9 ms·

UK spy bill will force tech firms to disclose future products before launch

158 points by maze-le 11y ago

deepnet 11y ago
Red tape, costly, lengthy & opaque approvals process - exactly what the UK tech industry needs to flourish. /s The chilling effect could be that compliant companies are fast tracked, while those who insist on due process get quagmired.
chris_wot 11y ago
Say goodbye to the tech industry in the UK!
- fit2rule 11y ago
  Indeed. Won't be buying British at all from now on. In fact, I'm putting UK on my blacklist of places to go, and places to buy from/invest in. Sorry Brits. You are letting your state fall into absolutel disaster. I'm putting you in the same bag as North Korea, now - your state cannot be trusted one bit.
  - stuaxo 11y ago
    I'm curious where you are based, as someone in the UK, I'm not keen on going to the US because of the crazy border controls amongst other things.
    - fit2rule 11y ago
      I am in middle Europe, in the sort of country where the lessons of these sorts of shenanigans are not, generally, over-ignored by the general populace at large, and the citizenry indeed feels genuinely responsible for not letting these apparat re-emerge as a means of social control. Alas there are generations and generations of Westerners - after all, we are stateless here in the HN frame - who are, moreover, completely willing to overlook the crimes of their state and just let it all happen, "for whatever reason". This is why I, also, choose not to ever live in the US. (It is the only reason: that I chose not to.) Members of states currently erecting apparatus of human social control, with explicit intent to violate human rights of any individual, no matter their non-/statehood, need to do one thing to change it all: move. Keep moving. Abandon your culture, and acclimate to a new one. Repeat, ad inf.
      - switch007 11y ago
        300,000+ people a year emigrate from Britain. What number is required to "change it all"? Have you experienced a revolution of any kind? Studied revolutions in detail perhaps? I haven't, but I do live in the UK. Perhaps you believe if we just voted for the other party, everything will change? It's so much bigger than that.
        fit2rule 11y ago
        Yes, well, its a start ..
  - chris_wot 11y ago
    That might be going a bit far. I was more saying that if firms have to go through all that red tape then there is just no way that they will be able to compete against countries that have technology bases that don't have this level of red tape. You'll not be buying tech invented in the UK because there won't be much if any new tech developed in the UK!
    - fit2rule 11y ago
      There won't be any reason for UK tech companies to do anything, because nobody is going to be buying that tech if it means its usage will be usurped by the UK government for their own means. This assumed power - indeed, entirely imperial - of possession over items of trade means that you won't, actually, ever be able to buy something "from the UK". You'll be actually leasing it "From the Uk Gov't". That is rather a huge show-stopper, for rather a lot of industry. Ownership matters.
      - chris_wot 11y ago
        Um, they are just going to have to disclose their technology before it is released, not give up ownership.
        fit2rule 11y ago
        The purpose of disclosing technology before release is so that the UK Gov't can plan and assess attack/intrusion measures before it becomes a mainstream/wide-spread product. Don't be so naive to think this is just an 'administrative procedure'. This is the UK Gov't - and its Customers - putting in the procedure for subverting any technology it wants.
        chris_wot 11y ago
        Yeah, that's not good. However, what's to stop the UK government from doing this after the product is released? But yes, that sounds like one of the reasons they want the legislation. However, I think a stronger motivation is that they want to force the company to weaken their security and/or add a backdoor for government enforcement. So yeah, I wouldn't be buying any product from the UK that has anything to do with security.
  - suvelx 11y ago
    So what about them ARM cpus then?
7952 11y ago
Could this be applied to browsers I wonder?
- tempodox 11y ago
  Absolutely. The fact that it's a crackbrained idea won't stop law makers. To quote a sentence I once heard: “It's the law, reason doesn't enter into it”. You had better not get caught using the wrong browser in the U.K.!
  - coldcode 11y ago
    Simply mandate IE6 for everyone. Easy to hack, no longer supported so hacks keep working, no need to announce new versions, problem solved.
sunshinerag 11y ago
Oceania wants all your data.
tankenmate 11y ago
And what about open source software that anyone can download from the internet? How does Govt UK intend to manage / police that?
- elcct 11y ago
  They will appoint Internet Police
- inquisitiveio 11y ago
  It does make you wonder who advisors these law makers because it comes across as if they don't even have a basic understand how tech works.
- tempodox 11y ago
  Logically, there has to follow a law that forbids using hardware, software, or anything else for that matter, that wasn't built in accordance to the new rules. So go dig up grandpa's type writer and slide rule...
  - madaxe_again 11y ago
    You kid, but the kremlin went back to purely mechanical typewriters a few years ago for this precise reason - and even they can be bugged.
    - adrianN 11y ago
      https://en.wikipedia.org/wiki/Acoustic_cryptanalysis https://en.wikipedia.org/wiki/Acoustic_cryptanalysis
- antihero 11y ago
  Well they'll require Apple/other device manufacturers to use trusted computing so only government authorised software can run on them, of course.
stuaxo 11y ago
FFS, are they just trying to kill off the tech industry in the UK?
- JustSomeNobody 11y ago
  And the US... "Any company with operations in the UK -- including Apple, Facebook, Google, Microsoft, and Twitter, which have submitted written evidence calling on the British lawmakers to revise the bill -- would have to comply with the rules."
  - czechdeveloper 11y ago
    This will not kill US tech companies. Maybe their UK market. I'd love to see those companies just leave UK ale let them have what they asked for.
    - azazqadir 11y ago
      This will affect US companies though.
- Spearchucker 11y ago
  Doubt they even see it that way. And the industry won't be killed. Like with drugs, it will simply be driven underground. An astute startup will register an offshore company and develop locally. And then there's the rise of remote working which makes staying legal even easier.
CommanderData 11y ago
Don't forget this from 2 months ago.. UK surveillance powers bill could force startups to bake in backdoors https://news.ycombinator.com/item?id=11265666 https://news.ycombinator.com/item?id=11265666 These laws WILL affect UK tech start-ups if privacy has anything to do with their business model. I have said so in the past, don't register your tech startups in the UK. Boycott is sometimes an effective means for change. UK law makers know this could back-fire, they are taking a gamble they have already lost.
JustSomeNobody 11y ago
Between the US and the UK, this is just getting comical. How do these governments not see that the people who would do harm to us will get their encrypted tech from somewhere else and bring it with them. Just adds full to the fire that this has nothing to do with protecting citizens.
- beedogs 11y ago
  In the end, it's about controlling citizens and predicting their behaviour, not protecting them.
jackgavigan 11y ago
Worth remembering that this has effectively been in place for some time: https://news.ycombinator.com/item?id=6893947 https://news.ycombinator.com/item?id=6893947
- 15thandwhatever 11y ago
  In the US, we've had this[1] in place for some time on products for phone networks. 1: https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...
tempodox 11y ago
We're really living in the age of overreaching surveillance. Law makers seem rabid and unable to consider reason: Just because surveillance is possible, it also has to be taken to the very top. They cover their asses while ruining everything else in the process.
kempe 11y ago
Sounds like 1984 coming closer and closer each day. I wonder however about the negative consequences to the tech industry, why would a company purchase a service they can not trust anymore due to weak encryption? They government probably also will miss their target completely as criminals/ terrorists etc will simply choose other products and services.
PJDK 11y ago
There's a lot of comments in this thread throwing up their hands about this. That's the attitude that will let this sort of thing happen. Bills are published like this well ahead of them even being debated so that interested parties can comment. There's a major faction within the Conservative party that is pro privacy (e.g. http://news.bbc.co.uk/1/hi/uk_politics/7450627.stm http://news.bbc.co.uk/1/hi/uk_politics/7450627.stm), and it's also pro business. This is anti privacy and anti business. It's a winnable fight, but not if you give up at the first suggestion of a thing you don't like. Write to MPs, say "As CEO of awesome corp I would seriously consider relocating to Berlin". That sort of thing will get attention.
- nunobrito 11y ago
  Agreed. Need to exist enough voices to keep the balance.
  - azazqadir 11y ago
    Didn't expect UK to present a bill like this one. Russia or China on the other hand would have made some sense.
    - nunobrito 11y ago
      In both Russia and China you find more "synergy" between private companies and state. There wouldn't be need for pass legislation because a company refusing to cooperate would be promptly "educated". In the western countries there is less synergy and more dispute. So they need to legislate for the law abiding organizations to become "outlawed" at some point for doing what is the ethically correct thing to do.
- TheOtherHobbes 11y ago
  The big guns are already doing it. It won't help, because the Home Office is run by paranoid authoritarians and crazies, and they keep trying to pull crap like this no matter who is in power. The critical question is just how likely is it that the gov will prosecute Apple, Google, or FB for not following the rules. "Not very", I'd guess. How likely is the gov to prosecute Tiny Corp Ltd? "8.1 Small companies (with under 10,000 users) will not be obligated to provide a permanent interception capability, although they may be obligated to give effect to a warrant." But look at this: "8.17 A person to whom a technical capability notice is given is under a duty to comply with the notice. In respect of a technical capability notice to give effect to equipment interference or bulk acquisition warrants, the duty to comply with a technical capability notice is enforceable against a person in the UK by civil proceedings by the Secretary of State. The duty to comply with a technical capability notice to give effect to interception warrants and CD authorisations is enforceable against a person in the UK and a person outside the UK by civil proceedings by the Secretary of State." That's civil proceedings, not criminal proceedings. So basically the SoS can sue, but not jail anyone. It's all quite confused, and fundamentally fails to understand the differences between targeted surveillance, bulk surveillance, end-to-end encryption, commercial encryption for (e.g.) secure banking, open source VPNs, and so on. If you pull apart the language, the mental model is of someone who thinks encryption is like an envelope around a letter. So if you demand a de-enveloping tool from the people who make and sell envelopes you've done your job. There's a bit more to it, but the legal language doesn't have any insight into that.
knorker 11y ago
So it's prior restraint?
nunobrito 11y ago
From today's Dilbert: http://assets.amuniversal.com/721c8690d8e901334e5c005056a9545d http://assets.amuniversal.com/721c8690d8e901334e5c005056a954...
stegosaurus 11y ago
Do we just end up in a state where the idea of a 'firm' has to radically change? It feels like the ultimate endgame of all of this is either that the technology industry just freezes (because innovation is killed by bureaucracy), or that we end up in some cryptopunk space in which the only interesting stuff happens over Tor/Freenet/whatever else. And of course, the latter becomes harder every day with hardware backdoors. I think that fundamentally the idea of the state regulating commerce is flawed. Individuals want to be able to make choices, but at the moment they can't because economics forces their hand. Apart from a few radicals, everyone has to use a car, has to use the subway with its' smart card, has to use their mobile phone for business, because otherwise society doesn't have a role for you any more. Can UBI help here? Or are we really just doomed to basically disable the Internet we created because it's too powerful?
antihero 11y ago
Idea: Create a company who's explicit purpose is to create and submit billions of iterations of the same software for their auditing purposes which horrifically unreadable/obfuscated code that completely swamps whatever agency is responsible for the process, and effectively DoSes them until literally nobody can release software at all.
fsloth 11y ago
And I thought the character of 'C' in the Spectre(2015 film) was a bit over the top. How silly I was, the fact that it culminated only on one character was actually a massive understatement
fsloth 11y ago
So the UK intelligence wants the capability provided by the Echelon surveillance network back? It's actually not as chilling in the sense that this would be nothing new - rather, I'm sure the spooks are grieving the fact that people are moving to secure technologies. I'm pretty sure that before the internet no envelope or phone call was inaccessible.
willow9886 11y ago
This is quickly shaping up to be another "War on Drugs"... It's hard to determine whether UK lawmakers actually think bills like this will make them more secure, or if it's just one incremental move in a long term strategy to remove any assurance of privacy. Either way the UK gov is looking highly incompetent.
jamedjo 11y ago
First thought was that people would protest this by flooding the relevant department with product updates, maybe triggered on each commit. Then I noticed the caveats: - Updates don't count: only significantly large changes need disclosing. - Can't be forced on companies with fewer than 10,000 users. Maybe commercially led open source products could claim that users are spread across many forks each with fewer users. - New product disclosures only applies to communications companies already forced to backdoor existing products. Maybe we'll see companies akin to Alphabet evading the need to backdoor new products by forming separate companies. Overall I'm more worried by the requirement to backdoor communications than having to disclose new services. Security shouldn't be sacrificed. Additionally the gagging order would prevent companies from being honest with their users as well as making it harder for them to fight against it.

158 points by maze-le 11y ago

Red tape, costly, lengthy & opaque approvals process - exactly what the UK tech industry needs to flourish. /s The chilling effect could be that compliant companies are fast tracked, while those who insist on due process get quagmired.

chris_wot 11y ago

Say goodbye to the tech industry in the UK!

fit2rule 11y ago
Indeed. Won't be buying British at all from now on. In fact, I'm putting UK on my blacklist of places to go, and places to buy from/invest in. Sorry Brits. You are letting your state fall into absolutel disaster. I'm putting you in the same bag as North Korea, now - your state cannot be trusted one bit.
- stuaxo 11y ago
  I'm curious where you are based, as someone in the UK, I'm not keen on going to the US because of the crazy border controls amongst other things.
  - fit2rule 11y ago
    I am in middle Europe, in the sort of country where the lessons of these sorts of shenanigans are not, generally, over-ignored by the general populace at large, and the citizenry indeed feels genuinely responsible for not letting these apparat re-emerge as a means of social control. Alas there are generations and generations of Westerners - after all, we are stateless here in the HN frame - who are, moreover, completely willing to overlook the crimes of their state and just let it all happen, "for whatever reason". This is why I, also, choose not to ever live in the US. (It is the only reason: that I chose not to.) Members of states currently erecting apparatus of human social control, with explicit intent to violate human rights of any individual, no matter their non-/statehood, need to do one thing to change it all: move. Keep moving. Abandon your culture, and acclimate to a new one. Repeat, ad inf.
    - switch007 11y ago
      300,000+ people a year emigrate from Britain. What number is required to "change it all"? Have you experienced a revolution of any kind? Studied revolutions in detail perhaps? I haven't, but I do live in the UK. Perhaps you believe if we just voted for the other party, everything will change? It's so much bigger than that.
      - fit2rule 11y ago
        Yes, well, its a start ..
- chris_wot 11y ago
  That might be going a bit far. I was more saying that if firms have to go through all that red tape then there is just no way that they will be able to compete against countries that have technology bases that don't have this level of red tape. You'll not be buying tech invented in the UK because there won't be much if any new tech developed in the UK!
  - fit2rule 11y ago
    There won't be any reason for UK tech companies to do anything, because nobody is going to be buying that tech if it means its usage will be usurped by the UK government for their own means. This assumed power - indeed, entirely imperial - of possession over items of trade means that you won't, actually, ever be able to buy something "from the UK". You'll be actually leasing it "From the Uk Gov't". That is rather a huge show-stopper, for rather a lot of industry. Ownership matters.
    - chris_wot 11y ago
      Um, they are just going to have to disclose their technology before it is released, not give up ownership.
      - fit2rule 11y ago
        The purpose of disclosing technology before release is so that the UK Gov't can plan and assess attack/intrusion measures before it becomes a mainstream/wide-spread product. Don't be so naive to think this is just an 'administrative procedure'. This is the UK Gov't - and its Customers - putting in the procedure for subverting any technology it wants.
        chris_wot 11y ago
        Yeah, that's not good. However, what's to stop the UK government from doing this after the product is released? But yes, that sounds like one of the reasons they want the legislation. However, I think a stronger motivation is that they want to force the company to weaken their security and/or add a backdoor for government enforcement. So yeah, I wouldn't be buying any product from the UK that has anything to do with security.
- suvelx 11y ago
  So what about them ARM cpus then?

7952 11y ago

Could this be applied to browsers I wonder?

tempodox 11y ago
Absolutely. The fact that it's a crackbrained idea won't stop law makers. To quote a sentence I once heard: “It's the law, reason doesn't enter into it”. You had better not get caught using the wrong browser in the U.K.!
- coldcode 11y ago
  Simply mandate IE6 for everyone. Easy to hack, no longer supported so hacks keep working, no need to announce new versions, problem solved.

sunshinerag 11y ago

Oceania wants all your data.

tankenmate 11y ago

And what about open source software that anyone can download from the internet? How does Govt UK intend to manage / police that?

elcct 11y ago
They will appoint Internet Police
inquisitiveio 11y ago
It does make you wonder who advisors these law makers because it comes across as if they don't even have a basic understand how tech works.
tempodox 11y ago
Logically, there has to follow a law that forbids using hardware, software, or anything else for that matter, that wasn't built in accordance to the new rules. So go dig up grandpa's type writer and slide rule...
- madaxe_again 11y ago
  You kid, but the kremlin went back to purely mechanical typewriters a few years ago for this precise reason - and even they can be bugged.
  - adrianN 11y ago
    https://en.wikipedia.org/wiki/Acoustic_cryptanalysis https://en.wikipedia.org/wiki/Acoustic_cryptanalysis
antihero 11y ago
Well they'll require Apple/other device manufacturers to use trusted computing so only government authorised software can run on them, of course.

stuaxo 11y ago

FFS, are they just trying to kill off the tech industry in the UK?

JustSomeNobody 11y ago
And the US... "Any company with operations in the UK -- including Apple, Facebook, Google, Microsoft, and Twitter, which have submitted written evidence calling on the British lawmakers to revise the bill -- would have to comply with the rules."
- czechdeveloper 11y ago
  This will not kill US tech companies. Maybe their UK market. I'd love to see those companies just leave UK ale let them have what they asked for.
  - azazqadir 11y ago
    This will affect US companies though.
Spearchucker 11y ago
Doubt they even see it that way. And the industry won't be killed. Like with drugs, it will simply be driven underground. An astute startup will register an offshore company and develop locally. And then there's the rise of remote working which makes staying legal even easier.

CommanderData 11y ago

Don't forget this from 2 months ago.. UK surveillance powers bill could force startups to bake in backdoors https://news.ycombinator.com/item?id=11265666 https://news.ycombinator.com/item?id=11265666 These laws WILL affect UK tech start-ups if privacy has anything to do with their business model. I have said so in the past, don't register your tech startups in the UK. Boycott is sometimes an effective means for change. UK law makers know this could back-fire, they are taking a gamble they have already lost.

JustSomeNobody 11y ago

Between the US and the UK, this is just getting comical. How do these governments not see that the people who would do harm to us will get their encrypted tech from somewhere else and bring it with them. Just adds full to the fire that this has nothing to do with protecting citizens.

beedogs 11y ago
In the end, it's about controlling citizens and predicting their behaviour, not protecting them.

jackgavigan 11y ago

Worth remembering that this has effectively been in place for some time: https://news.ycombinator.com/item?id=6893947 https://news.ycombinator.com/item?id=6893947

15thandwhatever 11y ago
In the US, we've had this[1] in place for some time on products for phone networks. 1: https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...

tempodox 11y ago

We're really living in the age of overreaching surveillance. Law makers seem rabid and unable to consider reason: Just because surveillance is possible, it also has to be taken to the very top. They cover their asses while ruining everything else in the process.

kempe 11y ago

Sounds like 1984 coming closer and closer each day. I wonder however about the negative consequences to the tech industry, why would a company purchase a service they can not trust anymore due to weak encryption? They government probably also will miss their target completely as criminals/ terrorists etc will simply choose other products and services.

PJDK 11y ago

There's a lot of comments in this thread throwing up their hands about this. That's the attitude that will let this sort of thing happen. Bills are published like this well ahead of them even being debated so that interested parties can comment. There's a major faction within the Conservative party that is pro privacy (e.g. http://news.bbc.co.uk/1/hi/uk_politics/7450627.stm http://news.bbc.co.uk/1/hi/uk_politics/7450627.stm), and it's also pro business. This is anti privacy and anti business. It's a winnable fight, but not if you give up at the first suggestion of a thing you don't like. Write to MPs, say "As CEO of awesome corp I would seriously consider relocating to Berlin". That sort of thing will get attention.

nunobrito 11y ago
Agreed. Need to exist enough voices to keep the balance.
- azazqadir 11y ago
  Didn't expect UK to present a bill like this one. Russia or China on the other hand would have made some sense.
  - nunobrito 11y ago
    In both Russia and China you find more "synergy" between private companies and state. There wouldn't be need for pass legislation because a company refusing to cooperate would be promptly "educated". In the western countries there is less synergy and more dispute. So they need to legislate for the law abiding organizations to become "outlawed" at some point for doing what is the ethically correct thing to do.
TheOtherHobbes 11y ago
The big guns are already doing it. It won't help, because the Home Office is run by paranoid authoritarians and crazies, and they keep trying to pull crap like this no matter who is in power. The critical question is just how likely is it that the gov will prosecute Apple, Google, or FB for not following the rules. "Not very", I'd guess. How likely is the gov to prosecute Tiny Corp Ltd? "8.1 Small companies (with under 10,000 users) will not be obligated to provide a permanent interception capability, although they may be obligated to give effect to a warrant." But look at this: "8.17 A person to whom a technical capability notice is given is under a duty to comply with the notice. In respect of a technical capability notice to give effect to equipment interference or bulk acquisition warrants, the duty to comply with a technical capability notice is enforceable against a person in the UK by civil proceedings by the Secretary of State. The duty to comply with a technical capability notice to give effect to interception warrants and CD authorisations is enforceable against a person in the UK and a person outside the UK by civil proceedings by the Secretary of State." That's civil proceedings, not criminal proceedings. So basically the SoS can sue, but not jail anyone. It's all quite confused, and fundamentally fails to understand the differences between targeted surveillance, bulk surveillance, end-to-end encryption, commercial encryption for (e.g.) secure banking, open source VPNs, and so on. If you pull apart the language, the mental model is of someone who thinks encryption is like an envelope around a letter. So if you demand a de-enveloping tool from the people who make and sell envelopes you've done your job. There's a bit more to it, but the legal language doesn't have any insight into that.

knorker 11y ago

So it's prior restraint?

nunobrito 11y ago

From today's Dilbert: http://assets.amuniversal.com/721c8690d8e901334e5c005056a9545d http://assets.amuniversal.com/721c8690d8e901334e5c005056a954...

stegosaurus 11y ago

Do we just end up in a state where the idea of a 'firm' has to radically change? It feels like the ultimate endgame of all of this is either that the technology industry just freezes (because innovation is killed by bureaucracy), or that we end up in some cryptopunk space in which the only interesting stuff happens over Tor/Freenet/whatever else. And of course, the latter becomes harder every day with hardware backdoors. I think that fundamentally the idea of the state regulating commerce is flawed. Individuals want to be able to make choices, but at the moment they can't because economics forces their hand. Apart from a few radicals, everyone has to use a car, has to use the subway with its' smart card, has to use their mobile phone for business, because otherwise society doesn't have a role for you any more. Can UBI help here? Or are we really just doomed to basically disable the Internet we created because it's too powerful?

antihero 11y ago

Idea: Create a company who's explicit purpose is to create and submit billions of iterations of the same software for their auditing purposes which horrifically unreadable/obfuscated code that completely swamps whatever agency is responsible for the process, and effectively DoSes them until literally nobody can release software at all.

fsloth 11y ago

And I thought the character of 'C' in the Spectre(2015 film) was a bit over the top. How silly I was, the fact that it culminated only on one character was actually a massive understatement

fsloth 11y ago

So the UK intelligence wants the capability provided by the Echelon surveillance network back? It's actually not as chilling in the sense that this would be nothing new - rather, I'm sure the spooks are grieving the fact that people are moving to secure technologies. I'm pretty sure that before the internet no envelope or phone call was inaccessible.

willow9886 11y ago

This is quickly shaping up to be another "War on Drugs"... It's hard to determine whether UK lawmakers actually think bills like this will make them more secure, or if it's just one incremental move in a long term strategy to remove any assurance of privacy. Either way the UK gov is looking highly incompetent.

jamedjo 11y ago

First thought was that people would protest this by flooding the relevant department with product updates, maybe triggered on each commit. Then I noticed the caveats: - Updates don't count: only significantly large changes need disclosing. - Can't be forced on companies with fewer than 10,000 users. Maybe commercially led open source products could claim that users are spread across many forks each with fewer users. - New product disclosures only applies to communications companies already forced to backdoor existing products. Maybe we'll see companies akin to Alphabet evading the need to backdoor new products by forming separate companies. Overall I'm more worried by the requirement to backdoor communications than having to disclose new services. Security shouldn't be sacrificed. Additionally the gagging order would prevent companies from being honest with their users as well as making it harder for them to fight against it.