5 ms·

The bill will not say unbreakable encryption is illegal. I've heard from sources inside the government that their intention is to maintain the legal status-quo

The bill will not say unbreakable encryption is illegal. I've heard from sources inside the government that their intention is to maintain the legal status-quo dating from RIPA 2000. Which is to say that service providers have to disclose personal communications where reasonably practicable. Since it's not possible for service providers to break end-to-end encryption, they will have a defence. Obviously this is a bit of a fudge and the position may need clarifying in court. But it's not the intention of this bill to change the legal status quo.

Natanael_L 11y ago
> reasonably practicable May lead to "implement backdoors and ban unknown ciphertext"
glomph 11y ago
If that is the intention then why has no one from inside the government gone on record to say that?
toyg 11y ago
> it's not the intention of this bill to change the legal status quo. If they didn't mean to change the status quo, they wouldn't have introduced a bill. As it happens, they do want to change the status quo, by making clearly acceptable for authorities to eavesdrop, something that was, er, technically illegal before, despite them doing it anyway. So instead of punishing spooks for breaking the law, they're changing the law. Easy, innit?
- autonomy77 11y ago
  Plus, with the new "websites visited" retention rules - extendable at whim, there will be a permanent record, for example of that episode of Frasier that you downloaded from a Torrent site. A permanent record that is, of you "stealing something".
- d_theorist 11y ago
  >If they didn't mean to change the status quo, they wouldn't have introduced a bill. Just strictly on this point, sometimes bills (or parts of bills) are introduced to clarify existing law. It may be a matter of subtle semantics, but this is often what is meant when it is claimed that a bill will not change the law.
  - toyg 11y ago
    Well, in this case the proposed act will basically supersede the Human Rights Act, by excluding authorities from respecting its article 8 ("Right to Privacy"), under which they've been repeatedly challenged (and defeated) since Snowden's revelations. Which is really a change in law, not a clarification. So yeah, what they really need is a change, because current law is very clear that what they do is illegal.
    - pjc50 11y ago
      No, it doesn't (and can't) supercede the HRA; there is actually no mechanism in UK law for doing that other than explicit repeal (Factortame principle). And article 8 has an ill-specified "national security" exemption. http://ukhumanrightsblog.com/incorporated-rights/articles-index/article-8-of-the-echr/ http://ukhumanrightsblog.com/incorporated-rights/articles-in...
SpaghettiCat 11y ago
> The bill will not say unbreakable encryption is illegal. It's already being planned, see: https://news.ycombinator.com/item?id=10498280 https://news.ycombinator.com/item?id=10498280
- jazzyk 11y ago
  I may claim that my encryption is breakable (any encryption is breakable), therefore legal. It will just take them 5 years to break it :-)
madaxe_again 11y ago
So, it doesn't, but it does say that GCHQ have carte blanche to break encryption at will without warrant, in clause 187 section 423 - which may as well be the same thing, given that they can break far more than they let on, as they've more than likely factorised the most commonly used primes in standard implementations of cryptographic protocols.
- tehmaco 11y ago
  That clause simply adds "make use of" to the beginning of the existing paragraph in the existing legislation[0]: (a)to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material; and They're still bound by the second clause in it: (2)The functions referred to in subsection (1)(a) above shall be exercisable only— (a)in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom; or (b)in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands; or (c)in support of the prevention or detection of serious crime. [0] http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gchq http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gch...
- TheCoelacanth 11y ago
  With cryptographic protocols that rely on the difficulty of factoring large semiprimes, aren't you supposed to use primes that no one else has used before? If you use the same primes to make your key, then you would have the same key as someone else.
bograt 11y ago
IANAL but I've been chewing my way through the ~300 pages of the published draft bill. What catches my attention is that the bill appears does not appear to sufficiently constrain the Secretary of State's powers to oblige a "telecommunications provider" to render technical capabilities deemed necessary to "assist in the in the implementation of warranted activity". Here, the definition of "telecommunications provider" seems (to my understanding) so broad as to cover any provider of an online service, paraphrasing section 193: "Communication" is "anything comprising speech, music, sounds, visual images or data of any description" and "signals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus." And a "telecommunication service" includes "any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted". Section 189 titled Maintenance of technical capability allows the Secretary of State to make obligations on telecommunication services including (paraphrasing again): * relating to apparatus * relating to the removal of electronic protection applied by a relevant operator to any communications or data * relating to the handling or disclosure of any material or data in addition to requiring them to "provide facilities or services of a specified description"; the specification apparently being deferred until notice is served on the service provider. Conversely, the Secretary of State is required to consult before serving a "technical capability notice" and section 190 lays out a number of considerations for the Secretary of State including "technical feasibility", "likely cost", "likely benefit" etc. But other than these apparently very weak constraints, it appears to provide carte blanche for the Secretary of State to demand new technical capabilities of any service provider for the warranted access and interception of any user data they store or transmit.

Natanael_L 11y ago

> reasonably practicable May lead to "implement backdoors and ban unknown ciphertext"

glomph 11y ago

If that is the intention then why has no one from inside the government gone on record to say that?

toyg 11y ago

> it's not the intention of this bill to change the legal status quo. If they didn't mean to change the status quo, they wouldn't have introduced a bill. As it happens, they do want to change the status quo, by making clearly acceptable for authorities to eavesdrop, something that was, er, technically illegal before, despite them doing it anyway. So instead of punishing spooks for breaking the law, they're changing the law. Easy, innit?

autonomy77 11y ago
Plus, with the new "websites visited" retention rules - extendable at whim, there will be a permanent record, for example of that episode of Frasier that you downloaded from a Torrent site. A permanent record that is, of you "stealing something".
d_theorist 11y ago
>If they didn't mean to change the status quo, they wouldn't have introduced a bill. Just strictly on this point, sometimes bills (or parts of bills) are introduced to clarify existing law. It may be a matter of subtle semantics, but this is often what is meant when it is claimed that a bill will not change the law.
- toyg 11y ago
  Well, in this case the proposed act will basically supersede the Human Rights Act, by excluding authorities from respecting its article 8 ("Right to Privacy"), under which they've been repeatedly challenged (and defeated) since Snowden's revelations. Which is really a change in law, not a clarification. So yeah, what they really need is a change, because current law is very clear that what they do is illegal.
  - pjc50 11y ago
    No, it doesn't (and can't) supercede the HRA; there is actually no mechanism in UK law for doing that other than explicit repeal (Factortame principle). And article 8 has an ill-specified "national security" exemption. http://ukhumanrightsblog.com/incorporated-rights/articles-index/article-8-of-the-echr/ http://ukhumanrightsblog.com/incorporated-rights/articles-in...

SpaghettiCat 11y ago

> The bill will not say unbreakable encryption is illegal. It's already being planned, see: https://news.ycombinator.com/item?id=10498280 https://news.ycombinator.com/item?id=10498280

jazzyk 11y ago
I may claim that my encryption is breakable (any encryption is breakable), therefore legal. It will just take them 5 years to break it :-)

madaxe_again 11y ago

So, it doesn't, but it does say that GCHQ have carte blanche to break encryption at will without warrant, in clause 187 section 423 - which may as well be the same thing, given that they can break far more than they let on, as they've more than likely factorised the most commonly used primes in standard implementations of cryptographic protocols.

tehmaco 11y ago
That clause simply adds "make use of" to the beginning of the existing paragraph in the existing legislation[0]: (a)to monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material; and They're still bound by the second clause in it: (2)The functions referred to in subsection (1)(a) above shall be exercisable only— (a)in the interests of national security, with particular reference to the defence and foreign policies of Her Majesty’s Government in the United Kingdom; or (b)in the interests of the economic well-being of the United Kingdom in relation to the actions or intentions of persons outside the British Islands; or (c)in support of the prevention or detection of serious crime. [0] http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gchq http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gch...
TheCoelacanth 11y ago
With cryptographic protocols that rely on the difficulty of factoring large semiprimes, aren't you supposed to use primes that no one else has used before? If you use the same primes to make your key, then you would have the same key as someone else.

bograt 11y ago

IANAL but I've been chewing my way through the ~300 pages of the published draft bill. What catches my attention is that the bill appears does not appear to sufficiently constrain the Secretary of State's powers to oblige a "telecommunications provider" to render technical capabilities deemed necessary to "assist in the in the implementation of warranted activity". Here, the definition of "telecommunications provider" seems (to my understanding) so broad as to cover any provider of an online service, paraphrasing section 193: "Communication" is "anything comprising speech, music, sounds, visual images or data of any description" and "signals serving either for the impartation of anything between persons, between a person and a thing or between things or for the actuation or control of any apparatus." And a "telecommunication service" includes "any case where a service consists in or includes facilitating the creation, management or storage of communications transmitted". Section 189 titled Maintenance of technical capability allows the Secretary of State to make obligations on telecommunication services including (paraphrasing again): * relating to apparatus * relating to the removal of electronic protection applied by a relevant operator to any communications or data * relating to the handling or disclosure of any material or data in addition to requiring them to "provide facilities or services of a specified description"; the specification apparently being deferred until notice is served on the service provider. Conversely, the Secretary of State is required to consult before serving a "technical capability notice" and section 190 lays out a number of considerations for the Secretary of State including "technical feasibility", "likely cost", "likely benefit" etc. But other than these apparently very weak constraints, it appears to provide carte blanche for the Secretary of State to demand new technical capabilities of any service provider for the warranted access and interception of any user data they store or transmit.