No ID Card Function Creep? Pull the Other One

Here's an interesting blast from the past, courtesy of that nice Mr Charles Clarke, one-time home secretary:

This letter was sent about eight years ago as a reply to my Member of Parliament, Bill Cash, in response to the second of two letters I wrote complaining about the Regulation of Investigatory Powers bill that was then being considered by Parliament.

As you can see from the second paragraph on the second page, the Minister of State responsible for the legislation categorically denied that access to 'communications data' would be extended to local authorities.

Got that? No access to communications data by local authorities making use of the Regulation of Investigatory Powers Act, word of honour.

Oh, but wait:

Powers designed to allow spying on terror suspects have been used by South Kesteven District Council to investigate anti-social behaviour and fly tipping.

The council carried out surveillence on the public nine times between April 2007 and April 2008, permitted by legislation in the Regulation of Investigatory Powers Act.

Now, tell me again why we should trust the UK government over ID cards? At least it seems a few other people are beginning to have their doubts:

The government should limit the data it collects on citizens for its ID card scheme to avoid creating a surveillance society, a group of MPs has warned.

The Home Affairs Select Committee called for proper safeguards on the plans for compulsory ID cards to stop "function creep" threatening privacy.

It wants a guarantee the scheme will not be expanded without MPs' approval.

Maybe the Home Secretary could give her word that will never happen....

Openness vs. Privacy

There's an interesting tension between openness and privacy: openness is good except when it might infringe on justifiable privacy. This makes matters of privacy, and hence encryption, a kind of obverse to openness. So legislation like the Regulation of Investigatory Powers Act is something that I've followed even before it was introduced in 2000.

I hadn't realised that part of that Act - that deals with disclosure of encryption keys - was not yet in force. As this news item explains, the UK Government is threatening to make this happen, but, as usual, without really thinking it through.

The justification - of course - is the tired old one of terrorism (anybody notice how this has become a kind of continuous justification for everything these days? - You don't think people have been reading 1984 for ideas or anything?). The "argument" is that the new powers are needed to "force" those evil terrorists to hand over the keys so that PC Plod can read all that incriminating evidence, and they can do their well-deserved porridge.

So, let's consider the various possibilities.

Either these terrorists, who tend to show scant regard for human life, let alone human laws, are suddenly going to become law-abiding, and say: "it's a fair cop, but society is to blame. Here are my encryption keys," and get sent down for the 10, 20, or 30 years they would cop for conspiring to carry out acts of terrorism blah-blah-blah. Or might they possibly just say "I've lost the keys", and get sent down for a couple of years instead?

Which do you think they'll choose?

Now tell me again why we need this legislation, since the only people it can possibly affect are law-abiding citizens like you and me, not law-defying terrorists?

Update 1: Slightly off-topic, but quite.

Update 2: More stupid UK legislation that will weaken, not strengthen people's security.