UK surveillance powers bill could force startups to bake in backdoors
techcrunch.com
techcrunch.com
If you feel you're being compelled to act immorally, remember non-compliance — whatever the immediate consequences to yourself — is the only acceptable course of action. When we decide to spend our days building powerful tools, we enter into an implicit agreement not to let them fall into the wrong hands. If the government comes knocking, BURN IT DOWN. Make good on your debt to humanity.
Seriously, can we get away from these fine-sounding (but otherwise utterly useless) slogans and clarion calls? There has to be a better response than a scorched-earth policy.
I'm a software developer based in the UK currently working on an app which will probably be affected by this bill. Apart from destroying the product and/or risking jail-time, are there any sensible options? Can I incorporate somewhere else in the EU and run everything from overseas? What if I am not a UK company but a DE company and everything happens from there?
I realise it's early days, but I'd hope HN could come up with some informed suggestions.
1) Shut the company down, lay off 50 employees, leave 100 clients without revenue, damage the UK economy to the tune of £300M/yr.
2) Go public, go to jail, and (1) will then happen anyway.
So frankly throwing the towel in looks like the only sane course of action, unless you have a magic wand to affect government policy.
The govt will still probably try to find a way around it but at least you've made it very difficult for them.
>The govt wouldn't give a squat about what contractual agreements
Setting yourself up in that manner would mean more challenges and making it difficult for the UK govt to win in court.
>Setting yourself up in that manner would mean if it needed to be taken to court, it would be difficult for the UK govt to win.
I don't think you understand how the legal system in the UK works, or anywhere else for that matter. You can't have contractual agreements that go against the law as it would constitute an illegal contract.
If you have a clause in the contract that requires you to either break the law outright or not to comply with it it will not be enforceable and will be considered void.
You then get to fire yourself; it is definitely a burn it to the ground strategy, but this type of strategy has happened before and no doubt will happen again even if infrequently.
But would it, really? This fails the same logical test as the warrant canary - it sounds comforting, but is absolutely useless in the real world.
You still have the same choices - you can follow the request, or ignore it. You can tell the world, or keep it secret.
In every scenario I can think of, this idea of "affirming you have not been compelled" provides absolutely no protection.
Are you able to provide an example that demonstrates how this off-shore/contractor setup would protect you from the UK equivalent of a NSL with a non-disclosure clause?
Another person posted a somewhat insightful excerpt from the draft which covers this situation:
Also, isn't the government bound by the Computer Misuse Act (and it's European and other foreign equivalents). That would make the coercion an illegal act.
Dare say there would be amendments intra UK but we'd need pan-European changes to be able to lawfully compel someone to access a [foreign] computer without authority
In case you want "Europe, but without EU law and surveillance", there is Switzerland.
I also met a friendly Lord over it last year who already opposed it loudly, and ensuingly had his political career murdered for his trouble.
This may be true for now, but I have seen far too many laws beeing used in other contexts than what they were intended for.
For now it maybe used in cases of 'terrorism'. In three years your products will get compromised because the state wants to catch a drug dealer. In 8 years, they also want to catch regular burglars, and in 10 years these laws may be used against you, because you forgot to mention a $100 bill on your tax declaration...
Only thing is its a bit more expensive than a typical Ltd.
I can not think of any way other than leaving, that will not compromise either your product, your customers or your integrity.
This is 'scrorched earth' if you will, without 'fine-sounding, useless slogans'. Consider this: If this crap becomes law, you certainly won't be alone when leaving. And when a critical amount of developers and entrepeneurs leave the UK permanently, the economy will suffer... greatly I think. And that, sad as it may sound, might be the only argument politicians would consider, when it comes to signing this bill.
Sorry to be this guy, but you do realize you're talking about UK, right??
IF you have pay attention to anything that comes out of UK politicians and being actually implemented in the law, you would have a hard time believing that UK citizens' disobedience, not matter how loud, will change ANYTHING AT ALL!
Sadly, they're doomed and I cannot find a friend who left years ago and never looked back.
I'm British, and recently left. I've met about 6-7 British people in my new country (I haven't been seeking them) and none have any intention of returning. Of course, they visit family and so on, but at present there's no reason not to.
I'm in the UK and weighing up options.
I wasn't particularly looking to move here, though it was a country I'd thought about. Then someone forwarded a job advert to me, and I ended up with an offer I couldn't refuse :-)
Anywhere in the EU is easy to move to, and easy to move away from if you don't like it. The big differences are probably the ease of getting a job, speaking the language (or not needing to) and meeting local people.
I get the sense that reincorporating in Bermuda, Gibraltar, or one of the Channel islands might help in some way, but I can't quite figure out just where in my brain that idea came from. Maybe it was one of those foil hat ideas that I had to discard because it only worked for Commonwealth citizens.
It would take a careful reading of the law to discover the most appropriate loophole. In the U.S., that often takes the form of having no meaningful penalty or enforcement for breaking a law. So, basically, companies just ignore it. But UK law works differently, so I can't say for certain whether that means a judge could invent an appropriate penalty or not.
Frankly it seems like a very good solution if the problem is laws in the UK. This program was launched specifically to attract entrepreneurs and offer them the means to launch tech businesses from anywhere in the world in Estonia.
That is an informed suggestion, informed by the reality that participation in the political process does not work, at all.
In your opinion, perhaps, but my gut is that most people would comply rather than spend several years in an 8x10 cell.
https://twitter.com/nixgeek/status/708267763089989632
I'd be interested to see how the numbers turn out on that!
The problem is that the most likely reality is that you will go to jail, your business will be shut down, you will never find another job again, your whole family will be added on all the government shit lists and nobody except your friends will know what happened.
There is a star system to martyrdom too. For 1 Snowden, there are probably thousands jailed and forgotten.
No right minded person in the world would rather go to jail than comply with this, the few that would really have an existential dilemma about this issue would most likely opt out to preemptively avoiding it than be the ones who sit at their desk with a gun in their hand and a bulletproof vest.
There is money to be made. When it comes down to making money by putting in backdoors or shutting it down and making none, the backdoor will be put in every time.
When London fails to become the "Fintech capital of the world" like it wants to be, because any fintech moving there has to main its own security and every potential customer knows it.
When UK companies are continually hacked and ripped off because the bad guys KNOW there's backdoors in every one of them, all they have to do is find them.
When the UK economy has taken enough of a beating. Then they might change their minds. Maybe.
Evil prevails because good men do nothing. And this generation seem to be the masters at doing nothing.
A truly gutsy CEO would say screw you to an oppressive law or government. They'd be willing to die in prison for their beliefs, and shut the whole company down in the process. Take the story to media and watch the government's stupidity get them publically humiliated by the press and social media.
Things like this will only stop if they become political suicide for any party or politician that tries to implement them.
http://www.livescience.com/18706-people-smart-democracy.html
In another story on Hacker News today, I find the following: "She offers a sample math problem from the test: You go to the store and there's a sale. Buy one, get the second half off. So if you buy two, how much do you pay? "High school-credentialed adults, they can't do this task — on average," says Carr."
http://wamc.org/post/americas-high-school-graduates-look-oth...
Clearly, the majority of the voters in a democracy aren't very intelligent. This probably means that most of the politicians in a democracy, such as the UK, aren't very intelligent either.
If you are willing to see how your life and role as a passive consumer has been designed, watch the BBC documentary "Century of the Self," read Edward Bernays' "Crystallizing Public Opinion," and "Propaganda," and for an extra dose of depression, Noam Chomsky's "Profit Over People."
Sorry.
But I reached my current world view by extensive wearing of foil hats and painstaking calibration of handcrafted bullshit detectors, so it would be nice to see the analyses of those more reputable than my usual sources (by many orders of magnitude), just in case they would ever be useful in an appeal to authority.
For instance, I could tell my spouse something for years, such as "chia seeds are a better source of omega-3s than flaxseed, because the chia seed coat is digestible, whereas the flax seed coat has to be cracked mechanically, which allows the oils inside to become rancid due to oxidation between milling and ingestion." And this is dismissed and forgotten, until Dr. Mehmet Oz features chia seeds on his television show. Afterward, I'm still the only one actually eating the chia seeds, but at least I get less flak for it when I do.
The Cassandra Phenomenon: it's horribly demoralizing.
It's even worse with my homespun political analysis.
Register overseas (if possible). This is going to harm the UK economy a lot more than they think.
Founders will think twice and will only add to risk and burdens when you are already competing in an international, competitive, start-up space.
Remove the offending country from the equation by relinquishing legal responsibilities. I know a few founders who have talked about doing this so I hope the UK reverses this or never becomes a prolific start-up space (which would be a shame).
I hope avoidance becomes common practice, the UK is not the only country that incentivise start-ups. Others do and thankfully don't have draconian laws such as this.
For example, I am part owner of a Canadian company that sells an online service. If we hire US employees (developers), then we must collect sales tax and pay income tax for sales originating within the governing municipality.
Obviously, I am talking about US tax law, and your question is of a different nature, so the best thing to do is to contact a lawyer who has expertise in that area. I only offer my experience as evidence that the location of employees can impact the legal responsibilities of a foreign business.
As long as you need to live in the UK, you're at their mercy.
If only there was a bigger power that looked a bit more after people's privacy and could stop local governments from doing this...
"7.14 Section 217(8) provides that obligations may be imposed on, and technical capability notices given to, CSPs located outside the UK and may require things to be done or not done outside the UK. Where a notice is to be given to a person outside the UK, the notice may (in addition to electronic or other means of service) be given to the CSP:
-- By delivering it to the person’s principal office within the UK or, if the person does not have an office in the UK, to any place in the UK where the person carries on business or conducts activities; or
-- At an address in the UK specified by the person."
https://www.gov.uk/government/uploads/system/uploads/attachm... -- page 59
I also don't think it's a safe assumption in any jurisdiction nowadays that the person who gets served with a notice will be an executive. It seems quite plausible to me that a front-line engineer could get served with a notice, and not even be allowed to tell an executive. Thus, even if your employees in the UK don't appear to have been coerced, this appearance could be deceiving.
There may be some limited countermeasures to this sort of thing, like regular audits of system configurations, etc. performed by a different group of people, and who will thus cry murder if they find any anomalies. This should work because the second group of people will not be the target of a notice, and thus not bound by its secrecy provisions. Possibly this group could do their auditing remotely, from outside the UK. Of course the in-UK group could, under coercion, rootkit the system to hide these changes, probably by being told to install government-issued software. Hmm...
Perhaps even more importantly, it's the people that care deeply about privacy there, too, and would protest obvious authoritarian moves by the government, while in the UK they seem to care almost as little about it as the Americans do.
Yes the German Government has been caught doing some nefarious stuff but if you compare the totality of what the UK government has been doing against what the German government has been doing, I'll take the German government every single time.
I say that as a UK citizen, also this is one of the areas where the EU has actually been really useful and I have a feeling we might leave in the referendum.
It is frightening how fast a government can eviscerate the very foundations of democracy. This is even more appaling when you look at the fastest growing political power in Germany: The rightists from the AFD. I have no doubt that, what is happening right now in poland can happen in germany too, given enough time.
Even more interesting is how this would work regarding open-source software. You can't keep such a backdoor secret in GPL'ed software and comply with the license, but a UK company couldn't release changes they'd made to comply with the law either. So if you suddenly see UK companies move away from GPL'ed software for no obvious reason, that may be a clue.
(a) Disclosure would likely result in liability for the executive officers and/or Company Directors, which might be contempt of court, or something more serious;
(b) Software developers working for Apple (an example) are likely under strict Non-Disclosure Agreements as part of their employment contracts, so the company served with such a request will likely make it clear to those responsible for technical implementation that it's covered by NDA.
Even in the case of (b) if a developer quits rather than implement the functionality, in many jurisdictions, the employer would have grounds to pursue a gag order.
If I quit a job at Apple over this, Apple might have to sue me for appearances sake, but my GoFundMe account would be quite fattened by the experience.
Talk on HN is comparatively cheap, and I suspect most people would reconsider their position when facing down the very real prospect of serving 5 years in HM Prison Belmarsh.
[1] https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... [2] http://arstechnica.com/tech-policy/2007/10/uk-can-now-demand... [3] https://www.schneier.com/blog/archives/2007/10/uk_police_can...
Principled idiots are of more use to mankind when they're on the loose.
My understanding of s49 is that to convict you, the government has to prove that you had the ability to decrypt at _any time in the past_. If they do that, you can make a defence by showing that you _no longer do_. In other words, if the government shows you ever had the ability to decrypt, the burden of proof changes to you to show you no longer do. Pretty ridiculous.
It does mean that if you can make it patently obvious that you can't decrypt something, you have a good defence. One option therefore is to place control of decryption in the hands of not yourself, but a trusted agent outside the UK (or both, with both required to decrypt).
There may also be grounds for appeal in the ECourtHR, as there is precedent that the 'right to a fair trial' in the EConventionHR includes the right to remain silent, etc.
Also, it's quite concerning that four US based companies could influence a country's policies so much.
There was a very big fear that if India and Pakistan will go to war the global IT business would suffer greatly because of just how much of the global IT has been outsourced to India.
It's a pretty regressive, insular country, ruled by fear.
Polls show NI/Wales/Scotland quite strongly opposed to such silliness.
I don't think it's quite like that, I think the media here has played a toxic role in our society. Many people still believe the BBC is an impartial news source, that alone speaks volumes. There's a tabloid-led mentality that is pervasive, and debates of any substance are limited by that.
Why would the tax department ever be allowed to do something like this directly? They seem incapable of fairly collecting the taxes of the country, what business do they have acting as an "equipment interference agency"?
One could reasonably question why this isn't a department or division of another agency, perhaps NCA, but I think it's a fair statement that forensic accounting and investigation is a somewhat specialised skill.
Read the actual proposal instead, it's written in natural language and perfectly readable: https://www.gov.uk/government/uploads/system/uploads/attachm... -- Chapter 7, begins at page 57.
Who wants to live in such a society?
Unfortunately the sands are shifting under me and since we are about two steps back from full idiocracy I can't see it changing.
We have an electorate is willfully almost gleefully uninformed, ruled over by politicians who are venal and rarely if ever held to account.
The whole system is bullshit from council to ministers.
The interesting question for me is more "has it always been this bad and we didn't know or are things actually worse now", I'm leaning towards the former as if you look at the history of government (in this country and most countries tbh) it's a litany of abuse after abuse.
The same can be said if the FBI wins the Apple case. I cannot see how this will not destroy at the very least the country's technology infrastructure. I'm not sure about the UK, but certainly in the US such actions would lead to a recession or worse considering that technology is pretty much the only sector to have recovered since the on-going recession. I suspect similar consequences for any country whose economy relies so heavily on technology, however.
1. people with a key
2. people with the skill to open the door (burglar)
Apple (for example) would already be in serious trouble is someone got their private keys, they use them to sign OS updates for example. If they could generate a device-specific signed cookie to say "open up", what harm would that do?
This may be next year's elected official, or the official elected in 10 years, or the spy who will work in the office 7 years and 2 months from now. Can you guarantee the intentions and actions of every single future government employee and official? This, in my opinion, is the biggest threat!
I don't think your analogy is going to help convince people that the policy is bad.
Yet another issue is oversight of those with the key (who watches the watchers)
I would sooner leave the UK than sell out on our users and be forced to keep quiet and carry on.
The key tool in the box, I think, is to give people orders that you expressly state can't be later revoked. You can use this to construct something like the human equivalent of an HSM. (An HSM, after all, is something that you give orders that in general can't later be superceded, namely about how to control access to cryptographic keys, thus allowing you to reason strongly about the security it provides.)
These people will need to be outside the UK, and be people you trust doubly: firstly to secure whatever cryptographic materials you escrow with them, and secondly because they can by virtue of that escrow hold your company hostage.
Some possibilities include setting things up so they have to review all source code changes (making it impossible for you to sneak anything by them); and some manner of non-duress verification protocol. One possibility off the top of my head for such a protocol is to declare that a failure to state a certain password in any conversation constitutes a duress indication. Obviously for this to work all such conversations must be secure. The idea is that when you're the subject of a notice and are asking them to backdoor things with the government breathing down your neck (possibly literally), the person on the other end starts acting oddly mutinous, but you appear to be doing everything you can to get them to comply. So long as the government can't prove you've done anything to be unhelpful - can't prove the existence of the non-duress password - it seems like it would be hard to find a case to prosecute you.
We have problems. It's not a police state (yet) any more than the US or other western nations.
Changing boundaries in a way that disproportionately benefits themselves.
Changing voter registration / deregistration to make non tory voters more likely to become deregistered.
Lowering short money when they rely on it the least.
Changing the way donations from unions work to drastically lower Labours funds.
So we can probably expect a Tory gov for a long time. Not that Blairs labour were much better...
I beg to differ. I was no fan of Blair, but the current Tory government is absolutely blatant in its disregard for public service. Here's the latest example, from earlier today...
http://www.mirror.co.uk/news/uk-news/iain-duncan-smith-claim...
"Heartless Iain Duncan Smith today claimed people thanked him for taking their benefits away.
He was accused of "losing the plot" after making a string of increasingly bizarre claims about his department's cruel benefit sanctions regime.
The Tory Work and Pensions secretary said 75% of people who have had their benefits stopped under his department's cruel sanctions regime said it helped them "focus and get on."
A spokesperson for the Department for Work and Pensions (DWP) was not immediately able to back up Mr Duncan Smith's claim.
But the sister of ex-soldier David Clapson, who died starving and penniless after having his benefits stopped said: "I don't think my brother said it had helped him get on.""
P.S. I know the Mirror isn't the best news source, but in this case the evidence is pretty clear.
I see my tax bill going down, knowing that the few hundred quid extra I have per year (which is basically lost in the financial noise for me - meaningless) means that somewhere someone who really needed that money or the service it paid for is now being fucked over. I don't even know who; Cameron and chums (I go sailing sometimes with a chap who used to share a house with Dave Cameron; apparently he was a self-entitled tosser then as well) are fucking poor people over on my behalf, presumably thinking that this is what I want. Or maybe they don't even think it's what I want; maybe they're on some bizarre Randian kick, living in the Westminster bubble in which poor people simply don't deserve any help, and this is some kind of moral crusade from their messed-up Westminster bubble. The benefit to me; zero. The cost to the people at the bottom; devastating.
I see our "leaders" acting as absolute cowards; these are the people who should be inspiring us, but instead they rush to surrender our freedoms as fast as they can. Again, presumably because the Daily Mail tells them that this is what we want. The other lot aren't any better. Remember when Harman wanted to introduce compulsory ID cards? She had a long record of voting in favour of more government power and fewer civil liberties. Intellectual and moral cowards, the lot of them.
You would think that they could relax. They no longer need to pander to the tabloids. If they liked, they could dismantle the media and rebuild it in their image. They could build a gigantic statue of Theresa May. They could go to war. The potential for evil doings is endless.
Instead they spend their time fucking over disabled people. I mean... why? What's in it for them?
That isn't really true in the case of houses so there's no need to legislate for "TSA locks" (master key system). Obtaining a warrant is still required but once you have authority, you can bash in the door, drill the lock, etc.
I don't understand why people imagine this to be a novel situation. LEOs can't get documents if the suspect always destroys them immediately after reading them. If you keep your secrets in a box in a hole in the middle of the desert, a warrant isn't going to find it or even prove it exists.
That has never been an excuse to ban paper shredders or track everyone's movements 24/7 in case they ever went to a secret place to do a secret thing.
People need to think of the consequences of getting what you want.
7.21 in the notes pdf about section 115 in the Bill
"This includes provision for CSPs to be able to publish information in relation to the number of warrants they have given effect to. In order to ensure that this does not reveal sensitive information that could undermine the ability of the security and intelligence and law enforcement agencies to do their job, further information on the way in which this information can be published is set out in regulations. The regulations make clear that statistical information can be published on the number of warrants that a CSP has given effect to within a specified range rather than the exact number. "
So a company can both disclose the number of warrants and are authorized to disclose information about warrants in general and not particular ones.
For example, a company would be allowed to publish how much warrants have cost them and taxpayers.
http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/1...
Which collectively if you think about it, and round up all the PCs in each home, and all the security that goes into them, it's (collectively) the most militarized group of computers there is, and they obviously don't feel outgunned.
Well the security they engender is mostly physical security i.e. not getting blown up by terrorists while the security they want to breach is information security. I could see why some people would not mind trading privacy for reducing the chance of getting blown up, all else being unconsidered.
I don't agree. When I'm in a hotel room, I'm supposed to enjoy some privacy. If this bill passes, you will know a priori that electronic communication is under judiciary control. As I said before, it will be the same as it has always been with telephone.
Really, absolutely-private remote communication didn't even exist before the advent of computers. And now it looks like it's a fundamental human right and no discussion is possible. I don't think that such a bill should be forced on UK (or any other) people, but fighting criminality is at least as important, and I'm not shocked that compromises are being proposed and discussed.
You can make an argument for crimefighting, but then you have to stay within the judicial boundaries: limited access, requiring a warrant, limited use, requirement for basis for suspicion. The crimefighting process is there to produce evidence which is then presented to a court in public.
The problem with the IPbill is that it comes from the military intelligence point of view instead. The process produces intelligence which is then classified and is illegal for the public to see. There are warrants to be issued under the IP bill: it is a criminal offence for the people on whom the warrant is served to "to disclose to any person, without reasonable excuse, the existence or contents of the warrant." This provision does not come with a time limit. You can be ordered to hack activists or opposition parties or human rights lawyers and not allowed to whistleblow, ever.
There are some extraordinary little subclauses like 154.(9):
"Any conduct which is carried out in accordance with a bulk equipment interference warrant is lawful for all purposes"
I just can't understand why any resemblance of a limitation of the privacy over electronic communication is greeted with such outrage. I do understand that encryption can be either controllable XOR secure. But my point is that secure encryption has never been a right: actually, the discussion has just started, due to the recent spread of its usage.
Again, telephone and (thanks for reminding) courier have always been controllable, thus not secure. Deciding whether a non-controllable medium of remote communication should exist, and who may use it, is a social and political question (like, for example, cloning: it is technically possible, but drastically controlled by laws). I understand it's quite natural for us HN-ers to stand on one side, but the world is bigger that HN.
I'm afraid it's been going on for decades: https://www.epic.org/crypto/clipper/
And that's partly why the mistrust exists. Law enforcement agencies are not given the benefit of the doubt on this because of previous abuses. There's a history here which is too long to #include every time the subject comes up.
Deciding whether a non-controllable medium of remote communication should exist, and who may use it, is a social and political question
"Controllable" is a word shift from "secret", and that's what the US 1st Amendment guarantees: the existence of non-controllable means of remote communication. After all, one of the founding heroes of the US was a ""terrorist"" who brought messages to the other members of his anti-government cell.
The UK situation is much worse, and a full discussion would have to involve the abuses of the last generation of antiterrorist police and military action in Northern Ireland.
This is exactly my point. They use the terrorist strawman to frame their agenda; which is to hack all the internets without anyone batting an eyelid.
Information technology is but one facet of reality, and a reflection. It is not the whole thing. It's for this reason it is more suitable to get to the core of why anyone would want to commit an act such as blowing oneself up in the first place.
It's like going all guns blazing on the symptoms of flu. Unless a cure is invented it will haunt us and we only have symptomatic relief.
I can understand the motivations for going after anyone doing something technically interesting with a computer (actually a rare thing unless you are supremely skilled and have chosen a life of learning systems and divulging technical manuals). Also see: homebrew crypto
Others would then follow, and although a lucrative industry might suffer, in the long run we may all be better off.
It looks likely that 95% of the startups in the UK wont be covered
So it's more likely that 100% of UK startups (with at least 10,000 users) will be covered.
This doesn't mean that startups have to build in backdoors now. But it does mean that if someone from the Ministry of Something or Other or MI5/6 or the Police turns up and demands a backdoor and/or access to records, the startup has to comply.
I have no idea where this leaves Apple, providers of VPNs, or startups trying to provide secure communications.
At a guess it means they'll probably try to stay outside of UK jurisdiction. And I won't be even slightly surprised if banning VPNs is the next step.
It's obvious this is going to collide head-on with the Apple vs FBI case in the US. But this time we won't be able to follow it, because the legislation includes a press and reporting gag.
The UK's Home Office is notorious for being stuffed full of authoritarian paranoiacs, and they're always doing stupid shit like this. You can't even blame the current gov because it was the same story with the previous crowd - although the authoritarian paranoiacs in power now seem to be trying to take things to the next few levels.
I wonder if we're going to see companies making increased efforts to make as much customer information completely unavailable to themselves to make these warrants not worth applying for? Unfortunately most businesses cannot operate in this manner fully, obviously.
I can imagine someone getting creative and redefining what they call a user… though I can imagine this devolving into if you have under x page views… and then x time spent on site… how much bandwidth over the wire… etc.
Such a joke, I hope everyone is enjoying their view of the circus lol
Sincerely, Russia & China
It's similar to how they are making smoking less and less popular by making new laws, increasing prices, and raising the legal smoking age.
Under the spreading chesnut tree, I sold you and you sold me.
Be Vigilant. Be Pure. Behave.
No way!
Most of it seems like bureaucrats trying to get access to information after they have obtained warrants. It all seems a lot more boring and a lot less cloak and dagger if you actually dredge through the bill here:
https://www.gov.uk/government/uploads/system/uploads/attachm...
The document mentions encryption four times and backdoors no times. One of those times is to say that the bill does not change anything about encryption that isn't already in law under this bill, RIPA: https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...
Really actually more scared of RIPA (which is already law) than this:
"In October 2014, it was revealed that RIPA had been used by UK police forces to obtain information about journalists' sources in at least two cases. These related to the so-called Plebgate inquiry and the prosecution of Chris Huhne for perversion of the course of justice."
It's amazing to me that the first two cases are absolute abuses of power; I thought we were still being told that these laws were to stop terrorists and paedophiles, not find out journalists sources...
A relevant operator includes telecommunications services, defined in s193(11) as "any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service)"
This has been slightly changed, now that the IP bill is no longer a draft: http://www.publications.parliament.uk/pa/bills/cbill/2015-20...
The above draft is now re-written as:
s217(4)(c): "obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data".
There's an appeals process, but the gist is that they're not outright banning backdoors. But if they come knocking, you better find a way to remove any protection that's there. Which is rather chilling.
It seems to suggest that technical feasibility and cost needs to be taken into account as well. If it's technically impossible due to Spider Oak style end to end encryption or for example the new iPhones (6+6s) having some very advanced encryption features I'm not certain that there is a requirement to insert a backdoor.
If the security services were monitoring a person who was genuinely planning to kill people and they asked you to put in a limited back door?
Most services remember do not have encrypted backend systems and it'll probably always be this way.
Mass surveillance is the complete opposite of this and is a totally unreasonable intrusion.
Not to mention that the "someone planning to kill a bunch of people" scenario never actually happens. Typically these tools are used when prosecuting regular people for regular crimes, or looking for information after an attack has already happened (San Bernadino). Nobody has yet been able to point to a case of consequence where this type of surveillance was ever used for someone actively planning an attack.