16 ms·

UK surveillance bill includes powers to limit end-to-end encryption

365 points by wjh_ 10y ago

fweespeech 10y ago
Has the UK lost their god damned minds? I'm sorry but between this and everything else lately...they seem pretty committed to "Security at any economic and/or personal cost! Security for everyone!" In the real world, that never works.
- pmontra 10y ago
  s/security/Orwell/
- gakada 10y ago
  Policy in the UK is dictated by the newspapers. If it makes the Sun and the Mail happy, then it's a good policy. No doubt this fits the bill.
- k-mcgrady 10y ago
  I don't think it's to do with people 'losing their minds'. The weird thing about bills like this, or really anything effecting privacy/IT security, is that no matter how bad it is the general public have no idea it's happening. The number of people I've spoken to who know nothing about Snowden/PRISM etc despite it being front page news for months shocks me. That basically means that it's up to a small group of people who are informed (like ourselves) to do what we can to stop this stuff. If we sit back and do nothing they won't have any problem implementing these laws.
  - flyinghamster 10y ago
    For a long time, people who are concerned about online security and privacy have been derided as paranoid, tinfoil-hat-wearing kooks. Not only that, but it seems to me that there's been far less coverage of these issues in mainstream media than in the tech press, and most mainstream coverage seems to take the governments' side. People who get most or all of their news from TV likely won't hear anything about all this; if they do, their eyes will glaze over as they don't have a clue how encryption works, or why it's important. Or, it will just vanish in the news cycle and they never think about it again. Edit: It also seems to me that most people just aren't going to care unless it directly affects them, at which time it's already far too late.
    - soundwave106 10y ago
      If this is implemented, it's going to be fun the day that someone from the government gets hacked and compromised via the very same security weaknesses they ordered.
- 1_2__3 10y ago
  I feel like the UK is showing us what happens when the western world enters the information age without the protections and focus on individual freedoms some other countries have (not just the US, although of course they're high on the list). In many ways we're seeing history play out all over again - new, disruptive thing shows up, governments wet themselves in terror, and try to control it. The difference is what happens now; in the US this tends (excluding drugs) to lead slowly towards a more nuanced position where the reigns are gradually loosened. In the UK that seems to never happen, the arrow of control and government intrusion only ever points in one direction. It's very puzzling; I'm not sure what the source of it is but I think it's going to be a serious issue in the future. Specifically as the rest of the world forges ahead, either through the evolving view of attempting to control of the uncontrollable, or through sheer lawlessness in other countries where the control is never in place. In the middle will be the UK, clinging desperately to the belief that (as someone else in the thread put it) they can hold back the tide.
- martiuk 10y ago
  "but paedos and terrorists!!!!" Welcome to any debate RE: technology and privacy.
zeveb 10y ago
> 'If we do not provide for access to encrypted communications when it is necessary and proportionate to do so then we must simply accept that there can be areas online beyond the reach of the law.' Yes, yes we must accept that, since it's reality. Queen Elizabeth can no more hold back encrypted communications than King Canute could hold back the tide.
- golemotron 10y ago
  It's a re-balancing. Before electronic bugs every park and pub had conversations that were completely beyond the reach of the law. And that's ok. We used to call that liberty.
- Zigurd 10y ago
  Even here you see people who harbor the delusion that governments are all-powerful, ignoring the fact that if they employed mind-readers, or, for that matter "polygraphers," they would be an unscientific fraud and no amount of law could change that.
saulrh 10y ago
> “Doors are now almost ubiquitous and are the default for most houses and buildings. If we do not provide for access to people's bathrooms when it is necessary and proportionate to do so then we must simply accept that there can be rooms beyond the reach of the law,” There are well-established and functional methods for extending law into areas that you can't see all the time. You don't need to ban encryption, in exactly the same way that you don't have to ban doors. Just because it's ooon the iiiinterneeettttt doesn't mean you need to break everything.
- themartorana 10y ago
  Or how you don't have to ban virus scanners on Windows just in case UK spooks want to run a virus on your computer because no safe spaces for terrorists.
- logfromblammo 10y ago
  The state's enforcers do not fear doors, because they have boots for kicking, and stout legs to fill them. Even the heavier doors can be breached by prybar, ram, cutting torch, or explosive. But when your bathroom door is protected by 256-bit encryption, the peace of your metaphorical deuce-dropping is (statistically) guaranteed until such time as the sun leaves the main sequence and devours the Earth. The states conveniently ignore that kicking down a toilet door to pick through someone's poo and count the peanuts is not generally beneficial to anyone's security, especially when holding out a net under the appropriate sewer pipe could usually achieve the same results with less public outrage. In any case, those with truly incriminating poo-peanuts will likely burn them, or head off into the woods with a trowel, and your toilet raids will only end up menacing those who linger too long in the stall, solving sudoku puzzles or practicing toilet-square origami, or whatnot.
  - saulrh 10y ago
    Exactly my point. Just like you don't mount cameras in everybody's bathrooms, you don't outlaw encryption. Instead, you install spy software on your target's computer, or you plant a bug in their light fixture, or subpoena Facebook to see if they ever messed up and said anything unencrypted. You can still find things out even if someone is being serious and uses end-to-end encryption, just like you can still find things out even if someone is being serious and burns their incriminating poo-peanuts.
sklivvz1971 10y ago
It's such a pointless war on its own law-abiding citizens. It makes me sad. People that really care about privacy, people who need to hide what they do will not be majorly impacted. * The main threat is metadata anyways, not the data itself. Locating where you are (e.g. with millions of cameras and facial recognition) is a much worse threat. * They will still use full disk encryption, free software, PGP or AES, etc. outside of the affected apps. That software won't stop to exist, nor the mathematics that powers it will stop working. The sad part is that the people who will be disproportionally affected will be the common people who have nothing to hide anyways, and do not have the technical means, or the will, to protect themselves. TLDR: useless and damaging.
- watbe 10y ago
  It provides a sort of scapegoat for attacks. The government can't be seen as doing nothing against the threat of terrorism, so when the adversary uses encryption to cover their tracks, the government can point and say 'we did our best to outlaw their method of communication'.
  - arethuza 10y ago
    The "Politician's syllogism": We must do something This is something Therefore, we must do this.
  - huherto 10y ago
    It must be this. Even politicians will be greatly impacted. Since anything can be used against them. Even the most innocent text message if leaked. And none of them is guaranteed to have control over it.
    - type0 10y ago
      That's why they will probably pass exception laws that allow political elites to use encryption and the tyranny will be inevitable.
- vidarh 10y ago
wheaties 10y ago
If I want to keep my communications encrypted online, I'm going to do so. The only people who won't have the same luxury as me are those that follow the law. I don't get it.
- superuser2 10y ago
  If encrypted communications are illegal, then anyone using them is an automatic target for investigation and the encryption itself may be probable cause to open up their lives and property. It's considerably more difficult to conceal the fact of encryption on the wire than (say) a gun in your home.
  - tomjen3 10y ago
    Ciphertext is supposed to be impossible to distinquis from random noise, so how are they going to prove I am not just sending random noise, with a PGP header? As for asking why I would do such a thing? I think the law is wrong and want to make the court waste their time.
    - bitwize 10y ago
      No one would actually send random noise as a message, so the law would assume that comnunications which look like random noise are, prima facie, encrypted comms and something the police have a right to see in cleartext.
      - logfromblammo 10y ago
        The folks at https://www.random.org/ https://www.random.org/ and similar true-randomness providers would beg to differ. They do, in fact, have a paid service to deliver what appears to be random noise as a message, then store that noise in their archive for subsequent re-verification. I recall seeing videos of lava lamps and handfuls of d6 dice on a vibrating table, broadcast live over the internet, purely for their utility as potential sources for truly random numbers. I can easily see a case for sending randomness in a client-server game with protections against cheating and bandwidth restrictions. The randomness server sends the same chunk of noise to game client and game server, and the game client sends user commands to the game server. As long as the user isn't cheating, the official server copy of the game state and the client copy remain in sync.
themartorana 10y ago
"...there should be no safe spaces..." Got it.
mankash666 10y ago
If the laws are this regressive and encompassing, the very least we as citizens can do is to lobby for full transparency in requests - after all the data belongs to the individual (regardless of what the TOS claims) and the individual deserves to know about requests on his data immediately.
pre 10y ago
So, how are companies supposed to keep customer data safe from hackers without encryption exactly? This kind of thing can only make the people of the UK less safe, more at risk, and more likely to be hacked and otherwise digitally abused. If you wanna keep the people safe, you don't ban encryption. Better would be to mandate it.
CiPHPerCoder 10y ago
Dear UK government, Good luck with that. Signed, An open source software developer outside your jurisdiction
- Spivak 10y ago
  I mean they're just going to fine/jail anyone within their jurisdiction that uses your software. Pretending that you can't ban encryption because you can't eliminate its availability is silly. This is a political problem that must have a political solution.
  - CiPHPerCoder 10y ago
    The only effective political solution is to get the common person in on using end-to-end encryption so its ban becomes unpopular.
tetrep 10y ago
I think this same logic that is purportedly the reasoning behind this bill would also require us to constantly record all of our vocal communications, as that would be the only way we could ensure that criminals could not have communications that aren't accessible to law enforcement. This, of course, would require microphones on all citizens as well as many more in the surrounding environment, to ensure communications of unwilling citizens can be monitored as well. And, of course, we'd need video as well to get those pesky sign language users[0]. These sort of bills always make me wonder if we'll ever see a moral stance taken by tech companies. There's a few skirmishes that happen every now and then but there doesn't seem to be any general consensus on what companies will tolerate in both themselves and their business partners. I'd love to see a "Fair Trade"-esque branding used as an indication that the product and its supply chain don't include actors who support government surveillance. [0]: OT, but it makes me realize you can literally make illegal gestures due to https://en.wikipedia.org/wiki/Hate_speech_laws_in_the_United_Kingdom https://en.wikipedia.org/wiki/Hate_speech_laws_in_the_United...
- geggam 10y ago
  Most citizens carry said microphones complete with GPS and other tracking abilities... already
  - LinuxBender 10y ago
    I agree with you. Every time I bring that up, I get down-voted due to the cognitive dissonance that folks have with their fondle-slabs. Now people are being conditioned to think it's normal for their microphone to always be on.
    - shostack 10y ago
      Are there any good low-tech ways to disable them similar to tape over the camera? Not sure if tape alone would be sufficient to block audio.
      - hx87 10y ago
reacharavindh 10y ago
It is to an extent funny to think that governments think they can sit on top of communications and implement mass surveillance. If you make it illegal to encrypt your stuff, the knowledged/tech savvy people will start to work on using steganography. There will be an explosion of cat pictures in the Internet. Good luck finding the hideous cat :-) All the government does now is inconvenience to the majority of citizens who they have nothing to worry about anyway.
brador 10y ago
When does something become encryption? Say I switch t and r in evetyrhing I rype, is that encryption? No? Then at what point of mixing does it all become encryption?
- dvtv75 10y ago
  I would guess the point at which they say it does.
deleted 10y ago
[deleted]
3v3rt 10y ago
Interesting to see that at the same time the EU privacy watch dog is proposing to mandate encryption and outlaw these kind of decryption methodologies[0]. While still an opinion, it is good to see that in this area the EU is among the most progressive governments around. [0] https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2016/16-07-22_Opinion_ePrivacy_EN.pdf https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/sha...
- mark_l_watson 10y ago
  Interesting indeed. I thought it peculiar that the UK government released the Tony Blair report just before the BRexit vote. That report certainly got many people riled up about the 'establishment' and possibly could have changed the BRexit voting result. My point is that if the UK had stayed in the EU then the UK surveillance bill might have been dead in the water because it might have comflicted with EU law.
  - Zenst 10y ago
    The EU referendum was on the 23rd June 2016 and the Chilcot report (as it is known formerly) was released 6th of July 2016. So those facts aside your point, do you have any conflicting EU laws in mind? I ask as currently the UK has not left and then looking at 2 years notice so any new UK law coming into play for years (due to the time to formulate them), will be complying within current EU laws and regulations. TL;DR No and no. But I respect the premise.
    - mark_l_watson 10y ago
      Thank you for the correction! I have made this cement to some friends, so I will let them know I was wrong.
thenewregiment 10y ago
Why not just mimic V for Vendetta
SeanDav 10y ago
I am surprised they did not add the line "think of the children" in there somewhere... Meanwhile in the real world, criminals will resort to sending encrypted USB sticks via post, or carrier pigeons, or implanted in mules. There is always a way around these things for those that absolutely do not want their communications compromised. It is safe to say that any criminal enterprise knows that live electronic communication of any sort is likely to be compromised. Also of concern, is that criminals will now have extra attack vectors to sensitive data, because if encryption has to be weakened for Government, it will be easier for other parties to exploit.
DanBC 10y ago
This is a fairly obvious sacrificial anode bit of the legislation. They'll drop this, while making the "provide the keys" bit of RIPA stronger.
49para 10y ago
What possibly can they do with all this data ? It seems that current governments can't seem to solve the drug war, the war on terror, gun crime, or the increasing number of terrorist attacks. How much intrusion do they actually need and what is the cost of the technology before they can actually seem to make headway on solving issues.
lb1lf 10y ago
This belief that you can somehow force the strong encryption genie back in his bottle is fascinating, if sad. I guess it is not as futile as it may appear at first glance, though - after all, you don't need all the world's suppliers of communication software to adhere to be successful; just force the major ones to help you out, then simply assume that anyone using an insignificant (by user base) app is up to something nefarious. Bah. Orwell was an optimist.
cloudjacker 10y ago
If UK finishes leaving the EU, they will just be excluded from the market given their diminished relevance. Are sure given the power vacuum in tech, I'll release a gimped software product for their citizens. $£$£$£$£$£$£$£$£$£
LinuxBender 10y ago
Two can play at this game. Surely folks here at HN can create something that is not technically or legally encryption, but accomplishes the same goal.
- pferde 10y ago
  ...until it gets legally declared as encryption as well.
  - LinuxBender 10y ago
    Fair enough. Maybe it's like an arms race, or a shell game. but you are probably right.
0xmohit 10y ago
"The Lives of Others" [0] [0] https://en.wikipedia.org/wiki/The_Lives_of_Others https://en.wikipedia.org/wiki/The_Lives_of_Others
JustSomeNobody 10y ago
Anyone hell bent on killing people will likely succeed. Surveillance is not the answer. Too much data is just as bad as not enough. The solution is finding out WHY people want to kill you and fix THAT.
inetsee 10y ago
I can't help but wonder how this bill, on top of Brexit, will affect the state of technology entrepreneurship in the UK. Why should an entrepreneur start up a technology business in the UK if his efforts will be hampered by politicians who have no clue about how technology actually works?
- carterehsmith 10y ago
  Rest assured that there are people working for the government that know more about encryption then you or I or 5,000 entrepreneurs. For example, GCHQ came up with PKI before the people that "invented" PKI and published it.
  - inetsee 10y ago
    I have no doubt that the people working for GCQH know as much as anybody about encryption. The question is, are they smart enough to convince buyers that encryption with backdoors is secure against hackers. Because if buyers don't believe encryption with backdoors is secure, they won't buy it. If the buyers won't buy it, it's going to be very hard for entrepreneurs to succeed in selling it.
hardlianotion 10y ago
Just another little reminder that you must never confuse the government's interests with your own.
beedogs 10y ago
Will the last tech company to leave the UK please turn off the lights?
austinjp 10y ago
It's time to call this stuff out for what it is: flat out idiocy or lies. Possibly both. Here's a brief thought to uncover why: There are two countries. Country A has security capabilities equivalent to today's UK. Country B, equivalent to today's UK plus the proposed changes. Could maniacs based in country B commit attacks of equivalent fatality to maniacs based in country A? Of course they could. Could a criminal gang in country B get away with crimes of similar magnitude to a similar gang in country A? Of course they could. Other threads here have pointed out the minimal extra effort that would be required by perpetrators, if any. So why propose these changes, and why give the stated reasons? Perhaps the government doesn't understand the negligible impact they'll have. This seems unlikely, although perhaps they "can't see the wood for the trees" and are getting carried away with the current xenophobic mood in the air. Perhaps the government is showing its true colours and exercising the basic Conservative desire to deny societal evolution, by tightening control over anything new and complex. Perhaps they've had a good hard think to the best of their abilities, and have genuinely decided this is The Best Thing To Do. Whatever the reason, it's either founded on idiocy or couched in lies.
petre 10y ago
If privacy is outlawed, only outlaws will have privacy. They created terrorism in the first place by bombing and occupying other countries, removing dictators.
known 10y ago
Govt should limit end-to-end encryption AFTER open sourcing all their software;

365 points by wjh_ 10y ago

Has the UK lost their god damned minds? I'm sorry but between this and everything else lately...they seem pretty committed to "Security at any economic and/or personal cost! Security for everyone!" In the real world, that never works.

pmontra 10y ago
s/security/Orwell/
gakada 10y ago
Policy in the UK is dictated by the newspapers. If it makes the Sun and the Mail happy, then it's a good policy. No doubt this fits the bill.
k-mcgrady 10y ago
I don't think it's to do with people 'losing their minds'. The weird thing about bills like this, or really anything effecting privacy/IT security, is that no matter how bad it is the general public have no idea it's happening. The number of people I've spoken to who know nothing about Snowden/PRISM etc despite it being front page news for months shocks me. That basically means that it's up to a small group of people who are informed (like ourselves) to do what we can to stop this stuff. If we sit back and do nothing they won't have any problem implementing these laws.
- flyinghamster 10y ago
  For a long time, people who are concerned about online security and privacy have been derided as paranoid, tinfoil-hat-wearing kooks. Not only that, but it seems to me that there's been far less coverage of these issues in mainstream media than in the tech press, and most mainstream coverage seems to take the governments' side. People who get most or all of their news from TV likely won't hear anything about all this; if they do, their eyes will glaze over as they don't have a clue how encryption works, or why it's important. Or, it will just vanish in the news cycle and they never think about it again. Edit: It also seems to me that most people just aren't going to care unless it directly affects them, at which time it's already far too late.
  - soundwave106 10y ago
    If this is implemented, it's going to be fun the day that someone from the government gets hacked and compromised via the very same security weaknesses they ordered.
1_2__3 10y ago
I feel like the UK is showing us what happens when the western world enters the information age without the protections and focus on individual freedoms some other countries have (not just the US, although of course they're high on the list). In many ways we're seeing history play out all over again - new, disruptive thing shows up, governments wet themselves in terror, and try to control it. The difference is what happens now; in the US this tends (excluding drugs) to lead slowly towards a more nuanced position where the reigns are gradually loosened. In the UK that seems to never happen, the arrow of control and government intrusion only ever points in one direction. It's very puzzling; I'm not sure what the source of it is but I think it's going to be a serious issue in the future. Specifically as the rest of the world forges ahead, either through the evolving view of attempting to control of the uncontrollable, or through sheer lawlessness in other countries where the control is never in place. In the middle will be the UK, clinging desperately to the belief that (as someone else in the thread put it) they can hold back the tide.
martiuk 10y ago
"but paedos and terrorists!!!!" Welcome to any debate RE: technology and privacy.

zeveb 10y ago

> 'If we do not provide for access to encrypted communications when it is necessary and proportionate to do so then we must simply accept that there can be areas online beyond the reach of the law.' Yes, yes we must accept that, since it's reality. Queen Elizabeth can no more hold back encrypted communications than King Canute could hold back the tide.

golemotron 10y ago
It's a re-balancing. Before electronic bugs every park and pub had conversations that were completely beyond the reach of the law. And that's ok. We used to call that liberty.
Zigurd 10y ago
Even here you see people who harbor the delusion that governments are all-powerful, ignoring the fact that if they employed mind-readers, or, for that matter "polygraphers," they would be an unscientific fraud and no amount of law could change that.

saulrh 10y ago

> “Doors are now almost ubiquitous and are the default for most houses and buildings. If we do not provide for access to people's bathrooms when it is necessary and proportionate to do so then we must simply accept that there can be rooms beyond the reach of the law,” There are well-established and functional methods for extending law into areas that you can't see all the time. You don't need to ban encryption, in exactly the same way that you don't have to ban doors. Just because it's ooon the iiiinterneeettttt doesn't mean you need to break everything.

themartorana 10y ago
Or how you don't have to ban virus scanners on Windows just in case UK spooks want to run a virus on your computer because no safe spaces for terrorists.
logfromblammo 10y ago
The state's enforcers do not fear doors, because they have boots for kicking, and stout legs to fill them. Even the heavier doors can be breached by prybar, ram, cutting torch, or explosive. But when your bathroom door is protected by 256-bit encryption, the peace of your metaphorical deuce-dropping is (statistically) guaranteed until such time as the sun leaves the main sequence and devours the Earth. The states conveniently ignore that kicking down a toilet door to pick through someone's poo and count the peanuts is not generally beneficial to anyone's security, especially when holding out a net under the appropriate sewer pipe could usually achieve the same results with less public outrage. In any case, those with truly incriminating poo-peanuts will likely burn them, or head off into the woods with a trowel, and your toilet raids will only end up menacing those who linger too long in the stall, solving sudoku puzzles or practicing toilet-square origami, or whatnot.
- saulrh 10y ago
  Exactly my point. Just like you don't mount cameras in everybody's bathrooms, you don't outlaw encryption. Instead, you install spy software on your target's computer, or you plant a bug in their light fixture, or subpoena Facebook to see if they ever messed up and said anything unencrypted. You can still find things out even if someone is being serious and uses end-to-end encryption, just like you can still find things out even if someone is being serious and burns their incriminating poo-peanuts.

sklivvz1971 10y ago

It's such a pointless war on its own law-abiding citizens. It makes me sad. People that really care about privacy, people who need to hide what they do will not be majorly impacted. * The main threat is metadata anyways, not the data itself. Locating where you are (e.g. with millions of cameras and facial recognition) is a much worse threat. * They will still use full disk encryption, free software, PGP or AES, etc. outside of the affected apps. That software won't stop to exist, nor the mathematics that powers it will stop working. The sad part is that the people who will be disproportionally affected will be the common people who have nothing to hide anyways, and do not have the technical means, or the will, to protect themselves. TLDR: useless and damaging.

watbe 10y ago
It provides a sort of scapegoat for attacks. The government can't be seen as doing nothing against the threat of terrorism, so when the adversary uses encryption to cover their tracks, the government can point and say 'we did our best to outlaw their method of communication'.
- arethuza 10y ago
  The "Politician's syllogism": We must do something This is something Therefore, we must do this.
- huherto 10y ago
  It must be this. Even politicians will be greatly impacted. Since anything can be used against them. Even the most innocent text message if leaked. And none of them is guaranteed to have control over it.
  - type0 10y ago
    That's why they will probably pass exception laws that allow political elites to use encryption and the tyranny will be inevitable.
vidarh 10y ago

wheaties 10y ago

If I want to keep my communications encrypted online, I'm going to do so. The only people who won't have the same luxury as me are those that follow the law. I don't get it.

superuser2 10y ago
If encrypted communications are illegal, then anyone using them is an automatic target for investigation and the encryption itself may be probable cause to open up their lives and property. It's considerably more difficult to conceal the fact of encryption on the wire than (say) a gun in your home.
- tomjen3 10y ago
  Ciphertext is supposed to be impossible to distinquis from random noise, so how are they going to prove I am not just sending random noise, with a PGP header? As for asking why I would do such a thing? I think the law is wrong and want to make the court waste their time.
  - bitwize 10y ago
    No one would actually send random noise as a message, so the law would assume that comnunications which look like random noise are, prima facie, encrypted comms and something the police have a right to see in cleartext.
    - logfromblammo 10y ago
      The folks at https://www.random.org/ https://www.random.org/ and similar true-randomness providers would beg to differ. They do, in fact, have a paid service to deliver what appears to be random noise as a message, then store that noise in their archive for subsequent re-verification. I recall seeing videos of lava lamps and handfuls of d6 dice on a vibrating table, broadcast live over the internet, purely for their utility as potential sources for truly random numbers. I can easily see a case for sending randomness in a client-server game with protections against cheating and bandwidth restrictions. The randomness server sends the same chunk of noise to game client and game server, and the game client sends user commands to the game server. As long as the user isn't cheating, the official server copy of the game state and the client copy remain in sync.

themartorana 10y ago

"...there should be no safe spaces..." Got it.

mankash666 10y ago

If the laws are this regressive and encompassing, the very least we as citizens can do is to lobby for full transparency in requests - after all the data belongs to the individual (regardless of what the TOS claims) and the individual deserves to know about requests on his data immediately.

pre 10y ago

So, how are companies supposed to keep customer data safe from hackers without encryption exactly? This kind of thing can only make the people of the UK less safe, more at risk, and more likely to be hacked and otherwise digitally abused. If you wanna keep the people safe, you don't ban encryption. Better would be to mandate it.

CiPHPerCoder 10y ago

Dear UK government, Good luck with that. Signed, An open source software developer outside your jurisdiction

Spivak 10y ago
I mean they're just going to fine/jail anyone within their jurisdiction that uses your software. Pretending that you can't ban encryption because you can't eliminate its availability is silly. This is a political problem that must have a political solution.
- CiPHPerCoder 10y ago
  The only effective political solution is to get the common person in on using end-to-end encryption so its ban becomes unpopular.

tetrep 10y ago

I think this same logic that is purportedly the reasoning behind this bill would also require us to constantly record all of our vocal communications, as that would be the only way we could ensure that criminals could not have communications that aren't accessible to law enforcement. This, of course, would require microphones on all citizens as well as many more in the surrounding environment, to ensure communications of unwilling citizens can be monitored as well. And, of course, we'd need video as well to get those pesky sign language users[0]. These sort of bills always make me wonder if we'll ever see a moral stance taken by tech companies. There's a few skirmishes that happen every now and then but there doesn't seem to be any general consensus on what companies will tolerate in both themselves and their business partners. I'd love to see a "Fair Trade"-esque branding used as an indication that the product and its supply chain don't include actors who support government surveillance. [0]: OT, but it makes me realize you can literally make illegal gestures due to https://en.wikipedia.org/wiki/Hate_speech_laws_in_the_United_Kingdom https://en.wikipedia.org/wiki/Hate_speech_laws_in_the_United...

geggam 10y ago
Most citizens carry said microphones complete with GPS and other tracking abilities... already
- LinuxBender 10y ago
  I agree with you. Every time I bring that up, I get down-voted due to the cognitive dissonance that folks have with their fondle-slabs. Now people are being conditioned to think it's normal for their microphone to always be on.
  - shostack 10y ago
    Are there any good low-tech ways to disable them similar to tape over the camera? Not sure if tape alone would be sufficient to block audio.
    - hx87 10y ago

reacharavindh 10y ago

It is to an extent funny to think that governments think they can sit on top of communications and implement mass surveillance. If you make it illegal to encrypt your stuff, the knowledged/tech savvy people will start to work on using steganography. There will be an explosion of cat pictures in the Internet. Good luck finding the hideous cat :-) All the government does now is inconvenience to the majority of citizens who they have nothing to worry about anyway.

brador 10y ago

When does something become encryption? Say I switch t and r in evetyrhing I rype, is that encryption? No? Then at what point of mixing does it all become encryption?

dvtv75 10y ago
I would guess the point at which they say it does.

deleted 10y ago

[deleted]

3v3rt 10y ago

Interesting to see that at the same time the EU privacy watch dog is proposing to mandate encryption and outlaw these kind of decryption methodologies[0]. While still an opinion, it is good to see that in this area the EU is among the most progressive governments around. [0] https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2016/16-07-22_Opinion_ePrivacy_EN.pdf https://secure.edps.europa.eu/EDPSWEB/webdav/site/mySite/sha...

mark_l_watson 10y ago
Interesting indeed. I thought it peculiar that the UK government released the Tony Blair report just before the BRexit vote. That report certainly got many people riled up about the 'establishment' and possibly could have changed the BRexit voting result. My point is that if the UK had stayed in the EU then the UK surveillance bill might have been dead in the water because it might have comflicted with EU law.
- Zenst 10y ago
  The EU referendum was on the 23rd June 2016 and the Chilcot report (as it is known formerly) was released 6th of July 2016. So those facts aside your point, do you have any conflicting EU laws in mind? I ask as currently the UK has not left and then looking at 2 years notice so any new UK law coming into play for years (due to the time to formulate them), will be complying within current EU laws and regulations. TL;DR No and no. But I respect the premise.
  - mark_l_watson 10y ago
    Thank you for the correction! I have made this cement to some friends, so I will let them know I was wrong.

thenewregiment 10y ago

Why not just mimic V for Vendetta

SeanDav 10y ago

I am surprised they did not add the line "think of the children" in there somewhere... Meanwhile in the real world, criminals will resort to sending encrypted USB sticks via post, or carrier pigeons, or implanted in mules. There is always a way around these things for those that absolutely do not want their communications compromised. It is safe to say that any criminal enterprise knows that live electronic communication of any sort is likely to be compromised. Also of concern, is that criminals will now have extra attack vectors to sensitive data, because if encryption has to be weakened for Government, it will be easier for other parties to exploit.

DanBC 10y ago

This is a fairly obvious sacrificial anode bit of the legislation. They'll drop this, while making the "provide the keys" bit of RIPA stronger.

49para 10y ago

What possibly can they do with all this data ? It seems that current governments can't seem to solve the drug war, the war on terror, gun crime, or the increasing number of terrorist attacks. How much intrusion do they actually need and what is the cost of the technology before they can actually seem to make headway on solving issues.

lb1lf 10y ago

This belief that you can somehow force the strong encryption genie back in his bottle is fascinating, if sad. I guess it is not as futile as it may appear at first glance, though - after all, you don't need all the world's suppliers of communication software to adhere to be successful; just force the major ones to help you out, then simply assume that anyone using an insignificant (by user base) app is up to something nefarious. Bah. Orwell was an optimist.

cloudjacker 10y ago

If UK finishes leaving the EU, they will just be excluded from the market given their diminished relevance. Are sure given the power vacuum in tech, I'll release a gimped software product for their citizens. $£$£$£$£$£$£$£$£$£

LinuxBender 10y ago

Two can play at this game. Surely folks here at HN can create something that is not technically or legally encryption, but accomplishes the same goal.

pferde 10y ago
...until it gets legally declared as encryption as well.
- LinuxBender 10y ago
  Fair enough. Maybe it's like an arms race, or a shell game. but you are probably right.

0xmohit 10y ago

"The Lives of Others" [0] [0] https://en.wikipedia.org/wiki/The_Lives_of_Others https://en.wikipedia.org/wiki/The_Lives_of_Others

JustSomeNobody 10y ago

Anyone hell bent on killing people will likely succeed. Surveillance is not the answer. Too much data is just as bad as not enough. The solution is finding out WHY people want to kill you and fix THAT.

inetsee 10y ago

I can't help but wonder how this bill, on top of Brexit, will affect the state of technology entrepreneurship in the UK. Why should an entrepreneur start up a technology business in the UK if his efforts will be hampered by politicians who have no clue about how technology actually works?

carterehsmith 10y ago
Rest assured that there are people working for the government that know more about encryption then you or I or 5,000 entrepreneurs. For example, GCHQ came up with PKI before the people that "invented" PKI and published it.
- inetsee 10y ago
  I have no doubt that the people working for GCQH know as much as anybody about encryption. The question is, are they smart enough to convince buyers that encryption with backdoors is secure against hackers. Because if buyers don't believe encryption with backdoors is secure, they won't buy it. If the buyers won't buy it, it's going to be very hard for entrepreneurs to succeed in selling it.

hardlianotion 10y ago

Just another little reminder that you must never confuse the government's interests with your own.

beedogs 10y ago

Will the last tech company to leave the UK please turn off the lights?

austinjp 10y ago

It's time to call this stuff out for what it is: flat out idiocy or lies. Possibly both. Here's a brief thought to uncover why: There are two countries. Country A has security capabilities equivalent to today's UK. Country B, equivalent to today's UK plus the proposed changes. Could maniacs based in country B commit attacks of equivalent fatality to maniacs based in country A? Of course they could. Could a criminal gang in country B get away with crimes of similar magnitude to a similar gang in country A? Of course they could. Other threads here have pointed out the minimal extra effort that would be required by perpetrators, if any. So why propose these changes, and why give the stated reasons? Perhaps the government doesn't understand the negligible impact they'll have. This seems unlikely, although perhaps they "can't see the wood for the trees" and are getting carried away with the current xenophobic mood in the air. Perhaps the government is showing its true colours and exercising the basic Conservative desire to deny societal evolution, by tightening control over anything new and complex. Perhaps they've had a good hard think to the best of their abilities, and have genuinely decided this is The Best Thing To Do. Whatever the reason, it's either founded on idiocy or couched in lies.

petre 10y ago

If privacy is outlawed, only outlaws will have privacy. They created terrorism in the first place by bombing and occupying other countries, removing dictators.

known 10y ago

Govt should limit end-to-end encryption AFTER open sourcing all their software;