7 ms·

I would argue that there's a fourth kind of ‘no’, when tech decides that enough is enough, and says "No, fuck you." We've reached that point in the UK, where t

I would argue that there's a fourth kind of ‘no’, when tech decides that enough is enough, and says "No, fuck you." We've reached that point in the UK, where the government has proposed draconian legislation[1] that would allow the government to force companies to create backdoors into encrypted messaging services. As a result, Whatsapp[2] and Signal[3] have said that they will pull out of the UK, and Apple[4] has said it will remove Facetime and iMessage from the UK if the legislation passes. 1: https://www.eff.org/deeplinks/2023/07/uk-government-very-close-eroding-encryption-worldwide https://www.eff.org/deeplinks/2023/07/uk-government-very-clo... 2: https://www.theguardian.com/technology/2023/mar/09/whatsapp-end-to-end-encryption-online-safety-bill https://www.theguardian.com/technology/2023/mar/09/whatsapp-... 3: https://www.bbc.co.uk/news/technology-64584001 https://www.bbc.co.uk/news/technology-64584001 4: https://www.bbc.co.uk/news/technology-66256081 https://www.bbc.co.uk/news/technology-66256081

Doches 3y ago
This is explicitly the point of the article, really: the author’s third type of ‘no’ is “we literally can’t do this” — and that’s the situation in the UK. It’s not that Meta, Apple, and Signal are saying “fuck you” to the UK; it’s that they’re saying “there is literally no way for us to comply with this legislation, so our only legal option is to leave your market.” I agree that there’s a sort of implied, under-the-breath muttering of “…you morons”, but if there were a way for the messaging companies to comply they’d just…comply. Angrily and noisily, perhaps, but even in its current pathetic state the UK is too big a market to ignore.
- peoplefromibiza 3y ago
  > “there is literally no way for us to comply with this legislation, so our only legal option is to leave your market.” as much as I love my encrypted chats, both those sentences are not true. Devil's advocate would say: 1: Tech companies can obviously share the keys with the government, like they do in a group chat, it would simply mean "GVT has joined the chat" [1] and it could also work the same way wiretaps have always worked, under a very strict legal framework and behind a colossal amount of bureaucracy to authorize their use. 2: tech companies are not leaving those markets, they are simply buying time, they don't want to do the work, because it's work they will not profit from, but there's nothing preventing them on the technical side from doing it. [1] have you ever seen this on an Android device? https://i.imgur.com/XUxiUUr.jpeg https://i.imgur.com/XUxiUUr.jpeg
  - rhaway84773 3y ago
    Not only is it not true, it’s very likely they’re already doing it. For example, WhatsApp sells itself as fully encrypted, etc. but if you’re in a group chat thars not true anymore. That information is available to WhatsApp and they almost certainly make it available to several governments (hopefully in a judicially protected way but we can’t know that). Further, if you backup your WhatsApp chats, that’s game over for any privacy. The UK legislation is stupid because the UK has been run by a bunch of stupid people for at least the past decade. Nothing about this legislation is dumber than Brexit, for example, which was a referendum that was proposed to the public in such a ridiculous manner that the next half decade was spent in divining what the referendum actually meant.
    - FabHK 3y ago
      > For example, WhatsApp sells itself as fully encrypted, etc. but if you’re in a group chat thars not true anymore. That information is available to WhatsApp and they almost certainly make it available to several governments (hopefully in a judicially protected way but we can’t know that). Source? It could well be that the sender e2ee it to each of the recipients, no? (Trivial to add the government or WhatsApp itself to the recipients, then, but that is a different claim.)
      - bostik 3y ago
        OP reads like something I have played devil's advocate for. In an earlier discussion about WA vulnerabilities, one of the reported bugs was that as implemented, Facebook could have added themselves silently to any group chat, thus receiving with plaintext copies of all messages sent in the group from that point onwards. I then extrapolated that if they so chose, they could change their plumbing enough to make all chats group chats - even when they were between two people. To be absolutely clear, there was not - neither back then, nor since - evidence of this being the case. But the technical capability and potential for such subversion was there at the time. I have not followed the domain news enough to know whether this is still the case. What is available to WA and thus to governments, is the traffic pattern part. Who communicates with whom, when, how large the messages approximately are, and so on. The stuff our industry and journalists at large have chosen to call metadata[tm]. I stubbornly call the whole thing for what it is: traffic analysis. Old-school style.
- barrysteve 3y ago
  I don't understand. In the case of a national security incident, the US gov/military would have popular apps cracked open ASAP. We live under a global survelliance network and somehow the gentlemen's agreement on keeping end-to-end encryption in place, is the only thing keeping our chat apps private? One would hope for a concrete privacy that doesn't depend on multi-national corps and nation-states to agree that it should be kept private. Something else has to be going on here, because nobody could commit to keeping dangerous secrets on whatsapp, after assange and snowden.. right?
  - rf15 3y ago
    > We live under a global survelliance network But we don't, right? Neither every word nor every move you make is recorded. Not to mention not globally shared, of all things.
    - permo-w 3y ago
      that's a pretty low bar
    - barrysteve 3y ago
      Uhh.. London has a CCTV network that doesn't prevent theft. My parking lots used to be tech-free and all now have poles with cameras and government signs on them. Face camera tech in all retail outlets. Every second or third home is plastered in cameras, some beaming their data back to some US corp. Phone tracks everything you do, to hundreds of app providers, who then sell it on to data aggregators. Refuse covid vax? No access to public services. My IT friends have admitted the whole point since the 80s was the spying. Watergate and Cyberdyne (nixon) started the end of secret keeping. It is no different to Oceangate and Teledyne (sub imploding) starting the end of physical freedom. Snowden, Assange, basic facts about GCHQ and google offshoring domestic data in the UK so they can classify it as 'foreign spying' and legally dissect it all, when they re-import it. Deanonymizing online activity is statisically trivial. All the 9/11 stuff destroying liberty and adding excessive security at airport gates and body scanners that were never needed before. ect. Euthanisia has been legalized. Some of us, do in fact, pay attention. Writing's on the (digital) wall. Every man will be a 'slave' to tech run by harvard-types, by the end of the 2030s. While we're "working from home", the gov and tech companies destroyed the physical infrastructure that allowed freedom and replaced it with tyranny. People are fleeing cities to live in the countryside. I. Wonder. Why. Here I am remembering and telling the truth. As if that mattered. I'm watching this in real time without the means to change my living circumnstances, and it's a big old brain melter. I'm supposedly responsible for my actions as a person, yet the gov and tech companies, really are indicating it doesn't think I should be allowed to exercise free will. ....
- soraminazuki 3y ago
  The author's third type of "no" refers to the technical feasibility of compliance. OP, on the other hand, is referring to the refusal of the idea itself. In the case of encryption, the technical side of things is insignificant compared to the Orwellian nightmare these sort of laws intend to create. It would still be a terrible idea even if technical drawbacks were absent, and one doesn't even have to be a nerd to see that.
genmon 3y ago
I guess the distinction comes from the type of underlying 'no'. These cases in the UK are a decided response to no-type-3: "we actually can’t do that". Whereas Meta disallowing news links in Canada (another enough-is-enough response) is because of a no-type-2: "that’s a really bad idea". Useful to have Evans' typology to distinguish those two cases. (As a counterfactual in the UK, the decided response _could_ have been, "we actually can't do that technically, but ok we'll change the architecture, destroy our brand promise and increase the attack surface, and put the back doors in anyway.")
- marcosdumay 3y ago
  > but ok we'll change the architecture That's why no-type-2 and no-type-3 don't have an strict line separating them. This is an example of both, because it's probably not being done because a lot of other countries would deem their service illegal if they did it, and not really for technical reasons.
jnsaff2 3y ago
This is BATNA: https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiated_agreement https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiat...
ekanes 3y ago
While it's probably not your point, I find it greatly heartening that these companies are sending such a strong message by leaving a big and valuable market. It doesn't really matter what their reason is... it could be: a) They value privacy and don't want to comply. b) They can't access the messages, and thus can't comply. Either reason is fine. Am I missing something?
- pbmonster 3y ago
  c) They don't want to deal with the clusterfuck of dealing with communication between parties in the UK and parties in the EU. Because then, UK law would require them to remove the privacy tech in place, while EU law would require them to protect that privacy. And they'll have parties changing jurisdiction frequently, possibly mid-call.
- MerelyMortal 3y ago
  d) It's more worthwhile to give up a small valuable market to appear like they're doing the right thing for a larger valuable market in order to keep those users.

Doches 3y ago

This is explicitly the point of the article, really: the author’s third type of ‘no’ is “we literally can’t do this” — and that’s the situation in the UK. It’s not that Meta, Apple, and Signal are saying “fuck you” to the UK; it’s that they’re saying “there is literally no way for us to comply with this legislation, so our only legal option is to leave your market.” I agree that there’s a sort of implied, under-the-breath muttering of “…you morons”, but if there were a way for the messaging companies to comply they’d just…comply. Angrily and noisily, perhaps, but even in its current pathetic state the UK is too big a market to ignore.

peoplefromibiza 3y ago
> “there is literally no way for us to comply with this legislation, so our only legal option is to leave your market.” as much as I love my encrypted chats, both those sentences are not true. Devil's advocate would say: 1: Tech companies can obviously share the keys with the government, like they do in a group chat, it would simply mean "GVT has joined the chat" [1] and it could also work the same way wiretaps have always worked, under a very strict legal framework and behind a colossal amount of bureaucracy to authorize their use. 2: tech companies are not leaving those markets, they are simply buying time, they don't want to do the work, because it's work they will not profit from, but there's nothing preventing them on the technical side from doing it. [1] have you ever seen this on an Android device? https://i.imgur.com/XUxiUUr.jpeg https://i.imgur.com/XUxiUUr.jpeg
- rhaway84773 3y ago
  Not only is it not true, it’s very likely they’re already doing it. For example, WhatsApp sells itself as fully encrypted, etc. but if you’re in a group chat thars not true anymore. That information is available to WhatsApp and they almost certainly make it available to several governments (hopefully in a judicially protected way but we can’t know that). Further, if you backup your WhatsApp chats, that’s game over for any privacy. The UK legislation is stupid because the UK has been run by a bunch of stupid people for at least the past decade. Nothing about this legislation is dumber than Brexit, for example, which was a referendum that was proposed to the public in such a ridiculous manner that the next half decade was spent in divining what the referendum actually meant.
  - FabHK 3y ago
    > For example, WhatsApp sells itself as fully encrypted, etc. but if you’re in a group chat thars not true anymore. That information is available to WhatsApp and they almost certainly make it available to several governments (hopefully in a judicially protected way but we can’t know that). Source? It could well be that the sender e2ee it to each of the recipients, no? (Trivial to add the government or WhatsApp itself to the recipients, then, but that is a different claim.)
    - bostik 3y ago
      OP reads like something I have played devil's advocate for. In an earlier discussion about WA vulnerabilities, one of the reported bugs was that as implemented, Facebook could have added themselves silently to any group chat, thus receiving with plaintext copies of all messages sent in the group from that point onwards. I then extrapolated that if they so chose, they could change their plumbing enough to make all chats group chats - even when they were between two people. To be absolutely clear, there was not - neither back then, nor since - evidence of this being the case. But the technical capability and potential for such subversion was there at the time. I have not followed the domain news enough to know whether this is still the case. What is available to WA and thus to governments, is the traffic pattern part. Who communicates with whom, when, how large the messages approximately are, and so on. The stuff our industry and journalists at large have chosen to call metadata[tm]. I stubbornly call the whole thing for what it is: traffic analysis. Old-school style.
barrysteve 3y ago
I don't understand. In the case of a national security incident, the US gov/military would have popular apps cracked open ASAP. We live under a global survelliance network and somehow the gentlemen's agreement on keeping end-to-end encryption in place, is the only thing keeping our chat apps private? One would hope for a concrete privacy that doesn't depend on multi-national corps and nation-states to agree that it should be kept private. Something else has to be going on here, because nobody could commit to keeping dangerous secrets on whatsapp, after assange and snowden.. right?
- rf15 3y ago
  > We live under a global survelliance network But we don't, right? Neither every word nor every move you make is recorded. Not to mention not globally shared, of all things.
  - permo-w 3y ago
    that's a pretty low bar
  - barrysteve 3y ago
    Uhh.. London has a CCTV network that doesn't prevent theft. My parking lots used to be tech-free and all now have poles with cameras and government signs on them. Face camera tech in all retail outlets. Every second or third home is plastered in cameras, some beaming their data back to some US corp. Phone tracks everything you do, to hundreds of app providers, who then sell it on to data aggregators. Refuse covid vax? No access to public services. My IT friends have admitted the whole point since the 80s was the spying. Watergate and Cyberdyne (nixon) started the end of secret keeping. It is no different to Oceangate and Teledyne (sub imploding) starting the end of physical freedom. Snowden, Assange, basic facts about GCHQ and google offshoring domestic data in the UK so they can classify it as 'foreign spying' and legally dissect it all, when they re-import it. Deanonymizing online activity is statisically trivial. All the 9/11 stuff destroying liberty and adding excessive security at airport gates and body scanners that were never needed before. ect. Euthanisia has been legalized. Some of us, do in fact, pay attention. Writing's on the (digital) wall. Every man will be a 'slave' to tech run by harvard-types, by the end of the 2030s. While we're "working from home", the gov and tech companies destroyed the physical infrastructure that allowed freedom and replaced it with tyranny. People are fleeing cities to live in the countryside. I. Wonder. Why. Here I am remembering and telling the truth. As if that mattered. I'm watching this in real time without the means to change my living circumnstances, and it's a big old brain melter. I'm supposedly responsible for my actions as a person, yet the gov and tech companies, really are indicating it doesn't think I should be allowed to exercise free will. ....
soraminazuki 3y ago
The author's third type of "no" refers to the technical feasibility of compliance. OP, on the other hand, is referring to the refusal of the idea itself. In the case of encryption, the technical side of things is insignificant compared to the Orwellian nightmare these sort of laws intend to create. It would still be a terrible idea even if technical drawbacks were absent, and one doesn't even have to be a nerd to see that.

genmon 3y ago

I guess the distinction comes from the type of underlying 'no'. These cases in the UK are a decided response to no-type-3: "we actually can’t do that". Whereas Meta disallowing news links in Canada (another enough-is-enough response) is because of a no-type-2: "that’s a really bad idea". Useful to have Evans' typology to distinguish those two cases. (As a counterfactual in the UK, the decided response _could_ have been, "we actually can't do that technically, but ok we'll change the architecture, destroy our brand promise and increase the attack surface, and put the back doors in anyway.")

marcosdumay 3y ago
> but ok we'll change the architecture That's why no-type-2 and no-type-3 don't have an strict line separating them. This is an example of both, because it's probably not being done because a lot of other countries would deem their service illegal if they did it, and not really for technical reasons.

jnsaff2 3y ago

This is BATNA: https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiated_agreement https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiat...

ekanes 3y ago

While it's probably not your point, I find it greatly heartening that these companies are sending such a strong message by leaving a big and valuable market. It doesn't really matter what their reason is... it could be: a) They value privacy and don't want to comply. b) They can't access the messages, and thus can't comply. Either reason is fine. Am I missing something?

pbmonster 3y ago
c) They don't want to deal with the clusterfuck of dealing with communication between parties in the UK and parties in the EU. Because then, UK law would require them to remove the privacy tech in place, while EU law would require them to protect that privacy. And they'll have parties changing jurisdiction frequently, possibly mid-call.
MerelyMortal 3y ago
d) It's more worthwhile to give up a small valuable market to appear like they're doing the right thing for a larger valuable market in order to keep those users.