10 ms·
I think this is an unquestionable overreach on the UK's part. If you live in any country that isn't the UK, you should feel the threat from this: the UK governm
by Shank 2y ago
I think this is an unquestionable overreach on the UK's part. If you live in any country that isn't the UK, you should feel the threat from this: the UK government believes that it is entitled to a backdoor on your hardware, even if you've never stepped a foot on UK soil or intend to. Mass surveillance is a threat to everyone, but this is not an instance of that, which has guards against it, like encryption. This is the UK asking for an encryption backdoor to everything, including for phones that never traverse its soil or internet boundaries, or even cross anywhere near FVEY collection devices.
This is a dramatic overreach of authority.
- varsketiz 2y ago> This is a dramatic overreach of authority. Well, the rest of the world lives with the USA constantly doing this. Hopefully you dont support that as well.
- graeme 2y agoThe US does not require Apple to make a backdoor to its encryption.
- Workaccount2 2y agoBut it is greatly in the interest of US agencies to perpetuate conspiracies that they have access to all data, all the time, with no court needed.
- nickslaughter02 2y agoHow do you know that? Similarly to the UK, USA has a process to force companies to add back doors. For all we know it might the USA wanting access and using its five eyes allies to get it done.
- sieabahlpark 2y agoPoint to the law that requires them to do it and keep quiet about it. The US law. I'll wait.
- varsketiz 2y agoThere does not have to be a law for the US government to do something. Remember the NSA spying scandal?
- fransje26 2y agoCALEA https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act https://en.wikipedia.org/wiki/Communications_Assistance_for_...
- alt227 2y agoHeres an example of when Apple got caught giving the US government all users push notifications, and then quite openly said they had been bound by law to keep quiet about it. https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/ https://www.macrumors.com/2023/12/06/apple-governments-surve... > "In this case, the federal government prohibited us from sharing any information,"
- deleted 2y ago[deleted]
- lern_too_spel 2y agoIt wasn't the US government, and it wasn't all users.
- quesera 2y agoCompelled speech, and compelled work, are both disallowed by the US constitution. Apple successfully used this argument several years ago when the FBI tried to demand that they break a phone for an investigation. If there is more recent news or legislation, perhaps I'm not remembering it?
- giobox 2y ago> Compelled speech, and compelled work, are both disallowed by the US constitution... Apple successfully used this argument several years ago when the FBI tried to demand that they break a phone for an investigation. I'm not sure this is how the San Bernardino case actually panned out: "Apple declined to create the software, and a hearing was scheduled for March 22. However, a day before the hearing was supposed to happen, the government obtained a delay, saying it had found a third party able to assist in unlocking the iPhone. On March 28, the government claimed that the FBI had unlocked the iPhone and withdrew its request." The arguments were never actually tested in court, the whole thing was quietly put away once the FBI found another way to unlock the phone. > https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
- quesera 2y agoYes, in this case: successfully used this argument to delay until the FBI gave up. If it had gone to court, the argument was considered strong, but of course no one knows until a verdict is reached and appeals are exhausted.
- giobox 2y agoThis is a gross simplification of the many factors that lead to the FBI dropping the demand against Apple, in my opinion.
- quesera 2y agoBut it is everything we know. The expectation was that FBI would lose in court. But that was not guaranteed, certainly. FBI had multiple reasons to abandon the effort, but one was that if legal precedent was established at that time, for that case, it would be harder to bypass in future cases.
- croes 2y agoBut the US demands data from non US citizens stored in non-US countries aka CloudAct.
- alt227 2y agoApple has a history of giving the US government whatever user data they want, lying about it, then when it leaks publicly they are able to say 'Well we couldnt tell you because it would have been breaking the law, sorry about that'. Have an example, of when it leaked that apple was secretly syphoning off all push notifications to the US government: https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/ https://www.macrumors.com/2023/12/06/apple-governments-surve...
- graeme 2y agoFundamentally not the same thing. Notifications aren't encrypted. Apple has made no claim that they're secret from the govt. Apple has very loudly and prominently and specifically stated that their encrypted is ecrypted and not even available to apple. They list which portions of icloud this applies to and not. Huge different between an omission and a large, positive lie.
- alt227 2y agoThey reason they have 'very loudly and prominently' proclaimed that they will never break encryption, is to make the general public believe their data is safe with Apple. Its purely a marketing stunt. The push message syphoning to governments is only one of many ways they willingly hand over data to governments on request.
- deleted 2y ago[deleted]
- wellthisisgreat 2y agoWell there is still a HUGE difference between some backroom dealing that blows up in government’s face in the most scandalous, generation defining way when it gets exposed, and a bunch of power-hungry troglodytes saying they want to play Orwellian villains in the open.
- JoshTriplett 2y agoWe should not normalize the idea that it's acceptable within a country's borders either. It's a massive overreach to demand a backdoor to phones within the country. Don't allow the even bigger overreach to move the Overton window and make it seem like it should ever be acceptable.
- pc86 2y agoI think it's reasonable here to differentiate between acceptable and legal. It's completely unacceptable, but the British people have proven time and time again they're more than happy to make horrifically unacceptable things completely legal in the pursuit of "safety."
- JoshTriplett 2y agoAs with the US, I would not equate "British lawmakers passed" with "British people are happy to". British people are not given direct referendum on this issue specifically, and all of the mainstream British parties currently support the Snooper's Charter.
- flir 2y agoMate, the "take all steps necessary to root out paedophiles" referendum would be won with 95% of the vote. It's all in the framing, you know that.
- davethedevguy 2y ago> It's all in the framing Yeah, that's the root of the problem, I think. It's easy to sell people that "we just need this one more bit of access to your private data, it helps us stops paedophiles and terrorists", but each step takes us further down a bad path. I'm sure everybody would agree that having full camera surveillance inside every UK home is too far, but no oversight at all is also bad. There is a point along that line where society would say "no, that's enough", but successive governments have realised that they can slowly push that point further right and nobody seems to notice, or care.
- selimthegrim 2y agoDo you remember when Theresa May had to tell the US no when they wanted to profile UK citizens of certain ethnic backgrounds for US travel?
- jeroenhd 2y agoA similar law passed in Australia a few years ago; various Australian law enforcement agencies can request or even demand companies to make changes to their code (read: introduce backdoors). Until people and companies start treating Australian-made software as dangerous to the extent that it affects the economy, other countries will probably follow with similar laws. That should include being hesitant to use American software as well. There's a good reason EU companies aren't allowed to store data on American servers.
- pjc50 2y agoCurrent state of this, as far as I can tell: https://www.firstattribute.com/en/news/eu-data-boundary-for-microsoft-cloud-solutions/ https://www.firstattribute.com/en/news/eu-data-boundary-for-... Note that it's seemingly unclear whether it's OK for EU companies to store data even on EU servers of US parent companies. Although very little has actually been done about this and everyone, governments included, is still using Microsoft 365.
- eapressoandcats 2y agoIn principle as long as a state has legal hooks into a large enough part of the business it’s probably ok. Data centers are less tricky than phones because they don’t move. I’m also not sure there’s so much practical difference between a company headquartered in the EU vs USA. The relevant thing would seem to be where operations happen, and what legal and practical hooks each side has into the company, including physical location of servers and the people who operate and write code for them.
- nickslaughter02 2y agoMore context: https://www.schneier.com/blog/archives/2024/09/australia-threatens-to-force-companies-to-break-encryption.html https://www.schneier.com/blog/archives/2024/09/australia-thr...
- dannyw 2y agoIt’s not just at Australian made hardware or software. You think Australia won’t try to assert this against a global company with presence in Australia?
- kitd 2y agoHere's the BBC report on the matter: https://www.bbc.co.uk/news/articles/c20g288yldko https://www.bbc.co.uk/news/articles/c20g288yldko It applies to content stored using ADP, Apple's E2EE tech. A backdoor into that would mean applying a backdoor into iOS on the phone itself, which is a much larger attack surface than anything centralised. All of which highlights the clownish nature of these regulations. They are so easy for bad actors to circumvent (eg using their own E2EE), resulting in the ridiculous situation where the innocent get their data stolen and the very people you're targeting being completely unaffected.
- swores 2y agoI'm entirely against what the UK government wants, however I would say: Although you're right that tech people would still be able to choose secure encrypted options, the fact is that the majority of criminals by pure numbers are not very sophisticated - so while this sort of backdoor obviously wouldn't be a guarantee that every criminal conversation could be snooped on, it would work on the 90-99% (I'd guess towards 99) who aren't both cautious enough to try to be secure and tech savvy enough to make the right choices. (But it's still a terrible idea, both for the sake of general privacy principles, and for the risk that current or future governments or personnel will abuse the access, and for the risk that criminals outside government will be able to take advantage of the same backdoor.)
- sejje 2y agoFor three whole minutes until everyone knows it's totally compromised and stops doing that
- swores 2y agoSMS is already known to be insecure and easily snooped on with a warrant, and has been used by police around the world in many cases, yet a surprisingly high number of criminals still use it.
- eapressoandcats 2y agoRealistically most criminals probably don’t even turn on ADP, so it will probably move the needle not at all.
- jtbayly 2y agoKind of like the EU overreach on privacy. Whether it’s for a good cause or a bad one, these sorts of overreach are to be opposed.
- arlort 2y agoIt'd be kinda like GDPR if the EU has demanded that non EU companies apply GDPR to non EU citizens As described by the parent post it's nothing like EU "overreach" on privacy (whatever that even means)
- jtbayly 2y agoHow am I supposed to put up a website intended for US citizens onto the world-wide-web, without worrying about GDPR?
- croes 2y agoSo you track your website vistors?
- jtbayly 2y agoI run multiple Discourse sites. You can spin that however you want. People have personal data on my sites for sure. Is that “tracking” in your book? What about in the EU’s book? Anyway, I’m not going to read the GDPR to find out whether that’s “illegal,” no matter what they say.
- alt227 2y agoYou only need to worry about GDPR if you are harvesting and saving personal and identifiable information on your users. If you are not doing that then you dont even have to think about it.
- rogerrogerr 2y agoThis always gets trotted out, usually by people who seem to have never run any web service before. IPs are apparently PII, and all default server configs log them. If you don’t, good luck complying with any security audits that will require you to keep them to make forensics possible. This is just one of the things that makes GDPR, in practice, an “if we don’t like you, we’ll investigate you and will definitely find something” law.
- matt-p 2y agoRight. Who would be the first country the US might go to if it wanted to spy on it's citizens from abroad? Perhaps one who already does this for them using other methods such as wire tapping?
- quesera 2y agoAre you suggesting that the UK government isn't snoopy or creative enough to initiate this idea on their own??
- matt-p 2y agoNo. Maybe it was their idea, maybe it was the US's. One thing's for sure though we wouldn't be pushing ahead with this without the tacit support of the US, particularly in the current environment.
- quesera 2y agoTenuous. The UK did not need US approval to make all of its existing privacy-violating laws. Nor did Australia, or parts of the EU. Don't get me wrong. The only thing holding the US government back from growing all the more monstrous is a patchwork of sketchy laws that might have teeth. But I don't see any reason to assume that the stupidity of Brits is the fault of Americans. This time.
- matt-p 2y agoSo they have us intercept internet traffic and pass it on to them, but they wouldn't want access to data in iCloud? Right, ok sure. I don't know, or care, if we initiated it or the US - but I find folks from the US acting like it's some shocking thing is quite galling.
- quesera 2y agoFWIW, the US govt does not have a back door into the encrypted data held by US companies. A US company is not obligated to create a way to decrypt customer data to respond to a court order. So this is different, and worse. Not everything stupid in the world can be blamed on the US, as it seems you're trying to do. Plenty can! But not everything. Some stupid is home grown. See also: Brexit.
- BiteCode_dev 2y agoThe US, through the Intel ME software, already got a backdoor in most laptop. Using PRISM, it also had one on most big Saas, and now that it's over, it probably has a similar one we don't know about given Snowden's revelations about xkeyscore and how it works. It's very likely they also have a backdoor in Apple phone with a gag order, given Apple was part of PRISM and we can't check their proprietary system. We also know China has backdoors to any software or hardware product you want to sell there. So it is a problem that the UK is asking for this for us, but from their perspective, they are just catching up with the current horrible state of things.
- quesera 2y ago> very likely they also have a backdoor in Apple phone with a gag order, given Apple was part of PRISM People keep repeating this as if PRISM was a voluntary, or even secretly cooperative, program. PRISM was no such thing. PRISM was the US govt snarfing up whatever data they could (under questionable legal authority), but no one has ever alleged that the data they were snarfing was provided willingly or knowingly by Google, Apple, etc. These companies are also victims of PRISM, not participants. All have explicitly refuted claims of any backdoor into their systems. There is no evidence that they are lying, or being forced to lie.
- alt227 2y ago> People keep repeating this as if PRISM was a voluntary, or even secretly cooperative, program. PRISM was no such thing. Wheres the evidence to say they had no idea about it and it was purely an external hacking effort? > All have explicitly refuted claims of any backdoor into their systems. There is no evidence that they are lying, or being forced to lie. Except all the previous times they have lied because the government asked them to. Like the time they willingly gave all users push notifications to the US government and then lied and said they didn't, until it leaked and they admitted they did and then openly spoke about how the government had forced them to keep quiet about it. https://www.macrumors.com/2023/12/06/apple-governments-surveil-push-notifications/ https://www.macrumors.com/2023/12/06/apple-governments-surve...
- 2y ago
- davethedevguy 2y agoI'm from the UK, and I completely agree. The general public either don't know about growing mass surveillance and privacy invasions, or don't care. "Terrorism and child abuse = bad, and if this prevents it and I have nothing to hide then why would it be a problem for me?"
- sunshinerag 2y agoIts for your safety and security /s
- ksec 2y agoIt isn't just UK. This isn't the first time a Nation decided that any company operating on its soil, would have to comply with an order that reach world wide operation and failure to do so would be fined on worldwide revenue. This is just absurd.