already carrying out a small number of these operations which were among 194 clandestine searches last year of people’s homes, offices and hotel bedrooms.

“To be a valid authorisation, the officer giving it must believe that when it is given it is necessary to prevent or detect serious crime and [the] action is proportionate to what it seeks to achieve,” Acpo said.

Dominic Grieve, the shadow home secretary, agreed that the development may benefit law enforcement. But he added: “The exercise of such intrusive powers raises serious privacy issues. The government must explain how they would work in practice and what safeguards will be in place to prevent abuse.”

The Home Office said it was working with other EU states to develop details of the proposals.

Reminds me of this lot -

 

[McBunny]

ah the good ol KGB

 

[Revels]

So some terrorist is going to have his MSN chat logs checked by a Spook? So?

He just wont use Facebook to sort out his Sleeper Cell anymore.

 

[McBunny]

soon enough they will be able to do it when they feel like it for any criminal activity

 

[cava83]

Soon enough, lol, they do this right now!

soon enough they will be able to do it when they feel like it for any criminal activity

 

[McBunny]

no they dont well not unless its just for a laugh on their coffee break

 

[Nigel]

This is the key for me, but I wouldn't like to argue against it if I were to get in trouble:

“To be a valid authorisation, the officer giving it must believe that when it is given it is necessary to prevent or detect serious crime and [the] action is proportionate to what it seeks to achieve,” Acpo said.

 

[Turkish]

Massively ambiguous line there. Potential for misinterpretation or general abuse of the system is pretty high when using language like that.

 

[Griff]

It allows police or MI5 officers who may be hundreds of miles away to examine covertly the hard drive of someone’s PC at his home, office or hotel room.

Women don't commit crime or something?!?

 

[Munson]

So how are the po po going to get past anti-virus, anti-spyware, and software & hardware firewalls? Do they have like Super-Hackers. Cyborgs? lol sounds like a load of old tosh to me.

Either way though, the fact that it's even being discussed is a scary sign of the future. Brazil, 1984 etc. etc.

 

[Vish]

This is ridiculous! Soon you wont be able to have a s**t without the government knowing about it!

Material gathered in this way includes the content of all e-mails, web-browsing habits and instant messaging

I don't have emails or IM (anymore) saved to my computer, so they'll just be able to see what p**n sites I go on. Fine by me, they're nothing weird. But for others, this is way overstepping the line of privacy.

He said the authorities could break into a suspect’s home or office and insert a “key-logging” device into an individual’s computer. This would collect and, if necessary, transmit details of all the suspect’s keystrokes. “It’s just like putting a secret camera in someone’s living room,” he said.

This is a right joke! Why should they have powers to access anyone's computers. If they think there is criminal activity going on, then why can't they get the actual computer of whoever it is and then search it???

Roy, I believe some companies actually employ "good" hackers to test the security of their software.

 

[Munson]

Roy, I believe some companies actually employ "good" hackers to test the security of their software.

Stands to reason. So the software is then left with holes it so the Police (and anyone else with the knowledge) can hack in? I don't understand how the po po can be anymore able to install a key logger on my machine, than that black dude from Transformers. Maybe I'm being naive. Are router hardware firewalls designed with special Police back doors?

Anyway besides all that. 'Sinister' is the exact correct word.

 

[Rob.]

So how are the po po going to get past anti-virus, anti-spyware, and software & hardware firewalls? Do they have like Super-Hackers. Cyborgs? lol sounds like a load of old tosh to me.

Either way though, the fact that it's even being discussed is a scary sign of the future. Brazil, 1984 etc. etc.

I understand where your coming from.

If they can get the permission of the ISP they could get a lot more internet based information then the normal 'Hacker'.
So if they could change the packets getting sent back from the ISP they maybe could make there way in easier then a normal hacker.

Roy, I believe some companies actually employ "good" hackers to test the security of their software.

There are hackers out there that have jobs of testing software security, But as soon as they find a hole/exploit its going get closed and fixed.

A fire wall with holes is like a boat with cracks it's not doing the job it was made for

 

[guysy]

I worries me a bit, I dont like the invasion of privacy thing one bit. And also whats to stop them from planting stuff when they feel like it.

 

[Nick_P]

Stands to reason. So the software is then left with holes it so the Police (and anyone else with the knowledge) can hack in?

What happens when this knowledge gets left on a train? Lets be honest thats only going to end in disaster.

 

[Munson]

If they can get the permission of the ISP they could get a lot more internet based information then the normal 'Hacker'.
So if they could change the packets getting sent back from the ISP they maybe could make there way in easier then a normal hacker.

Hmmm okay. I'll asume you're right, but it still seems unlikely they'd be able to install anything on a well protected PC without leaving a trace that would be picked up and fucked off by any good anti-virus/anti-spyware etc.

 

[Griff]

I understand where your coming from.

If they can get the permission of the ISP they could get a lot more internet based information then the normal 'Hacker'.
So if they could change the packets getting sent back from the ISP they maybe could make there way in easier then a normal hacker.

Heard of SSL?

 

[Griff]

Hmmm okay. I'll asume you're right, but it still seems unlikely they'd be able to install anything on a well protected PC without leaving a trace that would be picked up and f**ked off by any good anti-virus/anti-spyware etc.

Anti-virus/Anti-spyware software can only protect/detect what the OS allows it to. It would hardly be surprising if some "update" came out allowing certain authorities backdoor entrances in the OS bypassing said "security" software.

 

[Rob.]

Heard of SSL?

Very true if your smart enough and have enough stuff to hide you will use encryption for every thing.

 

[Vish]

Stands to reason. So the software is then left with holes it so the Police (and anyone else with the knowledge) can hack in? I don't understand how the po po can be anymore able to install a key logger on my machine, than that black dude from Transformers. Maybe I'm being naive. Are router hardware firewalls designed with special Police back doors?

Anyway besides all that. 'Sinister' is the exact correct word.

I don't think anything is ever totally secure. Normally are ways to get around things but you need to find out how etc and hackers like doing that.

 

[Munson]

Anti-virus/Anti-spyware software can only protect/detect what the OS allows it to. It would hardly be surprising if some "update" came out allowing certain authorities backdoor entrances in the OS bypassing said "security" software.

Windows Update? lol. Scary thought

 

[Macester]

i am surprised this hasn't been passed before now. we all know this type of activity has been going on for years! I'm not sure if its a good thing or not, you can argue both points. so basically make sure your computer is secure as you can possibly make it!

this is the sort of job I want to go into though, pen testing so I think its awesome!

 

[KDF]

Heard of SSL?

Heard of spoofed SSL Certs ? DNS poisoning etc.

 

[Turkish]

Windows Update? lol. Scary thought

As if running a dogshit MS OS isn't scary enough

 

[KDF]

I don't think anything is ever totally secure.

Finally a sensible post.

 

[KDF]

As if running a dogs**t MS OS isn't scary enough

Amen brother

 

[Griff]

Heard of spoofed SSL Certs ?

And the 2678 PS3's that go with them.

I'm not on about internet shopping here.

What have spoofed SSL certs got to do with transferring data from one machine to another known machine using SSL?!?

DNS poisoning etc.

Again what's that got to do with anything. It might trick people into thinking they're on Amazon when they're really on some Chinese p**n site (well maybe not) but again you're point has nothing to do with the subject matter.

 

[KDF]

Maybe they are just going to use the backdoor MS put in its OS.

http://news.bbc.co.uk/1/hi/sci/tech/437967.stm

 

[KDF]

And the 2678 PS3's that go with them.

I'm not on about internet shopping here.

What have spoofed SSL certs got to do with transferring data from one machine to another known machine using SSL?!?



Again what's that got to do with anything. It might trick people into thinking they're on Amazon when they're really on some Chinese p**n site (well maybe not) but again you're point has nothing to do with the subject matter.

Actually it has everything to do with it. Honestly, open your networking for dummies book and turn to the 'how SSL works' page.

Another known machine ? are you sure its the known machine your connecting to and exchanging public keys ? are you sure your private keys are safe ?

Of course, there have never been any vulnerabilities in SSL now have there.

Oh and it was 200 ps3's (ye, i get it.. you were trying sarcasm).. but imagine how easy it will be a year or two down the line what with nvidia GPU's etcc.

 

[MarcoB]

Maybe they are just going to use the backdoor MS put in its OS.

http://news.bbc.co.uk/1/hi/sci/tech/437967.stm

Who the hell publishes a picture like that? :S !

 

[Griff]

I think your anti MS conspiracy theories and all that tin foil are affecting you. Either that or you've misread/misunderstood my previous points.

PS - That BBC article is nearly 10 years old. You should let the grand masters know they need to update their propaganda at your next MS is evil cult meeting.

 

[Munson]

I'm out of this one. Firstly I don't know enough about the technical side, and secondly I'd rather watch my lawn grow under the snow than read more anti-MS geek waffle

 

[iain187]

I don't really understand how this is going to work.

I can't really see them having a loophole way into peoples systems as it opens up too much of a possibility that the hackers find out how to use it and then everyones face will be red

I don't really see the ISP's agreeing to divulge customer data


So I am cynically taking it as scare mongering until someone explains it further to me

 

[Macester]

at the end of the day as soon as you attach your computer to a network its vulnerable, we just dont know how and where yet. Neither do we know how the police will allegedly gain access to someones computer, so all we have learnt from this is, drop beats not bombs.

 

[KDF]

I think your anti MS conspiracy theories and all that tin foil are affecting you. Either that or you've misread/misunderstood my previous points.

PS - That BBC article is nearly 10 years old. You should let the grand masters know they need to update their propaganda at your next MS is evil cult meeting.

Nothing to do with MS bashing at all. Here's a little something more up to date for you.

http://news.bbc.co.uk/1/hi/uk_politics/4713018.stm

and I quote..

"A Home Office spokesman said: "The Home Office has already been in touch with Microsoft concerning this matter and is working closely with them."

"At the same time, we are working with law enforcement to help them understand its security features and will continue to partner with governments, law enforcement and industry to help make the internet a safer place to learn and communicate"

hmm.

 

[KDF]

I don't really see the ISP's agreeing to divulge customer data

Sorry to say... they already do.

 

[dk]

LOL@people thinking they are safe by installing norton on their computer..........

Having seen hackers at work I can see how easy it is for them to get around all this stuff pretty easily, unless you are the NSA (who have been hacked before) you have no chance, the british police will just employ the best hacker they can get their hands on to do this for them, if its to stop a terrorist then nothing is going to stop them.

I'm sure this stuff has been going on for a while anyway, I think if we knew what they were up to really, it would probably scare us.

 

[Initiale]

Welcome to the Police state. Established 2008.

 

[KDF]

Welcome to the Police state. Established 2008.

I'm pretty sure CS was established before that.

 

[iain187]

Sorry to say... they already do.

like what? names and addresses or stuff like browsing habits?