Sorry, but Google almost force you to use https these days. We (A&A) as an ISP, cannot log search history using https Google even if we wanted to, and no amount of money (and yes, the government will have to pay ISPs for this) will change that fact.
We also have no intention of logging web access either. It will be interesting to see what law you bring in. It will be interesting to see how much you think it will cost to pay every small ISP to install expensive kit to log this all (and retain it securely in accordance with DPA) and what happens when that ISP decides to sell its customer base to another new ISP over night, and eBay all that nice snooping kit you just paid for and delete all that data that was retained as old ISP no longer exists. Rinse repeat. "Andrews & Arnold Nov 2015 Ltd", "Andrews & Arnold Dec 2015 Ltd", anyone?
Or maybe we will make each and every customer an ISP themselves and we'll merely be "transit" for them, then they can each discuss the fee for imposing logging and secure retention of the search history for their home/office individually with the government. That would be fun.
Even if only the big ISPs are forced to do this - I hope that *lots* of their customers will DPA subject access request them on a regular basis for copies of all of the logs held.
I also hope that every time one of these logs associates web access with one person in a house when it is actually another person in the house, people will use their legal right to have that data corrected on those logs under the DPA, and report the incorrect data to the ICO.
Until all MPs have their full personal web and search history publicly available as a matter of course I cannot see anyone taking these ideas seriously.
Ironically, this week, having been in the US, I was using various wifi, and VPNing back to a FireBrick here. Almost all I do is https anyway, but VPN is an extra layer because "No idea what US or local wifi operators do with my meta data or whatever". I can see it soon being normal for the reverse - VPN from your home/office to "sane" countries so as to access the Internet without breach of your privacy.
Once we have exact details of the proposed law, I can provide a more detailed comment on this lunacy.
Goggle?
ReplyDeleteI've been toying with the VPN idea for a while now for that reason - not that I don't trust A&A at least as much as I'd trust any other ISP, but the option of an extra layer of protection is always welcome if the cost, in money and latency, is reasonable... Is it usable for normal use even with a VPN tunnel to another continent, RevK? I'd expected it to add enough latency to be irritating, particularly for interactive things like SSH.
ReplyDeleteIn the absence of a law against VPN anonymity, could you just bundle "free" use of a Firebrick VPN with Internet access? No need to encrypt that VPN, since it's only going within one rack ... a nice streamlined tunnelling protocol would do. PPPoE converted to L2TP, for example.
"Yes, Constable Plod, we can tell you exactly what we're required to about jas88's traffic that day: he sent 88,198,318 bytes of UDP packets that day, all of them destined for that Firebrick server over there ... What? You want to know what was in those packets? No idea, the law just said we had to record how much traffic and where it went..."
Oh, agreed. Even the IP over LCP we can do on FireBricks now may bypass any logging within BT.
DeleteWhat's an internet service? I provide email and dns for mrsclifford.com. Also backup services over the internet to separate sites. There is even a rudimentary web page.
ReplyDeleteIf I'm an ISP, will the Raspberry Pi be able to cope the snooping stuff? Perhaps the government will buy me a couple of Rasberry Pi 2's.
Question is when will AAISP offer encryption on their L2TP tunnels?
ReplyDeleteIt was funny the news article saying there needed to be a way of checking "if a suspect had downloaded a terrorist manual"
ReplyDeleteThey could always host it on a gov.uk site and then they'd have the access logs!
DeleteWhat about your plan to offer an always VPNd connect to another country?
ReplyDeleteIt would be really good if you could offer a service a clueless option to L2TP IPsec to another server, a bit like you do with mobile sims. Then it totally gets around the issues.
Would the definition of ISP allow you to set up another company A&A IPsec Ltd that just does the other side? Might not work for those with IP ranges but for Home::1 etc?
We do allow L2TP relay - I think you need to ask staff to set it initially, but it is an option, yes. As for IPSec, we don't have the large scale "head end" for that yet, but technology is improving all of the time and we may be able to in due course.
DeleteRevK, I was told 3 years ago that IPSec was on its way. As a user that has an L2TP back to the UK from abroad I'd be interested in the timelines for encryption.
ReplyDeleteWe have IPSec in FireBricks now, but not the large scale back end you would need for a service. Some broadband routers even do IPSec now - so the time is coming when this may be possible with cheap kit.
DeleteI have IPSec on my Mikrotik, any chance of a trial on my connection?
ReplyDeleteAs I say, we don't have the back end large scale IPSec capability just yet.
DeleteCould you invest if you could charge a premium and enough people were interested? What sort of numbers would you need for a trial?
DeleteIt may come to that...
DeleteThere have been many cases worldwide which have highlighted the importance of privacy protection tools; ranging from the Edward Snoweden files to The Pirate Bay take downs. While we do not condone any illegal activity we believe that protecting your online activities should be a human right. Choosing the right VPN can be daunting but this is where we come in. If you live in Usa and haven’t thought about USA VPN yet, then it’s high time to do so.
ReplyDeleteI know it is spam - but interesting, so I allowed it ^^
DeleteIf A&A simply permit all of us to resell 'ISP' services in their T&C (they might already do this; or more likely don't say we can't), then presumably we automatically become ISPs in our own right and can claim for huge storage units to record the potential traffic.
ReplyDeleteI could do with a new multi-TB nas or two :)
Google is https now but they host servers inside isp's networks e.g. a trace to google using sky yields this.
ReplyDelete1 <1 ms <1 ms <1 ms home.gateway [192.168.1.253]
2 * * * Request timed out.
3 8 ms 7 ms 7 ms 02780840.bb.sky.com [2.120.8.64]
4 * * 7 ms 02780a33.bb.sky.com [2.120.10.51]
5 7 ms 7 ms 7 ms host247-rangeB-google-ggc.cdn.thlon.isp.sky.com
[2.127.252.247]
Note also the connection isnt even using sky's dns server yet is still routed to an internal google server, I assume if sky have access to the end point then https wont block anything from them as they would be able to access the google logs.
London servers typically give 9-10 ms on this connection, so I am pretty sure that google box is inside sky's network.
Those are Google Global Cache servers - https://peering.google.com/about/ggc.html - colocated caching nodes within an ISP's network, the same way Akamai and Netflix do it. Google don't reveal much about how their nodes work, but as I recall the other companies doing this very definitely don't give the ISP access to logs or anything else: they assign it an IP address, rack it up and leave it alone.
DeleteTechnically, they could break in to the physical unit, but I doubt it contains anything "sensitive" - it's only there to cache popular static content, after all. I would guess it'll have its own SSL certificate for the cacheable content it might handle locally, and just relay everything else still encrypted back to a Google datacentre.