I Read Your Mail Headers

Nobody comments on the most obvious feature of the Interception Modernisation Programme -- the scheme to put intelligent sniffers in every ISP, funnelling anything GCHQ wants back to Cheltenham.

It's totally unauthenticated. Sniffers are purely at the network level. It identifies IP addresses, but not users. Without getting into the great "IP is [not] Personally Identifiable Data" debate, it seems pretty clear that this material will have to work pretty hard to prosecute anyone.

So it's just intelligence gathering? Pure snooping?

Obvious Really

I'm not interested in concealing my identity, exactly, but I don't put my real name on these because any security writing that uses real-life examples will sometimes be about Fail, even if it's Fail rectified, and who wants to go public about their own employer's Fail?

Even so, I've always been circumspect about what I say because I've felt that the intersection of the things I talk about -- Kent, Finance, Computer Security, Old man -- is going to be a pretty sparse set. Anyone who cares could find out who I am.

So it's interesting to see Schneier blogging about some research from PARC. Apparently the end-points of a regular commute are sufficient to identify a huge proportion of people. Pretty much all that required is that the granularity is fine enough for people to be working in a different zip, county or whatever from the one they live in.

I'll be more careful in future. I have a plan.