PassW0rd – 20th July 2016

Speaker A: This program is brought to you by Resonance 104.4 FM. If you like what you hear and want to support our work, please make a donation at fundraiser.resonance.fm.

Speaker B: Hello and welcome to Password on Resonance 104.4 FM with me, Peter Warren. The technology programme that tracks the process of our new high-tech existence. In today’s show, we report on the latest misfortune to befall the Investigatory Powers Bill that is making its way through the Lords. An initiative to use technology to bring the high street back to life using the internet. A new system to check people’s age online. The latest research into cybercrime gangs which has discovered that the old model so beloved of Hollywood is out of date. And finally, the sensors that were developed for musical instruments that are now preventing deaths in car crashes. But first, the Investigatory Powers Bill could be the first real test for Prime Minister Theresa May. She brought it to Parliament as Home Secretary, and many say she has a personal stake in it. But it’s just been declared illegal in the European Court of Justice following a challenge to the UK government brought by the human rights group Liberty on behalf of Tom Watson MP, the Deputy Labour Leader. It was also being brought by David Davis MP, but he had to drop out after his appointment as Brexit Secretary, or he would have been in the unusual position of taking a UK government to court for a proposed law drawn up by his boss using European legislation that his new job requires that he withdraws the UK from. Confused? So were we. So we asked Liberty’s lawyer, James Welch, to make sense of it all for us.

Speaker C: Well, what we got yesterday was an opinion from the Advocate General at the Court of Justice of the European Union in Luxembourg. It’s a slightly odd system there. They have a judge who gives a preliminary view on the case, and then we get a ruling from the full court. And usually the full court follows broadly what the Advocate General has said, but not necessarily. But what we got yesterday was the Advocate General’s opinion,, and it was very positive. We are acting for Tom Watson MP who is challenging the Data Retention and Investigatory Powers Bill Act 2014, commonly referred to as DRIPA, which is a piece of legislation that gives the Home Secretary the power to require companies that provide telephone services, internet services, to keep people’s communications data for up to 12 months. Communications data is basically everything but the content of communication, so what phone was used, who, where they were, how long the call lasted. And the reason the government wants communication service providers to keep this information is so that the police can get access to that information in relation to investigations. What— that legislation, CRIPA, was put in place in 2014 after A European directive which gave the Home Secretary identical powers basically was struck down by the Court of Justice of the European Union as against human rights, against the Human Rights Charter, the Charter of Fundamental Rights of the European Union. Unsurprisingly, as the government at the time just effectively reenacted what was in the directive, it is, or certainly on the basis of what the Advocate General just said yesterday, is going to fall foul of the same charter for the same reasons. Basically, there aren’t enough safeguards in the legislation to make sure that this power to get people’s communications data— and you can learn an awful lot about a person from communications data— there aren’t enough safeguards in DRIPA to make that compatible with human rights principles.

Speaker D: So essentially, it’s been struck out. Does this mean that it’s illegal?

Speaker C: Well, if the full court follows the Advocate General’s opinion, yes, it will mean that the legislation is illegal. Because Parliament has created an act of Parliament in an area covered by EU law, if what Parliament has enacted contravenes European Union law, contravenes the Charter of Fundamental Rights, the courts have the power to strike the legislation down.

Speaker D: But we’re leaving Europe, so surely, you know, in 2 years’ time we just rip it all up and the Home Secretary, the then Home Secretary, whoever that is, will just introduce another bill.

Speaker C: Well, we’re not leaving the European Union yet. I mean, the government has to invoke Article 50 and then there is still a 2-year period. But the Court of Justice of the European Union, you know, is an international court, but it doesn’t make its decisions in isolation. It will consider rulings on human rights issues of other international courts, in particular the European Court of Human Rights in Strasbourg. We are not withdrawing from the European Convention as a result of voting to leave the European Union. We are still going to stay in that, and Theresa May has confirmed that there is no parliamentary majority for withdrawing from the Convention on Human Rights.

Speaker D: So does that mean then, does that then mean that as a result of this, that legislation is illegal?

Speaker C: As I said, the opinion yesterday isn’t the final say of the Court of Justice in Luxembourg. But if the court follows it, yes, I think there is a, you know, the existing legislation will be illegal and anything which seems to legislate in similar terms, the Investigatory Powers Bill, is also likely to be illegal. So yes, I think it’s very clear that the government will have to change its plans, the bill currently going before Parliament.

Speaker D: Just a final question. It does appear as though this legislation, the Investigatory Powers Bill, and the DRIPA, which obviously is going to be terminated with its sunset clause, it does look as though it’s a bit of a dead duck, doesn’t it? Because the police don’t seem to, according to interviews that we did with the police, they don’t seem to be too fond of it. Senior Tory officials, Tory MPs that we’ve spoken to, seem to indicate that in its present form that it will be hacked around as it goes through the Lords, or as it’s going through the Lords at the moment. So you must be feeling a little optimistic that it might not quite make it.

Speaker C: I think people will be slow to wake up to how threatening the bill currently going through Parliament is. I mean, we’re not just talking about phone companies keeping communications data, we’re also talking about powers that police and others will have to hack into people’s computers, powers basically that already exist to pick up everybody’s electronic communications in order to trawl through them to see if there is anything of interest. I think that people need to realize how invasive of privacy this is going to be. And the Advocate General’s opinion yesterday was an important step. He, the Advocate General, has said that the existing legislation doesn’t have adequate safeguards. If the power that is probably the least intrusive end of what the government is now proposing doesn’t have adequate safeguards, then how can all the other things that the government is proposing in the Investigatory Powers Bill possibly comply with human rights principles?

Speaker B: James Welch of Liberty on the twists and turns of the Investigatory Powers Bill that looks increasingly as though it has been holed below the waterline. Now we turn to another bill that will be coming up in Parliament that will require people to prove their age online. Once again, it is a former initiative from our new Prime Minister and her predecessor, only this time the aim is to make you prove your age online in a bid to stamp down on underage access to pornography and other age-restricted products. Alastair Graham of AgeChecked, one of the companies developing technology to help online businesses comply with the upcoming legislation, wants to make us all more age-conscious online.

Speaker E: Well, I think, well, for hundreds of years society’s restricted access to things that we deem as harmful to kids. I think we’d all agree that it’s It’s a good thing that the local off-license would not sell whiskey to any 12-year-old kid who came through the door. So it’s the same logic that we’re applying really to the internet. Although there’s more challenges to check the age of your customer, the logic’s the same.

Speaker F: Okay.

Speaker D: So how on earth do you check someone’s age via the internet? You know, I mean, you’re not going to be able to tell whether I’m me or my 16-year-old daughter.

Speaker E: Well, there are a number, there’s a range of methods that we can use to check your age. There’s, they can be identity-based or they can just be based on age attributes. So we can use driving license information, mobile phone information. We can use electoral roll information. There’s loads of ways that we can actually gain information about you. The key point is that it’s done in a way that is proving you are the age that you say you are, but doesn’t allow that information ever to move on forward. So it stays within a protected and secure environment, and it’s an anonymous service to websites that need to use that information to allow you to get your goods or services.

Speaker D: I see. So I want to buy something from a website, and that website would have ordinarily some age restrictions on my obtaining that service or those things. So what happens then?

Speaker E: Well, if you use our service, you would have a pop-up that would appear in front of you during the sales process because the merchant that was selling you something has said, but we need to check your age. It comes to— you get a secure pop-up. Your information that you would add onto our service would be enough that we could verify your age. But at that point that we’ve done that, that information is completely removed from our servers. All we will do is pass on the information to your website that’s selling you something that this person is of an appropriate age, and there’s no personal information that’s passed on. For me, I think that’s necessary for age verification online to give people the comfort that this, There’s not sort of a nefarious data mining system that’s happening because that really wouldn’t be a correct use of what the government’s actually trying to do with the new Digital Economy Bill.

Speaker D: Okay, I mean, let’s come to that later. So what you’re saying is that you collect this information.

Speaker C: What do you do?

Speaker D: You then destroy it?

Speaker E: Well, there’s a number of methods we allow our customers to choose from.. For example, they could use a credit card method that we are able to ping those cards to check whether they’re valid cards and whether they’re credit cards. So last year, ATFO decided that the use of a credit card, the proof of use of a credit card was enough to prove that you’re 18, and therefore that’s an appropriate method. So if we take a number of a payment card, we can work out whether it’s a credit card, a debit card, card or a prepaid card.

Speaker D: Okay, we have that, we have that then. So you’re just basically checking people off against the list. But what about, I have a debit card, so many of my children have debit cards. What’s to stop them from buying some service that they’re not meant to?

Speaker E: So in that example, if they were to give a debit card, we’d actually We tell the customer that, sorry, this is a debit card, it’s not a credit card, it’s not sufficient proof, and we ask them to provide another type of proof to prove they’re the right age.

Speaker B: That was Alastair Graham on plans to bring the web into line with the high street. Now someone else who wants to do the same is Nick Brackenbury, the chief executive of Near Street, a high-tech startup that wants us all to wake up to the fact that shopping online it’s not all it’s cracked up to be, and that the thing you are searching for on the web may only be a short stroll away from your house. Get up from the couch and go and get it. Here’s Nick to tell us more.

Speaker D: Okay, now what is Near Street?

Speaker F: So Near Street is a website and an app that helps you find and buy products in shops nearby you. So you just search for something you want, we’ll show you exactly who’s got it nearby in real time, And then in just a couple of taps, you can order and pay for instant collection in the store or delivery to you within the hour.

Speaker D: Okay, so why have you done this?

Speaker F: What we see is that there is incredible value in the high street. If you think about how many products and how many different types of products are in shops nearby you right now, it’s incredible. But if you try and search for them on your smartphone today, they’re totally invisible. So as a result, all of our high street shops really suffer. And as a customer, you’re kind of forced to order stuff online that you could get in a shop just across the street. So we think that that’s kind of crazy, and it would be incredible for both shoppers and the shops themselves if you could just see what was in those shops and order it in just a couple of taps, faster and easier than actually ordering it online.

Speaker D: Is this just about convenience? I mean, we live in this instant age, don’t we? Instant gratification. We want things instantly. We don’t like waiting. Is this just another extension of the internet world that we’ve got used to?

Speaker F: I think that’s, you know, there’s no denying that’s how a lot of people like to have things nowadays. You know, people want things on demand. They want them at a place and time that’s convenient for them. And of course, you know, part of our service fulfills that. But also, I think everyone likes to see a really thriving local community, and we see high streets as the backbone of a healthy local community. So if we can really help people get into their local shops more easily, more conveniently, and in doing so help those shops thrive, then it really benefits everyone.

Speaker D: Do you think that this, that it actually builds relationships? Is there any research to suggest that having a good local high street is good for the community or good for people?

Speaker F: I mean, there’s a whole wealth of research going, you know, back to the Mary Portas Review that says, you know, high streets are an essential part of our community. They’re kind of the foundation of a local economy, giving local people jobs, but also variety and a place that you’re excited and proud to live. I think we all know kind of what that busy, bustling, successful high street looks like, and it’s a great place to be, as opposed to one that’s kind of dead with nothing but betting shops, estate agents, and maybe the occasional coffee chain there. So I think it’s a great place that people want to be when a high street is successful.

Speaker D: So is this a response to the world that we’ve developed over the last 20 years, which is this increasingly remote technological world where people stay in their houses and don’t really go out and talk to each other? Is it that that you want to break?

Speaker F: [Speaker:CHRIS] I think today, that’s the default option for us. It’s easier to order something online just because if you tap something into Google, then you see a bunch of places you can order it online. It doesn’t show you where you can order it nearby. I think if we can get people a really easy way to find and buy something from a shop nearby, you can have an incredible experience in shop. Shopkeeper specializes in selling that type of product, so he’s an expert in that area. And you can have a really great face-to-face experience that’s also really convenient for you as a shopper.

Speaker D: This is also about rebuilding community. We see so many times, you know, somebody was saying to me that they were really pleased they saw two people walking down the street hand in hand, and they realized that in the other hand, both of them had got mobile phones and that they were carrying on quite evidently secret conversations. Is it that, that— you know, we should move away from and start discovering things about our local community, talking to people again.

Speaker F: Yeah, and I think a big part of it is if you can make these things really easy for people to do, then people really will go out and explore things.

Speaker B: Nick Brackenbury of Near Street, a technology company that says the high street is essential to us and that we should cherish it. Now, in what may be a surprising revelation, the cybersecurity company F-Secure have found out that cybercriminals Crime gangs are increasingly beginning to mirror real-world companies, the largest behaving like corporations and others like customer-friendly, footloose startups that use cloud computing and systems like Google and Microsoft Office to do their admin. It’s a trend that Password picked up on some months ago when we revealed that skill shortages had forced computer criminals to headhunt and train staff. Here’s Sean Sullivan of F-Secure on the ransomware gangs who encrypt your computer, lock you out of it, and then provide customer support to help you get your system back.

Speaker G: The ones that are established have already put in the time and effort into building their, their botnets that facilitate the ransomware, and for them it does sort of run on autopilot somewhat. So They’ve put a lot of work into the look and the feel of their website that runs on a Tor hidden service. So it’s on the dark web that you can only get to via Tor browser or a proxy of some sort. And they put all the effort into the look and feel up front. They pay money for exploit kit services. And then they seem to just be happy to get what they get. And if you ask any questions of them, they’re like, look at the FAQ. And they don’t really want to put a whole lot of effort into communicating with you.

Speaker B: Right. Now, why should they? I mean, it’s not a well-known criminal trait, is it? I mean, it’s obviously something that’s developed recently.

Speaker G: Well, it is. I think some of the scams out there— actually, if you look at the IC3’s internet fraud report from 2015, there’s actually a whole lot more money that is lost to consumers via 419 advance fee fraud and romance scams.

Speaker E: They—

Speaker G: so that’s a lot of communication. So one of the ransomware variants that we looked at, which we get the impression is from only a handful of people as opposed to an established malware gang, they’re the ones that provided the most interactivity via email trying to get our reviewer to figure out how to buy the Bitcoin. They were very extremely helpful. Communicated quite a bit and don’t know if they’ve dabbled in things like romance scams, but the person who was engaged in that conversation could easily be also doing similar types of scams that aren’t malware related, but just, you know, creating the fake dating profile and luring people in with social engineering and then getting them to cut them, you know, buy them a plane ticket that then they refund somewhere. So, um, I would argue that’s a very well-known criminal trait. The more established malware gang guys might just be more engineers at heart, and therefore, yeah, they don’t communicate as much.

Speaker B: An engineering trait. So overall, what do you think that you found out from this exercise, and what were your conclusions?

Speaker G: Well, we went into it not expecting— we didn’t have any sort of like preconceptions, I suppose, as to what we would find. I mean, we expected to find some variance, and We are pleasantly surprised that, yeah, in fact, this perception we had of perhaps there’s some variance, like, yes, there is. There’s a lot of variance. It’s discouraging to see that there’s a lot of talent going to waste because you can kind of see from these smaller ones where they’re very entrepreneurial and they’re very communicative. I think the majority of these people would love to have a legitimate job, but they probably live in a place where there isn’t a rule of law that would protect their business if they built one from the ground up because of corruption. It would be taken away. So this is probably economically rational to do something like this where you’re underground and can make money secretly to whatever government or oligarch forces would take it away from you. Um, so I had a hunch that, you know, this is likely to be the sort of interactivity we would get from people that were like really hustling to earn your money. Because they have produced texts in the past, it sounded very hard-hearted, like this is the deal, these are your files, we’re going to delete them, pay us or else. But a lot of the smaller variants are, I mean, kind of humorous in a way, and they’re like you’ve joined the community. ‘This is an experiment in, like, teaching you, like, you need to be more secure. We’re here to help you.’ Um, it’s a bit tongue-in-cheek, but they really do work to make the money. And I think that might be because they are produced by people that maybe do have some connections to things like romance scams, and, and that doesn’t wear off, that sort of congeniality.

Speaker B: Or maybe, maybe they just got some, some residual morality.

Speaker G: Yeah, I think that’s probably it too. Yeah, I don’t know that they— as I said, I think the majority of them would like to have legitimate jobs in IT or otherwise, but they just don’t. I’m sure that they must be in a region where that’s not an easy option.

Speaker B: Sean Sullivan on those nice ransomware criminals who buy a license for the software they use to rob you for as little as £29. When we first discovered the emergence of what is now the fastest-growing crime trend on the internet 3 years ago, the gangs were asking for testimonials to prove that they were criminals of their word and that if you did pay, that you got your data back. Couldn’t make it up. And you couldn’t make up our next story either. What’s the connection between violinist Nigel Kennedy, Led Zeppelin’s John Paul Jones, robot feet, and airbags? Well, the answer’s sensors. All of them use sensors made by a US company called Bebop that first started out making the electric violins that are now are now the industry standard. They’ve now branched out into cars via robots. Keith McMillan of Bebop tells us how the company went from making music to making airbags intelligent.

Speaker H: I’ve been building musical instruments for about 35 years, and built violins that are considered the modern electric violin, and people such as Nigel Kennedy, Yo-Yo Ma, Kronos Quartet use them. And I wanted to augment the violin with a smart bow, and I wanted to develop a violin bow that could capture the performer’s grip and expression and transmit that for enhancing the sound. And there was no cylindrical style sensor that would go around the stick of a violin, so I started working with fabrics and impregnating with various conductive materials and was able to produce a fabric sensor. Kept improving it, and we were approached by a company that made exoskeletons, these robotic systems that strap onto a human. These were designed to help people walk, but they had difficulty keeping upright because they couldn’t sense the floor. And they approached us, and we built basically under-soles for the robots that had a myriad of sensors, and they could tell if they were tipping left, right. They could even tell what surface they were on.

Speaker D: So from violin bows, I understand, to car seats.

Speaker H: Why car seats? About 20 automotive companies asking us to help solve this problem of who is in the seat and how are they sitting. And this can be used to control airbags. We’ve been hearing a lot about airbag recalls and airbag incidents, and our system contains fabric fits underneath the upholstery of a seat and gives you an image, a picture of the pressure points of the seat so you can image the person’s behind, legs, etc., know how big the person is and if that person is leaning forward, left, right, and all of this information can be used to more safely deploy airbags. Could it, for example, know whether a woman was sitting in the seat and she was pregnant? There’s probably some balance information that would cue us forward. On that. No one’s asked before, so we’ll have to do some checking.

Speaker D: How does it work then? So the sensor gives a picture, you say, of information to the airbag. Does that then mean that the automotive manufacturers then point the airbag and deploy it with less or more pressure?

Speaker H: Exactly. If you’re an average person sitting, say, in the passenger seat and you’re leaning forward, you don’t want the airbags to deploy fully. The systems that we have now in our cars, they only measure weight. If it’s 30 kilograms, they’ll turn the airbag on. And it’s a very dramatic safety system, so it really needs some granularity, it needs some refinement.

Speaker D: How else is this being used then?

Speaker H: What are the other applications for it? We’re also rolling it out in motorcycle helmets, so if someone takes a spill, we’ll be able to record the actual impact pressures to the head and make a determination of how severe the fall was and dial an emergency number. Other applications are insoles. We have a growing population of people, unfortunately, with diabetes, and the swelling of feet is an early indicator of worse problems to come. And we’re working with a company that produces sensors or takes the sensor data and produces signals that go out to the cloud and can alert the doctor Of course, the question that everybody will ask about this is, are there any privacy implications behind all of this?

Speaker D: If you’re in a car, for example, could you find out what somebody was actually doing within that car?

Speaker H: You know, the alternatives to our seat sensing technology are multiple cameras in the car observing the occupants.

Speaker D: But one of the things that people have been talking about is autonomous vehicles.

Speaker H: Does this have any application for those? We’re in development with a partner on is a smart steering wheel. It has fabric underneath the leather wrap and has 42 sensors, and it can tell when you’re gripping the wheel and where you’re gripping the wheel. And this has safety applications and also for autonomous. If you’re in the seat and you want to take over from the autonomous driver, the computer, you merely grab the wheel and it’ll relinquish control.

Speaker B: The sensor technology that is tackling the issue of car airbag incidents. You’re listening to Password on Resonance FM with me, Peter Warren. And if you’ve just joined us, you’ve missed it and will have to tune in again next week or find us on Mixcloud. Password is brought to you by Future Intelligence and the Cybersecurity Research Institute. And if you want to know more about the issues we’ve been talking about go to our relaunched websites at www.futureintelligence.co.uk and www.csri.info.

Speaker A: Thanks for listening and goodbye. This program has been brought to you by Resonance 104.4 FM. If you liked what you heard and want to support our work, please make a donation at fundraiser.resonance.fm.