UK spy bill will force tech firms to disclose future products before launch
zdnet.com
zdnet.com
Bills are published like this well ahead of them even being debated so that interested parties can comment.
There's a major faction within the Conservative party that is pro privacy (e.g. http://news.bbc.co.uk/1/hi/uk_politics/7450627.stm), and it's also pro business. This is anti privacy and anti business. It's a winnable fight, but not if you give up at the first suggestion of a thing you don't like.
Write to MPs, say "As CEO of awesome corp I would seriously consider relocating to Berlin". That sort of thing will get attention.
In the western countries there is less synergy and more dispute. So they need to legislate for the law abiding organizations to become "outlawed" at some point for doing what is the ethically correct thing to do.
It won't help, because the Home Office is run by paranoid authoritarians and crazies, and they keep trying to pull crap like this no matter who is in power.
The critical question is just how likely is it that the gov will prosecute Apple, Google, or FB for not following the rules.
"Not very", I'd guess.
How likely is the gov to prosecute Tiny Corp Ltd?
"8.1 Small companies (with under 10,000 users) will not be obligated to provide a permanent interception capability, although they may be obligated to give effect to a warrant."
But look at this:
"8.17 A person to whom a technical capability notice is given is under a duty to comply with the notice. In respect of a technical capability notice to give effect to equipment interference or bulk acquisition warrants, the duty to comply with a technical capability notice is enforceable against a person in the UK by civil proceedings by the Secretary of State.
The duty to comply with a technical capability notice to give effect to interception warrants and CD authorisations is enforceable against a person in the UK and a person outside the UK by civil proceedings by the Secretary of State."
That's civil proceedings, not criminal proceedings. So basically the SoS can sue, but not jail anyone.
It's all quite confused, and fundamentally fails to understand the differences between targeted surveillance, bulk surveillance, end-to-end encryption, commercial encryption for (e.g.) secure banking, open source VPNs, and so on.
If you pull apart the language, the mental model is of someone who thinks encryption is like an envelope around a letter. So if you demand a de-enveloping tool from the people who make and sell envelopes you've done your job.
There's a bit more to it, but the legal language doesn't have any insight into that.
And forever pushing back is the price of freedom. OP is right, you have to keep telling them no.
-Not a massive fan of the British surveillance state?
-Want to stay in the EU?
-Enjoy low corporate tax rate of 12.5%?
-Enjoy friendly, well educated, English speaking, Pro-American people, good beer, decent music, nice quality of life, low crime and safe green natural environment?
-Want (relatively incompetent) pro-business government to butt out of your companies launch plans?
Invest in Ireland -> http://www.idaireland.com
This has been a public service announcement from the country next door. #irelandlovesyou :)
https://en.wikipedia.org/wiki/Microsoft_Corporation_v._Unite...
Seriously though, I live in Berkshire, and am looking for decent places to move to. The grass is definitely always greener! :)
I have even begun to look at some roles in SF.
Galway has always had a small but still decent tech sector.
Cork has always had a good medical tech sector.
I'm from Galway originally, and I've been casually eying up the situation in anticipation of a Brexit disaster. So far I haven't seen anything outside of Dublin that's wowed me, but would love to be proven wrong.
(I imagine sterling completely getting smashed if Brexit may also make a lot of people think the same as you).
Also, there are a ton of roles in Dublin with someone with your experience.
I was born and raised in Ireland, left for Scotland about six years ago. We'll be abandoning ship if this Brexit madness proceeds.
EDIT: now that I think about it, I'm kinda looking forward to a swarm of bright Irish ex-pats returning home from Britain if the political situation goes bad, as it'd be a huge boost to the Irish economy, and would go some way to reversing the classic brain-drain Ireland has suffered from.
I guess what I'm saying is that if the planets align just right then you can all move your clever, canny Irish brains to Scotland instead :)
As an aside, I lived in Donegal for three years (in the middle of no-where between Letterkenny and Milford). Despite being a bit far away from all the action in Dublin, Galway and Cork, I quite liked it. Was very fortunate to see "Mr Nice" (Howard Marks) tell his story at the An Grianan in LK in ~2009, amongst other folks.
edit: clarifying "Union"
I've been living in Edinburgh for the last few years, and absolutely love it. I'd be delighted to stay and live in an independent Scottish state.
I was mainly referring to the xenophobia expressed in the lead-up to the official campaign. It seemed to be mostly directed at Eastern Europeans, but the UK isn't exactly doing a stellar job accepting Syrian refugees either (what's the latest figure? 20,000 refugees over a five year period? That's the same figure that The Netherlands accepted just last year. Sweden admitted 4x that figure in 2015).
But the overall repressive stance towards software/technology, or the authoritarian stand-off between the MoH and NHS doctors doesn't help to raise my opinion of the UK either.
The UK is definitely a bit proponent of necessary EU reform. One significant reason behind Brexit, is that getting the EU to actually change is nigh on impossible.
As the other comments request, what is the toxic influence in your opinion?
Edit: Totally agree that if you want to help fight this then write to your MP and consider donating towards a publicity campaign by https://www.dontspyonus.org.uk.
https://news.ycombinator.com/item?id=11265666
These laws WILL affect UK tech start-ups if privacy has anything to do with their business model.
I have said so in the past, don't register your tech startups in the UK. Boycott is sometimes an effective means for change. UK law makers know this could back-fire, they are taking a gamble they have already lost.
How do these governments not see that the people who would do harm to us will get their encrypted tech from somewhere else and bring it with them.
Just adds full to the fire that this has nothing to do with protecting citizens.
It feels like the ultimate endgame of all of this is either that the technology industry just freezes (because innovation is killed by bureaucracy), or that we end up in some cryptopunk space in which the only interesting stuff happens over Tor/Freenet/whatever else.
And of course, the latter becomes harder every day with hardware backdoors.
I think that fundamentally the idea of the state regulating commerce is flawed.
Individuals want to be able to make choices, but at the moment they can't because economics forces their hand. Apart from a few radicals, everyone has to use a car, has to use the subway with its' smart card, has to use their mobile phone for business, because otherwise society doesn't have a role for you any more.
Can UBI help here? Or are we really just doomed to basically disable the Internet we created because it's too powerful?
The chilling effect could be that compliant companies are fast tracked, while those who insist on due process get quagmired.
"Any company with operations in the UK -- including Apple, Facebook, Google, Microsoft, and Twitter, which have submitted written evidence calling on the British lawmakers to revise the bill -- would have to comply with the rules."
I'd love to see those companies just leave UK ale let them have what they asked for.
I wonder however about the negative consequences to the tech industry, why would a company purchase a service they can not trust anymore due to weak encryption?
They government probably also will miss their target completely as criminals/ terrorists etc will simply choose other products and services.
Sorry Brits. You are letting your state fall into absolutel disaster. I'm putting you in the same bag as North Korea, now - your state cannot be trusted one bit.
Alas there are generations and generations of Westerners - after all, we are stateless here in the HN frame - who are, moreover, completely willing to overlook the crimes of their state and just let it all happen, "for whatever reason". This is why I, also, choose not to ever live in the US. (It is the only reason: that I chose not to.)
Members of states currently erecting apparatus of human social control, with explicit intent to violate human rights of any individual, no matter their non-/statehood, need to do one thing to change it all: move. Keep moving. Abandon your culture, and acclimate to a new one. Repeat, ad inf.
Perhaps you believe if we just voted for the other party, everything will change? It's so much bigger than that.
You'll not be buying tech invented in the UK because there won't be much if any new tech developed in the UK!
That is rather a huge show-stopper, for rather a lot of industry. Ownership matters.
Don't be so naive to think this is just an 'administrative procedure'. This is the UK Gov't - and its Customers - putting in the procedure for subverting any technology it wants.
But yes, that sounds like one of the reasons they want the legislation. However, I think a stronger motivation is that they want to force the company to weaken their security and/or add a backdoor for government enforcement. So yeah, I wouldn't be buying any product from the UK that has anything to do with security.
- Updates don't count: only significantly large changes need disclosing.
- Can't be forced on companies with fewer than 10,000 users. Maybe commercially led open source products could claim that users are spread across many forks each with fewer users.
- New product disclosures only applies to communications companies already forced to backdoor existing products. Maybe we'll see companies akin to Alphabet evading the need to backdoor new products by forming separate companies.
Overall I'm more worried by the requirement to backdoor communications than having to disclose new services. Security shouldn't be sacrificed. Additionally the gagging order would prevent companies from being honest with their users as well as making it harder for them to fight against it.
1: https://en.wikipedia.org/wiki/Communications_Assistance_for_...
It's actually not as chilling in the sense that this would be nothing new - rather, I'm sure the spooks are grieving the fact that people are moving to secure technologies.
I'm pretty sure that before the internet no envelope or phone call was inaccessible.
Either way the UK gov is looking highly incompetent.