Select Committee on Home Affairs Written Evidence


APPENDIX 47

Memorandum submitted by Dr Andy Phippen,[238] Dr Hazel Lacohee,[239] and Professor Steven Furnell[240]

  In this response to the call for evidence for the Home Affairs Committee's inquiry into "A Surveillance Society", we present a response that considers the citizen's perspective, examining their perceptions toward monitoring via various ICTs, before considering their awareness of protection mechanisms. The evidence presented is drawn from a major study in collaboration with BT Group Chief Technology Office and Hewlett Packard, supported by a number of further studies carried out by the University of Plymouth's Information Security and Network Research Group.[241]

  The Trustguide project[242] was concerned with exploring issues of trust, security and privacy in ICT based applications and services with the general public through direct dialogue, facilitated via 29 discussion groups between September 2005 and October 2006. In total approximately 400 citizens took part in discussions. Our findings suggest that UK citizens are technology-aware and have belief systems informed by a mix of mass media communication, personal, and peer experiences. This has significant implications for service providers and policy makers—the age of the naïve ICT user is over, replaced by a population who may not have experienced specific technologies first hand, but have confidence in their understanding based upon numerous information sources (albeit from sources that one might consider to be unreliable or subjective sources). We are faced with a population who believed they are well-informed regarding their understanding of ICTs, and are cynical when "sold" a technology for reasons that conflict with their own belief systems.

  In considering surveillance technologies, and citizen's attitude toward such, one of our more interesting initial findings was the tolerance of UK citizens toward CCTV monitoring. We felt, through our initial discussion, that citizens would be intolerant of such systems. However, in-depth discussion provides two key reasons why such tolerance exists. Firstly, CCTV exists in public spaces—people do not mind monitoring when it is open and not invasive of their private space (their homes, workplace, etc). In addition, media coverage of crime and terrorist attacks had demonstrated the value of CCTV in protecting society. The power of the media as a persuasive mechanism for the general public should not be underestimated, and it is something that we will return to later in this piece.

  However, this attitude should not lead to Government complacency related to further monitoring. We found high levels of concern regarding what is perceived as increasingly heavy surveillance of day-to-day movements and activities. State claims and justification for current and increased levels of surveillance (eg control of terrorist activities, reducing crime, road user monitoring) were greeted with scepticism both in terms of a genuine need for such high levels of surveillance and any evidence that it serves the stated purpose. Many citizens feel that their constitutional rights are being eroded in the name of security, yet few feel under the degree of threat that might warrant such measures.

  We have found this opinion results from a number of different beliefs. Firstly, as we have stated above, CCTV is tolerated because its benefits are clear to see via the media. Technologies such as ID cards, biometrics and DNA databases have less of an "evidence base" from which citizens can draw to inform their opinions. An important key finding from our work is that technological engagement with the general public has little to do with technical elegance, guarantees of security, and reliability. It does, however, have a lot to do with convenience for the citizen. If the citizen can see a clear benefit for either themselves or their community (whether their concept of community might be) they will be far more accepting of a technology than one where they cannot see such.

  So if we consider the issue of ID cards, we can see difficulties in being able to demonstrate the benefit to the individual. Indeed, what is the benefit for the individual in carrying an ID card? Clearly there are benefits for Government, security services and industry, but the individual can see little benefit to having one in their possession. Therefore, with an unreliable foundation upon which to build trust in ID cards, there is little wonder that further opposition is met with the proposals to have mandatory ID cards paid for by the citizen.

  Another key factor in the public's mistrust of surveillance systems is again something drawn from media influence. Numerous participants in our discussions stated that the Government were not effective at "doing IT". High profile public sector failures, or predicted failures, such as the Child Support Agency system, have resulted in a public who do not feel that the Government are capable of effectively managing the systems required to ensure the efficient operation of such surveillance system. Therefore, guarantees of 100% secure technologies are met with scepticism by citizens who, even if having no personal IT expertise, have been exposed to increasing reports in the media demonstrating this to be untrue. Compounded with this mismanagement is another factor that has eroded the public's trust of the Government looking after "their" data (individuals clearly believe that data held about them still belongs to them). There were subsections within many groups that were uncomfortable, not from the privacy issues but because they felt if the Government had physical ownership of that data, there might be temptations to sell such information to interested bodies, as has occurred with DVLA data.

  We believe that the Government's key issue with the acceptance of a reasonable "Surveillance Society" is not one of technology but education and informing the population. We have discussed at length the information sources that citizens draw upon when forming opinions regarding ICT—the main influencers are the media and peers. While those citizens that have access to professional advice will take it, the majority of their awareness comes from what they see in the newspapers, what they watch on television, and what they discuss with their peers.

  A key issue Government faces is that these information sources do not have an objective viewpoint. Arguably, the World Wide Web is a major threat to the media industry—therefore, where is the incentive for a media outlet to report "citizen uses ICT successfully to enrich life"? Previous attempts to use the media to disseminate objective material about Internet awareness and protection have only had limited impact. We discussed the Get Safe Online campaign[243] within both the Trustguide and subsequent survey work (surveying approximately 500 citizens regarding their ICT security practices and their sources of education), and in each case, impact had been minimal. In the survey responses, 12% of the population was aware of the campaign and only a third of those felt the information was useful.

  However, there is a belief among citizens that, while they have opinions regarding ICT and its threats, they do not have the confidence or concrete knowledge to protect themselves. In our survey work, the majority of respondents felt that they did not do enough to protect themselves from online threats for a variety of reasons, including lack of understanding, cost of products, or that they simply did not feel it was their responsibility. This was reflected in our Trustguide discussions, where many participants stated that either they did not feel equipped to protect themselves, or it was someone else's job to do so. When discussed in more detail, the responsibility for protection, in the eyes of the citizen, normally lies with either Government or manufacturers and service providers. There were many comparisons with motor vehicle safety, where citizens would not expect to purchase a car without it being roadworthy.

  However, some of our recent research would suggest that while IT providers are doing more, citizens are still failing to take any responsibility for protection. In carrying out a survey of unprotected wireless network access in cities and towns in the South West, we discovered on average around 25% of networks were not encrypted. This is a significant change from previous years, where generally around 60% were found to be unprotected. This change corresponds with a period in which the wireless hardware provided by vendors is now encrypted "out of the box". This means that the individual does not have to set up the encryption themselves, it is there by default. This represents a significant shift for IT vendors in taking steps to protect the citizen.

  Around the same time, a complementary experiment scanned for unsecured Bluetooth devices and, when discovered, the devices were sent a harmless, but unsolicited, image file. In over 50% of cases, the recipient was happy accepted the file without querying what it was or where it came from.

  These experiments show that while manufacturers taking greater responsibility to protect the public, some of the responsibility ultimately has to rest with the citizen. To take the motor vehicle analogy once more, someone purchasing a car and driving it home is not faced with an ever-evolving environment with new threats emerging on an hourly basis. However, this is exactly the environment facing IT users. Therefore, we feel we should stress the importance of reaching the public with accurate, objective information regarding ICTs so they can make informed decisions, rather than the current climate of building belief systems on very weak, ill constructed, foundations.

  Of more immediate concern is the protection of young people. Within our discussion with young people, it became very apparent that while they were technically capable, they had little awareness of the threats that exist in going online, and only had a veneer of knowledge regarding protection mechanisms. On three separate occasions in discussions with young people, we encountered experiences of stalking attempts via messenger services. While in all three cases, the perpetrator was blocked by the intended victim, there was no reporting of the incident to an authority figure. When asked why not, the responses ranged from "what's the point?" to "I didn't know how to". The majority of young people we spoke to felt that authority figures (such as parents and teachers) had less knowledge about online threats than they did, and as such would not know what to do either.

  This discovery led to further investigation into the exposure young people get to Internet awareness and protection through school curricula. Certainly GCSE and A-level curricula for ICT and Computing that we examined had virtually no mention of protection mechanisms, aside from those to deal with business ICT. However, we found that young people are receptive to the idea of classes in such an area, some suggesting Citizenship classes could cover such things. Certainly, the work of the Child Exploitation and Online Protection Centre,[244] with their schools programmes, is having an effect, but this is a small Government department reaching out the approximately 25,000 schools in the UK. Young people also felt the media could play a part, but were more likely to be engaged through drama than direct information presentations.

  In considering the safeguards for data use, and abuse, we finally consider legislative measures. While our studies with citizens have shown some awareness of measures such as the Data Protection Act and other legal mechanisms to ensure adequate protection, we also, unsurprisingly, discovered that the majority of citizens will not consider things such as Terms and Conditions in depth when registering with an online service, particularly if such a service is offering them some sort of material or social benefit. Obviously this can potentially leave the citizen open to all manner of data abuse, but the general opinions were that while they knew they should read such things, they lose interest in the legal syntax of such. Therefore, stronger legislation to ensure more effective privacy policies would have little impact.

  However, we believe there is one area that could potentially have more significant impact is more effective regulation of the service providers. At present, there is little professional liability within the IT industry. Hence the number of breaches and information thefts that occur online, the majority of which are down to poor security practices, design and implementation, rather than issues with the technology itself. The IT industry is one driven by the sort of remunerative rewards that one might expect from any professional discipline, but without the legislative controls that apply to, for example, the legal or medical professions. Therefore, service providers are happy to commit to service delivery without actually considering the feasibility of such approaches. Certainly, our own experiences acting as intermediaries between clients and service providers when troubleshooting what went wrong in projects would suggest the lack of legislative control results in a highly unregulated industry without some extremely unethical practice. While the British Computer Society is making great strides forward with its professionalism agenda, its membership is still only a small part of the IT industry, and complimentary to their reward-based incentives to become an "IT professional" could be stronger legislation. A service provider may become far more likely to carry out effective risk analysis, and penetration and boundary testing, on their services if they were to be held accountable for any avoidable breaches, in the same way that society would expect a surgeon behaving in an unethical manner would be held to account. Currently, we exist in a culture of "well, you signed-off the specification" where the responsibility is placed back with the procurer, rather than provider, of a service.

  In conclusion, we believe that while technology has a part to play in the public attitudes toward whether we exist in a "surveillance society", the major issue lies within the public perception of such approaches—whether they consider them to be acceptable and good for the private citizen. We believe education and information are key drivers in ensuring a society that is more aware, and accepting, of realistic surveillance measures in place to protect them. Our work also suggests that understanding of public perception still requires far more work, as our discoveries about the public's attitudes toward ICTs is in conflict with conventional wisdom. Finally, we believe that dividing responsibility between citizens and service providers is necessary to ensure more effective safeguards, and feel that stronger legislation of the ICT industry, with greater awareness of professional liability, is an important step forward in achieving such protection from data theft and abuse.

July 2007






238   Information Security and Network Research Group, School of Computing, Communications and Electronics, University of Plymouth, Drake Circus, Plymouth, UK. Back

239   BT Group Chief Technology Office, Adastral Park, Martlesham Heath, Ipswich, UK. Back

240   Information Security and Network Research Group, School of Computing, Communications and Electronics, University of Plymouth, Drake Circus, Plymouth, UK. Back

241   http://www.network-research-group.org/ Back

242   http://www.trustguide.org.uk/ Back

243   http://www.getsafeonline.org/ Back

244   http://www.ceop.gov.uk/ Back


 
previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2008
Prepared 8 June 2008