5

The recently announced Investigatory Powers Bill in the United Kingdom will mean that ISPs must store the internet activity of everyone for one year.

Anyone who wishes to evade such tracking can use a variety of methods such as using a secure proxy or VPN. These methods use encryption on the client device and as such all the ISP knows is that you connected to the secure proxy or VPN, but nothing else. Assuming one chooses a secure proxy or VPN out of reach of the government's jurisdiction then one's activity is completely opaque. Such services are now widely available around the world to the average consumer.

Given that the average consumer can easily avoid tracking, how does the law enable realistic intelligence gathering of valuable targets? One can assume that a valuable target (such as a terrorist or criminal) has at least as much knowledge as the average consumer.

  • This is why there is currently a parallel effort to outlaw encryption technology in the united kingdom. – Philipp Nov 4 '15 at 15:33
  • 1
    "Given that the average consumer can easily avoid tracking". It is really not that simple for the average consumer. A faulty configured DNS server while using a VPN connection for example, allows your ISP to still see what domains you've tried to connect to. Then there is browser finger printing that can be quite unique. Connecting to a VPN just doesn't cut it. I hope you're aware of that. – Jeroen - IT Nerdbox Nov 4 '15 at 15:37
  • as previous comments have said the average user could use one of these services but the vast majority wont and those of them that do will end up doing it wrong. it comes down to a lack of knowledge the public has on IT. – Lmnoppy Nov 4 '15 at 15:40
  • @Jeroen-ITNerdbox a quick google for secure vpn and the top results are for services that offer tunnelled VPN which includes DNS. The user would have to go out of their way to badly configure it. – Qwerky Nov 4 '15 at 16:02
  • @Qwerky: And there there is the browser finger printing, browsing behaviour etc. Again, not as easy as it seems. – Jeroen - IT Nerdbox Nov 4 '15 at 16:26
5

Your question deals about valuable targets which means that the services already know he is a terrorist/criminal. Then, I won't speak about « finding » them.

Using a VPN does not necessarily protect the target. Indeed there are 3 weak points :

  • The VPN does not change DNS thus the target has its trafic encrypted but the ISP can still see every domains he is visiting. This is called dns leak.
  • The VPN changes DNS but (and i'v seen that) use some non-privacy friendly one like google for example. If you have ever heard about PRISM then you'll understand the change is useless.
  • The VPN provider will/has to handle info on the target. Either it is forced by law or it accepts demand from those services. Keep in mind that the provider will have your real ID, payment info etc.. and can see your trafic. (Assuming you're not using a token based VPN) You should not believe any service that pretend to be "NSA Proof" or that don't keep any logs. There is always trust somewhere for the average consumer. (--> 'Hide My Ass' and LulzSec).

Proxies will be useless. At least for the average consumer. Keep in mind that those services are tapping fibre-optic cables. The target could use Tor but this is link with my next point.

Setting up a VPN/proxy/Tor on your computer does not make you untraceable. The target will have to follow strict rules and not make any mistakes which means never do anything that could help to correlate his real ID and the one browsing through his anonymizing solution. I won't even be able to list all the possible mistakes that people did: open pdf documents while connected, browse with Tor while your usual browser is still open, set up a VPN after Tor or a non-trusty one before Tor, browse Tor at home or never change the location… Well there are lot of points when the target is “playing with his life” against persistent threat which are able to manage 'attack' against Tor network.

You can have a look at some documents Ed Snowden leaked or even go on wikipedia. They should be able to decrypt a lot of VPN traffic. It is not on real time but is useful in a lot of cases. Tempora is definitely something you should dig in.

You ask only about internet but there are still a lot of communications done via mobile phones. Both NSA and GCHQ have been said to monitor those. Does the target is encrypting his phone calls and SMS? If not an IMSI-catcher will be useful.

Last point is about compromising devices. Phones should be the most breakable devices. Again an old article. The point in computer security is that no system is 100% secure. It is until we find the breach. And you can be sure those services have guys working on that every day of the year. No matter what anonymizing solution you are using, if your device is compromised it's over. A simple keylogger would give those services every information they want.

You should also get informed about CISA. A really nice bill coming from US.


For a conclusion I would say that those services will most likely use mistakes and misconfigurations from users to spy on them while gathering maximum data from providers/companies in a legal or illegal way. Using known or unknown security breaches will help them to compromise devices.

To end, I would say that your question silently implies that those "spying laws" emerging in a various range of countries around the world are effectively set up to counter terrorism or criminal activities. Well, one could see that these are just a way of setting a global surveillance on people that effectively don't know how to protect themselves. We already know that mass surveillance is not necessarily helpful in the fight against terrorism.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.