3 ms·

I looked through the draft bill a few months ago and I couldn't find the "we will force you to put backdoors in your software" anywhere in the bill. Most of it

I looked through the draft bill a few months ago and I couldn't find the "we will force you to put backdoors in your software" anywhere in the bill. Most of it seems like bureaucrats trying to get access to information after they have obtained warrants. It all seems a lot more boring and a lot less cloak and dagger if you actually dredge through the bill here: https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/473770/Draft_Investigatory_Powers_Bill.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... The document mentions encryption four times and backdoors no times. One of those times is to say that the bill does not change anything about encryption that isn't already in law under this bill, RIPA: https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Powers_Act_2000 https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po... Really actually more scared of RIPA (which is already law) than this: "In October 2014, it was revealed that RIPA had been used by UK police forces to obtain information about journalists' sources in at least two cases. These related to the so-called Plebgate inquiry and the prosecution of Chris Huhne for perversion of the course of justice." It's amazing to me that the first two cases are absolute abuses of power; I thought we were still being told that these laws were to stop terrorists and paedophiles, not find out journalists sources...

sh1989 11y ago
Section 189(4)(c) of the Draft Investigatory Powers Bill places "obligations relating to the removal of electronic protection applied by a relevant operator to any communications or data". A relevant operator includes telecommunications services, defined in s193(11) as "any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service)" This has been slightly changed, now that the IP bill is no longer a draft: http://www.publications.parliament.uk/pa/bills/cbill/2015-2016/0143/16143.pdf http://www.publications.parliament.uk/pa/bills/cbill/2015-20... The above draft is now re-written as: s217(4)(c): "obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data". There's an appeals process, but the gist is that they're not outright banning backdoors. But if they come knocking, you better find a way to remove any protection that's there. Which is rather chilling.
- andy_ppp 11y ago
  If the government goes to a judge and gets a court order to access information this is what I consider reasonable and in fact a good thing! It seems to suggest that technical feasibility and cost needs to be taken into account as well. If it's technically impossible due to Spider Oak style end to end encryption or for example the new iPhones (6+6s) having some very advanced encryption features I'm not certain that there is a requirement to insert a backdoor. If the security services were monitoring a person who was genuinely planning to kill people and they asked you to put in a limited back door? Most services remember do not have encrypted backend systems and it'll probably always be this way. Mass surveillance is the complete opposite of this and is a totally unreasonable intrusion.
  - ConfuciusSay02 11y ago
    Except if you put in the back door it's not limited to that one person planning to kill people. It would be for everyone, in which case it is potentially mass surveillance. Not to mention that the "someone planning to kill a bunch of people" scenario never actually happens. Typically these tools are used when prosecuting regular people for regular crimes, or looking for information after an attack has already happened (San Bernadino). Nobody has yet been able to point to a case of consequence where this type of surveillance was ever used for someone actively planning an attack.
    - andy_ppp 11y ago
      I like that you pointed out it never prevents the attack, always worth remembering. Does finding connections from an attack work either?
Ensorceled 11y ago
I guess it depends on what you mean by a "backdoor"; being able to remove any CSP added encryption upon request and being forced to explicitly add easily enabled monitoring tools (only if above a certain size or if the CSP is considered likely to be served warrants) is a backdoor by quite a few people's definition.
hlandau 11y ago
See the provisions for technical capability notices. I covered the draft version here: https://www.devever.net/~hl/investigatorypowers https://www.devever.net/~hl/investigatorypowers

sh1989 11y ago

Section 189(4)(c) of the Draft Investigatory Powers Bill places "obligations relating to the removal of electronic protection applied by a relevant operator to any communications or data". A relevant operator includes telecommunications services, defined in s193(11) as "any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service)" This has been slightly changed, now that the IP bill is no longer a draft: http://www.publications.parliament.uk/pa/bills/cbill/2015-2016/0143/16143.pdf http://www.publications.parliament.uk/pa/bills/cbill/2015-20... The above draft is now re-written as: s217(4)(c): "obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data". There's an appeals process, but the gist is that they're not outright banning backdoors. But if they come knocking, you better find a way to remove any protection that's there. Which is rather chilling.

andy_ppp 11y ago
If the government goes to a judge and gets a court order to access information this is what I consider reasonable and in fact a good thing! It seems to suggest that technical feasibility and cost needs to be taken into account as well. If it's technically impossible due to Spider Oak style end to end encryption or for example the new iPhones (6+6s) having some very advanced encryption features I'm not certain that there is a requirement to insert a backdoor. If the security services were monitoring a person who was genuinely planning to kill people and they asked you to put in a limited back door? Most services remember do not have encrypted backend systems and it'll probably always be this way. Mass surveillance is the complete opposite of this and is a totally unreasonable intrusion.
- ConfuciusSay02 11y ago
  Except if you put in the back door it's not limited to that one person planning to kill people. It would be for everyone, in which case it is potentially mass surveillance. Not to mention that the "someone planning to kill a bunch of people" scenario never actually happens. Typically these tools are used when prosecuting regular people for regular crimes, or looking for information after an attack has already happened (San Bernadino). Nobody has yet been able to point to a case of consequence where this type of surveillance was ever used for someone actively planning an attack.
  - andy_ppp 11y ago
    I like that you pointed out it never prevents the attack, always worth remembering. Does finding connections from an attack work either?

Ensorceled 11y ago

I guess it depends on what you mean by a "backdoor"; being able to remove any CSP added encryption upon request and being forced to explicitly add easily enabled monitoring tools (only if above a certain size or if the CSP is considered likely to be served warrants) is a backdoor by quite a few people's definition.

hlandau 11y ago

See the provisions for technical capability notices. I covered the draft version here: https://www.devever.net/~hl/investigatorypowers https://www.devever.net/~hl/investigatorypowers