12 ms·

Petition against UK Home Office plans for surveillance and encryption backdoors

126 points by ianopolous 9y ago

ianopolous 9y ago
The actual document is here: https://www.openrightsgroup.org/assets/files/pdfs/home_office/ANNEX_A_Draft_Investigatory_Powers_(Technical%20Capability)_Regulations.pdf https://www.openrightsgroup.org/assets/files/pdfs/home_offic...
- JupiterMoon 9y ago
  Is it safe to share this if a UK citizen? I.e. would a UK citizen be criminally liable under the Official Secrets Act or similar.
  - snowpanda 9y ago
    To be honest, what's the alternative? People sticking their head in the sand is what got you guys to this point.
    - deleted 9y ago
      [deleted]
  - nthcolumn 9y ago
    The Official Secrets Act must be signed by you and pertains to 'official secrets' you may become party to as a servant of the Crown. It is not illegal to share this as a common civilian. Whether it is safe to do so is another matter entirely.
    - anon1385 9y ago
      >The Official Secrets Act must be signed by you That's not true. It's a law not a contract; everybody is bound by it: http://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-7422 http://researchbriefings.parliament.uk/ResearchBriefing/Summ... >Do you have to sign the Official Secrets Act to be bound by it? >It is not necessary for a person to have signed the Official Secrets Act in order to be bound by it.
    - Guyag 9y ago
      If the Official Secrets Act applies to you, it's an offence to break it even if you've not signed it. http://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-7422 http://researchbriefings.parliament.uk/ResearchBriefing/Summ... edit: beat to it by a minute!
    - bazzargh 9y ago
      that's not true at all, Section 5 applies to everyone, and deals with passing on secrets you've obtained from people who have signed the act. That said, and IANAL, this document is not covered because of 5(2) - there's no reasonable grounds for believing that releasing this document is damaging to national security. It's a draft, so does not describe any measures currently in effect, and the draft will be made public in a few days when it is submitted to parliament, before it has any effect.
    - JupiterMoon 9y ago
      Dangerous and wrong advice. I already knew what the other posters replied with. I was looking for more specific opinions about whether it would be safe to post this link on a Facebook type platform
  - koenigdavidmj 9y ago
    If it's a crime to share a draft of a law, you're no longer dealing with a liberal democracy, but a Saudi-style shithole, and it's time for that country to remove its government.
FullMtlAlcoholc 9y ago
If this comes to fruition, i will never use software originating from the UK again.
- turblety 9y ago
  Me and a bunch of IT colleagues are all planning to leave and goto Europe once this and the Brexit stuff happens. The UK's going to be left with a bunch of uneducated, old fashioned, racist and obedient zombies. So don't worry, the UK's basically done. I'm guessing less and less products and research will come out of the UK until it basically becomes an irrelevant country.
  - stevekemp 9y ago
    If you're really committed to leaving I suspect it would be better to do so, and get settled, in advance. Instead of on the flag-day when "everybody" else is also leaving. Moving countries isn't easy, and getting settled in a new location takes time.
    - bazzargh 9y ago
      It's already too late in most cases, getting permanent residence rights elsewhere in the EU requires you to have lived there for 5 years; but there's under 2 years left before UK citizens lose their rights to work elsewhere in the EU. So you'd have to emigrate as a non-EU citizen, unless you qualify under one of the get-out clauses (eg joint citzenship, or you go to work in the EU and then have an accident that prevents you from ever working again(!))
      - fauigerzigerk 9y ago
        No, that is not necessarily the case. It will depend on the outcome of the negotiations. The 5 year rule is part of the existing freedom of movement regulation. It provides additional protection against getting kicked out in case of sickness or unemployment. Exercising the right to live and work anywhere in the EU before Brexit takes effect may well mean that you can keep those rights after Brexit and acquire permanent residence rights later on. Anything else would mean that hundereds of thousands of people would have to be deported, which would go against every promise made in the referendum campaign.
CyberDildonics 9y ago
You would think they might be a little less sympathetic to back doors with the NHS currently having problems with ransomware
- lordnacho 9y ago
  My bet is they will turn it into an even better reason to have back doors. And no, logic doesn't come into it.
infinity0 9y ago
interesting loophole: “relevant telecommunications operator” means a telecommunications operator, or a person who is proposing to become a telecommunications operator( b ), but does not include a person who provides, or who is proposing to provide, a telecommunications service only in relation to the provision by that person of banking, insurance, investment or other financial services.
- MarkMc 9y ago
  Smart move. I am planning to add end-to-end encryption to my UK accounting software. Without this loophole I would have been forced to move my business outside the UK.
satysin 9y ago
Not only is this stupid from a technical point of view but it could ruin the UK software industry because who in their right mind would buy any software knowing it is deliberately compromised?
- Kenji 9y ago
  I would refuse to develop or deploy software in any country that mandates such backdoors.
  - voltagex_ 9y ago
    And what would the UK software developers do? It's not always possible to move.
    - s_kilk 9y ago
      Take up farming, or something. Or, you know, annihilate the Tories, hold the state to account and prevent this shit from happening.
      - crdoconnor 9y ago
        "Or, you know, annihilate the Tories" That's difficult in a country with largely billionaire-run or staunchly establishment-friendly media. They may not like all the policies of the Tories but the alternative poses something of an existential threat to their overwhelming wealth.
      - MistahKoala 9y ago
        What makes you think this is entirely down to them (other than the usual eating-your-first-born tropes)? This stuff came to fruition under Labour - as I'm sure you'll acknowledge. Why not look at what both governments had in common? I'd be surprised if it wasn't found to be Home Office mandarins driving the agenda.
        JupiterMoon 9y ago
infinity0 9y ago
"To provide and maintain the capability to disclose, where practicable, the communications, equipment data and other information in an intelligible form to standards specified in the notice and to remove electronic protection applied by or on behalf of the telecommunications operator to those communications, equipment data or other information, or to permit the person to whom the warrant is addressed to remove such electronic protection." Could this be interpreted, legally, to exempt end-to-end encryption? - When implemented properly (i.e. with proper key verification UIs) it should not be "practicable" for communications operators to force disclosure of the contents of users' communications. - End-to-end encryption is not "applied by [..] the operator" but rather applied by the users' device.
- rocqua 9y ago
  They might argue that it is 'practicable' to force-push a software version of whatsapp that also sends the messages to the government. Alternatively, they could argue that since e2e services can't provide this backdoor, they aren't legal.
- zzzcpan 9y ago
  Not in any useful way. End-to-end encryption is a joke if you use a client controlled by a corporation. And a corporation can always implement a backdoor without you knowing to help the state.
hacker_9 9y ago
Seriously.. how many leaks have there been in the past week?? I'm losing track.
- Symbiote 9y ago
  Maybe it's time to watch Yes Minister again.
piqufoh 9y ago
> 7. To ensure that any hand-over interface complies with any industry standard, or other requirement, specified in the technical capability notice. ... Presumably now that the "industry standard" contains a backdoor, we (the people) can have a backdoor into this hand-over interface too?
driverdan 9y ago
News article: http://www.bbc.com/news/technology-39817300 http://www.bbc.com/news/technology-39817300
ed_balls 9y ago
It seems there is no official petition https://petition.parliament.uk/ https://petition.parliament.uk/
CommanderData 9y ago
I've advised a few companies to register (if feasible) a company in the EU or use Atlas to try and complicate being legally compelled in issues like these. These ideas are dangerous and backward. I can't see overseas companies trusting UK start ups with confidential trade and commercial secrets. There is already enough cooperate paranoia after the NSA was accused of spying on European corps and there seems to be evidence to suggest such a thing actually happened. Atleast I'm not the only person who thinks these policies are making the UK a unpopular place to open shop as long as there are countries with not so oppressive laws.

126 points by ianopolous 9y ago

The actual document is here: https://www.openrightsgroup.org/assets/files/pdfs/home_office/ANNEX_A_Draft_Investigatory_Powers_(Technical%20Capability)_Regulations.pdf https://www.openrightsgroup.org/assets/files/pdfs/home_offic...

JupiterMoon 9y ago
Is it safe to share this if a UK citizen? I.e. would a UK citizen be criminally liable under the Official Secrets Act or similar.
- snowpanda 9y ago
  To be honest, what's the alternative? People sticking their head in the sand is what got you guys to this point.
  - deleted 9y ago
    [deleted]
- nthcolumn 9y ago
  The Official Secrets Act must be signed by you and pertains to 'official secrets' you may become party to as a servant of the Crown. It is not illegal to share this as a common civilian. Whether it is safe to do so is another matter entirely.
  - anon1385 9y ago
    >The Official Secrets Act must be signed by you That's not true. It's a law not a contract; everybody is bound by it: http://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-7422 http://researchbriefings.parliament.uk/ResearchBriefing/Summ... >Do you have to sign the Official Secrets Act to be bound by it? >It is not necessary for a person to have signed the Official Secrets Act in order to be bound by it.
  - Guyag 9y ago
    If the Official Secrets Act applies to you, it's an offence to break it even if you've not signed it. http://researchbriefings.parliament.uk/ResearchBriefing/Summary/CBP-7422 http://researchbriefings.parliament.uk/ResearchBriefing/Summ... edit: beat to it by a minute!
  - bazzargh 9y ago
    that's not true at all, Section 5 applies to everyone, and deals with passing on secrets you've obtained from people who have signed the act. That said, and IANAL, this document is not covered because of 5(2) - there's no reasonable grounds for believing that releasing this document is damaging to national security. It's a draft, so does not describe any measures currently in effect, and the draft will be made public in a few days when it is submitted to parliament, before it has any effect.
  - JupiterMoon 9y ago
    Dangerous and wrong advice. I already knew what the other posters replied with. I was looking for more specific opinions about whether it would be safe to post this link on a Facebook type platform
- koenigdavidmj 9y ago
  If it's a crime to share a draft of a law, you're no longer dealing with a liberal democracy, but a Saudi-style shithole, and it's time for that country to remove its government.

FullMtlAlcoholc 9y ago

If this comes to fruition, i will never use software originating from the UK again.

turblety 9y ago
Me and a bunch of IT colleagues are all planning to leave and goto Europe once this and the Brexit stuff happens. The UK's going to be left with a bunch of uneducated, old fashioned, racist and obedient zombies. So don't worry, the UK's basically done. I'm guessing less and less products and research will come out of the UK until it basically becomes an irrelevant country.
- stevekemp 9y ago
  If you're really committed to leaving I suspect it would be better to do so, and get settled, in advance. Instead of on the flag-day when "everybody" else is also leaving. Moving countries isn't easy, and getting settled in a new location takes time.
  - bazzargh 9y ago
    It's already too late in most cases, getting permanent residence rights elsewhere in the EU requires you to have lived there for 5 years; but there's under 2 years left before UK citizens lose their rights to work elsewhere in the EU. So you'd have to emigrate as a non-EU citizen, unless you qualify under one of the get-out clauses (eg joint citzenship, or you go to work in the EU and then have an accident that prevents you from ever working again(!))
    - fauigerzigerk 9y ago
      No, that is not necessarily the case. It will depend on the outcome of the negotiations. The 5 year rule is part of the existing freedom of movement regulation. It provides additional protection against getting kicked out in case of sickness or unemployment. Exercising the right to live and work anywhere in the EU before Brexit takes effect may well mean that you can keep those rights after Brexit and acquire permanent residence rights later on. Anything else would mean that hundereds of thousands of people would have to be deported, which would go against every promise made in the referendum campaign.

CyberDildonics 9y ago

You would think they might be a little less sympathetic to back doors with the NHS currently having problems with ransomware

lordnacho 9y ago
My bet is they will turn it into an even better reason to have back doors. And no, logic doesn't come into it.

infinity0 9y ago

interesting loophole: “relevant telecommunications operator” means a telecommunications operator, or a person who is proposing to become a telecommunications operator( b ), but does not include a person who provides, or who is proposing to provide, a telecommunications service only in relation to the provision by that person of banking, insurance, investment or other financial services.

MarkMc 9y ago
Smart move. I am planning to add end-to-end encryption to my UK accounting software. Without this loophole I would have been forced to move my business outside the UK.

satysin 9y ago

Not only is this stupid from a technical point of view but it could ruin the UK software industry because who in their right mind would buy any software knowing it is deliberately compromised?

Kenji 9y ago
I would refuse to develop or deploy software in any country that mandates such backdoors.
- voltagex_ 9y ago
  And what would the UK software developers do? It's not always possible to move.
  - s_kilk 9y ago
    Take up farming, or something. Or, you know, annihilate the Tories, hold the state to account and prevent this shit from happening.
    - crdoconnor 9y ago
      "Or, you know, annihilate the Tories" That's difficult in a country with largely billionaire-run or staunchly establishment-friendly media. They may not like all the policies of the Tories but the alternative poses something of an existential threat to their overwhelming wealth.
    - MistahKoala 9y ago
      What makes you think this is entirely down to them (other than the usual eating-your-first-born tropes)? This stuff came to fruition under Labour - as I'm sure you'll acknowledge. Why not look at what both governments had in common? I'd be surprised if it wasn't found to be Home Office mandarins driving the agenda.
      - JupiterMoon 9y ago

infinity0 9y ago

"To provide and maintain the capability to disclose, where practicable, the communications, equipment data and other information in an intelligible form to standards specified in the notice and to remove electronic protection applied by or on behalf of the telecommunications operator to those communications, equipment data or other information, or to permit the person to whom the warrant is addressed to remove such electronic protection." Could this be interpreted, legally, to exempt end-to-end encryption? - When implemented properly (i.e. with proper key verification UIs) it should not be "practicable" for communications operators to force disclosure of the contents of users' communications. - End-to-end encryption is not "applied by [..] the operator" but rather applied by the users' device.

rocqua 9y ago
They might argue that it is 'practicable' to force-push a software version of whatsapp that also sends the messages to the government. Alternatively, they could argue that since e2e services can't provide this backdoor, they aren't legal.
zzzcpan 9y ago
Not in any useful way. End-to-end encryption is a joke if you use a client controlled by a corporation. And a corporation can always implement a backdoor without you knowing to help the state.

hacker_9 9y ago

Seriously.. how many leaks have there been in the past week?? I'm losing track.

Symbiote 9y ago
Maybe it's time to watch Yes Minister again.

piqufoh 9y ago

> 7. To ensure that any hand-over interface complies with any industry standard, or other requirement, specified in the technical capability notice. ... Presumably now that the "industry standard" contains a backdoor, we (the people) can have a backdoor into this hand-over interface too?

driverdan 9y ago

News article: http://www.bbc.com/news/technology-39817300 http://www.bbc.com/news/technology-39817300

ed_balls 9y ago

It seems there is no official petition https://petition.parliament.uk/ https://petition.parliament.uk/

CommanderData 9y ago

I've advised a few companies to register (if feasible) a company in the EU or use Atlas to try and complicate being legally compelled in issues like these. These ideas are dangerous and backward. I can't see overseas companies trusting UK start ups with confidential trade and commercial secrets. There is already enough cooperate paranoia after the NSA was accused of spying on European corps and there seems to be evidence to suggest such a thing actually happened. Atleast I'm not the only person who thinks these policies are making the UK a unpopular place to open shop as long as there are countries with not so oppressive laws.