If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.

February 24, 2025 –Bruce Schneier

At some point, if our species survives, we are going to look back and wonder whether there can ever have been a time when trillions of human beings walked around staring at a tiny screen in case they missed a communication of such supreme importance that it had to be able to be accessed there and then. When those in the future laugh themselves silly about that thought, they will then be able to extend the joke by wondering how, given these weirdos had this extreme and irresistible urge, they also voluntarily bound themselves in innumerable layers of so-called security so that the individual user had the utmost difficulty in utilising this immediate provision of information which they could not wait to view while huge numbers of scam and pointless advertising communications were still able to clutter up their all-important devices.

Thus, with deep prejudice bias and anger, I took my place last Friday as the Chairperson of Chambers’ Security, Intelligence and Technology Committee ‘SIT’. SIT sits in a room occupied by a member of Chambers who probably runs MI5 in his spare time and whose work is so sensitive that the door has both a code and fingerprint security. He, I fear to write his name lest that act alone breaches the Official Secrets Act, was late. None of us remembered the entrance code (if we had ever known it) and the fingerprint recognition device was not working.

I looked at the agenda which I had eccentrically printed out on a Chambers’ printer. When I had by-passed the 40 or so lines describing our security and privacy policies, I found the contents. My heart sank as I read that GDPR was the first item. There was a time when General Data Protection Regulations heralded a future free from junk mail and malicious communications. The rules seemed very innocuous. We had a simple online test annually to show that we were compliant. The test was so easy you could pass it even if you knew nothing about GDPR at all. The multiple options suggesting that you should spray your confidential material all over your home and workplace were obviously wrong and if the answer had ‘consult the clerks’ in it then you were generally on to a winner.

Sadly, I noticed no discernible change in the amount of spam hitting my mailbox and still saw Robing Rooms stuffed full of papers from long finished cases. Slowly, however, I did detect that one person (myself) was finding it harder and harder to communicate easily, becoming a virtual prisoner in a Bastille of password changes necessitated by data breaches (which seemed rather widespread), two-factor authentication and texts sent to my phone with access codes. I shuddered as I saw what members of Chambers clearly intended to be private emails sent to me. I reminded one that if she wrote to me about a complaining client describing the aforementioned as a ‘supreme cretin’, this person’s inevitable subject access request would have interesting consequences.

We were let into the room eventually by Chambers’ ‘Smiley’. It had an unpleasant musty smell. He seemed very anxious that I had brought what he called ‘hard copy’ into the room. While he was explaining a new GDPR contract to us concerning the regulatory status of anyone who had ever devilled a point in Chambers, I attempted to look involved while simultaneously paying my gas bill online. ‘Password not recognised’ came up and when instructed to press the relevant button for forgotten passwords I could not recall the email account with which it was associated. Then I remembered that I had enabled two-factor authentication on this site which involved me seeking a specially generated password by going to another site (which also required 2FA to access it). After ten minutes I managed to generate the wretched combination of letters and symbols but, by now, I had lost the original website demanding the thing in the first place.

‘William,’ said Reilly, Ace of Spies, ‘have you been listening to a word I have been saying?’ ‘Yes,’ I lied. ‘Then,’ said he, ‘would you like to help us all by identifying which person, or people, you identify as the Data Controller in the example I have been giving?’ I am not normally a victim of hysterics but I am afraid that I just broke down in uncontrollable laughter. ‘Sorry,’ I said, ‘cough not quite gone yet!’ and fled for the door. Sadly, I had no idea of the code needed to leave…