5 ms·

US examining whether UK's encryption demand on Apple broke data treaty

62 points by Shank 2y ago

stuaxo 2y ago
"Upon initial review of the U.S. and U.K. bilateral CLOUD Act Agreement, the United Kingdom may not issue demands for data of U.S. citizens, nationals, or lawful permanent residents ("U.S. persons"),..." OK, I can see that, though even then I could imagine this sometimes being the case. "...nor is it authorized to demand the data of persons located inside the United States." Really, even if in the case of individual UK citizens, under all circumstances ?
- Retric 2y ago
  Demand isn’t the same thing as request. As long as the US is willing to rubber stamp most requests it’s not nearly as limiting in practice as it might seem in theory.
- bryanrasmussen 2y ago
  I'm thinking in this case there is probably a legal difference between "may not" and "is not authorized", so I would expect the interpretation would be you can request data on a UK citizen in the US but not demand - so up to whoever you request it from. For any U.S Person you may not say anything about it at all. I mean that is totally reasonable, if they want that data it's basically a diplomatic matter not a demand you issue.
  - genewitch 2y ago
    Under no circumstances will UK be authorized to spy on a US citizen; the UK may possibly get authoritarian to spy on a UK citizen in the US, but can't do it merely because it's someone they're interested in or even a UK citizen visiting. With your clarification.
    - genewitch 2y ago
      uh, no pun intended on "authoritarian" the word i wanted to be there was "authorization"!
- dfawcus 2y ago
  Except surely the UK hasn't? What they've reportedly demanded is that systems be changed, so that later a demand for data may be be effective. As to if any hypothetical later demand for later would contravene the agreement would seem to simply be speculation for the moment. Surely the UK could just be careful not make a contravening demand at that time? Which would then make this whole "review" a case of PR on the part of the US politician. Now it is quite bad that the UK has apparently triggered this bit of the snoopers charter, but it would seem to be othogonal to that agreement.* * Unless someone bothers to review the agreement, and finds that such meta-demand are covered.
nullbyte808 2y ago
If I were Gabbard, I would go further and be more concerned that a UK company forced a US company to downgrade its privacy to suit its politics on privacy, which clearly confict with US ideals of privacy and free speech.
- suddenlybananas 2y ago
  Well, the UK is a sovereign country so they have the right to tell companies operating in their borders to do what they please.
  - lom 2y ago
    Doesn’t mean that the US government just needs to accept that.
    - beardyw 2y ago
      What does the US government have to do with it?
      - lodovic 2y ago
        The US government allowing a US company to operate in the US market, while the company enables a foreign country to access all US citizen's data. That's where the government is supposed to step in.
        beardyw 2y ago
        No, that is not the intention. If that were the case US diplomats would have intervened before now. Or maybe they were engaged in writing up what they did last week.
        lodovic 2y ago
        It's how I understood the UK's request to Apple, "Give us a global backdoor". If not, what was the intention?
cjs_ac 2y ago
Speaking as the person who pops up to defend the Online Safety Act (which regulates social media), I think the Investigatory Powers Act (which allows for this spat with Apple) is a terrible piece of legislation. The Online Safety Act is about internet systems that are akin to traditional publishing, and so it holds the operators of those systems to the same standards to which we hold traditional publishers, but the Investigatory Powers Act relates to individuals' private use of computer systems. It represents a serious breach of individuals' privacy, which is a foundation stone in the culture of a country as densely populated as the United Kingdom. The extraterritorial aspect of the legislation is not only uncouth in the twenty-first century, but presently unenforcible given the United Kingdom's diminished Armed Forces. Finally, choosing to pick this fight now was a poor choice given the current state of international politics.
- porker 2y ago
  > Speaking as the person who pops up to defend the Online Safety Act Do you defend the aims of the Act, the Act itself, or both? I'm having to figure out compliance for a volunteer run, donation funded forum, and I think the Act itself could (and should) have been better written. I don't think Ofcom can handle it better than they are, because until it's tested in court they haven't the ability to say what the vague and undefined terms mean.
  - cjs_ac 2y ago
    The Online Safety Act is vague because its purpose is not to create a regulatory system, but instead to empower Ofcom to create a regulatory system that can effectively regulate a wide range of business models and online services, including those that do not exist and are currently inconceivable. If you're looking for advice on how to comply with the act, the go-to person is Heather Burns[0]. [0] https://heatherburns.tech/ https://heatherburns.tech/
    - JoshTriplett 2y ago
      > The Online Safety Act is vague because its purpose is not to create a regulatory system, but instead to empower Ofcom to create a regulatory system that can effectively regulate a wide range of business models and online services, including those that do not exist and are currently inconceivable. And that awful purpose is something you see fit to defend?
ivan_gammel 2y ago
What happens to foreign citizens traveling to UK with encrypted devices? If I have advanced data protection on my iPhone, it surely won't be disabled automatically when I cross the border. How do they handle this case legally?
- soco 2y ago
  I think you are subject to local laws when you travel. So the question is rather, can UK request you to unlock it yourself?
  - Urahandystar 2y ago
    Yes see the case of the french journalist held under the terrorism act at the request of the french government. Whether you do or don't is up to you and your willingness to spend years in prison.
    - ivan_gammel 2y ago
      That was illegal, apparently. He sued and settled: https://www.bbc.com/news/uk-england-london-68922874 https://www.bbc.com/news/uk-england-london-68922874
      - soco 2y ago
        I think you will agree that not many people will choose this path, doing jail time while waiting for a settlement. At least I definitely wouldn't. So then, what is the point of this strong encryption, when the only time it would matter you can and will be forced to skip it? The xkcd $5 wrench will always look stronger, be it wielded by a criminal or by a government. Encryption is only as good as real life allows, so in this situation if you want stronger encryption against the government, you must have a law permitting that. As for protection from the criminals, good luck.
        ivan_gammel 2y ago
        They detained him for 24 hours instead of allowed 6. Not a big deal. I have no details on what happened next, but to be able to sue he must have been cleared by court. So the remaining question will be if police abuse is systemic or exceptional in the UK?
hsuduebc2 2y ago
I'm certainly sure that US is spying on everyone it wants. This is ridiculously hypocritical and I wouldn't be surprised if this was motivated by some politics.
- itopaloglu83 2y ago
  UK is trying to force Apple grant access to any and all persons worldwide not just their own citizens. Practically strong arming an American company to spy on the entire world for them. Why would any other sovereign country allow their own citizens’ privacy to be violated in their own country for UK?
- SR2Z 2y ago
  The US is spying on everyone it wants, but is compelled by its own laws to allow strong encryption to exist and be used. That the country is STILL able to spy is the result of huge amounts of spending and insecure applications. It's pretty well known that most US law enforcement cannot get into a locked iPhone, for example.

62 points by Shank 2y ago

"Upon initial review of the U.S. and U.K. bilateral CLOUD Act Agreement, the United Kingdom may not issue demands for data of U.S. citizens, nationals, or lawful permanent residents ("U.S. persons"),..." OK, I can see that, though even then I could imagine this sometimes being the case. "...nor is it authorized to demand the data of persons located inside the United States." Really, even if in the case of individual UK citizens, under all circumstances ?

Retric 2y ago
Demand isn’t the same thing as request. As long as the US is willing to rubber stamp most requests it’s not nearly as limiting in practice as it might seem in theory.
bryanrasmussen 2y ago
I'm thinking in this case there is probably a legal difference between "may not" and "is not authorized", so I would expect the interpretation would be you can request data on a UK citizen in the US but not demand - so up to whoever you request it from. For any U.S Person you may not say anything about it at all. I mean that is totally reasonable, if they want that data it's basically a diplomatic matter not a demand you issue.
- genewitch 2y ago
  Under no circumstances will UK be authorized to spy on a US citizen; the UK may possibly get authoritarian to spy on a UK citizen in the US, but can't do it merely because it's someone they're interested in or even a UK citizen visiting. With your clarification.
  - genewitch 2y ago
    uh, no pun intended on "authoritarian" the word i wanted to be there was "authorization"!
dfawcus 2y ago
Except surely the UK hasn't? What they've reportedly demanded is that systems be changed, so that later a demand for data may be be effective. As to if any hypothetical later demand for later would contravene the agreement would seem to simply be speculation for the moment. Surely the UK could just be careful not make a contravening demand at that time? Which would then make this whole "review" a case of PR on the part of the US politician. Now it is quite bad that the UK has apparently triggered this bit of the snoopers charter, but it would seem to be othogonal to that agreement.* * Unless someone bothers to review the agreement, and finds that such meta-demand are covered.

nullbyte808 2y ago

If I were Gabbard, I would go further and be more concerned that a UK company forced a US company to downgrade its privacy to suit its politics on privacy, which clearly confict with US ideals of privacy and free speech.

suddenlybananas 2y ago
Well, the UK is a sovereign country so they have the right to tell companies operating in their borders to do what they please.
- lom 2y ago
  Doesn’t mean that the US government just needs to accept that.
  - beardyw 2y ago
    What does the US government have to do with it?
    - lodovic 2y ago
      The US government allowing a US company to operate in the US market, while the company enables a foreign country to access all US citizen's data. That's where the government is supposed to step in.
      - beardyw 2y ago
        No, that is not the intention. If that were the case US diplomats would have intervened before now. Or maybe they were engaged in writing up what they did last week.
        lodovic 2y ago
        It's how I understood the UK's request to Apple, "Give us a global backdoor". If not, what was the intention?

cjs_ac 2y ago

Speaking as the person who pops up to defend the Online Safety Act (which regulates social media), I think the Investigatory Powers Act (which allows for this spat with Apple) is a terrible piece of legislation. The Online Safety Act is about internet systems that are akin to traditional publishing, and so it holds the operators of those systems to the same standards to which we hold traditional publishers, but the Investigatory Powers Act relates to individuals' private use of computer systems. It represents a serious breach of individuals' privacy, which is a foundation stone in the culture of a country as densely populated as the United Kingdom. The extraterritorial aspect of the legislation is not only uncouth in the twenty-first century, but presently unenforcible given the United Kingdom's diminished Armed Forces. Finally, choosing to pick this fight now was a poor choice given the current state of international politics.

porker 2y ago
> Speaking as the person who pops up to defend the Online Safety Act Do you defend the aims of the Act, the Act itself, or both? I'm having to figure out compliance for a volunteer run, donation funded forum, and I think the Act itself could (and should) have been better written. I don't think Ofcom can handle it better than they are, because until it's tested in court they haven't the ability to say what the vague and undefined terms mean.
- cjs_ac 2y ago
  The Online Safety Act is vague because its purpose is not to create a regulatory system, but instead to empower Ofcom to create a regulatory system that can effectively regulate a wide range of business models and online services, including those that do not exist and are currently inconceivable. If you're looking for advice on how to comply with the act, the go-to person is Heather Burns[0]. [0] https://heatherburns.tech/ https://heatherburns.tech/
  - JoshTriplett 2y ago
    > The Online Safety Act is vague because its purpose is not to create a regulatory system, but instead to empower Ofcom to create a regulatory system that can effectively regulate a wide range of business models and online services, including those that do not exist and are currently inconceivable. And that awful purpose is something you see fit to defend?

ivan_gammel 2y ago

What happens to foreign citizens traveling to UK with encrypted devices? If I have advanced data protection on my iPhone, it surely won't be disabled automatically when I cross the border. How do they handle this case legally?

soco 2y ago
I think you are subject to local laws when you travel. So the question is rather, can UK request you to unlock it yourself?
- Urahandystar 2y ago
  Yes see the case of the french journalist held under the terrorism act at the request of the french government. Whether you do or don't is up to you and your willingness to spend years in prison.
  - ivan_gammel 2y ago
    That was illegal, apparently. He sued and settled: https://www.bbc.com/news/uk-england-london-68922874 https://www.bbc.com/news/uk-england-london-68922874
    - soco 2y ago
      I think you will agree that not many people will choose this path, doing jail time while waiting for a settlement. At least I definitely wouldn't. So then, what is the point of this strong encryption, when the only time it would matter you can and will be forced to skip it? The xkcd $5 wrench will always look stronger, be it wielded by a criminal or by a government. Encryption is only as good as real life allows, so in this situation if you want stronger encryption against the government, you must have a law permitting that. As for protection from the criminals, good luck.
      - ivan_gammel 2y ago
        They detained him for 24 hours instead of allowed 6. Not a big deal. I have no details on what happened next, but to be able to sue he must have been cleared by court. So the remaining question will be if police abuse is systemic or exceptional in the UK?

hsuduebc2 2y ago

I'm certainly sure that US is spying on everyone it wants. This is ridiculously hypocritical and I wouldn't be surprised if this was motivated by some politics.

itopaloglu83 2y ago
UK is trying to force Apple grant access to any and all persons worldwide not just their own citizens. Practically strong arming an American company to spy on the entire world for them. Why would any other sovereign country allow their own citizens’ privacy to be violated in their own country for UK?
SR2Z 2y ago
The US is spying on everyone it wants, but is compelled by its own laws to allow strong encryption to exist and be used. That the country is STILL able to spy is the result of huge amounts of spending and insecure applications. It's pretty well known that most US law enforcement cannot get into a locked iPhone, for example.