6 ms·

Amber Rudd is the UK's Home Secretary not just any minister. "We need to make sure that our intelligence services have the ability to get into situations like

by mattbee 10y ago

Amber Rudd is the UK's Home Secretary not just any minister. "We need to make sure that our intelligence services have the ability to get into situations like encrypted Whatsapp." She has said she is "calling in" technology companies this week to try to "deliver a solution". Marr asks if they refuse to do that, will you legislate to force them to change? She's not drawn on that. Interview is here: http://www.bbc.co.uk/iplayer/episode/b08l62r7/the-andrew-marr-show-26032017 http://www.bbc.co.uk/iplayer/episode/b08l62r7/the-andrew-mar... [from 45:18] I understood that UK IP Bill already mean that she already has the ability to e.g. demand a backdoored version of Whatsapp be sent to a target device, but that's not covered in the interview. https://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/ https://www.theregister.co.uk/2016/11/30/investigatory_power...

Symbiote 10y ago
From [1], linked elsewhere in this discussion, and referring to a failed plot in India: "The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Mr. Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork." "the handler taught Mr. Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive." Even if the British government is successful with WhatsApp, can they do much against free, open source tools? [1] https://www.nytimes.com/2017/02/04/world/asia/isis-messaging-app-terror-plot.html?_r=0 https://www.nytimes.com/2017/02/04/world/asia/isis-messaging...
- zzzcpan 10y ago
  "Even if the British government is successful with WhatsApp, can they do much against free, open source tools?" Why would they care about open source tools and niche use of encryption? Of course they don't. They are after mass surveillance and use fear of terrorism to push for it. It's very logical of them.
  - dawnerd 10y ago
    I feel countries will ultimately make it a crime to use any non approved encryption.
    - Stranger43 10y ago
      The UK actually tried to enforce key escrow as far back and 1999(http://www.cyber-rights.org/crypto/ukpolicy.htm http://www.cyber-rights.org/crypto/ukpolicy.htm). But backed down due to conflicts with EU law. It's not entirely by accident that the UK current ramp up of legalized government surveillance coincide with Brexit, as the UK doesn't actually have a democratic constitution limiting government surveillance outside of the ECHR treaty they signed as a prerequisite for joining the EU/EEC.
      - stordoff 10y ago
        > ECHR treaty they signed as a prerequisite for joining the EU/EEC The UK signed the ECHR in 1950 (and were involved in writing it); the EEC did not exist until 1957.
        Stranger43 10y ago
        thanks for correcting my sometimes failing memory though the reality is more complex then that everything ECHR related was defined by 1950, as the active component of the ECHR did not come into existence until 1959 and was not acknowledged as superior court by the UK prior to the UK joining the EU. The court http://www.coe.int/t/democracy/migration/bodies/echr_en.asp http://www.coe.int/t/democracy/migration/bodies/echr_en.asp is what makes the ECHR significantly more effective then the unenforceable UN Declaration of Human Rights signed in 1948 only came into effect in 1859 and was only explicitly acknowledged as superior in British law with the still controversial Human rights act of 1998 https://www.supremecourt.uk/about/the-supreme-court-and-europe.html https://www.supremecourt.uk/about/the-supreme-court-and-euro.... The fact that EU membership demand actual rather then pretend ECHR compliance is a fairly big deal in the anti-EU Tory circles currently running the show in the UK and some of them seem to presume that leaving the EU will absolve the UK of any duty to submit to the ECHR court http://www.telegraph.co.uk/news/2017/01/26/theresa-may-preparing-abandon-plans-british-bill-rights-sources/ http://www.telegraph.co.uk/news/2017/01/26/theresa-may-prepa... even though I am sure they think otherwise in Strasbourg. but you are correct in stating that officially the ECHR came into dejura effect in 1950 under the Council of Europe where the UK unlike for the ECSC(1951) and the EEC(1957) was a founding member, but it's worth nothing here that the Council of Europe is a far more toothless organization(like the UN) then either the ECSC and the EEC. Edit: fixed links
- leggomylibro 10y ago
  That's the beauty of it; even with their more restrictive measures and massively increased surveillance, they won't make a significant dent in these sorts of attacks. So they'll never run out of reasons to push further. Hooray.
NetStrikeForce 10y ago
UK's best shot at surviving Brexit is become stronger on value added industries. They have a very good head start over any other EU country in IT and in some research areas. Amber Rudd seems hell bent on destroying their only chance.
- prodmerc 10y ago
  They all are intent on crippling any chance the UK has at becoming stronger in high tech industries. I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information about a drug (pharmaceutical, not just "weed LSD and lols"). Great fucking way to encourage your future chemists. Maybe ban keywords like JavaScript, PHP and SQL while at it, them's the powerful drugs maaan.
  - OJFord 10y ago
    > I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information Switch ISP, or contact your current one to disable this. They don't all do it by default, or at all.
    - jen20 10y ago
      As far as I'm aware all new accounts in the U.K. do this unless you call to have it disabled (and give personal information). I mean, how else would you protect the children...
      - deleted 10y ago
        [deleted]
      - IanCal 10y ago
        I think all mobile providers do, but the filters are not required on all ISPs, only the big 7 IIRC.
        timthorn 10y ago
FungalRaincloud 10y ago
The thing that concerns me about this perspective that everyday use of encryption is bad is that it makes no damn sense. Pandora's box is opened; if you force software solutions to backdoor their technology, someone will just step up who doesn't care about your laws. There are no global treaties on software development, and we aren't going to be signing any such thing any day soon. Even if we could force something like that down the throats of every country on Earth, the knowledge exists, and anyone can roll out their own solution with a high-school level understanding of the topic. It's absurd to think this can be resolved through legislation or cajoling companies into cooperation. But what really bothers me about this whole issue is that we already have laws in place that handle this situation, at least in the USA. In the USA, if you refuse to hand over an encryption key (or can't) and are being compelled to by a court, you can and will be held in contempt of court, and possibly convicted of destruction of evidence. The only thing that forcing people to backdoor their crypto does is allow government entities to investigate people without having sufficient evidence to compel them to give up their keys, and destroy the marketability of large scale, centralized end-to-end encryption solutions. I mean, you could make the argument that end-to-end encryption restricts the ability to wiretap people, sure, but a wiretap warrant should require a decent amount of evidence, and at that point, there are most likely other options.
- sergior 10y ago
  People can simply send random binary data to keep authorities busy.
  - FungalRaincloud 10y ago
    That would be somewhat entertaining, and reminds me of someone I read about years ago who was accidentally added to a watchlist, and no one was willing to remove him, so he started generating as much data as he could, just to keep them busy. I can't find a link, sadly. I don't think it's a good solution, though. This is going to sound like an argument that you hear about privacy by people who don't understand why privacy matters, but I think on this issue, it holds a little more truth: To be honest, I think the people who are likely to care to do this are people who are advocates for privacy and are tech savvy, and people who have something to hide. I don't think it's terribly difficult, with the resources the global Intelligence Community has to build a profile and dump people into those two buckets with a fair degree of accuracy. Everyone who's not generating random garbage data would still be observable, so it wouldn't really change much outside of the group that's acting. But for those acting, suddenly there's a red flag that they can look for, and then when they see it, start building a profile to figure out if you're a tech person with an interest in privacy, or someone doing something they don't want seen, and act accordingly. In the mean time, we waste time generating garbage instead of just using good enough encryption, and making it so easy to use that people don't even have to know they're using it. Now, if we could somehow implant babies with a chip that causes them to generate random noise (something babies are already pretty good at, mind you) from birth, that might be worth something. There's no profile building if the noise is just something that humans make by being alive.
doctorshady 10y ago
I'm surprised I haven't heard the IP bill mentioned other than here in this whole matter. Why all the fanfare? Especially if it's something they can already just do quietly; the public controversy from that law has mostly passed over.

by mattbee 10y ago

Symbiote 10y ago

From [1], linked elsewhere in this discussion, and referring to a failed plot in India: "The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Mr. Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork." "the handler taught Mr. Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive." Even if the British government is successful with WhatsApp, can they do much against free, open source tools? [1] https://www.nytimes.com/2017/02/04/world/asia/isis-messaging-app-terror-plot.html?_r=0 https://www.nytimes.com/2017/02/04/world/asia/isis-messaging...

zzzcpan 10y ago
"Even if the British government is successful with WhatsApp, can they do much against free, open source tools?" Why would they care about open source tools and niche use of encryption? Of course they don't. They are after mass surveillance and use fear of terrorism to push for it. It's very logical of them.
- dawnerd 10y ago
  I feel countries will ultimately make it a crime to use any non approved encryption.
  - Stranger43 10y ago
    The UK actually tried to enforce key escrow as far back and 1999(http://www.cyber-rights.org/crypto/ukpolicy.htm http://www.cyber-rights.org/crypto/ukpolicy.htm). But backed down due to conflicts with EU law. It's not entirely by accident that the UK current ramp up of legalized government surveillance coincide with Brexit, as the UK doesn't actually have a democratic constitution limiting government surveillance outside of the ECHR treaty they signed as a prerequisite for joining the EU/EEC.
    - stordoff 10y ago
      > ECHR treaty they signed as a prerequisite for joining the EU/EEC The UK signed the ECHR in 1950 (and were involved in writing it); the EEC did not exist until 1957.
      - Stranger43 10y ago
        thanks for correcting my sometimes failing memory though the reality is more complex then that everything ECHR related was defined by 1950, as the active component of the ECHR did not come into existence until 1959 and was not acknowledged as superior court by the UK prior to the UK joining the EU. The court http://www.coe.int/t/democracy/migration/bodies/echr_en.asp http://www.coe.int/t/democracy/migration/bodies/echr_en.asp is what makes the ECHR significantly more effective then the unenforceable UN Declaration of Human Rights signed in 1948 only came into effect in 1859 and was only explicitly acknowledged as superior in British law with the still controversial Human rights act of 1998 https://www.supremecourt.uk/about/the-supreme-court-and-europe.html https://www.supremecourt.uk/about/the-supreme-court-and-euro.... The fact that EU membership demand actual rather then pretend ECHR compliance is a fairly big deal in the anti-EU Tory circles currently running the show in the UK and some of them seem to presume that leaving the EU will absolve the UK of any duty to submit to the ECHR court http://www.telegraph.co.uk/news/2017/01/26/theresa-may-preparing-abandon-plans-british-bill-rights-sources/ http://www.telegraph.co.uk/news/2017/01/26/theresa-may-prepa... even though I am sure they think otherwise in Strasbourg. but you are correct in stating that officially the ECHR came into dejura effect in 1950 under the Council of Europe where the UK unlike for the ECSC(1951) and the EEC(1957) was a founding member, but it's worth nothing here that the Council of Europe is a far more toothless organization(like the UN) then either the ECSC and the EEC. Edit: fixed links
leggomylibro 10y ago
That's the beauty of it; even with their more restrictive measures and massively increased surveillance, they won't make a significant dent in these sorts of attacks. So they'll never run out of reasons to push further. Hooray.

NetStrikeForce 10y ago

UK's best shot at surviving Brexit is become stronger on value added industries. They have a very good head start over any other EU country in IT and in some research areas. Amber Rudd seems hell bent on destroying their only chance.

prodmerc 10y ago
They all are intent on crippling any chance the UK has at becoming stronger in high tech industries. I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information about a drug (pharmaceutical, not just "weed LSD and lols"). Great fucking way to encourage your future chemists. Maybe ban keywords like JavaScript, PHP and SQL while at it, them's the powerful drugs maaan.
- OJFord 10y ago
  > I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information Switch ISP, or contact your current one to disable this. They don't all do it by default, or at all.
  - jen20 10y ago
    As far as I'm aware all new accounts in the U.K. do this unless you call to have it disabled (and give personal information). I mean, how else would you protect the children...
    - deleted 10y ago
      [deleted]
    - IanCal 10y ago
      I think all mobile providers do, but the filters are not required on all ISPs, only the big 7 IIRC.
      - timthorn 10y ago

FungalRaincloud 10y ago

The thing that concerns me about this perspective that everyday use of encryption is bad is that it makes no damn sense. Pandora's box is opened; if you force software solutions to backdoor their technology, someone will just step up who doesn't care about your laws. There are no global treaties on software development, and we aren't going to be signing any such thing any day soon. Even if we could force something like that down the throats of every country on Earth, the knowledge exists, and anyone can roll out their own solution with a high-school level understanding of the topic. It's absurd to think this can be resolved through legislation or cajoling companies into cooperation. But what really bothers me about this whole issue is that we already have laws in place that handle this situation, at least in the USA. In the USA, if you refuse to hand over an encryption key (or can't) and are being compelled to by a court, you can and will be held in contempt of court, and possibly convicted of destruction of evidence. The only thing that forcing people to backdoor their crypto does is allow government entities to investigate people without having sufficient evidence to compel them to give up their keys, and destroy the marketability of large scale, centralized end-to-end encryption solutions. I mean, you could make the argument that end-to-end encryption restricts the ability to wiretap people, sure, but a wiretap warrant should require a decent amount of evidence, and at that point, there are most likely other options.

sergior 10y ago
People can simply send random binary data to keep authorities busy.
- FungalRaincloud 10y ago
  That would be somewhat entertaining, and reminds me of someone I read about years ago who was accidentally added to a watchlist, and no one was willing to remove him, so he started generating as much data as he could, just to keep them busy. I can't find a link, sadly. I don't think it's a good solution, though. This is going to sound like an argument that you hear about privacy by people who don't understand why privacy matters, but I think on this issue, it holds a little more truth: To be honest, I think the people who are likely to care to do this are people who are advocates for privacy and are tech savvy, and people who have something to hide. I don't think it's terribly difficult, with the resources the global Intelligence Community has to build a profile and dump people into those two buckets with a fair degree of accuracy. Everyone who's not generating random garbage data would still be observable, so it wouldn't really change much outside of the group that's acting. But for those acting, suddenly there's a red flag that they can look for, and then when they see it, start building a profile to figure out if you're a tech person with an interest in privacy, or someone doing something they don't want seen, and act accordingly. In the mean time, we waste time generating garbage instead of just using good enough encryption, and making it so easy to use that people don't even have to know they're using it. Now, if we could somehow implant babies with a chip that causes them to generate random noise (something babies are already pretty good at, mind you) from birth, that might be worth something. There's no profile building if the noise is just something that humans make by being alive.

doctorshady 10y ago

I'm surprised I haven't heard the IP bill mentioned other than here in this whole matter. Why all the fanfare? Especially if it's something they can already just do quietly; the public controversy from that law has mostly passed over.