4 ms·

The headline attached to this submission is sensationalist and misleading. GCHQ did not force CertiVox to shut down PrivateSky. CertiVox decided to close Privat

The headline attached to this submission is sensationalist and misleading. GCHQ did not force CertiVox to shut down PrivateSky. CertiVox decided to close PrivateSky after they were served with a notice issued under section 49 of the Regulation of Investigatory Powers Act (RIPA) which required that they hand over the key(s) required to decrypt one (or more) of their customer's data. The underlying legislation can be found here: http://www.legislation.gov.uk/ukpga/2000/23/contents http://www.legislation.gov.uk/ukpga/2000/23/contents The relevant section is 49 but sections 53 (Failure to comply with a notice) and 54 (Tipping off) are also of particular interest.

kintamanimatt 13y ago
I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.
- Bahamut 13y ago
  Arguably it is a problem they created by the architecture they chose, in which this is a fatal flaw of design that was almost certainly something that could be anticipated.
  - kintamanimatt 13y ago
    I do agree, but historically we've been able to write software in an environment we didn't foresee being hostile. We've been too trusting and blasé when it comes to privacy and security. For example, look at the original SMTP implementation: the designers didn't take into account there might be governments or other bad actors that would snoop wholesale on such messages as they bounced around the infrastructure. If the original designers had known, the specification would have undoubtedly been different. It's also hard to create a system that's private and secure, and it's vastly less convenient to use which increases friction and drives down adoption. PGP, for example, is very good but extremely inconvenient to use all the time. As an outsider, I think I understand the rationale behind their design decisions. Just saying it should have been more carefully created with privacy in mind glosses over the many complexities and difficulties that design goal entails. We, as creators of software, have problems that are more political than technical, no matter where we are in the world.
- jackgavigan 13y ago
  > They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316 https://news.ycombinator.com/item?id=6894316
  - RobAley 13y ago
    Nope, the beginning of one. Life is never black and white like that.
  - deleted 13y ago
    [deleted]
  - kintamanimatt 13y ago
    End of discussion? No, sir, it is not! Your interpretation is extremely naïve. I could hold a gun to your head, for example. You wouldn't be forced per se to meet my demands, but you probably would because it would be extremely unreasonable not to. In the same way, the consequences for not complying are: an extremely expensive and possibly unaffordable rewrite, going to jail for a few years, or giving up their customers data in violation of their principles. The GHCQ order effectively put a gun to their head.
    - lttlrck 13y ago
      Why is it extremely unreasonable to not comply when there is a gun at your head but not in this case?
      - kintamanimatt 13y ago
        I think you've misread what I wrote.
    - jackgavigan 13y ago
      > I could hold a gun to your head, for example. You wouldn't be forced per se to meet my demands, but you probably would because it would be extremely unreasonable not to. GCHQ never demanded that CertiVox shut down their service. That is the bottom line and, no matter what sort of ridiculous "gun against your head" rationale you come up with or how firmly you plug your ears while shouting "LALALA!" at the top of your voice; you cannot refute that fact. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316 https://news.ycombinator.com/item?id=6894316
Zigurd 13y ago
That doesn't appear to be the whole story. The claim to have needed to re-engineer their system to have access to keys, effectively making it a different service than it had been. And that means that a demand for keys can effectively make services where users' key are not accessible impermissible.
- bribriinlondon2 13y ago
  Again, that's the silver lining in this story. For details on how trust is split to assure no single point of failure, have a look at https://certivox.org/pages/viewpage.action?pageId=10420248 https://certivox.org/pages/viewpage.action?pageId=10420248 "Distributed Trust Authority"

kintamanimatt 13y ago

I disagree. The headline is reasonable because you can be put in a position in which you're not forced to do something, but it's extremely unreasonable not to do that thing. They weren't forced to close down per se, but their other options were extremely infeasible or reprehensible.

Bahamut 13y ago
Arguably it is a problem they created by the architecture they chose, in which this is a fatal flaw of design that was almost certainly something that could be anticipated.
- kintamanimatt 13y ago
  I do agree, but historically we've been able to write software in an environment we didn't foresee being hostile. We've been too trusting and blasé when it comes to privacy and security. For example, look at the original SMTP implementation: the designers didn't take into account there might be governments or other bad actors that would snoop wholesale on such messages as they bounced around the infrastructure. If the original designers had known, the specification would have undoubtedly been different. It's also hard to create a system that's private and secure, and it's vastly less convenient to use which increases friction and drives down adoption. PGP, for example, is very good but extremely inconvenient to use all the time. As an outsider, I think I understand the rationale behind their design decisions. Just saying it should have been more carefully created with privacy in mind glosses over the many complexities and difficulties that design goal entails. We, as creators of software, have problems that are more political than technical, no matter where we are in the world.
jackgavigan 13y ago
> They weren't forced to close down per se... That's the crux of the issue. They weren't forced to close down, they chose to. End of discussion. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316 https://news.ycombinator.com/item?id=6894316
- RobAley 13y ago
  Nope, the beginning of one. Life is never black and white like that.
- deleted 13y ago
  [deleted]
- kintamanimatt 13y ago
  End of discussion? No, sir, it is not! Your interpretation is extremely naïve. I could hold a gun to your head, for example. You wouldn't be forced per se to meet my demands, but you probably would because it would be extremely unreasonable not to. In the same way, the consequences for not complying are: an extremely expensive and possibly unaffordable rewrite, going to jail for a few years, or giving up their customers data in violation of their principles. The GHCQ order effectively put a gun to their head.
  - lttlrck 13y ago
    Why is it extremely unreasonable to not comply when there is a gun at your head but not in this case?
    - kintamanimatt 13y ago
      I think you've misread what I wrote.
  - jackgavigan 13y ago
    > I could hold a gun to your head, for example. You wouldn't be forced per se to meet my demands, but you probably would because it would be extremely unreasonable not to. GCHQ never demanded that CertiVox shut down their service. That is the bottom line and, no matter what sort of ridiculous "gun against your head" rationale you come up with or how firmly you plug your ears while shouting "LALALA!" at the top of your voice; you cannot refute that fact. EDIT: Actually, why don't we see what the CEO of CertiVox has to say on the matter? "The headline strongly infers our friends at GCHQ “forced” us to take PrivateSky down. That’s hogwash." Source: https://news.ycombinator.com/item?id=6894316 https://news.ycombinator.com/item?id=6894316

Zigurd 13y ago

That doesn't appear to be the whole story. The claim to have needed to re-engineer their system to have access to keys, effectively making it a different service than it had been. And that means that a demand for keys can effectively make services where users' key are not accessible impermissible.

bribriinlondon2 13y ago
Again, that's the silver lining in this story. For details on how trust is split to assure no single point of failure, have a look at https://certivox.org/pages/viewpage.action?pageId=10420248 https://certivox.org/pages/viewpage.action?pageId=10420248 "Distributed Trust Authority"