8 ms·

How the UK Is Weakening Safety Worldwide

317 points by billybuckwheat 2y ago

deleted 2y ago
[deleted]
GuestFAUniverse 2y ago
Undisclosable backdoors. Very democratic./sarcasm
aboardRat4 2y ago
>While there are no doubt a handful of evil people who would abuse E2EE to better cover their harmful tracks, it also benefits ordinary, law-abiding users by giving them a huge defensive boost against data breaches, massive data collection, unchecked mass surveillance, and a myriad of other threats online Very few people care about such things. Or rather, very few people understand such thing well enough to care about them.
- kristianc 2y ago
  It goes deeper than that in the UK. There's a large (and electorally powerful, as they're often older) proportion of the population who want, no expect, the government to step in and regulate social harms, and has a genuine belief that the good outweighs the harms.
  - Silhouette 2y ago
    Unfortunately as a nation our culture appears to have shifted away from taking personal responsibility for anything. It's always someone else's fault now. Some else's responsibility. Someone else's job. I have seen many comments that this has become worse since the isolation period caused by COVID. I tend to agree but I also think it goes deeper than that. We have some problems in our society that have been festering for much longer and have root causes like inequality, lack of opportunity, and a lack of constructive facilities and positive role models. I hear a lot from friends who work in education about children coming to school with profoundly disturbing attitudes and other children who have experienced nasty forms of abuse. And yes - absolutely the schools and the government should push back against problems like bullying and misogyny and racism where they can. But maybe the answer here isn't just trying to lock up this week's negative social media influencer or introduce unusual and potentially dangerous concepts like regulating online content that is "harmful" yet not illegal or expecting governments to spy on us all and interfere in our lives more often. Maybe we should first be asking why so many kids think they have nothing better to do than spend all day watching that nasty online content in the first place. Maybe we should be asking why so many kids are given unsupervised and unregulated access to ideas they aren't ready to deal with yet. That's about education and children but you can pick almost any hot button topic and find similar examples. Try immigration or people who live entirely off state benefits. You can find plenty of examples where people advocate for papering over social problems but there's a sad lack of discussion about properly fixing the cracks underneath. Those are the real social harms we should be trying to reduce. Unfortunately their perpetrators are often among the first to assume it must be someone else's problem.
    - arkh 2y ago
      > Unfortunately as a nation our culture appears to have shifted away from taking personal responsibility for anything. That's as old as hierarchy. The Hillsborough disaster was in the 90s: every one tried to shift the blame. The different sex abuse scandals (Rotherham, Rochdale, Telford etc.)? Same shit started early 90s and still going on with looking for people other than police to blame.
      - gambiting 2y ago
        I think that it's not just on that scale anymore though - it shifted to affect literally everything in your personal sphere too. Dropped the knife and hurt yourself? Blame manufacturer for making such slippery handle! Drove without adjusting speed for the conditions and ended up in a hedge? Better complain to the local council for not setting the right speed limit! Failed an assignment at school? It must have been badly written! I could keep going and going and going. It's so incredibly rare to hear "yeah that's my fault" nowadays, the first reaction is almost always to immediately blame anything else as if it's a magic get out of jail card(because actually, it is a lot of the time).
  - bell-cot 2y ago
    > There's a large (...) proportion of the population who... That's sadly true in a lot of places. Throw in all the optimism vigilantes - who react badly to any suggestion that the police & justice systems aren't straight out of some "Happy Sunshine Good Guys" children's book - plus all the folks who are trivial to stampede with claims that the gov't somehow needs Yet Another Power (to fight pedophiles, terrorists, or whatever pushes their buttons), and the convenient de-emphasis of history in recent decades... Yeah. Outside of those currently being beaten with the short & dirty end of the stick, freedom has very few supporters.
- hedora 2y ago
  > Very few people care about such things. This is untrue. Here’s a poll from 2019, showing 91% of the US cares: https://www.pewresearch.org/short-reads/2019/11/15/key-takeaways-on-americans-views-about-privacy-surveillance-and-data-sharing/ https://www.pewresearch.org/short-reads/2019/11/15/key-takea... Support for increasing regulation was at about 71% then and still is.
  - aboardRat4 2y ago
    > Here’s a poll from 2019, showing 91% of the US cares: This is a wrong poll, because "privacy" is too broad of a term to meaningfully to assess. Privacy is a "good" thing, so people, of course, respond "I care" because they want to feel good about themselves and care about good things. In reality they don't understand what privacy is and at what price or comes (in terms of inconvenience). >Support for increasing regulation was at about 71% then and still is. That's even better. I remember GDPR being legislated, and everyone was extremely fascinated by how much it "protects" the users, and literally a few days after GDPR came into power, my messenger company blocked me with the following message: "according to GDPR, we must keep your personal data private and secret, and since at the moment we don't have any of your personal data, we can't keep them secret, so we're blocking you. Please, upload a photocopy of you passport by following this link (link) to get unblocked". Again, the word "regulation" is perceived as a "good thing", because the opposite of "regulation" is "chaos, anarchy", and people are afraid of anarchy. If people actually understood what "regulation" means, support would have been way way lower.
    - fsflover 2y ago
      So you blame the law for being banned by a company that doesn't want to obey it? How does it make the law wrong?
      - aboardRat4 2y ago
        What do you mean? They obeyed it to the letter.
- robocat 2y ago
  > very few people understand such thing well enough to care about them Even understanding the risks, there's little that can be done about it. Use a credit card? Need a mortgage? Care about discounts when buying groceries? Have friends that post photos on social media? Live in a small country? Privacy is simply unavailable if you want to live in a modern society.
  - Silhouette 2y ago
    Privacy is simply unavailable if you want to live in a modern society. I think that's unnecessarily defeatist. Privacy has never been a black and white concept. We all share some information with some other people for good reasons. The big change with modern technology has been how easily information can be collected at a massive scale and how many people end up with access to that information and for what purposes they can then use it. Almost none of this change was inevitable or necessary to function in a modern society. Governments could step in to legally regulate the businesses making a fortune off data capitalism any time they wanted to. They just haven't. A cynic might suggest that this is because those businesses have made an awful lot of money. Some of that goes back to the governments in tax revenues. No doubt some of it also goes back to the politicians in campaign contributions. A different cynic might suggest that our governments are typically made up of career politics/media/economics types who are woefully underequipped to even understand the capabilities and implications of the technology that has become such a core part of our lives in the past 20-30 years and so almost totally fail to perceive or mitigate the threats it poses.
    - aboardRat4 2y ago
      >Governments could step in The OP-post is exactly about the (UK) government stepping in. (With disastrous consequences)
      - Silhouette 2y ago
        Not exactly aimed at data capitalism though. We already have some well-intentioned data protection laws in the UK and some more that we inherited from the pre-Brexit EU GDPR. But their implementation has not been very effective at challenging the culture of harvesting whatever personal data businesses can and then attempting to monetise it. Meanwhile like any regulation they introduce a compliance cost for everyone. A better attempt in the same spirit but written by people who actually knew what they were doing and enforced by people who had both good intentions and sufficient resources could undermine a lot of the more toxic practices that have built up since the likes of Facebook and Google made planetary scale corporate surveillance a thing. We could get a long way just by banning two practices - keeping or using personal details provided to make purchases for anything other than administering those sales and incorporating phone-home surveillance into physical products where that surveillance has nothing to do with why a normal customer would buy that product (think TVs, laptops, or cars). It would also help if governments could lead by example on this issue. They necessarily deal with a lot of sometimes sensitive personal data. They - not just national/federal government but all the spin-out agencies and more local forms of government as well - also have a tendency to abuse data collection powers granted to them by broad surveillance law for debatable reasons.
mettamage 2y ago
The crazy thing with allowing for backdoors is that the most capable or trusted advisaries get in first, aka: other nation states and former employees.
- kurthr 2y ago
  Yeah, almost makes you wonder who's actually behind it. Wouldn't be a bad political psyop for a UK/democracy adversary to go after. If the intelligence agencies don't know that their own tools can and will be used against them (and all the data on their own citizens they've kindly gathered for their adversaries) they are willfully ignorant. No excuses.
  - raincom 2y ago
    Who else? Five eyes, obviously.
    - jajko 2y ago
      This is political move, quid pro quo just like everything else. I wonder what UK got in exchange for some public heat (maybe not that much since common folks font care about this)
      - hgomersall 2y ago
        They haven't given anything. We've moved from a government of looney idealogues to a government of insecurity. Labours' actions can be pretty well understood as a need to be taken seriously by the Very Serious People, be that finance, big tech or the security services.
      - bloqs 2y ago
        Always always always assume stupidity over villany.
      - crimsoneer 2y ago
        There's really no need to be conspiratorial about this. Law enforcement has always had a way of reading your communications, and the Uk government believes that shouldn't stop because e2e is becoming the default. Nobody is blackmailing them.
alliao 2y ago
that's why I have long maintained CCP is the biggest threat to all citizens currently living in relatively free societies right now. Our democratic governments are only seemingly disgusted but whoever holds real power are ENTICED "what do you mean with these new tools and policies you've kept a billion people under control"
- chmod775 2y ago
  The CCP first and foremost keeps control by keeping their people happy, and controlling the narrative in such a way that the people are happy. Surveillance in China is a Damocle's sword at worst - hardly used in an enforcement capacity, transgressions (like using VPNs) are mostly ignored, and it's very easy to slip through the cracks. Everyone is breaking laws all the time - they're a tool only selectively used. Police will look the other way as long as you don't force their hand. Funnily enough you don't even need a surveillance state to create bullshit laws that you selectively enforce. They made a surveillance state... and don't really use it. I'm more afraid of surveillance states in a western countries, because they have a much better track record of consequently enforcing laws as written. If they make it illegal to say bad things about the party and use encryption, you can be sure enforcement will go beyond just silently deleting your critical Facebook post and killing your SSH connection. They'll throw the book at you.
  - deleted 2y ago
    [deleted]
  - throwaway290 2y ago
    > Police will look the other way as long as you don't force their hand. They usually don't need to look the other way because people will do it secretly not talk about it openly and most people by a mile would never even use it (because it is illegal and most people don't want to do illegal stuff unless it's necessary and it is not necessary) You don't need to enforce laws strictly to create an obedient population that does not dare think, you just need to have those laws and do a few show trials
    - 2y ago
aqueueaqueue 2y ago
Great article. Something they eluded to but didn't explicitly call out is the "good guys" I.e. the government who use the law to get access can be bad guys for many reasons. One is individual actors. See recent cases of how MI5 agents covered up DV using their privileges. Bad people love power, and they just need to get the right job. Another is a bad government, such as a repressive controlling style government gaining control and having everyone's personal data in a lake.
- bmenrigh 2y ago
  There are no good governments.
  - dijit 2y ago
    I think thats the right mindset to have in cases where power increases. I’m really exhausted with this sovereign citizen crap, but when the government is trying to accrue more powers its worthwhile asking what else can be done with it. For a prescient example: my mother welcomed policies that made protesting more-or-less illegal. “Just Stop Oil” had been doing a lot of nuisance things and she felt it justified. As did the right wing. Now, when the far-right started marching[0] she was horrified to learn the extent of the new powers and said it was orwellian. I use her as an example because I think HN leans left, but it will be the right wing folks who dislike government most. Obviously as a left winger myself- when the right wing government was installing anti-protest measures I was horrified, and was much more keen to point out they it could be used against people like my mum. The government aren’t your friends, they are either changable- meaning all rules have to be solid enough to be used fairly even if the ruling party changes a lot, or: you’re living in something other than democracy, which is largely considered bad. [0]: https://en.wikipedia.org/wiki/2024_United_Kingdom_riots https://en.wikipedia.org/wiki/2024_United_Kingdom_riots
    - wvh 2y ago
      People are massively choosing sides, colours, flags, identities. It's not about left or right. It's about personal opinions and identity, and one side having the power to violently disagree with you, to the point of no recourse. It does not matter if it's a left or right boot that stomps you in the face. I see the same thing in my parents, where actions become scary when "the other side" does them. It's a myopic arms race to the bottom of rational understanding.
politelemon 2y ago
> knowingly insert backdoors into their software Not true however and contradicts itself later. They have inserted backdoors, the backdoors exist. Them holding the keys to it does not magically make it not exist.
- amelius 2y ago
  Who have? And how?
marcus_holmes 2y ago
I flat do not trust that the motivations for the legislation are what the government says. The UK has a history of covering up child abuse by establishment figures, not least Prince Andrew. They are not actually concerned with preventing child abuse. Successive UK governments have tried to remove or weaken encryption over the years since the 90's. There have been a succession of excuses, but mostly "think of the children". The various MI* agencies have said publicly that they cannot carry out their duties (that of spying on UK citizens) while E2E encryption is available. IF they had the courage of their convictions they would just lay out their case for a society with no privacy, have the argument, and accept the conclusion. But I realise this is politically naive.
- Quarrelsome 2y ago
  > The UK has a history of covering up child abuse by establishment figures, not least Prince Andrew. Can we please reference Jimmy Saville instead? Jimmy Saville is an entirely deplorable example of what it is that you're getting at and he got away with blatant and horrific acts until he died. Conversely Prince Andrew is a crap example because what he is accused of (sex with a 17 year old in London in 2001) is actually entirely legal in the UK (age of consent is 16). So to hold him up as a prime example of a problem is just an Americanism.
  - latentsea 2y ago
    > Can we please reference Jimmy Saville instead? Jimmy Saville is an entirely deplorable example of what it is that you're getting at and he got away with blatant and horrific acts until he died. His case comes up on Thursday.
  - InkBloomfield 2y ago
    > So to hold him up as a prime example of a problem is just an Americanism. These girls were trafficked and groomed by Epstein and Maxwell. Even if the woman was older it would still be deeply immoral as these girls/women were trafficked.
    - deleted 2y ago
renegat0x0 2y ago
Crypto wars https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars https://gigazine.net/gsc_news/en/20191223-lotus-notes-nsa-backdoor https://gigazine.net/gsc_news/en/20191223-lotus-notes-nsa-ba... https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html https://archive.nytimes.com/www.nytimes.com/interactive/2013... https://www.eff.org/document/crypto-wars-governments-working-undermine-encryption https://www.eff.org/document/crypto-wars-governments-working... https://theintercept.com/2014/10/17/draft-two-cases-cited-fbi-dude-dumb-dumb https://theintercept.com/2014/10/17/draft-two-cases-cited-fb... https://arstechnica.com/tech-policy/2015/01/uk-prime-minister-wants-backdoors-into-messaging-apps-or-hell-ban-them https://arstechnica.com/tech-policy/2015/01/uk-prime-ministe... https://www.extremetech.com/defense/203275-the-nsa-wants-front-door-access-to-your-encrypted-data https://www.extremetech.com/defense/203275-the-nsa-wants-fro... https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key https://theintercept.com/2015/12/28/recently-bought-a-window... https://arstechnica.com/tech-policy/2016/01/yet-another-bill-seeks-to-weaken-encryption-by-default-on-smartphones https://arstechnica.com/tech-policy/2016/01/yet-another-bill... https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b... https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage https://www.washingtonpost.com/graphics/2020/world/national-... https://www.wired.com/story/europe-break-encryption-leaked-document-csa-law https://www.wired.com/story/europe-break-encryption-leaked-d... https://www.newscientist.com/article/2396510-mathematician-warns-us-spies-may-be-weakening-next-gen-encryption https://www.newscientist.com/article/2396510-mathematician-w... https://www.theregister.com/2024/04/25/asio_afp_accountable_encryption https://www.theregister.com/2024/04/25/asio_afp_accountable_...
PeterStuer 2y ago
"The thing is, Apple has made it abundantly clear in no uncertain terms that they will refuse any request by any government to knowingly insert backdoors into their software." They may say that, and it might even be true, but then again, If they were requested by the US they couldn't speak about it nor refuse without explicit court permission. In the U.S., gag orders under the Stored Communications Act (SCA) (18 U.S.C. § 2705(b)) and National Security Letters (NSLs) under the USA PATRIOT Act prevent companies from disclosing they were compelled to comply with law enforcement or intelligence agency requests. Key Regulations: Stored Communications Act (SCA) – 18 U.S.C. § 2705(b) Allows law enforcement to obtain a court-ordered non-disclosure order preventing a company from telling users or the public about the request. Typically applies to subpoenas, warrants, or other legal demands for electronic communications. National Security Letters (NSLs) – USA PATRIOT Act (18 U.S.C. § 2709) Used by the FBI to request customer information from telecom companies, ISPs, and financial institutions. NSLs often come with an automatic gag order, preventing disclosure. Companies may challenge NSLs in court, but they remain secret unless a judge rules otherwise. Foreign Intelligence Surveillance Act (FISA) Orders – 50 U.S.C. § 1805 Under FISA Section 702, the government can issue secret surveillance orders, and recipients are prohibited from disclosing them unless explicitly allowed. Executive Orders & National Security Directives Certain classified government surveillance programs, like PRISM, may be protected under Executive Orders (e.g., EO 12333) and other national security laws. Cloud Act (2018) While mainly about cross-border data access, it allows the U.S. to enter agreements with foreign governments and may include secrecy provisions regarding data requests.
- motbus3 2y ago
  As back in the 90s lots of "pedophiles" will be found in controversial investigations
- thefz 2y ago
  Apple can state all they want, but since the disclosure of PRISM, I will not believe anything they say. The general population will, however.
  - 2y ago
crimsoneer 2y ago
The Salt Typhoon example doesn't seem relevant, as it looks like it's down to unsecured routers? One more relevant question on this would be something like internet connection records, which when they were introduced everyone said would definitely get leaked. https://en.wikipedia.org/wiki/Collection_of_Internet_Connection_Records https://en.wikipedia.org/wiki/Collection_of_Internet_Connect...
- crimsontech 2y ago
  But from their internal position they fully compromised the system used for wiretapping. https://en.wikipedia.org/wiki/2024_United_States_telecommunications_hack#Wiretapping_systems https://en.wikipedia.org/wiki/2024_United_States_telecommuni...
sph 2y ago
https://www.activism.net/cypherpunk/manifesto.html https://www.activism.net/cypherpunk/manifesto.html 1993 — feels so far away now. Even us techies have become either posers or corporate lackeys, and no one is left to fight for privacy in the digital space.
- literalAardvark 2y ago
  They're drowned out by the eternal September, but they're out there. Expecting most of the population to care about privacy is extraordinary.
- aleph_minus_one 2y ago
  > Even us techies have become either posers or corporate lackeys, and no one is left to fight for privacy in the digital space. I have a feeling that this depends a lot on the country: In the USA, there is now big money to be made in programming jobs, so a lot of people have become what you call "posers or corporate lackeys". Money makes it easy to look away from mass surveillance. On the other hand, in Germany, you can live off of being a programmer, but you very likely won't become rich this way. Additionally in Germany there is, based on the experience of two dictatorships on German soil in the 20th century (where the crimes of the GDR have barely accounted for), much more of a privacy culture at least in some circles than I observe in many other countries.
  - pjmlp 2y ago
    And yet elections went down as they did, because newer generations think it is only fairy tales to scare kids at night. So many lost lessons.
mihaaly 2y ago
Since ProtonMail was mentioned in a context, I wonder what is the fate of the Proton infrastructure in UK, also having encrypted storage of various items similar to iCloud. And the alike (Tresorit, ...). Are they the next? Although it is only partially parallel topic but my current pet peeve about the generic true uninterest of data safety in the UK is the practice of property agents requesting full set of data only necessary at the time of contract - or not even then, like the name of your children - just to start talk about viewing a rental property. Not for the viewing, not for applying for tenancy, no, before even talking about if there is available timeslots for viewing. First reply from them: fill this (very long) form. Some even ask for recent credit check reports uploaded on sending in interest for viewing opportunities. And people comply on masses without apparent hesitation. Years of degrading practice (8 years ago it was much different and less privacy intrusive) means several hundrends of thousands (millions?) people's deep personal data is flowing around in unencrypted emails or forms stored in the third party system (not even at the property agents) the agents dedicate for this purpose, very very fragmented in procedure and solutions and granularity. Apparently there is no objection of the masses as this is a practice property agents escalated to this level claiming "industry practice" when trying to complain. Feels like being alone, refusing, then being refused - I know, I am problematic not handing over all my data on first ask. I wonder what the Information Commissioner's Office will say about the matter. I reported one of the many cases. Only out of curiosity as the matter will be mute not only because of the 16 weeks turnaround for comment - 8 are already passed, and by then we will be out of the UK, for other reasons too - which is awfully slow for anyone affected but by the extent of uninterest for privacy from the UK masses. Property agents are just one tiny part of the pattern actually, asking for your data as the first move is a generic thing from almost all services I came accross. A representative example: - How much would this cost? - What is your name, phone number, address and email address? - the question comes instead of an answer despite that the price depends not the slightest on those data. And this is working this way for very long time. I have a bit of scepticism about if the UK population would ever fight back - risking put into the group of pedofiles by public opinion. I can imagine more arguing for it. As 'Good people have nothing to hide' principle. The "Get Involved" links are for the idealistic ones alone.
upofadown 2y ago
Isn't Apple doing client side encryption? It sounds like there is a key kept in the phone that is used to encrypt the stuff in the cloud. I am not seeing more than one "end" here. What aspect of their scheme causes the article to refer to it as "end to end encryption"? I think this is important because the UK is effectively cracking down here on the very idea of keeping things private. We don't have to bring messaging into this; this is a case of an individual attempting to keep their personal stuff to themselves. Most people would consider that a perfectly normal thing to be able to do.
dp-hackernews 2y ago
First they came for the socialists, and I did not speak out— Because I was not a socialist. Then they came for the trade unionists, and I did not speak out— Because I was not a trade unionist. Then they came for the Jews, and I did not speak out— Because I was not a Jew. Then they came for me—and there was no one left to speak for me.
- mixmastamyk 2y ago
  A great piece, pls attribute.
  - dp-hackernews 2y ago
    https://en.wikipedia.org/wiki/First_They_Came https://en.wikipedia.org/wiki/First_They_Came
LittleTimothy 2y ago
I think it's actually valuable to hear from one of the former Tory ministers who was in favour of the bill says[1]. I don't necessarily agree with him, but it's interesting to hear he essentially argues that you don't have the security you think you do. If a bad actor wants to pwn you they'll do it on your device and you can't stop them. I think that's broadly true of some actors. If you personally are being targetted by a motivated opponent then yes, they will likely target your personal device first and then encrypted cloud is essentially moot. It's also an interesting idea to not say "We need this to tackle CSAM" but instead to say "We need this so that these companies can't enable CSAM whilst claiming to be unaware" - I think on a practical level that does hold more water. At the end of the day though, he doesn't address the clearest problem with these backdoors which is that the payoff value of being able to blanket unencrypted cloud data is of such high value it's extremely likely to get exploited, and for the average person you're more worried about being exposed as part of a broad attack on infrastructure not a targeted attack on your individually. It's also pretty difficult to give credence to the idea that they need this tool to tackle CSAM or organised crime. The reason you can't believe that is because they don't tackle CSAM or organised crime by and large. The UK government simply hasn't prioritized policing that, so we're not in a context of "we're doing all we can but we need more powers", we're in the context of "We can't be bothered, curtail people's rights so our job is easier". I'm sure Apple is not in favour of CSAM, but Apple isn't a member of the British police responsible for investigating and tackling CSAM, why are we trying to recruit them to be? [1]https://x.com/BenWallace70/status/1893936287477912035 https://x.com/BenWallace70/status/1893936287477912035
- rightbyte 2y ago
  > If a bad actor wants to pwn you they'll do it on your device and you can't stop them. I think that's broadly true of some actors. I mean that is correct in the literal sense. Both Google and probably Samsung can hack my device remotely by remote code execution via targeted updates. So American and South Korean authorities. But I don't think any "bad actor" could do it? Like, the Foobarland police. Is that a reasonable take?
- matthewdgreen 2y ago
  I don't think that's very persuasive. Targeted compromise of iPhones is incredibly expensive, and relatively hard for mere criminals to access. If that's the only way for a bad actor to access your data, you've instantly taken everyone but the most wildly sophisticated (and wealthy) criminals and state actors off the table. Meanwhile iCloud backups are available not only to sophisticated folks who can compromise Apple's servers, but also to anyone who can social-engineer a password recovery flow or bribe an Apple customer service agent. Second, re: CSAM, the iCloud ADP system is focused on backing up your personal devices. It is not designed to share data with other users. So a criminal can have CSAM on their phone and simply turn off iCloud Backup (and thus be "invisible") or they can use ADP. The two things are equivalent, and both assume a sophisticated user. I'm sure there's some bizarre and painful scheme where you could use ADP to distribute CSAM to other folks, but there are many easier ways to do that. Once you grant the CSAM point, you're just saying it's necessary for all personal device data to be constantly available for search by the government. (And while I disagree with that opinion, it is an opinion and should be fully fleshed out.)
troyvit 2y ago
When I saw the headline I thought, "what click-baity hyperbole is this now?" That was the attitude I had when I went to read the story, then I got to this part: > and while I always encourage readers to explore other options by privacy-first companies, I (among many other privacy enthusiasts) still touted this as a win for giving the everyday user an easy, effective way to protect their data. Actual. Nuance. It's been a few weeks since I've seen that in my feeds.
agent327 2y ago
So how does this work when I visit the UK with my iPhone. Will it auto-decrypt? Will I be locked out of certain functions?
florbnit 2y ago
I feel like Apple should have made a bolder statement and made the iCloud accounts of all politicians in the UK fully publicly accessible. And state that they would keep them such until the courts finished dealing with the appeal. But of cause Apple has cut its activist roots several decades ago and will stay sober in their dealing, which I also appreciate they feel like the only tech giant who’s actually acting like adults when it comes to privacy.
dp-hackernews 2y ago
"The only thing necessary for the triumph of evil is that good men do nothing." https://quoteinvestigator.com/2010/12/04/good-men-do/ https://quoteinvestigator.com/2010/12/04/good-men-do/

deleted 2y ago

[deleted]

GuestFAUniverse 2y ago

Undisclosable backdoors. Very democratic./sarcasm

aboardRat4 2y ago

>While there are no doubt a handful of evil people who would abuse E2EE to better cover their harmful tracks, it also benefits ordinary, law-abiding users by giving them a huge defensive boost against data breaches, massive data collection, unchecked mass surveillance, and a myriad of other threats online Very few people care about such things. Or rather, very few people understand such thing well enough to care about them.

kristianc 2y ago
It goes deeper than that in the UK. There's a large (and electorally powerful, as they're often older) proportion of the population who want, no expect, the government to step in and regulate social harms, and has a genuine belief that the good outweighs the harms.
- Silhouette 2y ago
  Unfortunately as a nation our culture appears to have shifted away from taking personal responsibility for anything. It's always someone else's fault now. Some else's responsibility. Someone else's job. I have seen many comments that this has become worse since the isolation period caused by COVID. I tend to agree but I also think it goes deeper than that. We have some problems in our society that have been festering for much longer and have root causes like inequality, lack of opportunity, and a lack of constructive facilities and positive role models. I hear a lot from friends who work in education about children coming to school with profoundly disturbing attitudes and other children who have experienced nasty forms of abuse. And yes - absolutely the schools and the government should push back against problems like bullying and misogyny and racism where they can. But maybe the answer here isn't just trying to lock up this week's negative social media influencer or introduce unusual and potentially dangerous concepts like regulating online content that is "harmful" yet not illegal or expecting governments to spy on us all and interfere in our lives more often. Maybe we should first be asking why so many kids think they have nothing better to do than spend all day watching that nasty online content in the first place. Maybe we should be asking why so many kids are given unsupervised and unregulated access to ideas they aren't ready to deal with yet. That's about education and children but you can pick almost any hot button topic and find similar examples. Try immigration or people who live entirely off state benefits. You can find plenty of examples where people advocate for papering over social problems but there's a sad lack of discussion about properly fixing the cracks underneath. Those are the real social harms we should be trying to reduce. Unfortunately their perpetrators are often among the first to assume it must be someone else's problem.
  - arkh 2y ago
    > Unfortunately as a nation our culture appears to have shifted away from taking personal responsibility for anything. That's as old as hierarchy. The Hillsborough disaster was in the 90s: every one tried to shift the blame. The different sex abuse scandals (Rotherham, Rochdale, Telford etc.)? Same shit started early 90s and still going on with looking for people other than police to blame.
    - gambiting 2y ago
      I think that it's not just on that scale anymore though - it shifted to affect literally everything in your personal sphere too. Dropped the knife and hurt yourself? Blame manufacturer for making such slippery handle! Drove without adjusting speed for the conditions and ended up in a hedge? Better complain to the local council for not setting the right speed limit! Failed an assignment at school? It must have been badly written! I could keep going and going and going. It's so incredibly rare to hear "yeah that's my fault" nowadays, the first reaction is almost always to immediately blame anything else as if it's a magic get out of jail card(because actually, it is a lot of the time).
- bell-cot 2y ago
  > There's a large (...) proportion of the population who... That's sadly true in a lot of places. Throw in all the optimism vigilantes - who react badly to any suggestion that the police & justice systems aren't straight out of some "Happy Sunshine Good Guys" children's book - plus all the folks who are trivial to stampede with claims that the gov't somehow needs Yet Another Power (to fight pedophiles, terrorists, or whatever pushes their buttons), and the convenient de-emphasis of history in recent decades... Yeah. Outside of those currently being beaten with the short & dirty end of the stick, freedom has very few supporters.
hedora 2y ago
> Very few people care about such things. This is untrue. Here’s a poll from 2019, showing 91% of the US cares: https://www.pewresearch.org/short-reads/2019/11/15/key-takeaways-on-americans-views-about-privacy-surveillance-and-data-sharing/ https://www.pewresearch.org/short-reads/2019/11/15/key-takea... Support for increasing regulation was at about 71% then and still is.
- aboardRat4 2y ago
  > Here’s a poll from 2019, showing 91% of the US cares: This is a wrong poll, because "privacy" is too broad of a term to meaningfully to assess. Privacy is a "good" thing, so people, of course, respond "I care" because they want to feel good about themselves and care about good things. In reality they don't understand what privacy is and at what price or comes (in terms of inconvenience). >Support for increasing regulation was at about 71% then and still is. That's even better. I remember GDPR being legislated, and everyone was extremely fascinated by how much it "protects" the users, and literally a few days after GDPR came into power, my messenger company blocked me with the following message: "according to GDPR, we must keep your personal data private and secret, and since at the moment we don't have any of your personal data, we can't keep them secret, so we're blocking you. Please, upload a photocopy of you passport by following this link (link) to get unblocked". Again, the word "regulation" is perceived as a "good thing", because the opposite of "regulation" is "chaos, anarchy", and people are afraid of anarchy. If people actually understood what "regulation" means, support would have been way way lower.
  - fsflover 2y ago
    So you blame the law for being banned by a company that doesn't want to obey it? How does it make the law wrong?
    - aboardRat4 2y ago
      What do you mean? They obeyed it to the letter.
robocat 2y ago
> very few people understand such thing well enough to care about them Even understanding the risks, there's little that can be done about it. Use a credit card? Need a mortgage? Care about discounts when buying groceries? Have friends that post photos on social media? Live in a small country? Privacy is simply unavailable if you want to live in a modern society.
- Silhouette 2y ago
  Privacy is simply unavailable if you want to live in a modern society. I think that's unnecessarily defeatist. Privacy has never been a black and white concept. We all share some information with some other people for good reasons. The big change with modern technology has been how easily information can be collected at a massive scale and how many people end up with access to that information and for what purposes they can then use it. Almost none of this change was inevitable or necessary to function in a modern society. Governments could step in to legally regulate the businesses making a fortune off data capitalism any time they wanted to. They just haven't. A cynic might suggest that this is because those businesses have made an awful lot of money. Some of that goes back to the governments in tax revenues. No doubt some of it also goes back to the politicians in campaign contributions. A different cynic might suggest that our governments are typically made up of career politics/media/economics types who are woefully underequipped to even understand the capabilities and implications of the technology that has become such a core part of our lives in the past 20-30 years and so almost totally fail to perceive or mitigate the threats it poses.
  - aboardRat4 2y ago
    >Governments could step in The OP-post is exactly about the (UK) government stepping in. (With disastrous consequences)
    - Silhouette 2y ago
      Not exactly aimed at data capitalism though. We already have some well-intentioned data protection laws in the UK and some more that we inherited from the pre-Brexit EU GDPR. But their implementation has not been very effective at challenging the culture of harvesting whatever personal data businesses can and then attempting to monetise it. Meanwhile like any regulation they introduce a compliance cost for everyone. A better attempt in the same spirit but written by people who actually knew what they were doing and enforced by people who had both good intentions and sufficient resources could undermine a lot of the more toxic practices that have built up since the likes of Facebook and Google made planetary scale corporate surveillance a thing. We could get a long way just by banning two practices - keeping or using personal details provided to make purchases for anything other than administering those sales and incorporating phone-home surveillance into physical products where that surveillance has nothing to do with why a normal customer would buy that product (think TVs, laptops, or cars). It would also help if governments could lead by example on this issue. They necessarily deal with a lot of sometimes sensitive personal data. They - not just national/federal government but all the spin-out agencies and more local forms of government as well - also have a tendency to abuse data collection powers granted to them by broad surveillance law for debatable reasons.

mettamage 2y ago

The crazy thing with allowing for backdoors is that the most capable or trusted advisaries get in first, aka: other nation states and former employees.

kurthr 2y ago
Yeah, almost makes you wonder who's actually behind it. Wouldn't be a bad political psyop for a UK/democracy adversary to go after. If the intelligence agencies don't know that their own tools can and will be used against them (and all the data on their own citizens they've kindly gathered for their adversaries) they are willfully ignorant. No excuses.
- raincom 2y ago
  Who else? Five eyes, obviously.
  - jajko 2y ago
    This is political move, quid pro quo just like everything else. I wonder what UK got in exchange for some public heat (maybe not that much since common folks font care about this)
    - hgomersall 2y ago
      They haven't given anything. We've moved from a government of looney idealogues to a government of insecurity. Labours' actions can be pretty well understood as a need to be taken seriously by the Very Serious People, be that finance, big tech or the security services.
    - bloqs 2y ago
      Always always always assume stupidity over villany.
    - crimsoneer 2y ago
      There's really no need to be conspiratorial about this. Law enforcement has always had a way of reading your communications, and the Uk government believes that shouldn't stop because e2e is becoming the default. Nobody is blackmailing them.

alliao 2y ago

that's why I have long maintained CCP is the biggest threat to all citizens currently living in relatively free societies right now. Our democratic governments are only seemingly disgusted but whoever holds real power are ENTICED "what do you mean with these new tools and policies you've kept a billion people under control"

chmod775 2y ago
The CCP first and foremost keeps control by keeping their people happy, and controlling the narrative in such a way that the people are happy. Surveillance in China is a Damocle's sword at worst - hardly used in an enforcement capacity, transgressions (like using VPNs) are mostly ignored, and it's very easy to slip through the cracks. Everyone is breaking laws all the time - they're a tool only selectively used. Police will look the other way as long as you don't force their hand. Funnily enough you don't even need a surveillance state to create bullshit laws that you selectively enforce. They made a surveillance state... and don't really use it. I'm more afraid of surveillance states in a western countries, because they have a much better track record of consequently enforcing laws as written. If they make it illegal to say bad things about the party and use encryption, you can be sure enforcement will go beyond just silently deleting your critical Facebook post and killing your SSH connection. They'll throw the book at you.
- deleted 2y ago
  [deleted]
- throwaway290 2y ago
  > Police will look the other way as long as you don't force their hand. They usually don't need to look the other way because people will do it secretly not talk about it openly and most people by a mile would never even use it (because it is illegal and most people don't want to do illegal stuff unless it's necessary and it is not necessary) You don't need to enforce laws strictly to create an obedient population that does not dare think, you just need to have those laws and do a few show trials
  - 2y ago

aqueueaqueue 2y ago

Great article. Something they eluded to but didn't explicitly call out is the "good guys" I.e. the government who use the law to get access can be bad guys for many reasons. One is individual actors. See recent cases of how MI5 agents covered up DV using their privileges. Bad people love power, and they just need to get the right job. Another is a bad government, such as a repressive controlling style government gaining control and having everyone's personal data in a lake.

bmenrigh 2y ago
There are no good governments.
- dijit 2y ago
  I think thats the right mindset to have in cases where power increases. I’m really exhausted with this sovereign citizen crap, but when the government is trying to accrue more powers its worthwhile asking what else can be done with it. For a prescient example: my mother welcomed policies that made protesting more-or-less illegal. “Just Stop Oil” had been doing a lot of nuisance things and she felt it justified. As did the right wing. Now, when the far-right started marching[0] she was horrified to learn the extent of the new powers and said it was orwellian. I use her as an example because I think HN leans left, but it will be the right wing folks who dislike government most. Obviously as a left winger myself- when the right wing government was installing anti-protest measures I was horrified, and was much more keen to point out they it could be used against people like my mum. The government aren’t your friends, they are either changable- meaning all rules have to be solid enough to be used fairly even if the ruling party changes a lot, or: you’re living in something other than democracy, which is largely considered bad. [0]: https://en.wikipedia.org/wiki/2024_United_Kingdom_riots https://en.wikipedia.org/wiki/2024_United_Kingdom_riots
  - wvh 2y ago
    People are massively choosing sides, colours, flags, identities. It's not about left or right. It's about personal opinions and identity, and one side having the power to violently disagree with you, to the point of no recourse. It does not matter if it's a left or right boot that stomps you in the face. I see the same thing in my parents, where actions become scary when "the other side" does them. It's a myopic arms race to the bottom of rational understanding.

politelemon 2y ago

> knowingly insert backdoors into their software Not true however and contradicts itself later. They have inserted backdoors, the backdoors exist. Them holding the keys to it does not magically make it not exist.

amelius 2y ago
Who have? And how?

marcus_holmes 2y ago

I flat do not trust that the motivations for the legislation are what the government says. The UK has a history of covering up child abuse by establishment figures, not least Prince Andrew. They are not actually concerned with preventing child abuse. Successive UK governments have tried to remove or weaken encryption over the years since the 90's. There have been a succession of excuses, but mostly "think of the children". The various MI* agencies have said publicly that they cannot carry out their duties (that of spying on UK citizens) while E2E encryption is available. IF they had the courage of their convictions they would just lay out their case for a society with no privacy, have the argument, and accept the conclusion. But I realise this is politically naive.

Quarrelsome 2y ago
> The UK has a history of covering up child abuse by establishment figures, not least Prince Andrew. Can we please reference Jimmy Saville instead? Jimmy Saville is an entirely deplorable example of what it is that you're getting at and he got away with blatant and horrific acts until he died. Conversely Prince Andrew is a crap example because what he is accused of (sex with a 17 year old in London in 2001) is actually entirely legal in the UK (age of consent is 16). So to hold him up as a prime example of a problem is just an Americanism.
- latentsea 2y ago
  > Can we please reference Jimmy Saville instead? Jimmy Saville is an entirely deplorable example of what it is that you're getting at and he got away with blatant and horrific acts until he died. His case comes up on Thursday.
- InkBloomfield 2y ago
  > So to hold him up as a prime example of a problem is just an Americanism. These girls were trafficked and groomed by Epstein and Maxwell. Even if the woman was older it would still be deeply immoral as these girls/women were trafficked.
  - deleted 2y ago

renegat0x0 2y ago

Crypto wars https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars https://gigazine.net/gsc_news/en/20191223-lotus-notes-nsa-backdoor https://gigazine.net/gsc_news/en/20191223-lotus-notes-nsa-ba... https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html https://archive.nytimes.com/www.nytimes.com/interactive/2013... https://www.eff.org/document/crypto-wars-governments-working-undermine-encryption https://www.eff.org/document/crypto-wars-governments-working... https://theintercept.com/2014/10/17/draft-two-cases-cited-fbi-dude-dumb-dumb https://theintercept.com/2014/10/17/draft-two-cases-cited-fb... https://arstechnica.com/tech-policy/2015/01/uk-prime-minister-wants-backdoors-into-messaging-apps-or-hell-ban-them https://arstechnica.com/tech-policy/2015/01/uk-prime-ministe... https://www.extremetech.com/defense/203275-the-nsa-wants-front-door-access-to-your-encrypted-data https://www.extremetech.com/defense/203275-the-nsa-wants-fro... https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key https://theintercept.com/2015/12/28/recently-bought-a-window... https://arstechnica.com/tech-policy/2016/01/yet-another-bill-seeks-to-weaken-encryption-by-default-on-smartphones https://arstechnica.com/tech-policy/2016/01/yet-another-bill... https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b... https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage https://www.washingtonpost.com/graphics/2020/world/national-... https://www.wired.com/story/europe-break-encryption-leaked-document-csa-law https://www.wired.com/story/europe-break-encryption-leaked-d... https://www.newscientist.com/article/2396510-mathematician-warns-us-spies-may-be-weakening-next-gen-encryption https://www.newscientist.com/article/2396510-mathematician-w... https://www.theregister.com/2024/04/25/asio_afp_accountable_encryption https://www.theregister.com/2024/04/25/asio_afp_accountable_...

PeterStuer 2y ago

"The thing is, Apple has made it abundantly clear in no uncertain terms that they will refuse any request by any government to knowingly insert backdoors into their software." They may say that, and it might even be true, but then again, If they were requested by the US they couldn't speak about it nor refuse without explicit court permission. In the U.S., gag orders under the Stored Communications Act (SCA) (18 U.S.C. § 2705(b)) and National Security Letters (NSLs) under the USA PATRIOT Act prevent companies from disclosing they were compelled to comply with law enforcement or intelligence agency requests. Key Regulations: Stored Communications Act (SCA) – 18 U.S.C. § 2705(b) Allows law enforcement to obtain a court-ordered non-disclosure order preventing a company from telling users or the public about the request. Typically applies to subpoenas, warrants, or other legal demands for electronic communications. National Security Letters (NSLs) – USA PATRIOT Act (18 U.S.C. § 2709) Used by the FBI to request customer information from telecom companies, ISPs, and financial institutions. NSLs often come with an automatic gag order, preventing disclosure. Companies may challenge NSLs in court, but they remain secret unless a judge rules otherwise. Foreign Intelligence Surveillance Act (FISA) Orders – 50 U.S.C. § 1805 Under FISA Section 702, the government can issue secret surveillance orders, and recipients are prohibited from disclosing them unless explicitly allowed. Executive Orders & National Security Directives Certain classified government surveillance programs, like PRISM, may be protected under Executive Orders (e.g., EO 12333) and other national security laws. Cloud Act (2018) While mainly about cross-border data access, it allows the U.S. to enter agreements with foreign governments and may include secrecy provisions regarding data requests.

motbus3 2y ago
As back in the 90s lots of "pedophiles" will be found in controversial investigations
thefz 2y ago
Apple can state all they want, but since the disclosure of PRISM, I will not believe anything they say. The general population will, however.
- 2y ago

crimsoneer 2y ago

The Salt Typhoon example doesn't seem relevant, as it looks like it's down to unsecured routers? One more relevant question on this would be something like internet connection records, which when they were introduced everyone said would definitely get leaked. https://en.wikipedia.org/wiki/Collection_of_Internet_Connection_Records https://en.wikipedia.org/wiki/Collection_of_Internet_Connect...

crimsontech 2y ago
But from their internal position they fully compromised the system used for wiretapping. https://en.wikipedia.org/wiki/2024_United_States_telecommunications_hack#Wiretapping_systems https://en.wikipedia.org/wiki/2024_United_States_telecommuni...

sph 2y ago

https://www.activism.net/cypherpunk/manifesto.html https://www.activism.net/cypherpunk/manifesto.html 1993 — feels so far away now. Even us techies have become either posers or corporate lackeys, and no one is left to fight for privacy in the digital space.

literalAardvark 2y ago
They're drowned out by the eternal September, but they're out there. Expecting most of the population to care about privacy is extraordinary.
aleph_minus_one 2y ago
> Even us techies have become either posers or corporate lackeys, and no one is left to fight for privacy in the digital space. I have a feeling that this depends a lot on the country: In the USA, there is now big money to be made in programming jobs, so a lot of people have become what you call "posers or corporate lackeys". Money makes it easy to look away from mass surveillance. On the other hand, in Germany, you can live off of being a programmer, but you very likely won't become rich this way. Additionally in Germany there is, based on the experience of two dictatorships on German soil in the 20th century (where the crimes of the GDR have barely accounted for), much more of a privacy culture at least in some circles than I observe in many other countries.
- pjmlp 2y ago
  And yet elections went down as they did, because newer generations think it is only fairy tales to scare kids at night. So many lost lessons.

mihaaly 2y ago

Since ProtonMail was mentioned in a context, I wonder what is the fate of the Proton infrastructure in UK, also having encrypted storage of various items similar to iCloud. And the alike (Tresorit, ...). Are they the next? Although it is only partially parallel topic but my current pet peeve about the generic true uninterest of data safety in the UK is the practice of property agents requesting full set of data only necessary at the time of contract - or not even then, like the name of your children - just to start talk about viewing a rental property. Not for the viewing, not for applying for tenancy, no, before even talking about if there is available timeslots for viewing. First reply from them: fill this (very long) form. Some even ask for recent credit check reports uploaded on sending in interest for viewing opportunities. And people comply on masses without apparent hesitation. Years of degrading practice (8 years ago it was much different and less privacy intrusive) means several hundrends of thousands (millions?) people's deep personal data is flowing around in unencrypted emails or forms stored in the third party system (not even at the property agents) the agents dedicate for this purpose, very very fragmented in procedure and solutions and granularity. Apparently there is no objection of the masses as this is a practice property agents escalated to this level claiming "industry practice" when trying to complain. Feels like being alone, refusing, then being refused - I know, I am problematic not handing over all my data on first ask. I wonder what the Information Commissioner's Office will say about the matter. I reported one of the many cases. Only out of curiosity as the matter will be mute not only because of the 16 weeks turnaround for comment - 8 are already passed, and by then we will be out of the UK, for other reasons too - which is awfully slow for anyone affected but by the extent of uninterest for privacy from the UK masses. Property agents are just one tiny part of the pattern actually, asking for your data as the first move is a generic thing from almost all services I came accross. A representative example: - How much would this cost? - What is your name, phone number, address and email address? - the question comes instead of an answer despite that the price depends not the slightest on those data. And this is working this way for very long time. I have a bit of scepticism about if the UK population would ever fight back - risking put into the group of pedofiles by public opinion. I can imagine more arguing for it. As 'Good people have nothing to hide' principle. The "Get Involved" links are for the idealistic ones alone.

upofadown 2y ago

Isn't Apple doing client side encryption? It sounds like there is a key kept in the phone that is used to encrypt the stuff in the cloud. I am not seeing more than one "end" here. What aspect of their scheme causes the article to refer to it as "end to end encryption"? I think this is important because the UK is effectively cracking down here on the very idea of keeping things private. We don't have to bring messaging into this; this is a case of an individual attempting to keep their personal stuff to themselves. Most people would consider that a perfectly normal thing to be able to do.

dp-hackernews 2y ago

First they came for the socialists, and I did not speak out— Because I was not a socialist. Then they came for the trade unionists, and I did not speak out— Because I was not a trade unionist. Then they came for the Jews, and I did not speak out— Because I was not a Jew. Then they came for me—and there was no one left to speak for me.

mixmastamyk 2y ago
A great piece, pls attribute.
- dp-hackernews 2y ago
  https://en.wikipedia.org/wiki/First_They_Came https://en.wikipedia.org/wiki/First_They_Came

LittleTimothy 2y ago

I think it's actually valuable to hear from one of the former Tory ministers who was in favour of the bill says[1]. I don't necessarily agree with him, but it's interesting to hear he essentially argues that you don't have the security you think you do. If a bad actor wants to pwn you they'll do it on your device and you can't stop them. I think that's broadly true of some actors. If you personally are being targetted by a motivated opponent then yes, they will likely target your personal device first and then encrypted cloud is essentially moot. It's also an interesting idea to not say "We need this to tackle CSAM" but instead to say "We need this so that these companies can't enable CSAM whilst claiming to be unaware" - I think on a practical level that does hold more water. At the end of the day though, he doesn't address the clearest problem with these backdoors which is that the payoff value of being able to blanket unencrypted cloud data is of such high value it's extremely likely to get exploited, and for the average person you're more worried about being exposed as part of a broad attack on infrastructure not a targeted attack on your individually. It's also pretty difficult to give credence to the idea that they need this tool to tackle CSAM or organised crime. The reason you can't believe that is because they don't tackle CSAM or organised crime by and large. The UK government simply hasn't prioritized policing that, so we're not in a context of "we're doing all we can but we need more powers", we're in the context of "We can't be bothered, curtail people's rights so our job is easier". I'm sure Apple is not in favour of CSAM, but Apple isn't a member of the British police responsible for investigating and tackling CSAM, why are we trying to recruit them to be? [1]https://x.com/BenWallace70/status/1893936287477912035 https://x.com/BenWallace70/status/1893936287477912035

rightbyte 2y ago
> If a bad actor wants to pwn you they'll do it on your device and you can't stop them. I think that's broadly true of some actors. I mean that is correct in the literal sense. Both Google and probably Samsung can hack my device remotely by remote code execution via targeted updates. So American and South Korean authorities. But I don't think any "bad actor" could do it? Like, the Foobarland police. Is that a reasonable take?
matthewdgreen 2y ago
I don't think that's very persuasive. Targeted compromise of iPhones is incredibly expensive, and relatively hard for mere criminals to access. If that's the only way for a bad actor to access your data, you've instantly taken everyone but the most wildly sophisticated (and wealthy) criminals and state actors off the table. Meanwhile iCloud backups are available not only to sophisticated folks who can compromise Apple's servers, but also to anyone who can social-engineer a password recovery flow or bribe an Apple customer service agent. Second, re: CSAM, the iCloud ADP system is focused on backing up your personal devices. It is not designed to share data with other users. So a criminal can have CSAM on their phone and simply turn off iCloud Backup (and thus be "invisible") or they can use ADP. The two things are equivalent, and both assume a sophisticated user. I'm sure there's some bizarre and painful scheme where you could use ADP to distribute CSAM to other folks, but there are many easier ways to do that. Once you grant the CSAM point, you're just saying it's necessary for all personal device data to be constantly available for search by the government. (And while I disagree with that opinion, it is an opinion and should be fully fleshed out.)

troyvit 2y ago

When I saw the headline I thought, "what click-baity hyperbole is this now?" That was the attitude I had when I went to read the story, then I got to this part: > and while I always encourage readers to explore other options by privacy-first companies, I (among many other privacy enthusiasts) still touted this as a win for giving the everyday user an easy, effective way to protect their data. Actual. Nuance. It's been a few weeks since I've seen that in my feeds.

agent327 2y ago

So how does this work when I visit the UK with my iPhone. Will it auto-decrypt? Will I be locked out of certain functions?

florbnit 2y ago

I feel like Apple should have made a bolder statement and made the iCloud accounts of all politicians in the UK fully publicly accessible. And state that they would keep them such until the courts finished dealing with the appeal. But of cause Apple has cut its activist roots several decades ago and will stay sober in their dealing, which I also appreciate they feel like the only tech giant who’s actually acting like adults when it comes to privacy.

dp-hackernews 2y ago

"The only thing necessary for the triumph of evil is that good men do nothing." https://quoteinvestigator.com/2010/12/04/good-men-do/ https://quoteinvestigator.com/2010/12/04/good-men-do/