Government/ISP tracking of internet activity trivial to evade?

Question

The recently announced Investigatory Powers Bill in the United Kingdom will mean that ISPs must store the internet activity of everyone for one year.

Anyone who wishes to evade such tracking can use a variety of methods such as using a secure proxy or VPN. These methods use encryption on the client device and as such all the ISP knows is that you connected to the secure proxy or VPN, but nothing else. Assuming one chooses a secure proxy or VPN out of reach of the government's jurisdiction then one's activity is completely opaque. Such services are now widely available around the world to the average consumer.

Given that the average consumer can easily avoid tracking, how does the law enable realistic intelligence gathering of valuable targets? One can assume that a valuable target (such as a terrorist or criminal) has at least as much knowledge as the average consumer.

Answer 1

Your question deals about valuable targets which means that the services already know he is a terrorist/criminal. Then, I won't speak about « finding » them.

Using a VPN does not necessarily protect the target. Indeed there are 3 weak points :

• The VPN does not change DNS thus the target has its trafic encrypted but the ISP can still see every domains he is visiting. This is called dns leak.
• The VPN changes DNS but (and i'v seen that) use some non-privacy friendly one like google for example. If you have ever heard about PRISM then you'll understand the change is useless.
• The VPN provider will/has to handle info on the target. Either it is forced by law or it accepts demand from those services. Keep in mind that the provider will have your real ID, payment info etc.. and can see your trafic. (Assuming you're not using a token based VPN) You should not believe any service that pretend to be "NSA Proof" or that don't keep any logs. There is always trust somewhere for the average consumer. (--> 'Hide My Ass' and LulzSec).

Proxies will be useless. At least for the average consumer. Keep in mind that those services are tapping fibre-optic cables. The target could use Tor but this is link with my next point.

Setting up a VPN/proxy/Tor on your computer does not make you untraceable. The target will have to follow strict rules and not make any mistakes which means never do anything that could help to correlate his real ID and the one browsing through his anonymizing solution. I won't even be able to list all the possible mistakes that people did: open pdf documents while connected, browse with Tor while your usual browser is still open, set up a VPN after Tor or a non-trusty one before Tor, browse Tor at home or never change the location… Well there are lot of points when the target is “playing with his life” against persistent threat which are able to manage 'attack' against Tor network.

You can have a look at some documents Ed Snowden leaked or even go on wikipedia. They should be able to decrypt a lot of VPN traffic. It is not on real time but is useful in a lot of cases. Tempora is definitely something you should dig in.

You ask only about internet but there are still a lot of communications done via mobile phones. Both NSA and GCHQ have been said to monitor those. Does the target is encrypting his phone calls and SMS? If not an IMSI-catcher will be useful.

Last point is about compromising devices. Phones should be the most breakable devices. Again an old article. The point in computer security is that no system is 100% secure. It is until we find the breach. And you can be sure those services have guys working on that every day of the year. No matter what anonymizing solution you are using, if your device is compromised it's over. A simple keylogger would give those services every information they want.

You should also get informed about CISA. A really nice bill coming from US.

---

For a conclusion I would say that those services will most likely use mistakes and misconfigurations from users to spy on them while gathering maximum data from providers/companies in a legal or illegal way. Using known or unknown security breaches will help them to compromise devices.

To end, I would say that your question silently implies that those "spying laws" emerging in a various range of countries around the world are effectively set up to counter terrorism or criminal activities. Well, one could see that these are just a way of setting a global surveillance on people that effectively don't know how to protect themselves. We already know that mass surveillance is not necessarily helpful in the fight against terrorism.