Theresa May's new Big Brother powers won’t help catch more criminals ...

By Andrew Smith, The Open University

 Home Secretary Theresa May is giving new powers to the police, which will enable them to clearly identify who is using a computer or mobile phone at a given time. Putting the politics of national security and counter-terrorism aside, the proposed act would force all internet data-providers to retain data, linking devices to users.

Due to be announced before Parliament on November 26, the legislation is in effect looking to track the Internet Protocol (IP) addresses of any suspects. This includes, organised crime, cyber-bullies, hackers, terror suspects, suspected child sex offenders and vulnerable people who may be at personal risk.

While this all looks good on paper and might seem like the right move, as someone who has been teaching network engineers for many years, I can see many flaws in this politically noble endeavour.

How does it work?

At the moment your computer, smartphone or tablet connects to the internet, it had to make a connection via a network communication and routing device. The routing device could have been the wireless device at home, 3G or the free wifi in the cafe. When the connection is made, you are issued with a temporary IP address, which temporarily ties down your device and is logged on the network.

With this knowledge, internet service providers can easily record who is using what device and when. This technology has been available for a long time. Corporate networks have been able to log staff computers and their IP addresses for many years. If you connect your laptop to the cafe wifi, it is not difficult to keep a log of each connection, where you visit, your devices MAC address and send this to a remote logging server.

MAC addresses are hard-wired into your devices, in this respect smartphones and computers are alike may have multiple addresses. Therefore each device is effectively unique and means that service providers can keep a track of who is using your home network. If it is insecure, it may result in an unexpected dawn visit.

Will it stop the criminals?

The stark reality is that the people who are the greatest danger are often the most capable, as recent news has proven. Often capable cyber-criminals and other undesirables will have taken the time to learn how to circumvent and avoid being easily spotted.

MAC addresses can be spoofed. Which means that I can trick a network server into thinking that I am using a completely different device. In addition, I could easily create my own proxy (a go-between server), hiding different devices behind another spoofed IP address. If someone was determined, there are many ways of hiding from those who are attempting to record the activities of millions of devices.

The measures announced by the UK government will go some way to help the police gather much needed evidence when they have a clear case. But in the cat and mouse game of keeping up with the more advanced criminals, sadly this measure is years behind the actual skills out there.

The Conversation
Andrew Smith does not work for, consult to, own shares in or receive funding from any company or organisation that would benefit from this article, and has no relevant affiliations.
This article was originally published on The Conversation. Read the original article.

Comments

Post a Comment

Popular posts from this blog

Wikipedia editors never walk alone: Hillsborough changes can be traced ... from @ConversationUK

Image
By Andrew Smith , The Open University According to the Liverpool Echo , UK government computers have been used to make offensive comments on the Wikipedia page detailing the 1989 Hillsbourgh Disaster over a number of years. The newspaper reports that revisions to the page have been made from computers using the government’s secure intranet since 2009. They include insults to Liverpool fans and a comment suggesting that fans were responsible for the football ground disaster, in which 96 people died. This case highlights the continual issue of trolling and cybervandalism on Wikipedia. It also shows how journalism is using good, technical forensic tools at the disposal of every cybercitizen. Cybercitizens can be good or bad So many of us use Wikipedia on a daily basis that it is one of the most visited websites in the world. Yet not that many of us really understand how it works. Wikipedia is based on the principle that the community can create, edit and refine pages covering
Read more

If airlines offer in-flight Wi-Fi, they should invest in an extra black box for security ...

Image
Yijun Yu , The Open University and Andrew Smith , The Open University In-flight Wi-Fi is one of the most sought-after facilities for air travellers these days, now that laptops and smartphones are so common and so much of our working and personal life revolves around online services. But a US Government Accountability Office report has suggested that many in-flight wireless networks could expose the plane to being hacked or remotely controlled . In fact it’s of such a concern to US authorities that when a well-known computer security expert made an admittedly ill-thought-out joke about doing so on Twitter, he was promptly arrested, his computers confiscated, and subsequently banned from the airline . And all he was suggesting was to make the oxygen masks drop down. So it would appear that the stuff of Hollywood may jump from fiction to fact: Liam Neeson and Julianne Moore starred in the 2014 film Non-Stop , where a passenger hacking the aircraft’s internal wirel
Read more

Highlights and lowlights of 2014, a golden year for cybercrime from @ConversationUK

Image
Looking back, 2014 was not a good year for keeping things safe under digital lock and key. If a score was being kept, it might seem that the cybercriminals are in the lead, despite the valiant efforts – and own goals – from the cybersecurity profession worldwide. Cast your mind back to March , everyone was panicking about the HeartBleed bug. Based on an error in code upon which the majority of the world’s secure servers relied, experts had plenty of time to fix the issue. Sadly there was an array of conflicting information about changing passwords, leading to widespread confusion. While most IT administrators made sure this was managed in a professional manner, it created a stir that seemed to set the tone for the year. In May , online auction giant Ebay admitted to having been compromised. The site said its systems, with personal details of tens of millions of users, may have had been vulnerable for months. Everyone was advised, indeed forced, to change their password. In the
Read more