DNA database

Data protection and the inexorable march of the snooping state

Jock — Wed, 16 Jul 2008 23:52:07 +0000

Apparently the Data Protection Act turned ten years old on Wednesday, according to El Reg. But you'd be forgiven for thinking it never existed, or has been repealed, given all the recent stories of data loss by, of all organizations, the government, and the newer suggestions that all our DNA, phone and internet communications records, should be in a database, forever, and instantly accessible to any accredited official (I won't say "qualified" because I suspect they won't be) with an easily contrived excuse.

Fortunately, the Information Commissioner, Richard Thomas, stands between the state and its ambition to know everything there is to know about its citizens and what they do, consume, learn and who they associate with. But with such a lax attitude to their own obligations under their own Data Protection laws somehow I doubt Mr Thomas will be heard, let alone listened to.

My attachment to a few home comforts prevents me from becoming a survivalist type, and I am too much of a coward to be a martyr. But I do seriously consider at times whether there is a way to opt out of this inexorable creep of the surveillance state. Emigration? Where would be any better though I wonder? Switzerland maybe, but I doubt they'd have me.

And I just do not understand why so many people, it seems from my view anyway, are able passively to accept this state encroachment into our lives. I know plenty who do not even see it going on. Why on earth is it any more acceptable say, for the state to know about all your telephone calls or emails than it would be, say, to open every posted letter somewhere in the postal system, or, creepier still, have someone follow you so they can check out who you talk to in the street or who you visit? I'm sure there have been times when this ability is exactly the reason why the Royal Mail existed - for intelligence purposes - and with a monopoly too, mind you, though in the popular conscience the Royal Mail, USPS and other national mail services are actually supposed to be trusted guarantors that nobody should tinker with private correspondence with impunity.

Of course, such surveillance of physical media communications or personal movements would be impractical on a mass scale whereas electronic communications tend to leave tracks for all sorts of (usually business) reasons. But "just because we can", just because massive scale monitoring is now feasible and manageable with electronic communications does not mean we should. I have a contract with a phone company, and the data even they keep should be limited to as little, and for as short a time as necessary, as needed to deliver me the service they promised. And indeed, that is core to the principles behind the Data Protection Act.

No doubt they will all say that you can breach those principles "in the national interest" or whatever. But at the very worst, such a situation should be the exception and not the rule, and should be subject at all times to proof of probable cause via judicial oversight. After all, the "national interest" could, and usually will be, what the government of the day decide it is if it is left up to them and their agents. I always have a rueful smile when I recall that for years each part of your annual tax return would be dealt with by a different Inland Revenue clerk so that no one government official would actually know what you earned in total. Can we ever hope to resurrect such a level of government respect for our privacy?

I'm not sure I believe any longer that grand government database and surveillance projects do originate in a genuine desire to do something good. I just think it is an innate trait of government and power to want to have as much information about those over whom they wield power or those on whom they are dependent for power as they possibly can. Acton's dictum is writ large in the creep of the surveillance state: "Power tends to corrupt, and absolute power corrupts absolutely". Information brings, and sustains power.

I linked to this post at the Libertarian Party blog the other day, but if you didn't read it then, please go have a look now. It's a light-hearted look at the inconveniences that could beset the most minor activities in your daily lives if all these supposedly beneficial systems actually come to pass. Forget that "if you've nothing to hide" crap, I challenge anyone to say they would not be severely pissed off with this level of "helpful" surveillance.

Yet all of this need not be the end game, just as I am sure today there are thousands of people trying to find new ways of evading the Chinese national firewall, or make a few phone calls without being billed for them, people will continue to develop ways of keeping one step ahead of the voracious information state. Ultimately, I don't believe that the state can win against the advance of the technology. But there is a danger, if we do not start constitutionally protecting our privacy now, that the state will keep trying on any pretext they can muster, and turn truly tyrannical in their desire to control information flows.

surveillance state

Habeas (the tiniest little bit of my) corpus

Jock — Mon, 25 Feb 2008 12:03:26 +0000

Hat tip to a wonderful post from South Africa about Britain's surveillance culture in which Chris Rodrigues reminds us that it was Nicolae Ceausescu who often pushed the surveillance state in totalitarian Romania with the now much overused saying that "if you've got nothing to hide you've got nothing to worry about".

We hear it all the time in Britain whenever someone starts complaining about the "surveillance state", as if just not being a criminal makes it okay to have your movements tracked, your DNA held on file or your telephone tapped. And yet again, in the wake of the two high profile convictions last week of Steve Wright and Mark Dixie, people have been calling for a full national DNA database.

Whilst it's not a terribly palatable subject, one wonders just how many DNA samples one might collect from a prostitute. Their work gets pretty intimate. One of these two fiends was on the existing database yet that doesn't seem to have been enough for the police - they want us all on the database, so they can trawl through every little sample they find at a crime scene, presumably using more computer power than Los Alamos to match up then round up casual crime scene visitors who will have nothing to do with the crime yet inevitably some will end up having to explain their innocent presence there.

No, it's time to call a halt to this expansion of the creepy, big brother state. My DNA is part of me. I may unwittingly leave bits of it lying around all over the place but to take some off me for cataloguing and storage is it seems to me a breach of habeas corpus. You're asking to hold a little bit of me in perpetuity, like a miniature electronic tag so you can reel me in whenever my DNA appears anywhere near a crime.

The fact is that Steve Wright and Mark Dixie were caught and were convicted. The existence or not of their DNA on a super-duper database doesn't seem to have prevented justice being done eventually. Good old police work was what did for them. That's where it should stop. read more »

DNA for "littering"

Jock — Wed, 16 Jan 2008 12:51:07 +0000

While Peter Black today highlights a story in the Western Mail by Jenny Willott I noticed closer to home an egregious abuse, potentially, of the DNA database system:

Police handcuffed a student and took his fingerprints and DNA after he tried to throw a bottle of water to tree protesters.

Jonathan Leighton, a student at St Anne's College, was arrested at 2am on Sunday in Bonn Square, Oxford, after he tried to give the water to tree protester Gabriel Chamberlain.

Now, I am against the "tree protestors" and their supporters, and I do hate littering enough to want it to be a criminal offence, albeit a minor one, but this seems heavy handed at best if the story is as it seems. And potentially to have your DNA (a part of you) on a database for the rest of your life for trying to pass a bottle of water to someone as a gesture of kindness is outrageous.

I would like DNA to be subject to Habeas Corpus, so long as that principle still obtains in English Law - which of course is already doubtful! read more »

That data, those cards and data protection, nuclear style

Jock — Wed, 21 Nov 2007 19:34:28 +0000

I seem to remember being told that once upon a time Inland Revenue officers used not to be allowed to work on different tax schedules so that no one officer would ever know a citizen's true financial position. Oh for such propriety today when whole records in their millions are transported around different departments merely for audit purposes. Much has been said today about the loss of disks containing the child benefit records of 25 million people and many have suggested that it would be quite wrong now to go ahead with ID cards knowing that information security is so lax in a government department that already holds sensitive data on each and every one of us.

I want to take a slightly different line. I have always been and remain utterly opposed to the system of ID cards linked to a database that is now legislated for. However when I was on the Lib Dems' Civil Liberties working party eight years ago or so I did propose a wholly different type of ID card/account that would come into its own in this situation.

My idea was that we could all have a card or account that would "lock" all data held on us by government and that would require us to be present, or able to authenticate online or on the phone like you do with your telephone or internet banking systems, before any government officer could access your data or authorize any transfer of a part of it to someone else. A sort of a "nuclear key" where both the data subject's and the data user's half of that key would effectively be needed to decrypt any of the data subject's personal information. Yes, it might slow certain things down, but let's face it, there are some things we really don't want government interfering in unbeknownst to us. One needn't even have to trust government to guarantee one's identity - you could open it up so an individual could choose a firm like Thawte, who provide guarantees of identity to online commerce sites we trust with £40bn of our custom each year, to guarantee their identity and private key.

Data about us is part of us. It is our right to know it's secure, especially when we have no choice in handing it over - and such circumstances should be minimized. Whether it's bank account details or DNA it's an invasion of our privacy and self-ownership and every additional byte stored about us is a step towards totalitarianism. The apparatus of government should be our servant and not our master and many fought and died to ensure that we were not enslaved by overbearing states in the twentieth century.

I do not see why the National Audit Office should want all the records on the database. Surely audit is about taking a sample to prove that procedures were being followed and the bona fides of the person being audited and the figures they have produced. HMRC should have a system of internal audit that itself can be verified without any other department needing access to the original data. And if they do need access to the original data, then it should be done on site in a secure area or through secure access direct to the systems concerned. No other business surely sends all of their customer records to their external auditors do they? Nor should they in the civil service, and if that's how NAO and District Audit work then that too should change and urgently.

Commentators like Richard Murphy are just plain wrong in insisting that this is not an extremely serious breach that highlights systemic problems in organizations that handle such huge amounts of data without the effective scrutiny of competition for their customers to keep them on their toes. No junior official, in fact I'd go so far as to say no individual official should have had access to the whole data universe without a great deal of additional verification. It defies belief that anyone thought this system was sufficiently secure.

And finally - a word of warning...

In this highly interactive and globalized society, if we continue to insist on potentially intangible bases - our incomes - for tax, the amount and intrusiveness of data they will need to hold on us can only increase. Another plus for taxing land.

Putting the genie back in the bottle

Jock — Wed, 05 Sep 2007 07:03:03 +0000

We should be grateful to Lord Justice Sedley for one thing - re-igniting the debate about the national DNA database. His prescription, however, is completely wrong, and unjustifiable. He is right when he says that:

...the current database, which holds DNA from crime suspects and scenes, was "indefensible" because it was unfair and inconsistent.

but we should be very wary of his suggested fix for that, that...

...whole population and every UK visitor should be added to the national DNA database.

He is of course correct that the current situation is indefensible, Black men are more than twice as likely to be on the database than white, just because of the disproportionate way in which the police target black men for stop and search operations. But his prescription that:

"Going forwards has very serious but manageable implications. It means that everybody guilty or innocent should expect their DNA to be on file for the absolutely rigorously restricted purpose of crime detection and prevention."

So, we are to be scared from committing any crimes because we know they already have our DNA and when they find that at the scene it'll be an easy next step to "pull" anyone whose DNA is found for questioning. With no other probable cause than that their DNA was at the scene - Paul Walter's Liberal Burblings puts this much better than I have, describing it as "presumed guilt", overturning what must probably be, after Habeas Corpus perhaps, the key principle of English law.

One could imagine a situation where, for example, a victim of crime in the hours before being raped or murdered or whatever was in a place with lots of other people - perhaps a bar or a club. He or she brushed up against countless innocent bystanders, some of whom left a hair on the victim's clothes or sneezed over them or somehow transferred DNA to them or to another item of evidence. The police could just pull all of those people for questioning. Or perhaps that the crime scene was quite a publicly frequented place, and countless innocent samples are collected and the owners of that DNA pulled for questioning.

And as if that weren't enough, what sort of access would the defense have to be given to make this fair? Someday one could imagine the argument succeeding that with evidence disclosure rules, the defense could subpoena anyone whose DNA sample was found to try to create reasonable doubt for their client.

And in future, when the purpose of individual genes are steadily discovered, a witness statement might describe someone that may or may not be involved at the scene and based on that physical description the police could pull all blond men with blue eyes and the obesity gene in the local area to question?

The judge talks also about how many "cold cases" have been solved using DNA evidence. Yes, that may be one of the advances that has been made possible with DNA technology. But I wonder how many of them have actually been solved simply by matching up with the database. I rather suspect very few. That most have probably been a case of arresting the person first suspected many years ago and then checking them up against the DNA. Ie that DNA is used merely to corroborate existing evidence that somehow proved insufficient at the time to convict. That's a very different proposition from having a pro-active database from which to go and pull every person that brushed past the victim twenty years ago and happened to leave DNA that was subsequently collected.

No, storing our DNA is storing a little part of each and every one of us. As I said last week, our DNA should be subject to habeas corpus. It's like putting us all on bail for further questioning, sometime, about any other matter they feel we might be able to help with. The implications even now, let alone in some future time when we may have a seriously authoritarian regime in power or where the technology is available to extrapolate from descriptions what the suspect's DNA might look like, are horrendous.

In an accompanying article, the BBC puts the other side of the case. We already hold proportionally more DNA samples than any other country. Since it was first allowed in 1995 it has been steadily extended. The evidence of "mission creep" is clear already. We cannot trust any government with this sort off information. One only has to have seen the film Gattaca to know why. We must go back to the 1995 regulations, and strengthen them indeed so that people have rights to know and control whether their DNA is held if they are not currently in the criminal justice system for a good reason.

DNA - did Lynne really say this?

Jock — Sun, 26 Aug 2007 11:57:30 +0000

I hope not - and I know how badly the media can mangle the real message of what people say by selective quoting...

DNA database chaos with 500,000 false or misspelt entries - Independent Online Edition > UK Politics:

Lynne Featherstone, the Liberal Democrat MP for Hornsey and Wood Green, called for an urgent investigation and questioned why so much inaccurate information was on the system.

"If the database is to be of any use, then it has to be accurate. DNA data is open to abuse and this could allow people who mean no good to do no good. The more failsafe the police regard DNA, the easier it is to set someone up," she said.

This database, accurate or not, is open to abuse. The way the data is collected is abhorrent, from children and uncharged adults who have likely done nothing wrong or where the evidence has not been able to show they have done anything wrong. Our message is that it should be scrapped. Not merely tidied up.

Our DNA is part of us as individuals. Holding samples of it is false imprisonment. It should be subject to habeas corpus. There can be no truck with this illiberal nonsense.