8 ms·

The logical end point, if you think it through, is scary for technology. There will be a battle for a time where legislators play cat and mouse with technology

by zmmmmm 10y ago

The logical end point, if you think it through, is scary for technology. There will be a battle for a time where legislators play cat and mouse with technology and privacy companies. But as each new hole appears, they'll invent new laws to close them off. This wouldn't be so bad except for the problem that encryption is math and short of making math illegal there will always be a hole. Factor in steganography and it just gets worse. But this doesn't mean that technology wins. Rather, it makes the loss even worse, because it means the laws will ultimately have to be defined in reverse - rather than outlawing encryption, they will have to outlaw inability to decrypt. That is, it will be the end user's responsibility to ensure that authorities can decode data you transmit. Transmission of undecryptable data will be a crime, in and of itself. Apart from the obvious dystopian consequences, this will impact progress in technology tremendously - suddenly it won't be possible to just invent a new data format or protocol any more. Doing so will put you at extreme risk of being interpreted as sending unauthorised encrypted data. So data formats will have to be registered - to send data in a new format you will first have to register a codec with the government and probably yourself have to be licensed. This will have a severe chilling effect on innovation. Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. It's a depressing picture but given the trends of late I don't really see it going any other way. Only some extreme swing back towards individual rights over rights of the state will change its direction. But terrorism seems to have set in as a permanent tool for governments to grind away at individual rights.

SomeStupidPoint 10y ago
The US has at least one mechanism against that: the first amendment. Content and format are both matters of speech, so the choice of format and the decision to broadcast noise as a statement are both protected. I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.
- jasonkostempski 10y ago
  I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.
  - terravion 10y ago
    This! And talk to your representative / MP / whatever and tell them how important this is. Often they just don't know and they hear <SCARY THINGS> from people who have control+profit based agendas.
- kabdib 10y ago
  > the first amendment It took great effort to get crypto even recognized under the first amendment -- the USGov kept insisting that source code was not speech. In the 1990s it was against the law to let foreign nationals have access to the source code to DES. If you had folks from overseas in your organization, technically you couldn't let them see the source for crypto in your product (e.g., you had to wall off pieces of your repositories, and many companies did). We could see a return to this. Don't take it for granted.
  - athenot 10y ago
    This can be partially fixed by printing the code on a tshirt. https://www.wired.com/2000/08/court-to-address-decss-t-shirt/ https://www.wired.com/2000/08/court-to-address-decss-t-shirt...
    - kabdib 10y ago
      Or by printing it in a book. There's LOTS of reluctance to ban actual, physical books in the US (and plenty of reasons that any ban would be struck down). That said, up to the mid 90s it was theoretically against the law to show a foreign national a printed-out copy of DES. Crazy. I think it was published in magazines . . .
drbw 10y ago
> they will have to outlaw inability to decrypt. The UK's already done that - the Regulation of Investigatory Powers Act 2000 already made it an offence not to divulge encryption keys when asked. [1] 1 https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...
- zmmmmm 10y ago
  Yes, that's a step towards it. But at least the person has to be a "suspect" in another crime (however low the bar for that is) and an explicit demand has to be made for the key. Not that it does a lot of good since anybody can become a suspect and the demand for the key is retrospective to when you weren't a suspect.
  - mcherm 10y ago
    I really don't think that having to be a suspect is in ANY way meaningful, since there is absolutely no bar to being a suspect. It is perfectly reasonable to state "we have no idea who did this so every UK resident is a possible suspect".
  - anexprogrammer 10y ago
    https://www.youtube.com/watch?v=BO8EpfyCG2Y https://www.youtube.com/watch?v=BO8EpfyCG2Y (Constable Savage) Suspect of being Muslim, wearing a beard and using an ISP that the public hasn't heard of that isn't price competitive is more than enough for a media hatchet job. How low does the bar have to be? This should be the preserve of Uganda and N Korea.
marcosdumay 10y ago
There's stuff there about cryptography too, but the logging is about metadata. For metadata things are the opposite of your logic. It is always accessible. Whatever protocol you create to hide it, will have holes; Math dictates it.
- ronald_raygun 10y ago
  Is that true though? I thought the point of protocols like Tor was that it makes gathering the metadata very very expensive.
  - marcosdumay 10y ago
    Yes, expensive. That means it's perfectly doable (and was already done a few times).
7952 10y ago
Do you think that browser makers could come under attack? Will Chrome and Firefox be required to add back doors to their "service".
- pjc50 10y ago
  I don't think that there's any public actor you can say is definitely not at risk of attack. Edit: this is probably a good opportunity to remind people to donate to the Open Rights Group, who are the UK counterpart to the EFF and already actively opposing this and other bad laws.
- zmmmmm 10y ago
  I'm sure they will, but it's too easily answerable - open source browsers without the back doors will be trivial for end users to build. So again, it'll come back to criminalising what end users do, because in the end only restrictions on the end user can stop them using their own resources to build things.
- gcp 10y ago
  Historically browsers for distribution outside the USA were required to be limited to 40-bit crypto. "(About Netscape) The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0). Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version, whose weak 40-bit encryption could be broken in a matter of days using a single personal computer." (Wikipedia - https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...) In fact, strong crypto was only allowed in 2000. Only 16 years ago!
jasonkostempski 10y ago
This may be a stupid question but I've got to ask because I'm not 100% sure. Is there no practical way data can be sent and received anonymously? If no one, except the people trying to communicate, knows who encrypted or decrypted anything, how could they enforce such a law? Since a well encrypted message should be safe to broadcast, it can be sent to the whole world with only the intended recipients being able to decrypt it. Even if it's inconvenient to coordinate such a thing, I'm sure the perverts and terrorists would deal with it if they had to.
- sdenton4 10y ago
  Once upon a time, we imagined a cypherpunk future, where speech was free and the internet was the great frontier of autonomous anonymity. It turns out, though, that we leave fingerprints on everything we touch. And many of the conveniences and indeed basic user experience we've come to expect leave plenty of markers of who we are for anyone who might be listening. This makes it easy for hacker news to remember who I am, and easy for advertisers to target ads, and governments to track individuals. So yeah, tools exist, sort of, but require a lot of inconvenience. We've seen instances of ISPs inserting their own cookies on headers of outgoing customer traffic, meaning there are still times when your precautions don't matter at all. When I've thought about totally anonymous internet usage, my guess is that you need to go buy a fresh laptop with cash, and then only use it on large public networks, with good encryption...
- digler999 10y ago
  because when you send messages, they go from your computer to your ISP, then to the internet. so anyone watching you at the ISP level sees you sent something. Then, it depends where you sent it. Email goes to one person, so receipt of the message is seen on their ISP's side. Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files. In order for the receiver to find what they wanted, they would have to browse the public folder to find what they needed, and this act of browsing strips the anonymity away. The other problem is that you have to exchange the decryption keys with the person you intend to communicate with. You either need to physically give/mail them to the recipient (loss of anonymity in the case of mail), or else you need to exchange them electronically, which usually requires an A<->B exchange, or you can post your public key and let the recipient find it. Basically, if you are a government watching all the communication from above, you can usually tell what path information takes, even if its posted publicly.
pjc50 10y ago
There was a round of this fought in the US over the "clipper chip" technology in the 90s. I've been wondering about the interaction of technologies like this with DRM technologies; what if I send HDCP-over-TCP? What if ISIS start using Macrovision on their jihadi videos?
CoryG89 10y ago
> Transmission of undecryptable data will be a crime, in and of itself. I agree with you, but I am a bit afraid you are giving them ideas. >.>
digler999 10y ago
> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. It might sound OT to bring up TPP in a discussion like this, but please hear me out: It's important to block broad international agreements like TPP because it creates competition among nations that would protect us from the dystopia you describe. Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. Which would cause larger nations to think twice before their valued tech talent packs up and moves to escape their surveillance state. I know not everyone can pack up and go, but the competition and fear of just how many might leave would be enough to keep even rich nations in check. But if something like TPP goes though, they can point to all its provisions and say "boo hoo, you're shitting on trade deals by allowing encryption, now we're going to bully your whole nation with economic sanctions"
- anigbrowl 10y ago
  Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. It could, but it probably won't, because hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing...and I say that as someone who has moved internationally 6 times. Look, your argument is fundamentally weak - we can generalize and say big countries are bad because it eliminates competition between smaller jurisdictions, therefore federalism is bad. And indeed, the notion that federalism is bad (or at least damn risky) is partly why the USA has ~3000 county governments despite the manifest inefficiency involved. Your error is in assuming that competition is always beneficial. As we can see in the US, counties and states frequently pass laws that reduce rather than enhance freedom. So while I wouldn't want you to construe this as an endorsement of the TPP in particular, I reject your claim that any kind of trade agreement is necessarily destructive of freedom. Besides, your notion of comeptition as unalloyed good is easy enough to subvert. Uruguay sets up the world's freest internet? Denounce Uruguay as a haven for cyber-criminals and impose penalties on unverified connections from there. Despite the fact that it makes the digiterati uncomfortable, things like child porn and terrorism are genuine problems that impact the lives of real people when allowed to operate unchecked. This isn't a 'think of the children' argument; I personally know people who were trafficked for sex and child porn as small children and who suffer from serious dysfunction as adults because of this. Their liberty and safety shouldn't be considered acceptable sacrifices on the altar of your liberty and safety; there are valid reasons to delegitimize some kinds of commercial traffic.
tn13 10y ago
> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. I think what will prevent the above from happening is inability of government to enforce laws on the books, people disregard for those laws and the fact that technology experiments are often positive sums games where Google, Microsoft and Oracle stand to lose more by blocking entry to small players through regulatory mechanisms. If we look at the majority of tech law suites we can easily observe that there is no clear winner and either parties seem to have achieved only small term gains. But I most certainly see that government will successfully kill innovation when it comes to heavily regulated industries such as education, drugs, medicine and biotech.

by zmmmmm 10y ago

SomeStupidPoint 10y ago

The US has at least one mechanism against that: the first amendment. Content and format are both matters of speech, so the choice of format and the decision to broadcast noise as a statement are both protected. I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.

jasonkostempski 10y ago
I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.
- terravion 10y ago
  This! And talk to your representative / MP / whatever and tell them how important this is. Often they just don't know and they hear <SCARY THINGS> from people who have control+profit based agendas.
kabdib 10y ago
> the first amendment It took great effort to get crypto even recognized under the first amendment -- the USGov kept insisting that source code was not speech. In the 1990s it was against the law to let foreign nationals have access to the source code to DES. If you had folks from overseas in your organization, technically you couldn't let them see the source for crypto in your product (e.g., you had to wall off pieces of your repositories, and many companies did). We could see a return to this. Don't take it for granted.
- athenot 10y ago
  This can be partially fixed by printing the code on a tshirt. https://www.wired.com/2000/08/court-to-address-decss-t-shirt/ https://www.wired.com/2000/08/court-to-address-decss-t-shirt...
  - kabdib 10y ago
    Or by printing it in a book. There's LOTS of reluctance to ban actual, physical books in the US (and plenty of reasons that any ban would be struck down). That said, up to the mid 90s it was theoretically against the law to show a foreign national a printed-out copy of DES. Crazy. I think it was published in magazines . . .

drbw 10y ago

> they will have to outlaw inability to decrypt. The UK's already done that - the Regulation of Investigatory Powers Act 2000 already made it an offence not to divulge encryption keys when asked. [1] 1 https://wiki.openrightsgroup.org/wiki/Regulation_of_Investigatory_Powers_Act_2000/Part_III https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

zmmmmm 10y ago
Yes, that's a step towards it. But at least the person has to be a "suspect" in another crime (however low the bar for that is) and an explicit demand has to be made for the key. Not that it does a lot of good since anybody can become a suspect and the demand for the key is retrospective to when you weren't a suspect.
- mcherm 10y ago
  I really don't think that having to be a suspect is in ANY way meaningful, since there is absolutely no bar to being a suspect. It is perfectly reasonable to state "we have no idea who did this so every UK resident is a possible suspect".
- anexprogrammer 10y ago
  https://www.youtube.com/watch?v=BO8EpfyCG2Y https://www.youtube.com/watch?v=BO8EpfyCG2Y (Constable Savage) Suspect of being Muslim, wearing a beard and using an ISP that the public hasn't heard of that isn't price competitive is more than enough for a media hatchet job. How low does the bar have to be? This should be the preserve of Uganda and N Korea.

marcosdumay 10y ago

There's stuff there about cryptography too, but the logging is about metadata. For metadata things are the opposite of your logic. It is always accessible. Whatever protocol you create to hide it, will have holes; Math dictates it.

ronald_raygun 10y ago
Is that true though? I thought the point of protocols like Tor was that it makes gathering the metadata very very expensive.
- marcosdumay 10y ago
  Yes, expensive. That means it's perfectly doable (and was already done a few times).

7952 10y ago

Do you think that browser makers could come under attack? Will Chrome and Firefox be required to add back doors to their "service".

pjc50 10y ago
I don't think that there's any public actor you can say is definitely not at risk of attack. Edit: this is probably a good opportunity to remind people to donate to the Open Rights Group, who are the UK counterpart to the EFF and already actively opposing this and other bad laws.
zmmmmm 10y ago
I'm sure they will, but it's too easily answerable - open source browsers without the back doors will be trivial for end users to build. So again, it'll come back to criminalising what end users do, because in the end only restrictions on the end user can stop them using their own resources to build things.
gcp 10y ago
Historically browsers for distribution outside the USA were required to be limited to 40-bit crypto. "(About Netscape) The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0). Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version, whose weak 40-bit encryption could be broken in a matter of days using a single personal computer." (Wikipedia - https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...) In fact, strong crypto was only allowed in 2000. Only 16 years ago!

jasonkostempski 10y ago

This may be a stupid question but I've got to ask because I'm not 100% sure. Is there no practical way data can be sent and received anonymously? If no one, except the people trying to communicate, knows who encrypted or decrypted anything, how could they enforce such a law? Since a well encrypted message should be safe to broadcast, it can be sent to the whole world with only the intended recipients being able to decrypt it. Even if it's inconvenient to coordinate such a thing, I'm sure the perverts and terrorists would deal with it if they had to.

sdenton4 10y ago
Once upon a time, we imagined a cypherpunk future, where speech was free and the internet was the great frontier of autonomous anonymity. It turns out, though, that we leave fingerprints on everything we touch. And many of the conveniences and indeed basic user experience we've come to expect leave plenty of markers of who we are for anyone who might be listening. This makes it easy for hacker news to remember who I am, and easy for advertisers to target ads, and governments to track individuals. So yeah, tools exist, sort of, but require a lot of inconvenience. We've seen instances of ISPs inserting their own cookies on headers of outgoing customer traffic, meaning there are still times when your precautions don't matter at all. When I've thought about totally anonymous internet usage, my guess is that you need to go buy a fresh laptop with cash, and then only use it on large public networks, with good encryption...
digler999 10y ago
because when you send messages, they go from your computer to your ISP, then to the internet. so anyone watching you at the ISP level sees you sent something. Then, it depends where you sent it. Email goes to one person, so receipt of the message is seen on their ISP's side. Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files. In order for the receiver to find what they wanted, they would have to browse the public folder to find what they needed, and this act of browsing strips the anonymity away. The other problem is that you have to exchange the decryption keys with the person you intend to communicate with. You either need to physically give/mail them to the recipient (loss of anonymity in the case of mail), or else you need to exchange them electronically, which usually requires an A<->B exchange, or you can post your public key and let the recipient find it. Basically, if you are a government watching all the communication from above, you can usually tell what path information takes, even if its posted publicly.

pjc50 10y ago

There was a round of this fought in the US over the "clipper chip" technology in the 90s. I've been wondering about the interaction of technologies like this with DRM technologies; what if I send HDCP-over-TCP? What if ISIS start using Macrovision on their jihadi videos?

CoryG89 10y ago

> Transmission of undecryptable data will be a crime, in and of itself. I agree with you, but I am a bit afraid you are giving them ideas. >.>

digler999 10y ago

> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. It might sound OT to bring up TPP in a discussion like this, but please hear me out: It's important to block broad international agreements like TPP because it creates competition among nations that would protect us from the dystopia you describe. Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. Which would cause larger nations to think twice before their valued tech talent packs up and moves to escape their surveillance state. I know not everyone can pack up and go, but the competition and fear of just how many might leave would be enough to keep even rich nations in check. But if something like TPP goes though, they can point to all its provisions and say "boo hoo, you're shitting on trade deals by allowing encryption, now we're going to bully your whole nation with economic sanctions"

anigbrowl 10y ago
Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. It could, but it probably won't, because hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing...and I say that as someone who has moved internationally 6 times. Look, your argument is fundamentally weak - we can generalize and say big countries are bad because it eliminates competition between smaller jurisdictions, therefore federalism is bad. And indeed, the notion that federalism is bad (or at least damn risky) is partly why the USA has ~3000 county governments despite the manifest inefficiency involved. Your error is in assuming that competition is always beneficial. As we can see in the US, counties and states frequently pass laws that reduce rather than enhance freedom. So while I wouldn't want you to construe this as an endorsement of the TPP in particular, I reject your claim that any kind of trade agreement is necessarily destructive of freedom. Besides, your notion of comeptition as unalloyed good is easy enough to subvert. Uruguay sets up the world's freest internet? Denounce Uruguay as a haven for cyber-criminals and impose penalties on unverified connections from there. Despite the fact that it makes the digiterati uncomfortable, things like child porn and terrorism are genuine problems that impact the lives of real people when allowed to operate unchecked. This isn't a 'think of the children' argument; I personally know people who were trafficked for sex and child porn as small children and who suffer from serious dysfunction as adults because of this. Their liberty and safety shouldn't be considered acceptable sacrifices on the altar of your liberty and safety; there are valid reasons to delegitimize some kinds of commercial traffic.

tn13 10y ago

> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high. I think what will prevent the above from happening is inability of government to enforce laws on the books, people disregard for those laws and the fact that technology experiments are often positive sums games where Google, Microsoft and Oracle stand to lose more by blocking entry to small players through regulatory mechanisms. If we look at the majority of tech law suites we can easily observe that there is no clear winner and either parties seem to have achieved only small term gains. But I most certainly see that government will successfully kill innovation when it comes to heavily regulated industries such as education, drugs, medicine and biotech.