PassWord – 4th November 2015

Speaker A: This program is brought to you by Resonance 104.4 FM. If you like what you hear and want to support our work, please make a donation at fundraiser.resonance.fm.

Speaker B: Hello and welcome to Password on Resonance FM with me, Peter Warren, the tip The technology program that keeps you abreast of the latest developments in the high-tech world. In today’s program, 3 hours ago the government announced its planned changes to the Regulation and Investigatory Powers Act, the surveillance legislation that has been dubbed the Snooper’s Charter. This apparently will allow it to hold on to all of our internet records for a year. We have 2 studio guests to discuss what that might mean. And TalkTalk. The government wants telecom companies to retain our data, but TalkTalk doesn’t seem to be able to hold its own data on us, let alone data that the government wants it to hold. How can we be safe? And while the government tries to lay out its legal framework for the information age, we look at its progress on the digital infrastructure that is going to be the bedrock of our future, and we find considerable room for improvement. Finally, though, It’s not all doom and gloom. The website company that has put together a system so that musicians can make money. Yes, you heard it right. Good news for the much-battered musicians, though not, unfortunately, for the recording industry, because it would appear that the first steps are being taken for the separation of the two. But first, the government’s proposed changes to the Regulation of Investigatory Powers Act were announced in Parliament earlier, and they’ve taken a lot of people by surprise. We have two studio guests to discuss what the government is proposing and whether it will make any difference. Bit from the privacy group Big Brother Watch, and Jan Vekemans, the technical director of Cryptik, a system that was launched last week that promises to protect your privacy from anyone. The app offers 100% secure communications. All your communications are secure, encrypted, and completely free— sorry, completely private— and free phone calls and messaging services to boot. Dan, welcome to Password.

Speaker A: Hi, thanks for having me.

Speaker B: Dan, you must be very happy with Theresa May’s announcement. It would appear that the government have listened to its critics and done something about their concerns.

Speaker A: Well, we have seen in the initial announcement a few things that we are relatively happy about. The double lock of the judicial sign-off on the most intrusive powers does seem to have that element of judicial approval we’ve been asking for. And also, it looks as though when it comes to searching through internet connection records, there are going to be set circumstances for it. But as ever, the devil will be in the detail. I’m sure as we dig into the bill, we’ll find more that will need to be addressed.

Speaker B: It’s odd that you should say that because we, just before we came on air, we spoke to the former director of legal affairs for GCHQ who did say the devil will be in the detail. But what is, what does this actually mean?

Speaker A: Well, in certain aspects of it, for example, if we look at internet connection records, it seems like there is a good system in place for, and a strict system in place for the access of them, but we need to make sure that where that information is held, to make sure that that is completely secure and making sure that it won’t be compromised in any way because this is obviously very personal information that’s going to be held. And as we’ve seen from recent weeks, things such as TalkTalk and other companies being hacked or losing data, there’s that very real risk.

Speaker B: [Speaker:DAVID] Yeah, and there’s another issue here too, isn’t there, which is, you know, how much use is it for the government to hold those records for over a year? Because as I understand it, it’s just a list of where you’ve been. So for example, this morning I logged on to Resonance FM, and so the metadata on where I went to would have been recorded in my profile if this legislation had been enacted. So they wouldn’t have the web pages if Resonance FM were to update its website. What happens then?

Speaker A: Well, I think there’s definitely question marks over how, why they need this information. That’s one of the elements we would like answers to exactly why law enforcement agencies and security agencies think this is necessary to have this information, especially given that no other Commonwealth or European country actually requires this information to be stored for any length of time. It’s something that we would definitely like answers to.

Speaker B: Now, Jan Viekman, Technical Director of Cryptik, you’ve put together this system that seems to be the absolute sort of anathema to the UK government. What does your system do?

Speaker C: What our system does is basically it gives you your privacy back. What we think is that everybody is entitled to his privacy. Let me give you a little example. If you are in a pub and you’re with your best friend and you get a call from your wife, what most people do is they get up, they go outside and take the call. It’s not because there are secrets being told, but because you want to have the privacy of talking to your partner in private. That’s what we think is what a call is about. You are the only person who can decide for himself whether a call is something you want to have in the privacy of your own hearing or whether you want this to share with someone else. It’s not up to the government, it’s not to go up to anybody else. That’s why when I’m in the pub, I go outside and talk to my wife. But surely, I mean, all you’ve done is you’ve put together a suite of products that are just going to be useful to organized criminals, terrorists, and all of these sort of, um, well, what our tool does not allow you is to make an anonymous call from A to B, because if, if someone is snooping on the line, he can see that phone number X, which belongs to me, is calling phone number Y, which is what most intelligence companies are actually interested in. So we don’t, we don’t hide that detail because that’s not ours to hide. That’s, well, whomever wants to hide that, and that’s why, for instance, burner cells are being sold. That’s at least if we have to believe what’s being told on television. But, you know, guys, what we do is we take serious what the rest of the world is saying, and they say privacy is a right. If privacy is a right, then it applies to what we say. It doesn’t apply to whom we talk to. Applies to what we say to those people or what we send as messages to those people.

Speaker B: So, Dan, I mean, that’s what, that’s what Jan’s just been saying. Privacy is a right. I mean, are the government just really being a little foolish? Are they not really coming to terms with the information age and the fact that no matter what they do, what they legislate, someone will find the technology to get around it?

Speaker A: Well, I mean, this is always an ongoing concern, and I think The best they can do is make sure that they are fully aware of capabilities that they are, that they have and that they need and continue to make the case when they need new capabilities, making the case that they absolutely do need them and show the evidence why they need them, making sure that, you know, they are transparent about what they’re doing.

Speaker B: I mean, the point was made a little bit earlier too, not on this programme, but in the general discussion about this, that really what this discussion is about is the fact that the intelligence agencies, without proper oversight at that time upon them, were going out and picking up whatever information they wanted. Are you satisfied that that can’t happen?

Speaker A: Well, I think this is again a question for once we’ve looked through the bill completely, but I know that the last legislation we had in this area, the Regulation of Investigative Powers Act, suffered from being quite rushed, went through Parliament in 6 months, and at the time people were concerned about how quickly it was moving.

Speaker D: This can’t—

Speaker A: the same cannot happen with this legislation. We need a proper length of time to scrutinise it and ensure that it is completely watertight.

Speaker B: But I spoke to one of the gentlemen who was the architect of this earlier, as I mentioned at the top of this call, and he said that really what these proposals seem to do is embrace that earlier legislation and extend it. He said it’s a much bigger document now. He said that what they seem to be doing is to try to get some sort of transparency for Parliament?

Speaker A: Well, no, absolutely the bill should be bringing more transparency and this is why we need to dig down into it and see exactly what it’s saying, making sure that it’s putting out exactly and clearly what powers the intelligence agencies have and making the case for them because if the intelligence agencies and police do need these powers, we’re not going to stop them. We need to make sure that they actually do need them and they’re actually going to solve problems with them and they’re going to use them in a proper way and that’s what we’re interested in making sure that the powers they have are necessary and being used proportionately.

Speaker B: Now, Jan, you say that you want to give people their privacy back. Who are the people that you think that you are— are going to be your target customers? Who are the people who actually will want to use your service?

Speaker C: Honestly, anybody who wants to keep certain information away from other people. Let me give you a few examples. If I am a businessman like I am who is traveling a lot, I do not want everybody to know when I’m not at home. So I want to keep my travel details away from most people because it would encourage burglars to get into my place. It will also expose my kids to more danger because people will know that I’m not around for my kids. You know, I might not be the prime target for those things because I’m not, I’m not a very wealthy person. But if you, if you are, that might be a target. If you look at your bank details, although I have not a wealthy bank account, I don’t want anybody to know what’s on my bank account.

Speaker B: Okay, so you’re seeing this as basically as, you know, having a similar sort of system to that that we have in the, you know, in the real world, and you just want to to have the equivalent sort of life that you’ve got in the real world on the internet. But isn’t, you know, the government and the intelligence agencies will be looking for the communications that they can’t see. Surely they’ll just target encrypted communications.

Speaker C: Well, let me give you there another example of something that happened in the past and which might be a good example for the intelligence community to look at. That is when, and now this will show how old I am, When browsers were in their earlier states and when there were Netscape browsers and things like that around, there was a country called France who limited the security on a browser to 40-bit DES because 128-bit DES was uncrackable in those days, or at least was very hard to crack in a short term of time. And so they limited every browser that was used within France to 40-bit because then they conveniently could see what you were doing. What happened was that everybody simply got a browser that was made outside of France and kept on doing what they were doing. And this is actually the real life, guys. Instead of making a law that prohibits people from doing things, think about how you can make people do things in a proper way. Rather than asking them to go and find something outside of your country. Because if the UK does this on its own, what good will the law be?

Speaker B: Right. Now, Dan, there’s a sunset clause in this bill. Doesn’t that mean that basically you’ve been given, you know, what you want for the time being, and then what, in 1 year, 2 years’ time, we’re going to have this discussion all over again, and there will probably be a lot of the draconian measures that you’ve hoped to evade?

Speaker A: I’m unaware of a sunset clause in this bill. My knowledge was that sunset clause was in the previous bill, the Data Retention and Investigatory Powers Act, and that was going to be in December 2016, which is why this legislation is coming in now. So we’ll have that time to discuss it and put it in place.

Speaker B: Oh, I understand. Sorry, I thought when I was listening to Theresa May, she actually said there is a sunset clause, but the sunset clause is for the previous legislation then, and this legislation will last us for what, forever?

Speaker A: Well, until it needs to be rewritten or it is overturned, I’m assuming.

Speaker B: Yeah. I mean, it must be good news. I mean, The Telegraph said yesterday that the government was going to sort of ban encryption unless it was between companies that it actually favored. That doesn’t seem to be there. There was no mention of encrypted— of the government having a problem with encrypted communications.

Speaker A: Well, I mean, as you said, there does seem to be some good things in this bill, and as I said before, I’m sure once we look through it fully, we will be able to give a proper answer on that. But it does look more promising than it has in the past, I feel.

Speaker B: I mean, perhaps the most promising thing about all of this was you were actually consulted. Theresa May did say, and I did hear that correctly in Parliament, that the privacy organizations had been consulted, that charities involved with child abuse victims and things like that, because there’s considerable evidence that pedophilia is on the rise in the UK. So a lot of the interest groups were consulted by the government along with the technology companies as well. So you must be happier about that.

Speaker A: I mean, it’s always heartening to see consultation taking place, and it’s important that continues into the pre-legislative scrutiny that is going to take place from now.

Speaker B: Okay, well, Dan Nesbitt of Big Brother Watch and Jan Vekemans, Technical Director of Cryptik, thank you very much. Thank you.

Speaker A: Thank you.

Speaker B: Right, now in a week that’s seen the ongoing row about the TalkTalk data loss and the news that the Crown Prosecution Service has been fined £200,000 by the Information Commissioner for the loss of unencrypted laptops containing video evidence of sex abuse victims, we talk to Mark Deem, a lawyer for Cooley, a law firm with a special particular specialism in legal issues.

Speaker E: There’s no law per se that affects companies and requires them to encrypt data in the sense of thou shalt encrypt. We have to take care not to confuse the issue with whether or not liability can flow or indeed will flow from any failure to encrypt. We do have a whole raft of legislation on the statute book which will deal with the ways in which data must be kept. The Data Protection Act, the Privacy and Electronic Communications Regulations are just two of them. And in addition, there are also the laws of tort and contract laws which will backfill any holes to make sure that companies will often owe duties of care as to the way in which they go about holding information. Or companies such as TalkTalk may have automatically given obligations or assumed obligations to hold data in a certain way by their terms and conditions.

Speaker F: Right. So I mean, that duty of care, that strikes me as that’s one of the really important bits in all of this, isn’t it? So, you know, that should mean that they are looking after the data. Does that mean that, say, the Information Commissioner’s Office, for example, will look upon them in a more kindly way if they have encrypted data?

Speaker E: I think that’s right, and they certainly will do. This is one of the points of mitigation that the Information Commissioner’s Office will often take into account in the event of there being a breach that has been notified. What encryption does though is I think it goes slightly further than that, and it shows the way in which a company is approaching its data as an asset of the business. The very fact that the company has gone to the lengths to try to encrypt will often mean that they have recognised the problem, recognised there might be an issue, and dealt with or tried to put safeguards in place to make sure that that data is kept in a safe, or as safe as possible, environment.

Speaker F: Now if I’m a consumer, obviously people are concerned about their data at the moment. It’s quite likely that some of the customers of TalkTalk might take this up as an issue with TalkTalk and say that they want some compensation for their data having been lost. I mean, if they have encrypted that data and it got lost in any way at all, then they would be pretty safe against that, wouldn’t they?

Speaker E: They would be. I mean, encryption is very much the first line of defense. Unfortunately, encryption will never give a 100% guarantee that it won’t ever be vulnerable to an attack or vulnerable to be read by others. But it does actually provide that first level of defense. And that comfort that the consumer and also the companies really require.

Speaker F: Right. So, final question then. I’m a consumer. Should I ask the company that I’m giving my data to now, do you encrypt my data? Or should they actually be pushing for some sort of disclosure on a website saying your data is encrypted, we keep it safe?

Speaker E: Absolutely. There is no harm as a consumer to be asking those questions and pushing for answers. Encryption obviously is very important, but it’s not just encryption in itself. It’s the extent of the encryption, the standard of encryption that’s being applied. Those are also important matters. Now, for the consumer on the street who may not be fully conversant in all the different forms of encryption, it can be very difficult and quite baffling to actually go through all of this, which is why, as you say, putting something on the website might actually be the very best way forward to make sure that consumers would be protected going forward.

Speaker F: Right. So we should be looking for those things. I mean, I take on board what you say about the encryption. You know, I mean, there’s all of these AES-256 and so on and so on and so on. It could be terribly confusing. But I assume that if it says this website is encrypted and I find that it’s been encrypted by my 5— by the managing director’s 5-year-old son and that he’s using this sort of letter substitution system, then I’ve probably got some room for complaint. Absolutely.

Speaker E: I think if anyone says that something is being encrypted, I think that it is implicit in that it is being encrypted in accordance with best practice that’s around at the moment.

Speaker F: So that’s it then. That’s the final line that we should be looking for. We look on the website and the website says, we encrypt to the highest levels, we encrypt to the best practice standards of this in our industry, and then we should be okay.

Speaker E: Absolutely.

Speaker F: Brilliant, wonderful. Are you happy with that? Yeah.

Speaker E: I don’t know if my last answer was a bit too emphatic.

Speaker B: Now, last week we talked about smart cities and the week before that about the problems the UK is facing over broadband installation. Ministers are talking about a minimum of 2.5 megabytes for people in the UK when other countries routinely play with 1 gigabyte. Does it matter? Apparently so. Richard Jones, the Chief Operating Officer of the telecoms infrastructure firm VentureNext, who is moderating the Smart City Conference NextGen15, says our broadband network is now seriously holding us back.

Speaker G: Talking about HS2, which, you know, I think is an important thing. I think perhaps you and I would agree that given previous infrastructure projects, this one’s going to go significantly over over budget. And you could have Fibres to the Home everywhere in the country for the budget of— for the original budget of HS2. In fact, you could probably have it for the overspend that’s likely.

Speaker F: Well, that’s the point, isn’t it? The point about all of this is that we’re in the information age and the highway for the information age should theoretically be the network. That’s going to be the place where everybody is saying that new businesses would develop and that new income will come from. And for some reason the intellectual leap to sit there and think, well, in that case then we ought to build this network because this is a network for the future rather than look at a train network hasn’t been made, has it?

Speaker G: No, not at all. Strange thing. In Jersey, so I basically am Chief Commercial Officer of Venture Next which is an open access operator doing managing operations, running operations around the world but also, a partner in Ventura Team, which is a long-standing next-gen consultancy. Now we were the consultants for Jersey Telecom when they, as possibly the 6th highest GDP per capita part of the world, decided that the financial services they have been relying on for 150 years is not enough for the future. And their government decided to back Jersey Telecom in offering 1 gigabit fiber to the home to all businesses and all residents. Why did they do that? They did that because they can look beyond today when they are currently very successful and say what you just said, that this is the basis for future jobs. This is the basis for future wealth. We’ve seen our manufacturing base in the UK be exported. We’re not going to be the kings of the service business or the kings of financial services forever. And it’s important to have this kind of infrastructure in place to enable people to build these new businesses and create these new jobs and this new wealth for the future.

Speaker F: And just to go back to this point about copper, I’ve been told that it’s far more expensive to maintain copper in the ground than it is fiber. So again, why on earth are we bothering to keep our copper network going and not replicate what you’ve just described in Jersey and put fiber to the home?

Speaker G: Well, it is scarily expensive is one of the issues. The point you make about the OPEX that’s required on copper and fiber is completely correct. So where people are putting in new cables, they’ll be putting in fiber generally because of that lower OpEx. One of the things that you don’t get though is that full saving of that OpEx until you reach a point whereby your network is wholly fiber. Up to that point, you’re now managing two different networks with two different technologies. You’ve got two different sets of spare parts. So actually, you can’t accrue all the benefits immediately. One of the problems that you see with, with copper is very simple, and that’s that it’s run by an incumbent network. And they will only invest in things like fiber to the home through fear, ego, or greed. We’ve seen ego-driven developments in the Gulf where I work a lot, where UAE has got fiber to the home everywhere, Qatar’s got fiber to the home everywhere. We see it through greed where there’s a possibility to really extract more money from the market, or fear that somebody else will do it. But if that’s not the case, then a sensible chairman and CEO of an incumbent operator will just say, we’re going to sweat this copper asset. We’re going to keep it going. We’ve already paid for it. We’re getting some nice revenues from this. We’ll do the minimum possible. And that’s where the regulator needs to come in and try to encourage with the right government policies, et cetera, the right kind of pressure that will actually lead to an upgrade in the network.

Speaker B: That was Richard Jones of Ventura next on why we should start building the network of the future. Or not be part of it. Now, some very good news. The internet company Wix has come up with websites that have been specifically made to help musicians to make money. They can sell through them, deal directly with their fans through them, post their music to— through music distribution sites through them, and automate the whole process. Wix has also negotiated with YouTube to allow hitherto unknown artists from its platform to front famous tracks by top artists in a similar way that support bands go on before artists at concerts. They say this will promise 100 million plays for artists who need the exposure. Here’s Liat Karpel-Gerwitz, Head of Strategic Marketing at Wix, to tell us more about the system.

Speaker D: I think the very essence of being an artist or a musician is that it’s your art and your music, and nobody else can define that for you. And that’s true of all of their digital assets. You know, they want anything that they put out there to look and feel and sound like the art that they’re creating, and nobody can do that but them.. So all we can do is provide them a platform for that, a platform for their voice, the best tools out there to make it look professional and stunning. But the actual outcome and the actual content of it is completely up to them.

Speaker F: Isn’t that going to be the challenge though? Because a lot of people will be sitting there thinking, oh well, yes, but this sounds like they’re just offering me a load of different modules and that my website will end up looking the same as website for Barry Manilow, and I don’t want that because I’m a heavy metal rocker.

Speaker D: So I think that, you know, if you look at the technology that we have today, it’s moved so far beyond that. We have such an easy-to-use drag-and-drop editor. Really, so quickly and easy, people can create stunning websites of their own. And I can tell you, I look at user websites every single day, and none of them look the same. We do provide— when we say a template, it’s more of a guideline and something to get you started. The idea is not for you to stay with that as your outcome and for you to look like anybody else. It’s just sometimes approaching a blank canvas can be very intimidating. So we give you somewhere to start, and we give you some kind of direction, an idea of what your website could become, but it’s completely up to the user to make it whatever it is that they want it to be.

Speaker F: Presumably, you say that this is music that you’ve identified, but presumably this is something for any performance artist.

Speaker D: Right, and I think that you’ll see also with our platform, we’re offering more and more services to different audiences or verticals, if you like, that are tailored to them and their needs. So, you know, depending on what your business is or what it is that you’re trying to do, you can take a look at our platform and find the solution that works for you. Specifically for musicians, this is the package that they’re looking for online regardless of Wix. These are the tools that they’re using to get their music out there. And we’re just bringing all of those things together in a way that’s easy to use, easy to manage, and of course easy to make look stunning and really give you a great voice and presence online.

Speaker F: One of the points that many people have been making is Okay, you know, the last 20 years, that was the time of the technologists. Now, the artists are coming onto the internet. The artists are beginning to populate the internet. The artists are beginning to try to play with the technology to do things that are new, different, innovative. You say that it’s the artists’ content that you’re seeing that’s creating all of these new and different sites. Are they actually also saying to you, we’d quite like some input? Into some of the modules?

Speaker D: I don’t know if input. I think that what they are looking for is functionality that allows them to take it to the next step. So we are always looking at our user feedback and looking for what is that next thing that they are trying to do on their website. Is there something that they want to add? Is there another way that they want to play their music? Is there another way they want sell their music, is there another type of gallery they want to include. So I think that less for input, but more they’re looking for specific tools and of course as much flexibility as possible so they can really do whatever they’re dreaming of creating.

Speaker B: Well, Wix, the company with musicians at heart. You’re listening to Password on Resonance FM. And if you’ve just joined us, I’m afraid you’ve missed it. If you want to learn more about the issues we have raised, log on to our website, Future Intelligence, at www.futureintelligence.co.uk. Password is brought to you by Angel Media.

Speaker A: Goodbye. This program has been brought to you by Resonance 104.4 FM. If you liked what you heard and want to support our work, please make a donation at fundraiser.resonance.fm.