Home -> Law Blog Directory -> International Law Blogs -> Spy Blog

International Law

: Spy Blog

MI5 Security Service web site re-fresh - shadow people and foreign language version inconsistency

The MI5 Security Service website design was officially re-launched on the 1st of September 2009. - New version of Security Service website

We have also introduced a new Freephone number (0800 111 4645) to make it easier for members of the public to contact us to report suspected threats to national security. This is in addition to our existing Public Telephone Number (0207 930 9000).

N.B. the exisiting telephone number should "officially" be written as 020 7930 9000.

If, as stated in the they really are trying to recruit agents and informants from overseas , as well as from within the UK, then the international dialing code prefix would also help: +44 (0)20 7930 9000.

Given how little content there is overall on the MI5 website, the "other language" versions could easily have been full translations of the whole English language website, rather than just cut down versions.

More worrying, is the inconsistent, or entirely missing foreign language versions of the SSL encrypted secure web contact form.

The English version, correctly, goes to an SSL encrypted web page (https://) , and then properly processes the potentially very sensitive personal details or intelligence tip off, with a server side script, again protected via SSL, even if you follow a link from the default unencrypted web pages.

The Arabic version secure web form also does this correctly..

However, the Welsh language web contact form, but it does not, by default, make use of SSL encryption. (It can be made to do so, if you change "http://" to "https://" by hand)

The French, Russian, Urdu, Farsi and Chinese language versions do not bother to offer a link to a translated version, nor even to the original English version of this secure web contact form.

The Chinese language version has a broken web link to what was probably former Home Secretary Jacqui Smith's official ministerial biography on the Home Office website.

The Farsi version of the website has a translated contacts page, which mentions Secure Sockets Layer (spelled out in English) , but does not bother to use it. The postal address also misses out the word "Desk" from "The Enquries Desk. PO Box 3255, London SW1P 1AE "

How relevant or interesting to the rest of the world, are the relatively detailed explanations about UK legislation like UK Regulation of Investigatory Powers Act 2000 etc., which is what much of the translated versions seem to concentrate on ?

Still missing from the English version, let alone the foreign language ones, is an SMS text message short code method of contact (mobile phones are much more common than internet connected computers) ,

There is still no MI5 Security Service published PGP public encryption key or a public email address - why not ?.

The MI5 Security Service MI5 Contacts Us web page is still much better than, that of the MI6 Secret Intelligence Service, or even the Metropolitan Police Service Anti-Terrorism Hotline contact pages (which does at least have an encrypted web form).

Some of the new features such as the MI5 News and Updates RSS syndication feed had already been sneaked in back in July, without any fanfare.

We wonder if this new website design (not very different from the old one) has actually been properly security penetration tested, following the Cross Site Scripting vulnerability demonstrated back in July. - see Which was worse - the MI6 website spelling mistakes or the MI5 website Cross Site Scripting vulnerability ?

The graphical images chosen and, presumably officially approved at the highest level, to represent the MI5 "corporate brand image" or "look and feel" give the impression of a sinsister, Kafkaesque bureaucracy:

Note how many blurred images, or people with their backs to the camera, or with their faces otherwise obscured etc. there are in this selection of graphics from the website, which seem to depict the organisation and its targets and the general public as "shadow people".

Full post as published by Spy Blog on September 04, 2009 (boomark / email).