Will Drip law make UK citizens' data more attractive to hackers?

Cybercrime experts disagree over whether new surveillance law will create new 'soft targets' for cyber-criminals.


The Data Retention and Investigatory Powers (Drip) bill that yesterdaycleared the House of Lords will make companies holding UK citizens’ communications data far more attractive to criminal hackers, a security expert has warned.


This will likely be a long-term consequence of the law as it will spread the UK’s data across the world, said Dr Adrian Davis, cybercrime expert and European director of (ISC)2, an association of information security professionals.


Davis raised concerns about clause 4 of the bill, which extends the territorial reach of UK surveillance powers by making it clear foreign firms holding UK citizen data can be served with a warrant to hand over information.


The government chose to add the clause as the current law only has an “implicit extraterritorial effect” and “some of the largest communications providers” based outside of the UK have questioned whether the legislation applies to them.


But this will lead to storage of data in more locations around the world, thereby increasing the chance hackers will be able to access it, Davis said, adding that companies storing the information may not have the same quality of security as those within the UK.


“Because of the extraterritorial reach in the Drip bill, it requires foreign internet service providers, who may be providing webmail services to British citizens (think of the expats living in Spain or Florida and using national ISPs for example), to store data about those British citizens in data or storage centres outside the jurisdiction of the UK Data Protection and other relevant Acts,” Davis told the Guardian.


“As a result, we don’t know how that data is stored, processed, accessed or protected … Hackers may view foreign ISPs storing British citizens’ data as a ‘soft target’ – the levels of protection may be different and the penalties for stealing or compromising data could be lower.”


Davis also claimed that organisations within the UK will also become more attractive to criminal hackers thanks to the proposed update of the Regulation of Investigatory Powers Act, which currently governs how surveillance by UK agencies can be carried out.


A House of Commons' standard note about Drip indicated any company that provides "webmail" services will have to retain data, thus increasing the volume of data they have to store and thereby increasing the number of enticing targets for criminal hackers hoping to get their hands on troves of data, he said.


Some security experts disagree, however. Prof Alan Woodware from the department of computing at the University of Surrey said the data that companies are being forced to retain may not actually be that attractive to malicious hackers.


He said that the metadata that the government wants to have stored includes who spoke to whom, when and from where – not the actual content of the communications. “User IDs I suppose could be of interest but without passwords is that really going to tempt hackers? I’d expect hackers to be more interested in fuller data sets,” said Woodward.


“But, I suppose also there will be someone who tries to do this to make a point. The point however is that they could do it before Drip, and the fact that Drip is now in place simply means they continue to have the same opportunity, if indeed it exists.”


Richard Clayton, security expert from the University of Cambridge Computer Laboratory, agreed it was unlikely hackers would put more effort into breaching ISPs as a result of Drip. But it may lead to more journalist attempts to illegally acquire interesting communications data, he added.


“What does seem plausible is that journalists will bribe insiders for the data. A list of mobile phone calls performed by Mr Cameron over the past week or so might be very interesting," said Clayton. "But lots of this data is held for a short period anyway - so the increased risk comes from being able to look back 12 months for this information."


Despite claims Drip would simply reaffirm the status quo, lawyers and human rights activists have pointed out that clauses 4-5 of the bill extend the government’s reach to US and foreign companies and increasing the kind of web services for which intercept warrants can be issued.


“In our view these clauses should be deleted entirely,” said Jim Killock, executive director of the Open Rights Group. There is also a heated debate over whether the bill has been rushed through without proper debate about its implications.