4 ms·

Signal said they may have to pull out of the UK if the bill is enacted as well. This would be a major setback for communications here. We'd basically have to go

Signal said they may have to pull out of the UK if the bill is enacted as well. This would be a major setback for communications here. We'd basically have to go back to SMS/MMS and email as far as I can tell. I don't know this is a fight the UK government can win. Does anyone else remember that the American government tried to ban encryption (back in the 90's I think it was)? They eventually had to give up because people just downloaded encryption products from the internet and used them anyway.

jupp0r 4y ago
What does it mean for Signal to "pull out" of the UK? How can the UK government enforce this law against an app whose makers have no physical presence inside the country? Force phone makers to ban the app from app stores?
- OJFord 4y ago
  No +44 number sign-up, no listing in UK app stores.
  - wkat4242 4y ago
    Just take a foreign prepay number and sideload the app :) It won't really stop people.
    - OJFord 4y ago
      1) are you joking, that will stop 99. some number of 9s % of the population; 2) I'm not making any claims about it being desirable or effective, I'm just explaining what 'exiting the UK' means or what they'd be required to do. The crown won't sue a foreign company because a citizen found a way to workaround it not being available here - that would be like criticising the manufactuter of an illegally dangerous electrical item only rated for and sold in 110V markets that someone imported.
      - wkat4242 4y ago
        People didn't use to be so stupid. If they could manage Word Perfect 5.1 they can surely sideload a little app :P I think it's more of a "don't want to know" than anything, in which case it's their own problem IMO.
- jhasse 4y ago
  Not phone makers, but Google and Apple. You wouldn't find the app in their App Stores in the UK.
- anigbrowl 4y ago
  If it's a criminal statute, the UK could fine Signal and the US would help them collect. https://irp.fas.org/world/uk/us-uk-mla.pdf https://irp.fas.org/world/uk/us-uk-mla.pdf
  - amadeuspagel 4y ago
    Maybe the treaty's exception for offenses of a political character applies here?
    - anigbrowl 4y ago
      I doubt that. Signal themselves say they can't read the content of messages, so the UK prosecutors could argue that they're not being targeted over the content of the messages but the fact of enabling their concealment. Recall that in the US there is no explicit right to privacy. You might be able to make a 1A argument that manually encrypting a message is itself a speech act, but the government could theoretically ban the distribution tools like Signal and argue they have the authority under the commerce clause, which stands on a equal Constitutional footing to the 1A. I don't think this is likely, but I could easily see it being offered as the justification to honor a UK ban.
- nicoburns 4y ago
  Yeah, app store releases are per-region. They'd just untick the UK region.
_Wintermute 4y ago
France effectively banned encryption in the 90s and had to backtrack, I can't see this being enacted for any length of time before even the most stupid of politicians realise it's a bad idea.
- Kim_Bruning 4y ago
  Would you happen to have links to some good reading material on this? People could -eg.- show it to their representatives.
  - _Wintermute 4y ago
    I'm probably not best equipped since I wasn't living in France at the time, but there's a quick summary at the time here: https://www.theregister.com/1999/01/15/france_to_end_severe_encryption/ https://www.theregister.com/1999/01/15/france_to_end_severe_...
    - Kim_Bruning 4y ago
      Merci beaucoup!
tialaramex 4y ago
The US said that encryption (well, good encryption) was a munition and so you needed an export license to make it available outside the US, e.g. by putting it on a web site. Such rules are not unusual for physical objects - why sell your enemies or even potential enemies the rope they will hang you with? But for encryption it doesn't make sense because it's just information, and unlike physical objects, after writing is invented humans can trivially reproduce information, so too bad. Eventually they whittled the "export license" step to something like a form letter Fax and IIRC Mozilla had a process where you raised a Bugzilla ticket, that caused the appropriate fax to be filled out and sent, so that was part of the release process, making it as painless as possible to comply with the stupid law. (And now it's gone altogether)
- NoZebra120vClip 4y ago
  And not a few folks commissioned Perl tattoos with crypto code, thereby becoming human munitions and daring Customs to stop them in ports of entry. And then came the Clipper Chip...
tracker1 4y ago
Or people not on Apple devices side-load the app anyway (F-Droid). Assuming the corporate action is just to remove the market from the Play store.
- varenc 4y ago
  If the law is enacted, and that seems unlikely, just removing it from app stores doesn’t seem sufficient to comply. Besides side-loading, users will just keep the old version of the app. WhatsApp can pretty clearly know if a user of the app is in the UK based on their account’s phone number country code and GeoIP. So if they wanted to comply by pulling out of the UK completely they’d probably have to make some attempt to disable WhatsApp messages for those users they’re reasonably expected to know with some confidence are located in the UK. But as others have said, this all just seems like posturing that’s unlikely to become law.
  - tracker1 4y ago
    It is not my responsibility to make sure that citizens of Elbonia aren't able to use my application if I don't operate a business or live in Elbonia. It comes down to jurisdiction. If you don't have it on the default marketplace for the region, and don't have a physical business presence in the region, it can be argued, you've done enough and aren't subject to the jurisdiction and are not doing business there. That users may bypass and side-load your application is immaterial. If a user in the UK uses a US based VPN, they can also still use the app even if you added IP blocking, and IP blocking in and of itself is less than perfect often subject to false positive/negatives, and best to be avoided.
hackernewds 4y ago
Why do countries want to ban E2E anyways? To spy on their citizens?
- Digit-Al 4y ago
  The excuse being used here is the prevention of child pornography. The bill being proposed puts the onus on tech companies to scan all messages going through their systems for evidence of child pornography. Obviously, E2E messages cannot be scanned so would be in breach of the law.

jupp0r 4y ago

What does it mean for Signal to "pull out" of the UK? How can the UK government enforce this law against an app whose makers have no physical presence inside the country? Force phone makers to ban the app from app stores?

OJFord 4y ago
No +44 number sign-up, no listing in UK app stores.
- wkat4242 4y ago
  Just take a foreign prepay number and sideload the app :) It won't really stop people.
  - OJFord 4y ago
    1) are you joking, that will stop 99. some number of 9s % of the population; 2) I'm not making any claims about it being desirable or effective, I'm just explaining what 'exiting the UK' means or what they'd be required to do. The crown won't sue a foreign company because a citizen found a way to workaround it not being available here - that would be like criticising the manufactuter of an illegally dangerous electrical item only rated for and sold in 110V markets that someone imported.
    - wkat4242 4y ago
      People didn't use to be so stupid. If they could manage Word Perfect 5.1 they can surely sideload a little app :P I think it's more of a "don't want to know" than anything, in which case it's their own problem IMO.
jhasse 4y ago
Not phone makers, but Google and Apple. You wouldn't find the app in their App Stores in the UK.
anigbrowl 4y ago
If it's a criminal statute, the UK could fine Signal and the US would help them collect. https://irp.fas.org/world/uk/us-uk-mla.pdf https://irp.fas.org/world/uk/us-uk-mla.pdf
- amadeuspagel 4y ago
  Maybe the treaty's exception for offenses of a political character applies here?
  - anigbrowl 4y ago
    I doubt that. Signal themselves say they can't read the content of messages, so the UK prosecutors could argue that they're not being targeted over the content of the messages but the fact of enabling their concealment. Recall that in the US there is no explicit right to privacy. You might be able to make a 1A argument that manually encrypting a message is itself a speech act, but the government could theoretically ban the distribution tools like Signal and argue they have the authority under the commerce clause, which stands on a equal Constitutional footing to the 1A. I don't think this is likely, but I could easily see it being offered as the justification to honor a UK ban.
nicoburns 4y ago
Yeah, app store releases are per-region. They'd just untick the UK region.

_Wintermute 4y ago

France effectively banned encryption in the 90s and had to backtrack, I can't see this being enacted for any length of time before even the most stupid of politicians realise it's a bad idea.

Kim_Bruning 4y ago
Would you happen to have links to some good reading material on this? People could -eg.- show it to their representatives.
- _Wintermute 4y ago
  I'm probably not best equipped since I wasn't living in France at the time, but there's a quick summary at the time here: https://www.theregister.com/1999/01/15/france_to_end_severe_encryption/ https://www.theregister.com/1999/01/15/france_to_end_severe_...
  - Kim_Bruning 4y ago
    Merci beaucoup!

tialaramex 4y ago

The US said that encryption (well, good encryption) was a munition and so you needed an export license to make it available outside the US, e.g. by putting it on a web site. Such rules are not unusual for physical objects - why sell your enemies or even potential enemies the rope they will hang you with? But for encryption it doesn't make sense because it's just information, and unlike physical objects, after writing is invented humans can trivially reproduce information, so too bad. Eventually they whittled the "export license" step to something like a form letter Fax and IIRC Mozilla had a process where you raised a Bugzilla ticket, that caused the appropriate fax to be filled out and sent, so that was part of the release process, making it as painless as possible to comply with the stupid law. (And now it's gone altogether)

NoZebra120vClip 4y ago
And not a few folks commissioned Perl tattoos with crypto code, thereby becoming human munitions and daring Customs to stop them in ports of entry. And then came the Clipper Chip...

tracker1 4y ago

Or people not on Apple devices side-load the app anyway (F-Droid). Assuming the corporate action is just to remove the market from the Play store.

varenc 4y ago
If the law is enacted, and that seems unlikely, just removing it from app stores doesn’t seem sufficient to comply. Besides side-loading, users will just keep the old version of the app. WhatsApp can pretty clearly know if a user of the app is in the UK based on their account’s phone number country code and GeoIP. So if they wanted to comply by pulling out of the UK completely they’d probably have to make some attempt to disable WhatsApp messages for those users they’re reasonably expected to know with some confidence are located in the UK. But as others have said, this all just seems like posturing that’s unlikely to become law.
- tracker1 4y ago
  It is not my responsibility to make sure that citizens of Elbonia aren't able to use my application if I don't operate a business or live in Elbonia. It comes down to jurisdiction. If you don't have it on the default marketplace for the region, and don't have a physical business presence in the region, it can be argued, you've done enough and aren't subject to the jurisdiction and are not doing business there. That users may bypass and side-load your application is immaterial. If a user in the UK uses a US based VPN, they can also still use the app even if you added IP blocking, and IP blocking in and of itself is less than perfect often subject to false positive/negatives, and best to be avoided.

hackernewds 4y ago

Why do countries want to ban E2E anyways? To spy on their citizens?

Digit-Al 4y ago
The excuse being used here is the prevention of child pornography. The bill being proposed puts the onus on tech companies to scan all messages going through their systems for evidence of child pornography. Obviously, E2E messages cannot be scanned so would be in breach of the law.