12 ms·

New York Wants to Force Vendors to Decrypt Users’ Phones

171 points by uptown 11y ago

tracker1 11y ago
Won't happen, vendors just won't be able to sell in NY, so residents will have to buy elsewhere. And when the NY 1% can't buy their iPhone because Apple protects their privacy, I think any such law wouldn't last long.
- vinceguidry 11y ago
  I want the bill to pass for this reason. I want to see how the courts interpret it. Just how much pull should local jurisdictions be able to exert on a corporation's business practices? Say the major vendors just decide to pull out of the NY market, yanking devices off of shelves. How exactly does NY think they can enforce the law?
  - sbuttgereit 11y ago
    I'm not a lawyer or an expert on the commerce clause, etc. But is seems like these issues have passed muster before. Consider that California has stricter environmental regulations concerning the cars that are sold there than many other states. The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). If that local regulation has passed any and all legal tests, then I would be surprised if New York couldn't act independently in this case. And I think the manufacturers would simply do something similar: you'd end up with compromised security on all devices that come under the law even in states where that law didn't exist.
    - JoshTriplett 11y ago
      > The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). Many manufacturers still distinguish cars with "California emissions".
    - baddox 11y ago
      Another example: big name-brand beers have different alcohol percentages in different states.
    - sathackr 11y ago
      I buy equipment all the time that is not legal for sale in California. But I don't go out of my way to do such. With the emissions argument, lower emissions is generally accepted as a positive feature, though some may dislike the reduced performance or increased cost associated with it in some instances. Backdoored encryption is not something generally accepted as a positive feature, and I suspect many people will specifically seek out non-backdoored devices if the law is passed and manufacturers start making devices for the lowest common denominator. But since this is a software feature, I see no reason why a single device couldn't serve both markets, with a fused bit somewhere permanently enabling the backdoor. But, as said previously ad nauseam, the law would stop criminals about as effectively as the anti-radar detector laws keeps radar detectors out of Virginia. The widespread use of instant-on radar and LIDAR has done far more to curb the widespread use of them, in all states, by simply making them ineffective.
      - sbuttgereit 11y ago
        Many people would seek out such devices... but many people can still be a small minority of your target market. If the economics makes sense to have two different builds they'll do it, if it doesn't then you'll get one size fits all. Also, consider how many people that buy these devices also use cloud services available for these devices where even fourth amendment protections are likely null/void. In some ways/shapes/forms it makes the device encryption backdoor already moot for many.
        sathackr 11y ago
        Yes...I'm curious to see how 'things stored in the cloud' will eventually work out with the 4th/5th amendment protections. Seems most of the current law applies to them as electronic communications, but I think they are becoming more and more like a safe deposit box, which I think has fared a bit better. It's unfortunate that it will likely take a few guinea pigs with a lot of money and the right type of case to force the judicial system to work this out. Of course, the prudent criminal would encrypt anything, using non-backdoored encryption, before it left his/her control thus making LEO/Government access to their cloud storage ineffective.
  - cmurf 11y ago
    Schadenfreude fan, huh? The courts will likely treat it the way they have wiretapping. That is, unless a skilled defense shows that unfunded and indefinitely key escrowing is impractical or unfair somehow, which is probably hard to do seeing as Apple used to offer a key escrow service (opt-in) on OS X's FileVault 2, and Microsoft offers one (opt-out after they have the key escrowed) still today. This is what China wants, so if Apple isn't going to stop selling in China on principled grounds, then why would they stop selling in NY or anywhere else that decides to go down this path? As for enforcement, every state has its own rules for merchants. NY State has the business license and if you don't follow their laws they can withdraw the license and now the company can't sell product in the state. The thing that irks me is this transparently targets average Joe User and below average crook. Because only those two groups will end up with either weaker encryption (breakable encryption, including backdoors) or keys being escrowed. Anyone who understands this, including the above average crook and far worse, will just get some other product that uses escrow-free strong encryption that isn't subject to that state or that country's laws.
    - drdaeman 11y ago
      More likely "immediately worse present for a better future". It just seems that humans rarely learn unless they experience a painful failure (and sometimes a multiple ones are required) and get some reminders by the scars left. This, of course, doesn't work if worst is introduced gradually (it's how we got where we are) - only acute cases work. The idea is, governments would never cease their attempts just because there are some objections and counterpoints. But after a grand fuck-up they won't dare to try it - and if they do they'll be told "you want another New York, eh?" and that will work.
  - kec 11y ago
    This sort of thing isn't exactly without precedent. Look at gun laws in CA: there are many types of firearms and firearm accessories which are legal in most of the US but cannot be sold or possessed in California. Gun manufacturers have responded over the years by either pulling out of the state entirely, or producing California compliant versions of their products.
- TillE 11y ago
  Don't forget the loss of sales tax. It's a poorly considered way of achieving some poorly considered goals.
  - philipov 11y ago
    This is just politicians pretending to work. Someone's probably using this as a bargaining chip for negotiating their real goals, or to show they're a team player, or pander to their constituency.
- peterhadlaw 11y ago
  I think more of what @CamperBob2 is alluding to will happen to be honest... Unfortunately.
  - deleted 11y ago
    [deleted]
- mc32 11y ago
  Just wait till China, Russia and India get the itch for this. Just one of them have enough market and potential markets no vendors will leave money on the table and give up market share. It has a good chance of happening in one of those markets if not here and then, it's just a matter of time till many nations demand the same.
  - krasin 11y ago
    Apple came to Russia relatively late (near iPhone 4, I think). People did buy lots of iPhones before that anyway. They would just buy in the USA and have it delivered via post (sometimes unofficial post). And Apple understands that. I don't have any data on China and India. They might be more lucrative markets due to the size.
    - csydas 11y ago
      I don't think there are official Apple Stores in Russia, just retailers that carry the products. All the stores I see selling Mac stuff are usually under the name re:Store [1] and while they have certainly imp'd the Apple Store look, they very clearly are not Apple. I know they have an online presence for Russians, but the majority of sales either come through these reseller stores or through people buying online from abroad and having someone send the device. That being said, the number of old ladies I see on the metro with iPhone 6's makes me somewhat envious. [1] - http://www.re-store.ru http://www.re-store.ru
- mirimir 11y ago
  That, or residents who want secure devices will just buy them elsewhere. It's very common now for people to have cellphone accounts from other states.
  - kazinator 11y ago
    That or someone actually communicating with others with regard to illegal activities will install non-backdoored encryption software rather whatever came with their device. The cops will backdoor the phone and decrypt it, only to find a file called "my-awesome-terrorist-plot.doc.aes".
- hobs 11y ago
  I would be interested to see the cost of losing The Apple Stores in NYC. Some of the highest valued retail that there is from what I remember reading, but I guess real estate in NYC is super valuable in any case.
  - JoshTriplett 11y ago
    Turn them in to Tesla-style showrooms, where you can't actually buy a device directly.
- threatofrain 11y ago
  Most people just buy their phones without thinking, and would find this encryption debate a little technical. They probably also think that they won't be personally inconvenienced, and that only criminals would be specifically targeted by the authorities. I think only an effortful, informed, and motivated individual would buy their phone out-of-state. Plus, I'm pretty sure NY won't be the only place enacting such anti-encryption measures. Eventually, those who advocate for encryption and privacy will be out of the moral mainstream, and will have a tough PR road ahead of them.
  - mikeash 11y ago
    People buy phones out of state all the time, when they buy them online. I don't think that would be a particularly notable impediment.
    - kabdib 11y ago
      When a voter can't go into a phone store / Apple store and buy a shiny new thing: Boom, recall election. Presumably assemblyman Titone knows this, and is expecting the bill to do nothing other than provide the usual security theatre. That, or he is dumb as a post. Could go either way :-) I expect to see congressional level legislation like this very soon. That'll be significantly more interesting.
      - threatofrain 11y ago
        I thought that businesses would simply create a NY-compliant version, just like I'm sure they create many variations of their existing products for compliancy around the globe. I also don't expect this to stay NY-specific. This sounds like something that would be generally desired by many nations. Customers need not experience inconvenience if this is done right. There are obvious reasons why the police would actually want this beyond security theater (PR). It actually makes their job easier.
        Bud 11y ago
        It makes their job far too easy, which is of course precisely the point. It also makes doing things that are not "their job" at all quite easy, which is the other part of the point.
- ryan-c 11y ago
  Really? I'm pretty sure that when CA passed the smartphone kill switch law all smartphones got kill switches.
  - tzs 11y ago
    One big difference with that was the phone makers were moving toward kill switches anyway. Apple touted theirs as a feature long before that law was introduced in California. The main opposition to kill switches came from phone carriers because they make a lot of money selling (1) replacement phones to people whose phones are stolen and (2) theft insurance to people who fear their phones will be stolen, and from some privacy and civil rights groups that (1) misunderstood the bill due to not reading it carefully and/or (2) were basing their opposition on completely ridiculous scenarios [1]. [1] For example, some claimed that police could use the kill switches to quickly and without a warrant shut down all the phones of protestors to stop them from reporting and filming police brutality. That was a ridiculous scenario for several reasons. First, the kill switch involves sending a targeted command to each specific phone to be killed, so the police would first have to bring in something to identify all the protestor phones. Then they would have to go to the phone maker or the carrier (which depends on how the particular kill switch works for that phone) and get them to send the command. There is no particular reason to believe that the companies would have a procedure for that, so this could be very slow...and there is also no reason to believe it is even possible, because nothing in the law requires that the company can kill the phone without the cooperation of the owner. By the time they do all this, the protest is likely to be long over. Furthermore, the law only applies to smartphones. People with feature phones would be free to report and record unfettered, as would people using tablets. On top of that, the law allows (and as far as I know every implementation implements) the phone owner to turn off kill switch capability, so the "use the kill switch to cover up police brutality" plan only works if none of the protestors are smart enough to turn off the kill switch before joining the protest. If the police actually, in the real world, were going to try to block protestors from reporting and recording with their phones they would do it by trying to get the cell towers in the area shut down, or by using Stingray-like devices in active mode to intercept and block communications.
    - 11y ago
- sathackr 11y ago
  And of course, criminals will certainly only purchase/steal device compliant with the law, because, you know, they want to obey the law. And they won't install any apps or use any other means to hide their illegal goods/communications. Just like the ones with violent felonies/intending to commit violent felonies will only lawfully acquire guns to commit violent felonies. Can someone explain please what I'm not seeing? I give you our politicians are sometimes not the smartest, but it doesn't take even an average IQ to see the logical failure here. That being the case, these elected officials must know that this won't solve the problem. So what is their ulterior motive in spending so much time chasing after a law that will do very little to stop real crime? Just so they can look like they're doing 'something?'
  - Umn44 11y ago
    "That being the case, these elected officials must know that this won't solve the problem. Except your not understanding why this is happening. You and most americans really are out of the loop about what is going on in the world... right now world leaders fear political awakening of the masses of the planet. The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor. https://www.youtube.com/watch?v=n7ZyJw_cHJY https://www.youtube.com/watch?v=n7ZyJw_cHJY Brezinski at a press conference https://www.youtube.com/watch?v=VWTIZBCQ79g https://www.youtube.com/watch?v=VWTIZBCQ79g Snowden on terrorism/spying. http://www.theguardian.com/us-news/video/2015/sep/25/edward-snowden-treaty-glenn-greenwald-mass-surveillance-terrorism-video http://www.theguardian.com/us-news/video/2015/sep/25/edward-... Democracy Inc. http://www.amazon.com/Democracy-Incorporated-Managed-Inverted-Totalitarianism/dp/069114589X/ http://www.amazon.com/Democracy-Incorporated-Managed-Inverte... Intereference in other states when the corporations dont get their way https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be&list=PLKR2GeygdHomOZeVKx3P0fqH58T3VghOj&t=724 https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be...
CamperBob2 11y ago
This is the outcome Apple must have expected when they announced their encryption policy. They can now claim that they tried to do the right thing -- they would have taken the steps needed to guarantee their users' safety from illegal spying, warrantless surveillance, and unconstitutional gag orders -- but the evil government won't let them. Pretty smart in retrospect to force the government to play Bad Cop.
- Bud 11y ago
  Completely disagree. Apple sincerely wants to maintain its current encryption policy. It has substantial business value and improves the quality of their products. There is no evidence whatsoever that Tim Cook goes out and tells lies, as you allege, about major pieces of Apple's technology. See also: https://theintercept.com/2016/01/12/apples-tim-cook-lashes-out-at-white-house-officials-for-being-wishy-washy-on-encryption/ https://theintercept.com/2016/01/12/apples-tim-cook-lashes-o...
  - newman314 11y ago
    Agreed. No consumer is going to say I want to buy a less secure phone because that is better
    - CamperBob2 11y ago
      No one is going to ask the question that way. "Do you want to buy a less secure phone?" is exactly the same question as, "Do you agree that law enforcement should be able to access a suspected terrorist or pedophile's cell phone conversations and data with an appropriate court order?" You will get vastly different answers depending on which phrasing you use. That's what the politicians count on.
  - serge2k 11y ago
    Even if it is done because they think it's moral, it's still a smart thing to do from a PR standpoint. They get credit for fighting win or lose.
  - 11y ago
Bud 11y ago
Another story also previously posted: https://news.ycombinator.com/item?id=10906636 https://news.ycombinator.com/item?id=10906636
JustSomeNobody 11y ago
When are we finally going to get fed up with the government's terrorism crap?
derekp7 11y ago
I think the most realistic anti-encryption legislation would be to ban a vendor from shipping a device with encryption enabled by default. If they were to provide an api to plug in a third party encryption module, then most people would probably leave the phone in the default settings. Which would return things to the previous status quo -- most devices would be searchable, and only people who new what they were doing (including a subset of "bad" people) would have encrypted devices. Note: I'm not endorsing this, but I do believe it would satisfy the governments.
- cmurf 11y ago
  I doubt it would satisfy them, if the language of the bill, and the arguments being used thus far, is a valid indication. What they want is the ability to decrypt, and to get that means compelling companies to enduring cryptographic key escrow service, which law enforcement can use a subpoena to have Apple, Google, Microsoft, etc use to turn over plain text. So far this is "data at rest" request. It's for data on the phone. It's not for data in motion which is another technology that PFS makes rather difficult to impractical to setup key escrowing for, that's sorta the point. But then, the basebands are all proprietary and probably compromised by state (nations) actors.
the8472 11y ago
> The justification for the decryption requirement in the bill, as has become the norm, is the threat of criminals or terrorists using encrypted devices for nefarious deeds. meanwhile terrorists just roll their own encryption software, making regular citizens less secure than them. http://www.defenseone.com/technology/2016/01/isis-now-has-new-secure-messaging-app/125062/ http://www.defenseone.com/technology/2016/01/isis-now-has-ne...
- ivanca 11y ago
  All the eavesdropping is completely dumb, even the less technical of all terrorists can just change a word for another and all your billion dollar security goes to the dump. Example: when they talked personally they agreed girl=bomb Their texts will look like: - my girl is not with me, I left her at discowild - nothing happened mate, no idea why? - relax fam, ask mike to present you another girl, he is partyng next to dominoes. We getting wasted today tho, no bs And now is completely impossible to differentiate that conversation from all the other 10 billions texts that happen at any Saturday night.
  - mahouse 11y ago
    You don't realise they don't want to be able to actually decrypt the texts, what they want is to frame you (or whoever they want) as a suspect just because you use some encryption software.
  - eru 11y ago
    Of course, statistics and metadata analysis still help to crack these.
    - SN76477 11y ago
      Most recent reposts that I saw showed that metadata had not lead to stopping terrorism.
  - delbel 11y ago
    Ready for Rockabye baby, from Goldfinger https://www.youtube.com/watch?v=VrUm0KY8dJA https://www.youtube.com/watch?v=VrUm0KY8dJA
Spooky23 11y ago
The good news is that in New York, this kind of thing needs to be linked to the budget to go anywhere, and this isn't. The endemic corruption and routine prosecution of NY legislators gives me hope that this thing will go nowhere, because they have something to hide. The bill is more of a trial balloon.
macspoofing 11y ago
I think it's only a matter of time until back-doors are (re)added. At some point, Russia, or India, or China, or Europe, or America will come up with some legislation that says "backdoor or GTFO" and a few vendors will decide to adhere, and others will be forced to follow so they don't miss out and that'll be that.
such_a_casual 11y ago
We're gonna finally catch all the bad guys.
horsecaptin 11y ago
Great time for Apple to close it's stores in NY and open a few extra in the neighboring states.
downandout 11y ago
This just shows the ignorance of the bill's author, Assemblyman Matthew Titone. If you live in New York and have the ability to vote for this person's opponent next time he is up for election, you should probably do so. Apple/Google et al are not going to make an insecure "New York Edition" of their operating systems and phones. Cell dealers in the state would simply not have any phones to sell that comply with the law, and New Yorkers would either go without phones or would buy them from out of state on eBay. I'll let you guess which of those outcomes is most likely. Apple Stores in New York would have to stop carrying the iPhone. Of course none of this will ever happen, because this bill is idiotic and would cause enormous economic damage to the state. But dangerous, ignorant politicians like this should be voted out of office at the earliest opportunity.
imamoron 11y ago
Simple solution don’t sell your products in New York anymore … They can go back to the stone age for all I care … honestly I’m tired of this … They understand by doing something like this they put more people in danger of fraud … Politicians need to get over themselves, they are not gods and just because they can’t as easily snoop on people as they have been since phones were invented they try to one up with this crap. The real Criminals will have strong encryption no matter what. It’s public knowledge and easy to implement and now it’s even easier to build your own phone with working sim … Beaglebone, raspberry phi, mino, etc… This stuff is cheap and you can customize a version of android that would omit this back door very easily … It’s open source. Anyone who is for this and thinks it will actually work on criminals is a complete moron.
forrestthewoods 11y ago
#NewYorkValues
MrQuincle 11y ago
There doesn't seem any comment that considers the pro, so I'll try to raise two points: * It is possible to ensure that encryption will physically destroy the phone. Preferably it destroys the antenna, the screen, the battery, etc. In that case the law must be pretty sure, you're the bad guy and the use of it as a backdoor becomes limited to people that value your data above the value of your phone. * If manufacturers have to open up parts of the phone to certain parties, there is a possibility that they have to open up these parts to the consumer as well. It might have on the long term a positive effect on the ability to root your own phone. If the government might own my phone, perhaps I might myself own my phone as well. Just my two cents!
- Coding_Cat 11y ago
  >becomes limited to people that value your data above the value of your phone. Pretty sure me and some random mugger are the only people who even care about the value of my phone. >there is a possibility that they have to open up these parts to the consumer as well. There is a whole lot of precedent that says this isn't going to happen. Even if manufacturers wanted to do this, I'd expect we'd see laws in turn which gag them so that " the terrorists can't break our backdoors".
Findeton 11y ago
I'm in the UK, with Virgin Media as ISP, and for some reason onthewire.io is blocked. WTF
- justincormack 11y ago
  Is that the "porn blocker", or general censorship? Andrews & Arnold is pretty much the only uncensored ISP in the uk.
jensen123 11y ago
I'm wondering - are big cities becoming obsolete? I suppose there is no coincidence that some of the worst anti-privacy stuff is coming from big cities like New York or countries that are totally centered around a big city such as the UK or France. A big city of 10 million seems far more vulnerable to terrorism than 10 cities of 1 million each. In the past, if you wanted a decent life, you kinda had to live in a big city. Now, however, thanks to the Internet, that is perhaps becoming less the case? The Internet now has a fantastic selection of shops. You'll also find lots of radio stations, music and video streaming online. There are more and more opportunities for remote work. On the other hand, a city of 10 million has far more restaurants, clubs and social opportunities than a city of 1 million. So I'm not really sure whether big cities are becoming obsolete. Still, I'll be reluctant to move to a big city if it means that I have to give up my privacy. Not saying I'll never make such a move, but the balance of pros and cons seems to be changing.
- JshWright 11y ago
  What does a city have to do with it? I live in semi-rural area and I would be impacted by this law if it were to pass (it's not going to).
  - jensen123 11y ago
    Rural areas in jurisdictions that have big cities, such as the UK or the state of New York, will of course be impacted by such laws (if they pass). However, rural areas in other countries/states that don't have big cities are less likely to ever get such laws.
cm2187 11y ago
What is frustrating as always is that they invoke criminals and terrorists (and for once no reference to paedophiles!) but these laws will be used 99% of the time in civil cases (divorce cases, etc) and against petty crime. I remember when the UK used the terrorism act to freeze the assets of Icelandic banks. Terrorism has just become the keyword law enforcement officials add to the title of any law they want to see passed, no question ask. http://news.bbc.co.uk/1/hi/uk_politics/7688560.stm http://news.bbc.co.uk/1/hi/uk_politics/7688560.stm
- matthewmacleod 11y ago
  This isn't really related to your main point, but it's disingenuous to describe the freezing of Landbanki's assets as a use of the "terrorism act" just because the legislation had "anti-terrorism" in the title. The Anti-Terrorism, Crime and Security Act is pretty wide-ranging, and as well as whatever anti-terror legislation it contains, also contains some legislation around economic security - which is what was used in the case of Icesave.
  - cm2187 11y ago
    That's actually precisely my point. Voted immediately after 9/11, it's a prime example of a law titled "anti-terrorism" which actually has a much broader range and provides powers in domains that have nothing to do whatsoever with terrorism.
- SN76477 11y ago
  Almost like some sort of conspiracy.
- adrianlmm 11y ago
  >but these laws will be used 99% of the time in civil cases (divorce cases, etc) Would that be a bad thing?, so you are implying that encryption is wanted to actually hide crimes or unloyal behavior mostly?
  - gruez 11y ago
cmdrfred 11y ago
So NY going to ban books? https://en.wikipedia.org/wiki/Book_cipher https://en.wikipedia.org/wiki/Book_cipher
javajosh 11y ago
"New York" doesn't want anything - it's a state, not a person. This bill was introduced by Assemblyman Matthew Titone - mentioned in the 7th paragraph of the article. Gee whiz I wonder who's paying his election bills? "The fact is that, although the new software may enhance privacy for some users, it severely hampers law enforcement’s ability to aid victims." This is actually an argument against privacy itself. Astounding.
bobby_9x 11y ago
I feel like the reasons against such laws parallels the gun debates in the US: harsher laws won't effect the crimininal or terrorist, but the avetage citizen.
spdustin 11y ago
Government keeps wanting this sort of thing to help them find "the needle in the haystack" when all it does is make a bigger haystack.
sandworm101 11y ago
These statehouse bills come up regularly. Ignore them. NY has seen a half dozen "must decrypt", "must register" and "must identify" bills come and go. Some lawmaker has dinner with a low-ranking officer at some agency and come away thinking the sky is falling because of some new technology. The reality is that these statehouse bills are normally trumped (I hate that word now) by federal legislation. Even if not, there are enough people in places like NY that understand that the courts will shred these things. So they never pass. Once the news is over, once the bill proponents have made their peaches, they are quietly disappeared.
DyslexicAtheist 11y ago
this is how I picture the discussion between politicians and their technical advisers: https://www.youtube.com/watch?v=vh3tuL_DVsE https://www.youtube.com/watch?v=vh3tuL_DVsE
known 11y ago
"Never do anything against conscience even if the state demands it." --Einstein
joshka 11y ago
Also discussed at: https://news.ycombinator.com/item?id=10903084 https://news.ycombinator.com/item?id=10903084

171 points by uptown 11y ago

Won't happen, vendors just won't be able to sell in NY, so residents will have to buy elsewhere. And when the NY 1% can't buy their iPhone because Apple protects their privacy, I think any such law wouldn't last long.

vinceguidry 11y ago
I want the bill to pass for this reason. I want to see how the courts interpret it. Just how much pull should local jurisdictions be able to exert on a corporation's business practices? Say the major vendors just decide to pull out of the NY market, yanking devices off of shelves. How exactly does NY think they can enforce the law?
- sbuttgereit 11y ago
  I'm not a lawyer or an expert on the commerce clause, etc. But is seems like these issues have passed muster before. Consider that California has stricter environmental regulations concerning the cars that are sold there than many other states. The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). If that local regulation has passed any and all legal tests, then I would be surprised if New York couldn't act independently in this case. And I think the manufacturers would simply do something similar: you'd end up with compromised security on all devices that come under the law even in states where that law didn't exist.
  - JoshTriplett 11y ago
    > The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though). Many manufacturers still distinguish cars with "California emissions".
  - baddox 11y ago
    Another example: big name-brand beers have different alcohol percentages in different states.
  - sathackr 11y ago
    I buy equipment all the time that is not legal for sale in California. But I don't go out of my way to do such. With the emissions argument, lower emissions is generally accepted as a positive feature, though some may dislike the reduced performance or increased cost associated with it in some instances. Backdoored encryption is not something generally accepted as a positive feature, and I suspect many people will specifically seek out non-backdoored devices if the law is passed and manufacturers start making devices for the lowest common denominator. But since this is a software feature, I see no reason why a single device couldn't serve both markets, with a fused bit somewhere permanently enabling the backdoor. But, as said previously ad nauseam, the law would stop criminals about as effectively as the anti-radar detector laws keeps radar detectors out of Virginia. The widespread use of instant-on radar and LIDAR has done far more to curb the widespread use of them, in all states, by simply making them ineffective.
    - sbuttgereit 11y ago
      Many people would seek out such devices... but many people can still be a small minority of your target market. If the economics makes sense to have two different builds they'll do it, if it doesn't then you'll get one size fits all. Also, consider how many people that buy these devices also use cloud services available for these devices where even fourth amendment protections are likely null/void. In some ways/shapes/forms it makes the device encryption backdoor already moot for many.
      - sathackr 11y ago
        Yes...I'm curious to see how 'things stored in the cloud' will eventually work out with the 4th/5th amendment protections. Seems most of the current law applies to them as electronic communications, but I think they are becoming more and more like a safe deposit box, which I think has fared a bit better. It's unfortunate that it will likely take a few guinea pigs with a lot of money and the right type of case to force the judicial system to work this out. Of course, the prudent criminal would encrypt anything, using non-backdoored encryption, before it left his/her control thus making LEO/Government access to their cloud storage ineffective.
- cmurf 11y ago
  Schadenfreude fan, huh? The courts will likely treat it the way they have wiretapping. That is, unless a skilled defense shows that unfunded and indefinitely key escrowing is impractical or unfair somehow, which is probably hard to do seeing as Apple used to offer a key escrow service (opt-in) on OS X's FileVault 2, and Microsoft offers one (opt-out after they have the key escrowed) still today. This is what China wants, so if Apple isn't going to stop selling in China on principled grounds, then why would they stop selling in NY or anywhere else that decides to go down this path? As for enforcement, every state has its own rules for merchants. NY State has the business license and if you don't follow their laws they can withdraw the license and now the company can't sell product in the state. The thing that irks me is this transparently targets average Joe User and below average crook. Because only those two groups will end up with either weaker encryption (breakable encryption, including backdoors) or keys being escrowed. Anyone who understands this, including the above average crook and far worse, will just get some other product that uses escrow-free strong encryption that isn't subject to that state or that country's laws.
  - drdaeman 11y ago
    More likely "immediately worse present for a better future". It just seems that humans rarely learn unless they experience a painful failure (and sometimes a multiple ones are required) and get some reminders by the scars left. This, of course, doesn't work if worst is introduced gradually (it's how we got where we are) - only acute cases work. The idea is, governments would never cease their attempts just because there are some objections and counterpoints. But after a grand fuck-up they won't dare to try it - and if they do they'll be told "you want another New York, eh?" and that will work.
- kec 11y ago
  This sort of thing isn't exactly without precedent. Look at gun laws in CA: there are many types of firearms and firearm accessories which are legal in most of the US but cannot be sold or possessed in California. Gun manufacturers have responded over the years by either pulling out of the state entirely, or producing California compliant versions of their products.
TillE 11y ago
Don't forget the loss of sales tax. It's a poorly considered way of achieving some poorly considered goals.
- philipov 11y ago
  This is just politicians pretending to work. Someone's probably using this as a bargaining chip for negotiating their real goals, or to show they're a team player, or pander to their constituency.
peterhadlaw 11y ago
I think more of what @CamperBob2 is alluding to will happen to be honest... Unfortunately.
- deleted 11y ago
  [deleted]
mc32 11y ago
Just wait till China, Russia and India get the itch for this. Just one of them have enough market and potential markets no vendors will leave money on the table and give up market share. It has a good chance of happening in one of those markets if not here and then, it's just a matter of time till many nations demand the same.
- krasin 11y ago
  Apple came to Russia relatively late (near iPhone 4, I think). People did buy lots of iPhones before that anyway. They would just buy in the USA and have it delivered via post (sometimes unofficial post). And Apple understands that. I don't have any data on China and India. They might be more lucrative markets due to the size.
  - csydas 11y ago
    I don't think there are official Apple Stores in Russia, just retailers that carry the products. All the stores I see selling Mac stuff are usually under the name re:Store [1] and while they have certainly imp'd the Apple Store look, they very clearly are not Apple. I know they have an online presence for Russians, but the majority of sales either come through these reseller stores or through people buying online from abroad and having someone send the device. That being said, the number of old ladies I see on the metro with iPhone 6's makes me somewhat envious. [1] - http://www.re-store.ru http://www.re-store.ru
mirimir 11y ago
That, or residents who want secure devices will just buy them elsewhere. It's very common now for people to have cellphone accounts from other states.
- kazinator 11y ago
  That or someone actually communicating with others with regard to illegal activities will install non-backdoored encryption software rather whatever came with their device. The cops will backdoor the phone and decrypt it, only to find a file called "my-awesome-terrorist-plot.doc.aes".
hobs 11y ago
I would be interested to see the cost of losing The Apple Stores in NYC. Some of the highest valued retail that there is from what I remember reading, but I guess real estate in NYC is super valuable in any case.
- JoshTriplett 11y ago
  Turn them in to Tesla-style showrooms, where you can't actually buy a device directly.
threatofrain 11y ago
Most people just buy their phones without thinking, and would find this encryption debate a little technical. They probably also think that they won't be personally inconvenienced, and that only criminals would be specifically targeted by the authorities. I think only an effortful, informed, and motivated individual would buy their phone out-of-state. Plus, I'm pretty sure NY won't be the only place enacting such anti-encryption measures. Eventually, those who advocate for encryption and privacy will be out of the moral mainstream, and will have a tough PR road ahead of them.
- mikeash 11y ago
  People buy phones out of state all the time, when they buy them online. I don't think that would be a particularly notable impediment.
  - kabdib 11y ago
    When a voter can't go into a phone store / Apple store and buy a shiny new thing: Boom, recall election. Presumably assemblyman Titone knows this, and is expecting the bill to do nothing other than provide the usual security theatre. That, or he is dumb as a post. Could go either way :-) I expect to see congressional level legislation like this very soon. That'll be significantly more interesting.
    - threatofrain 11y ago
      I thought that businesses would simply create a NY-compliant version, just like I'm sure they create many variations of their existing products for compliancy around the globe. I also don't expect this to stay NY-specific. This sounds like something that would be generally desired by many nations. Customers need not experience inconvenience if this is done right. There are obvious reasons why the police would actually want this beyond security theater (PR). It actually makes their job easier.
      - Bud 11y ago
        It makes their job far too easy, which is of course precisely the point. It also makes doing things that are not "their job" at all quite easy, which is the other part of the point.
ryan-c 11y ago
Really? I'm pretty sure that when CA passed the smartphone kill switch law all smartphones got kill switches.
- tzs 11y ago
  One big difference with that was the phone makers were moving toward kill switches anyway. Apple touted theirs as a feature long before that law was introduced in California. The main opposition to kill switches came from phone carriers because they make a lot of money selling (1) replacement phones to people whose phones are stolen and (2) theft insurance to people who fear their phones will be stolen, and from some privacy and civil rights groups that (1) misunderstood the bill due to not reading it carefully and/or (2) were basing their opposition on completely ridiculous scenarios [1]. [1] For example, some claimed that police could use the kill switches to quickly and without a warrant shut down all the phones of protestors to stop them from reporting and filming police brutality. That was a ridiculous scenario for several reasons. First, the kill switch involves sending a targeted command to each specific phone to be killed, so the police would first have to bring in something to identify all the protestor phones. Then they would have to go to the phone maker or the carrier (which depends on how the particular kill switch works for that phone) and get them to send the command. There is no particular reason to believe that the companies would have a procedure for that, so this could be very slow...and there is also no reason to believe it is even possible, because nothing in the law requires that the company can kill the phone without the cooperation of the owner. By the time they do all this, the protest is likely to be long over. Furthermore, the law only applies to smartphones. People with feature phones would be free to report and record unfettered, as would people using tablets. On top of that, the law allows (and as far as I know every implementation implements) the phone owner to turn off kill switch capability, so the "use the kill switch to cover up police brutality" plan only works if none of the protestors are smart enough to turn off the kill switch before joining the protest. If the police actually, in the real world, were going to try to block protestors from reporting and recording with their phones they would do it by trying to get the cell towers in the area shut down, or by using Stingray-like devices in active mode to intercept and block communications.
  - 11y ago
sathackr 11y ago
And of course, criminals will certainly only purchase/steal device compliant with the law, because, you know, they want to obey the law. And they won't install any apps or use any other means to hide their illegal goods/communications. Just like the ones with violent felonies/intending to commit violent felonies will only lawfully acquire guns to commit violent felonies. Can someone explain please what I'm not seeing? I give you our politicians are sometimes not the smartest, but it doesn't take even an average IQ to see the logical failure here. That being the case, these elected officials must know that this won't solve the problem. So what is their ulterior motive in spending so much time chasing after a law that will do very little to stop real crime? Just so they can look like they're doing 'something?'
- Umn44 11y ago
  "That being the case, these elected officials must know that this won't solve the problem. Except your not understanding why this is happening. You and most americans really are out of the loop about what is going on in the world... right now world leaders fear political awakening of the masses of the planet. The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor. https://www.youtube.com/watch?v=n7ZyJw_cHJY https://www.youtube.com/watch?v=n7ZyJw_cHJY Brezinski at a press conference https://www.youtube.com/watch?v=VWTIZBCQ79g https://www.youtube.com/watch?v=VWTIZBCQ79g Snowden on terrorism/spying. http://www.theguardian.com/us-news/video/2015/sep/25/edward-snowden-treaty-glenn-greenwald-mass-surveillance-terrorism-video http://www.theguardian.com/us-news/video/2015/sep/25/edward-... Democracy Inc. http://www.amazon.com/Democracy-Incorporated-Managed-Inverted-Totalitarianism/dp/069114589X/ http://www.amazon.com/Democracy-Incorporated-Managed-Inverte... Intereference in other states when the corporations dont get their way https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be&list=PLKR2GeygdHomOZeVKx3P0fqH58T3VghOj&t=724 https://www.youtube.com/watch?v=8mxp_wgFWQo&feature=youtu.be...

CamperBob2 11y ago

This is the outcome Apple must have expected when they announced their encryption policy. They can now claim that they tried to do the right thing -- they would have taken the steps needed to guarantee their users' safety from illegal spying, warrantless surveillance, and unconstitutional gag orders -- but the evil government won't let them. Pretty smart in retrospect to force the government to play Bad Cop.

Bud 11y ago
Completely disagree. Apple sincerely wants to maintain its current encryption policy. It has substantial business value and improves the quality of their products. There is no evidence whatsoever that Tim Cook goes out and tells lies, as you allege, about major pieces of Apple's technology. See also: https://theintercept.com/2016/01/12/apples-tim-cook-lashes-out-at-white-house-officials-for-being-wishy-washy-on-encryption/ https://theintercept.com/2016/01/12/apples-tim-cook-lashes-o...
- newman314 11y ago
  Agreed. No consumer is going to say I want to buy a less secure phone because that is better
  - CamperBob2 11y ago
    No one is going to ask the question that way. "Do you want to buy a less secure phone?" is exactly the same question as, "Do you agree that law enforcement should be able to access a suspected terrorist or pedophile's cell phone conversations and data with an appropriate court order?" You will get vastly different answers depending on which phrasing you use. That's what the politicians count on.
- serge2k 11y ago
  Even if it is done because they think it's moral, it's still a smart thing to do from a PR standpoint. They get credit for fighting win or lose.
- 11y ago

Bud 11y ago

Another story also previously posted: https://news.ycombinator.com/item?id=10906636 https://news.ycombinator.com/item?id=10906636

JustSomeNobody 11y ago

When are we finally going to get fed up with the government's terrorism crap?

derekp7 11y ago

I think the most realistic anti-encryption legislation would be to ban a vendor from shipping a device with encryption enabled by default. If they were to provide an api to plug in a third party encryption module, then most people would probably leave the phone in the default settings. Which would return things to the previous status quo -- most devices would be searchable, and only people who new what they were doing (including a subset of "bad" people) would have encrypted devices. Note: I'm not endorsing this, but I do believe it would satisfy the governments.

cmurf 11y ago
I doubt it would satisfy them, if the language of the bill, and the arguments being used thus far, is a valid indication. What they want is the ability to decrypt, and to get that means compelling companies to enduring cryptographic key escrow service, which law enforcement can use a subpoena to have Apple, Google, Microsoft, etc use to turn over plain text. So far this is "data at rest" request. It's for data on the phone. It's not for data in motion which is another technology that PFS makes rather difficult to impractical to setup key escrowing for, that's sorta the point. But then, the basebands are all proprietary and probably compromised by state (nations) actors.

the8472 11y ago

> The justification for the decryption requirement in the bill, as has become the norm, is the threat of criminals or terrorists using encrypted devices for nefarious deeds. meanwhile terrorists just roll their own encryption software, making regular citizens less secure than them. http://www.defenseone.com/technology/2016/01/isis-now-has-new-secure-messaging-app/125062/ http://www.defenseone.com/technology/2016/01/isis-now-has-ne...

ivanca 11y ago
All the eavesdropping is completely dumb, even the less technical of all terrorists can just change a word for another and all your billion dollar security goes to the dump. Example: when they talked personally they agreed girl=bomb Their texts will look like: - my girl is not with me, I left her at discowild - nothing happened mate, no idea why? - relax fam, ask mike to present you another girl, he is partyng next to dominoes. We getting wasted today tho, no bs And now is completely impossible to differentiate that conversation from all the other 10 billions texts that happen at any Saturday night.
- mahouse 11y ago
  You don't realise they don't want to be able to actually decrypt the texts, what they want is to frame you (or whoever they want) as a suspect just because you use some encryption software.
- eru 11y ago
  Of course, statistics and metadata analysis still help to crack these.
  - SN76477 11y ago
    Most recent reposts that I saw showed that metadata had not lead to stopping terrorism.
- delbel 11y ago
  Ready for Rockabye baby, from Goldfinger https://www.youtube.com/watch?v=VrUm0KY8dJA https://www.youtube.com/watch?v=VrUm0KY8dJA

Spooky23 11y ago

The good news is that in New York, this kind of thing needs to be linked to the budget to go anywhere, and this isn't. The endemic corruption and routine prosecution of NY legislators gives me hope that this thing will go nowhere, because they have something to hide. The bill is more of a trial balloon.

macspoofing 11y ago

I think it's only a matter of time until back-doors are (re)added. At some point, Russia, or India, or China, or Europe, or America will come up with some legislation that says "backdoor or GTFO" and a few vendors will decide to adhere, and others will be forced to follow so they don't miss out and that'll be that.

such_a_casual 11y ago

We're gonna finally catch all the bad guys.

horsecaptin 11y ago

Great time for Apple to close it's stores in NY and open a few extra in the neighboring states.

downandout 11y ago

This just shows the ignorance of the bill's author, Assemblyman Matthew Titone. If you live in New York and have the ability to vote for this person's opponent next time he is up for election, you should probably do so. Apple/Google et al are not going to make an insecure "New York Edition" of their operating systems and phones. Cell dealers in the state would simply not have any phones to sell that comply with the law, and New Yorkers would either go without phones or would buy them from out of state on eBay. I'll let you guess which of those outcomes is most likely. Apple Stores in New York would have to stop carrying the iPhone. Of course none of this will ever happen, because this bill is idiotic and would cause enormous economic damage to the state. But dangerous, ignorant politicians like this should be voted out of office at the earliest opportunity.

imamoron 11y ago

Simple solution don’t sell your products in New York anymore … They can go back to the stone age for all I care … honestly I’m tired of this … They understand by doing something like this they put more people in danger of fraud … Politicians need to get over themselves, they are not gods and just because they can’t as easily snoop on people as they have been since phones were invented they try to one up with this crap. The real Criminals will have strong encryption no matter what. It’s public knowledge and easy to implement and now it’s even easier to build your own phone with working sim … Beaglebone, raspberry phi, mino, etc… This stuff is cheap and you can customize a version of android that would omit this back door very easily … It’s open source. Anyone who is for this and thinks it will actually work on criminals is a complete moron.

forrestthewoods 11y ago

#NewYorkValues

MrQuincle 11y ago

There doesn't seem any comment that considers the pro, so I'll try to raise two points: * It is possible to ensure that encryption will physically destroy the phone. Preferably it destroys the antenna, the screen, the battery, etc. In that case the law must be pretty sure, you're the bad guy and the use of it as a backdoor becomes limited to people that value your data above the value of your phone. * If manufacturers have to open up parts of the phone to certain parties, there is a possibility that they have to open up these parts to the consumer as well. It might have on the long term a positive effect on the ability to root your own phone. If the government might own my phone, perhaps I might myself own my phone as well. Just my two cents!

Coding_Cat 11y ago
>becomes limited to people that value your data above the value of your phone. Pretty sure me and some random mugger are the only people who even care about the value of my phone. >there is a possibility that they have to open up these parts to the consumer as well. There is a whole lot of precedent that says this isn't going to happen. Even if manufacturers wanted to do this, I'd expect we'd see laws in turn which gag them so that " the terrorists can't break our backdoors".

Findeton 11y ago

I'm in the UK, with Virgin Media as ISP, and for some reason onthewire.io is blocked. WTF

justincormack 11y ago
Is that the "porn blocker", or general censorship? Andrews & Arnold is pretty much the only uncensored ISP in the uk.

jensen123 11y ago

I'm wondering - are big cities becoming obsolete? I suppose there is no coincidence that some of the worst anti-privacy stuff is coming from big cities like New York or countries that are totally centered around a big city such as the UK or France. A big city of 10 million seems far more vulnerable to terrorism than 10 cities of 1 million each. In the past, if you wanted a decent life, you kinda had to live in a big city. Now, however, thanks to the Internet, that is perhaps becoming less the case? The Internet now has a fantastic selection of shops. You'll also find lots of radio stations, music and video streaming online. There are more and more opportunities for remote work. On the other hand, a city of 10 million has far more restaurants, clubs and social opportunities than a city of 1 million. So I'm not really sure whether big cities are becoming obsolete. Still, I'll be reluctant to move to a big city if it means that I have to give up my privacy. Not saying I'll never make such a move, but the balance of pros and cons seems to be changing.

JshWright 11y ago
What does a city have to do with it? I live in semi-rural area and I would be impacted by this law if it were to pass (it's not going to).
- jensen123 11y ago
  Rural areas in jurisdictions that have big cities, such as the UK or the state of New York, will of course be impacted by such laws (if they pass). However, rural areas in other countries/states that don't have big cities are less likely to ever get such laws.

cm2187 11y ago

What is frustrating as always is that they invoke criminals and terrorists (and for once no reference to paedophiles!) but these laws will be used 99% of the time in civil cases (divorce cases, etc) and against petty crime. I remember when the UK used the terrorism act to freeze the assets of Icelandic banks. Terrorism has just become the keyword law enforcement officials add to the title of any law they want to see passed, no question ask. http://news.bbc.co.uk/1/hi/uk_politics/7688560.stm http://news.bbc.co.uk/1/hi/uk_politics/7688560.stm

matthewmacleod 11y ago
This isn't really related to your main point, but it's disingenuous to describe the freezing of Landbanki's assets as a use of the "terrorism act" just because the legislation had "anti-terrorism" in the title. The Anti-Terrorism, Crime and Security Act is pretty wide-ranging, and as well as whatever anti-terror legislation it contains, also contains some legislation around economic security - which is what was used in the case of Icesave.
- cm2187 11y ago
  That's actually precisely my point. Voted immediately after 9/11, it's a prime example of a law titled "anti-terrorism" which actually has a much broader range and provides powers in domains that have nothing to do whatsoever with terrorism.
SN76477 11y ago
Almost like some sort of conspiracy.
adrianlmm 11y ago
>but these laws will be used 99% of the time in civil cases (divorce cases, etc) Would that be a bad thing?, so you are implying that encryption is wanted to actually hide crimes or unloyal behavior mostly?
- gruez 11y ago

cmdrfred 11y ago

So NY going to ban books? https://en.wikipedia.org/wiki/Book_cipher https://en.wikipedia.org/wiki/Book_cipher

javajosh 11y ago

"New York" doesn't want anything - it's a state, not a person. This bill was introduced by Assemblyman Matthew Titone - mentioned in the 7th paragraph of the article. Gee whiz I wonder who's paying his election bills? "The fact is that, although the new software may enhance privacy for some users, it severely hampers law enforcement’s ability to aid victims." This is actually an argument against privacy itself. Astounding.

bobby_9x 11y ago

I feel like the reasons against such laws parallels the gun debates in the US: harsher laws won't effect the crimininal or terrorist, but the avetage citizen.

spdustin 11y ago

Government keeps wanting this sort of thing to help them find "the needle in the haystack" when all it does is make a bigger haystack.

sandworm101 11y ago

These statehouse bills come up regularly. Ignore them. NY has seen a half dozen "must decrypt", "must register" and "must identify" bills come and go. Some lawmaker has dinner with a low-ranking officer at some agency and come away thinking the sky is falling because of some new technology. The reality is that these statehouse bills are normally trumped (I hate that word now) by federal legislation. Even if not, there are enough people in places like NY that understand that the courts will shred these things. So they never pass. Once the news is over, once the bill proponents have made their peaches, they are quietly disappeared.

DyslexicAtheist 11y ago

this is how I picture the discussion between politicians and their technical advisers: https://www.youtube.com/watch?v=vh3tuL_DVsE https://www.youtube.com/watch?v=vh3tuL_DVsE

known 11y ago

"Never do anything against conscience even if the state demands it." --Einstein

joshka 11y ago

Also discussed at: https://news.ycombinator.com/item?id=10903084 https://news.ycombinator.com/item?id=10903084