I mentioned the other day that MI5 is now offering to send out threat levels via email. What I hadn’t realised until helpfully pointed out by Spy Blog, was the terribly unsafe system they were using. The BBC has the full story.
Threat Level By Email System Unsafe?
Tags:
Comments
2 responses to “Threat Level By Email System Unsafe?”
Storm, meet teacup.
The information that went to the USA (but doesn’t any longer) was…
1. An email address
2. A firstname and surname of your choice
Yes, they were doing it without any SSL either.
All this seems scary until you remember that email is not encrypted: so any email you ever get from them will have your email and your chosen firstname/surname in the clear anyway. If you’re concerned about the non-SSL issue, you shouldn’t ever be using non-encrypted email. So it really is a storm in a teacup.
(And, as an aside, nobody appears to have thought of the fact that emails are very easily spoofed…)
Maybe so.
But my larger concern is really that the whole system is pointless and scaremongering.
Essentially a escalating the “threat level” is akin to those “Baby on board” car stickers. I’m supposed to drive extra carefully when behind someone with a small child. With anyone else, I can drive as recklessly as I like can I? What am I supposed to differently when the threat level is raised? If I see something suspicious I’m inclined to report it even if MI5 is telling me the country’s rosy.
No – raising the threat level is just about scaring the populous stupid.
Still – I signed up using the unsecure system. Although I note that I mightn’t always get timely notice of raised alerts if it’s in the security services’ interests not to mention it:
Please note that there will therefore be occasions when, for operational reasons, a delay is necessary between the threat level being changed and the public being informed.