I have been reading about the Snoopers charter bill that was passed in the UK this week.

It mentions a "Black Box" which is cited here: ‘Black boxes’ to monitor all internet and phone data.

It states it works like so:


  When an individual uses a webmail service such as Gmail, for example,
  the entire webpage is encrypted before it is sent. This makes it
  impossible for ISPs to distinguish the content of the message. Under
  the Home Office proposals, once the Gmail is sent, the ISPs would have
  to route the data via a government-approved “black box” which will
  decrypt the message, separate the content from the “header data”, and
  pass the latter back to the ISP for storage.


It is very vague on how it works to "decrypt" the data.

Is there such a thing as a "Black Box" and should I be concerned?

Yes. It's called a Man-in-the-Middle attack. You terminate the SSL session at a mid-point, thereby having the encryption key, then create a new session to the target server, so you have that encryption key too. The data path now goes User->MitM->Server, where each of the arrows is an encrypted connection. Data returned from the server goes Server->MitM->User, again, where each arrow is encrypted, but the other points are not.

There are ways to prevent this from working, but in the case of a government mandated system, it seems likely that these will be specifically avoided - there may be regulations for companies to provide valid certificates for the "black boxes", so that HPKP keeps working, for example. It is unclear whether such rules would apply to companies which don't operate directly in the UK, or whether there would be penalties for attempting to bypass these rules (for example, by the use of VPNs based in other countries).

Edit based on comments:
Note that it is technically possible to create such a device, but the problems mostly come from requiring cooperation from a large number of parties. As a government, there are options available which aren't possible for smaller actors. For example, it would be possible (if unlikely) to require that all internet connected devices sold in the UK come pre-configured with a government issued root CA certificate, and to prosecute anyone using a device which does not have this installed. This would be terrible for internet security, but so is the overall concept, so it depends on security experts convincing the government just how bad this idea is.
