You're (not) nicked —

Data snooping blunders by UK spies, cops led to wrongful arrests—watchdog

IP address mistakes particularly troubling; likely to get worse under Snoopers' Charter.

Data snooping blunders by UK spies, cops led to wrongful arrests—watchdog

Seventeen people were wrongly arrested or had their homes searched without cause because of mistakes made in acquiring communications data last year, it has been revealed.

That figure was among were some of the 23 "serious" errors that were investigated by the Interception of Communications Commissioner’s Office (IOCCO), and published in a report.

Human errors accounted for 14 of the serious blunders, according to the IOCCO, and nine were technical gaffes. The latter "resulted in multiple consequences and a large number of erroneous disclosures (2,036)," it said.

The total number of errors reported to IOCCO in 2015 was 1,199, a troubling increase of 20 percent from the previous year.

Altogether, 761,702 items of communications data were acquired by public authorities during 2015. The watchdog explained: "An item of data is a request for data on a single identifier or other descriptor, for example, 30 days of incoming and outgoing call data in relation to a mobile telephone would be counted as one item of data." The reported added what each item of data referred to:

The majority of items of data (82.6 percent) related to telephony identifiers e.g. landline or mobile phone numbers, 14.1 percent related to Internet identifiers e.g. e-mail addresses or Internet protocol addresses, 0.8 percent related to postal identifiers e.g. postal addresses and the remaining 2.5 percent related to 'other' identifiers, e.g. bank account or credit card numbers.

Police forces and other law enforcement agencies acquired 93.7 percent of the data items of data, 5.7 percent were requested by intelligence agencies, and 0.1 percent by local authorities. Altogether, 145 public authorities acquired data in 2015, the report found.

Many of the errors relate to IP addresses, even though they formed only a small part of the total:

It is of note that a large proportion of these errors (including the majority of errors where applicants specified the incorrect date or time) relate to Internet protocol addresses.

This is significant considering Internet protocol addresses account for less than 14 percent of the items of data acquired by public authorities and given the potential for serious consequences to result from mistakes that are made when resolving internet protocol addresses.

The report noted various reasons why that was the case:

The fact that Internet protocol addresses are generally dynamic in nature and public authorities receive information about Internet protocol addresses linked to crimes (and other statutory purposes) in numerous time zones and date formats, and are correspondingly required to acquire data from [communication service providers] in numerous time zone and date formats to resolve which individual they relate to, presents opportunities for errors to occur.

The particular problem with IP addresses is likely to become even more serious once everyone's IP address is routinely collected and stored as part of the Internet connection records (ICRs) required under the Investigatory Powers Bill currently working its way through parliament.

The IOCCO report, it could be argued, rather undermines the government case for retaining sensitive ICR data for a year: "80 percent of the requests required data on an identifier for periods of three months or less (for example, one month of incoming and outgoing call data). A high volume of data was acquired for a period of less than one day (approximately 20 percent)."

Even though national security is regularly invoked to justify the introduction of the so-called Snoopers' Charter, the report shows that less than seven percent of communications data related to this area. By contrast, "53 percent of the data was acquired in relation to four crime types: drugs offences, sexual offences, theft offences, and fraud and deception offences."

Unsurprisingly, prime minister Theresa May ignored these facts when she spoke in parliament on Thursday about a brace of reports from the IOCCO and a similar one from the intelligence services commissioner, which also reported a "significant rise" in errors from 43 to 83.

"Both reports show the rigour and strength of our intelligence oversight system, a system that will be further strengthened with the introduction of the Investigatory Powers Commissioner provisions set out in the Investigatory Powers Bill," she said. "I welcome the unprecedented level of transparency about the authorisation and oversight regimes that both reports contain."

Channel Ars Technica