The UK's Proposed Spy Law Would Force Apple to Secretly Hack its Phones Too
eff.org
eff.org
you mean "we can vote another similar group in"
And GHQ will be the same people
Moreover there is evidence that at least some makers of mobile baseband systems included the ability to parse and execute special commands to turn phones into room bugs. This was revealed in a federal case against mafia activity. So it's not unprecedented for very large technology companies to comply with requests of that nature and keep them confidential.
I didn't mean that as an absolute demand. Rather, I disapprove of the absolute x-sucks attitude, along the lines of "guaranteed Intel did <name bad thing>, after all <some other bigco> did <some other bad thing>".
Either everyone can have access to locks, Mr. Cameron, or nobody has locks. And by the way, since locks already exist, and since they are in the form of software which can be replicated across the world in seconds, and in the brains of people across the world, it's going to be impossible to enforce the no-locks law without introducing the world described by George Orwell in his seminal work, 1984.
And that exploit will be worked on from hour one.
The world where management was under constant scrutiny but proles not ?
In "1984" the "proles" weren't constantly monitored, but they also had no influence to anything.
But you are right, the techological capabilities of today seem to surpass the imagination of the author writing the book 70 years ago.
I'd guess that there would be huge complaints from the populace. I'd guess that Android providers would swoop in.
However, given Google's support of Apple's position here, would they too try to influence the hardware providers to pull out too (not bloody likely, I'd hazard.)?
Given that this election cycle seems to be leaning toward a 'burn the place down' mentality, I wonder if now is not the perfect time to be drawing lines in the sand…
> I'd guess that there would be huge complaints from the populace.
Probably. Most people seem to care more about the latest Apple status symbol than about privacy. They don't seem to realize that the surveillance systems that are being put in place now, could for example be used against labor activists, who are simply fighting for decent wages and safe working conditions for ordinary people, in the future.
Would this result in a sales/import ban?
How would this effect devices already in circulation?
This would certainly educate the populous that the conversations happening in parliament and the media do/are having a direct impact into their daily lives - especially if it means someone is considering banning their favorite phone.
Plus, the government relies on encryption for communication too. Are they going to say that only certain government officials should be allowed to use secure devices? What happens when someone in government wants to have a private conversation with someone in the private sector? The private sector person will need a secure device too, and we're back where we started.
The fact is our government needs to figure out how to keep us safe without relying on backdoors.
If Apple pulls out, then maybe. If Samsung pulled all it's Android phones, some other company would just swoop in and replace them. You would end up with a marked filled with companies with no morals, who just do what ever the government asks, no questions asked.
You run the risk of companies that are actually trying to do the right thing going out of business, and you left with the ones with no morals. Apple might be a bit different, customers would complain bitterly if iPhones where no longer available in the UK.
Nobody else has proven to be at his level, as far as I can remember. Not during my lifetime anyways.
The press is asking questions about Apple vs. DOJ daily in the White House Press Secretary's briefings [2] [3]
[1] http://www.politico.com/tipsheets/morning-cybersecurity/2016...
[2] https://www.whitehouse.gov/the-press-office/2016/02/24/press...
The EFF always seem to go just that little bit too far and make their arguments silly. Do they really seek to convince us that the UK authorities are "exploiting" terrorist attacks to gain access to people's everyday inane communications?
People don't care about government seeing their communications because their communications aren't worth seeing.
If it saves one life for the a GCHQ analyst to see all my inane texts (SMS) then I'm absolutely fine with that [in practice of course it's more like, they check the metadata and decide to ignore me, then delete all the data after a year or two].
They also mention 'the legislation will let them do this and that' but they don't mention the restrictions, like needing warrants or court orders, or signed permissions from the Secretary of State, or whatever. The way it's couched is 'all your communications will be accessed whenever the gov want' - if there really aren't any preconditions then the EFF should have shouted about that more, if there are any then they appear to be being deceptive by not mentioning them.
We've enough politicians not being straight with us already, we don't need pressure groups doing the same.
Looking for example at S189 [1] of the IPB one sees that (though I only took a cursory look) the requirement for a telecoms/postal company to take action needs first a warrant from the court (warrants tend to require evidence of criminal activity, not just suspicion, but again I haven't looked in detail about the specifics here - the EFF lawyers presumably have). The the Secretary of State (SoS) needs to make consultations with relevant parties including the Technical Advisory Board and representatives of the manufacturers/service operators.
People are talking about infringement of HRA/ECHR or generally held moral rights but there is a balance between the right to privacy and the right for the populous to use the mechanisms of state to enable the proper investigation of criminal activity (and other non-beneficial actions). Whilst I have rights not to have my family life impinged on by the state they only extend so far as it is not necessary to limit those rights to protect my children, say, or prevent me committing crimes. I'm pretty much OK with that and think the majority of the populous - who are decried here as sheeple - are OK with the state having such powers _given the checks and balances built in to the legal system in the UK_.
If the government see people taking part in criminal activity and solicit a warrant from the court and in order to perform a search in that warrant the SoS finds there is sufficient suggestion of a national security issue, or significant loss of life, and on consultation with the affected companies they find that access to that information is possible with limited financial cost, then I consider that the SoS should be able to issue an order that the company cooperates with the legal system to enable appropriate officers to see the content that would otherwise be hidden.
[ 1 - See for example the S189 on p180 and the explanatory notes on pp 285+, https://www.gov.uk/government/uploads/system/uploads/attachm...]
>The EFF always seem to go just that little bit too far and make their arguments silly. Do they really seek to convince us that the UK authorities are "exploiting" terrorist attacks to gain access to people's everyday inane communications?
Yes, just watch the interviews of a Home Secretary on the news after any terrorist news.
> If it saves one life for the a GCHQ analyst to see all my inane texts (SMS) then I'm absolutely fine with that [in practice of course it's more like, they check the metadata and decide to ignore me, then delete all the data after a year or two].
Bully for you but it isn't just you. It is people with legitimate needs for privacy; journalists, whistleblowers lawyers, MPs and many others. You also don't know when you may need privacy in future.
> They also mention 'the legislation will let them do this and that' but they don't mention the restrictions, like needing warrants or court orders, or signed permissions from the Secretary of State, or whatever. The way it's couched is 'all your communications will be accessed whenever the gov want' - if there really aren't any preconditions then the EFF should have shouted about that more, if there are any then they appear to be being deceptive by not mentioning them.
There may be a government right to access a particular device with appropriate oversight. The idea that they can force third parties to prevent strong protections or to weaken their security (for all devices not just those subject to a warrant) is an entirely separate proposition. Nobody is saying that the FBI don't have a right to crawl all over the phone, the argument is about the extent they can force Apple to do work for them, the knock on consequences of that.
>People are talking about infringement of HRA/ECHR or generally held moral rights but there is a balance between the right to privacy and the right for the populous to use the mechanisms of state to enable the proper investigation of criminal activity (and other non-beneficial actions). Whilst I have rights not to have my family life impinged on by the state they only extend so far as it is not necessary to limit those rights to protect my children, say, or prevent me committing crimes. I'm pretty much OK with that and think the majority of the populous - who are decried here as sheeple - are OK with the state having such powers _given the checks and balances built in to the legal system in the UK_.
Yes a balance is required and rights are not absolute. The UK government can already imprison you if you don't provide the passcode. The suggestion is that they can cripple the entire country's security.
Also while you trust the UK government Apple operates across the world. What about China, Saudi Arabia or even Syria? Don't you see that if Apple takes a hard line that they don't backdoor their phones it is far easier than if they do it for the US (or US/UK) but not for others. The global consequences of Apple bending on this are very significant.
>If the government see people taking part in criminal activity and solicit a warrant from the court and in order to perform a search in that warrant the SoS finds there is sufficient suggestion of a national security issue, or significant loss of life, and on consultation with the affected companies they find that access to that information is possible with limited financial cost, then I consider that the SoS should be able to issue an order that the company cooperates with the legal system to enable appropriate officers to see the content that would otherwise be hidden.
To what extent and with what side effects? If to access the phone they had to disable all security for all users would that be appropriate? The reality is the side effects are not that extreme but they are very significant. Also how much cost/time is reasonable? Apple think it will take about 10-12 people 2-4 weeks to create the software (and that might be an underestimate). That is time not being spent improving the software and security for everyone.
>[[...]
>To what extent and with what side effects? If to access the phone they had to disable all security for all users would that be appropriate? [...] //
I think I must have misunderstood the situation. As I understood we were talking about Apple having the capability to access their technology and them refusing to use it for individual cases following issue of a warrant and personal intervention of the SoS. That is an entirely different proposition to what you're suggesting - the a company be forced to design a system with a particular back door. That doesn't appear to be in the information I read about the IPB but I stand to be corrected as necessary.
If [as it appears to be the case here] Apple, say, have the capability to disable security on all phones then I can't see how the findings in this case change the ability of another state - China, SA, Syria, as your examples - to demand that Apple push changes to disable the security of phones. It's not like China will say 'oh, USA courts found it unconstitutional so we better not ask Apple to do it'.
FWIW I don't really trust the government; as you say "Bully for [me]" if I don't have things to hide. But I was attempting to answer the comments saying 'why isn't everyone up in arms, they're all sheeple'.
Another aspect is, your notional MP being snooped on for unwholesome reasons means that the entire fabric of the British legal and political system is corrupt. If we're at that point then I dare say the Secretary of State will just call in Apple bosses and have their partner's fingernails pulled until the bosses agree to push a firmware update.
48 man-weeks vs Apple's tens of thousands of man weeks per day [from 115k employees] seems pretty small cost. There's no reason Apple couldn't/shouldn't be compensated for that time. TBH in the USA situation it would surprise me if TLA-agencies wouldn't write the code (if they haven't already), they really only need Apple for the distribution keys I expect.
Good points but I'm afraid I remain as yet unswayed.
The software development teams at Apple are really quite small and they can't just get new people in for this work because large amounts of knowledge are needed. The 115k employees are largely not OS engineers.
Yes I'd suggest they're doing just that. After all, you're more likely to die as a result of a lightning strike or accident with household furniture than be victim of a terrorist attack.
It seems as though there has been a sustained effort to move the Overton Window[1] towards the acceptance of ever more onerous restrictions on freedom. The Daily Mail is more than happy to take this line, as they have since their founding.
It's interesting to remember that at the end of WW2 the UK abolished dumb cardboard identity cards as they were seen to be an infringement of civil liberties.
If it saves one life for the a GCHQ analyst to see all my inane texts ...
Do you want to keep anything at all private? Do you trust every GHCQ and government employee? There have already been cases of abuse.
See: http://jacquesmattheij.com/if-you-have-nothing-to-hide
From a security point of view there appears to be little benefit either. How many recent events were revealed to have been discussed on Twitter or Facebook, yet all these various surveillance schemes didn't prevent them happening. In which case, what's the point? In fact, in more than one case the perpetrator was already on some security watch list.
I submit that the government should be able to monitor my communications etc, if and only if I am suspected of a crime and a warrant to do so is obtained beforehand. Blanket surveillance is counter productive and, crucially, ineffective.
In the event my phone, for instance, cannot be accessed they should ask me for access as is already on the statute book. A backdoor into devices will be hacked and on the net in remarkably short order.
[1] Overton Window is the range of ideas the public will accept. See: https://en.wikipedia.org/wiki/Overton_window