Hacker News Reader

Comment by tptacek | Hacker News Reader

HN is trying to derive axiomatically what this is about, but there's an empirical backstory you want to know about this. Start with this grugq conversation on Twitter from a few months ago:

https://twitter.com/thegrugq/status/1610169123388141568

What this appears to be about is not encrypted messengers but rather particular brands of modded Android phones that are used exclusively for organized crime.

That doesn't mean you should support the proposal, but if you're reading it as "the UK is trying to ban encryption outright", that's not the whole story.

View on HN

It's still troublesome as a precedent: Making a particular class of software illegal to be in possession of.

As others have pointed out - once the precedent is in place, what is stopping them from deciding that some other piece of software superficially matches the law close enough that the police will ding you for it? After all, this is policing 101, where they use whatever laws are on the book as leverage for something totally unrelated to the laws they're using.

Having a look at the wording on offer:

- An offence of making, modifying, supplying, offering to supply a specified article where a person has reasonable grounds to suspect that it will be used in any serious crime.

- An offence of possessing any specified article where a person intends or, has reasonable grounds to suspect, that it will be used in any serious crime.

Every time we get new laws like this, we take a step towards the police being able to arrest anyone, for any reason, at any time.

Two things are simultaneously true:

1. The entire UK economy is dependent on everyone having access to cryptography so good that even Russia can't break it, therefore it is of paramount national interest that everyone does have access to it.

2. Bad people will use the exact same tech to avoid detection while planning and committing major crimes that have the potential to escalate to the level of undermining the state.

The only way to prevent #2 is to enforce extremely luddite laws that mess up #1.

In reality things get much harder to guess at when pontificating from armchairs, as when you have to account for the fact that the government and police aren't actually trying to perfectly enforce any specific law — not even the ones we all grew up assuming they "surely must" fully enforce because they were the worst horrors in the newspapers — it stops being clear how much any given law is supposed to help nor how much harm it will cause.

> The only way to prevent #2 is to enforce extremely luddite laws that mess up #1.

That's often how they think, but of course it isn't true.

The FBI has had good success with another route:

https://www.pcmag.com/news/fbi-sold-criminals-fake-encrypted...

Then there's just good old fashioned good police work. Informants. In-person Surveillance. Sting operations.

The problem with the latter is that it's very labor-intensive, and states would like to be able to automate detection in the same way that professional criminals are becoming capable of automating crime.

It's interesting that the UK is (as usual) taking the approach of designating particular technologies to be bad because they facilitate crime, and thus presumptively assigning criminal liability to their manufacture. Perhaps it's because the technology can be described in abstract terms, similar to a patent. A more expedient approach (like saying 'I notice, sir, that 95% of your customers are criminals') founders on the dilemma of needing a new kind of legal theory to address the criminal supplier's plausible deniability, or an elaborate and uncertain investigation to discern just how product X gained the approval of the criminal class to become established as a standard.

It's also interesting how non-geeky criminals want a walled garden ecosystem with very limited configurability, so they can outsource the technical decision-making to some underworld equivalent of Steve Jobs instead of having to promulgate standards of digital security practices.

You're ignoring the main point of the comment you're replying to, which is that laws like this mean they can arbitrarily charge whoever they like because everyone is constantly in violation of some law. The argument that we should trust the police not to use this power irresponsibly doesn't stand up when they're shown again and again that they are very happy to abuse such powers despite promising not to do so when the law is brought in. The UK government has made it clear they want to prevent anyone from hiding data from them and criminalising encryption and selectively enforcing that law is one way to achieving that.

Funny you say that. It's almost like if some part of Russian intelligence had strong influence on the Tory party and they try to make us less safe.

Elections can't come soon enough. These people are dangerous.

Almost, but not quite. It seems that there isn't a country left on Earth that isn't toying with such ideas, so I don't see how one could blame it on covert influence of Russia or any other single state.

> The only way to prevent #2 is to enforce extremely luddite laws that mess up #1.

Except laws are not effective in preventing #2 because bad people, by definition, are happy to break the law. Such pre-emptive laws mostly annoy honest, law abiding citizens.

> but if you're reading it as "the UK is trying to ban encryption outright", that's not the whole story.

But isn't that the whole story? A device produced to securely encrypt data is proposed to be outlawed - if that's a physical device today, it'll be an algorithmic device tomorrow. A law against one effective safe is a law against all effective safes.

Any encryption device is "sophisticated" if it is useful. Maybe we could read it as "UK is trying to ban /useful/ encryption outright"

In fact, these devices are already out there. Specifically your smartphone (most likely) already encrypts data at rest and your laptop possibly does too.

In fact their own laptops do, and often get left on trains.

This is yet another authoritarian power grab.

It's dangerous to assume context and intent when writing a law will limit how that law, once passed, is applied. Because they won't. And there's a lot of "not available commercially" language in there, that makes me think it'll apply to anything you can't buy at a local mall, e.g. a privacy-focused Android fork.

It's also a dangerous step in making the mere act of hiding from the government a crime.

The problem, of course, is that the government can never be trusted to keep within the boundaries they claim they'll set. Metadata retention went through in Australia and the meat inspectors wanted access to it; surveillance in the UK was used to spy on people who left their rubbish bins out; at the height of the pandemic, contact-tracing data (which was promised hand-on-heart to be for public health only) was used by the police for unrelated crimes.

If a communication device is favoured by criminals, I kinda want in. I mean, we're talking people who have very good reasons to avoid detection, right? Maybe there's something good in those phones?

(Not that I would trust the criminal's supply chain, mind you.)

You would think so but most of them have terrible security:

https://threatpost.com/europol-arrests-cracked-sky-ecc/16474...

https://www.wired.com/story/encrochat-phone-police-hacking-e...

https://arstechnica.com/information-technology/2018/11/polic...

https://www.engadget.com/fbi-encrypted-chat-app-anom-crimina...

Well I tried… Thanks for the links.

> If a communication device is favoured by criminals, I kinda want in. (...) (Not that I would trust the criminal's supply chain, mind you.)

Here's an extra challenge: how do you know that a given device is "favoured by criminals"? Where did you acquire that knowledge, and how sure are you of it?

If it's just from randos on the Internet, even if you aggregated opinions of many such randos, it's likely the result is still wrong. Or worse, a honeypot. On the other hand, if you honestly have it on good authority from actual users with skin in the game... then you're probably already in - on the crime part.

EDIT: And, on the off chance the actual preference of experienced criminals becomes public knowledge, guess which tool the law enforcement will focus on breaking and circumventing?

This kind of security has an anti-inductive quality similar to that of the stock market: if you learn some information that could let you beat the market, most likely the information is either wrong, or has already been exploited to the point of diminishing returns.

You make good points, I think I agree with them. I started this tongue in cheek, but if I'm being serious here, my actual method is building genuine expertise in infosec and cryptography, to the point where I can make my own stuff. Which I did: https://monocypher.org

I was dissatisfied with the state of the art, which did not seem to provide the simple solutions I thought the world deserves. (My subject at the time was file encryption.) Even cryptographic libraries left something to be desired, including libsodium itself, despite the ton of respect I have for this library.

So I experimented with my own thing, and ended up finding a sweet spot between portability, performance, and simplicity. A surprising benefit was the embedded market: Monocypher can go where libsodium doesn't, and is to this day one of the fastest cryptographic libraries on micro-controllers.

Long story short, I don't have to rely on some reputation game to evaluate the security of something. I have the expertise to look at it more directly, and if need be do much of it myself. I have, and will, but I do hope the world doesn't turn so badly that my own expertise becomes more reliable than good external sources.

>"the UK is trying to ban encryption outright", that's not the whole story

It really is though.

They’ll always have a good reason to present, and they’ll always say it won’t go any further.

This whole story is kind of sad because crimephones don't even provide good security. Either they are easily hacked by the government or they're government honeypots from the beginning.

I never understood the purpose of those phones. They aren’t using their own secret crypto (which would be a bad idea) like the military does, so why not just use something like Signal?

If I were in this market, I’d be more suspicious of some modified device sold specifically to unsavory characters. It would be a great target for the government to compromise.

The phones "just work" and are a kind of status symbol. It's not like selling drugs even at a high level requires a lot of brainpower. Buy from Colombians, put in shipping container disguised as something else, wait, ???, profit. You just have to have a large risk appetite.

I suppose if you're someone selling privacy to criminals, it's a lot easier to preconfigure mid-range Android phones to sell than to configure each individual customer phone for maximum privacy. Also, it's not just about keeping your own data private, but about the other person you're communicating with. If you know the other person is using the same phone you can feel safer that it's secure, as opposed to trusting that the other person is taking things seriously and knows what they're doing when configuring their own phone. Plus it makes it easier to enforce things like messages being deleted after a period of time. The extra cost is easy to justify when you're trying to avoid jail time.

Which, they have, eg https://www.engadget.com/fbi-encrypted-chat-app-anom-crimina...

But imagine you're the tech-smart mobster trusting your freedom to the rest of the mobsters. You really want to play text support, or you just gonna properly setup Signal to auto-destruct and pre-verify safety number and give those devices out?

If anyone wants to start reading on the shady world of organized crime, smuggling, gangsters and such that can be found in Vancouver, BC, google "phantom secure Vancouver".

The well known "phantom secure" custom firmware phones sold years ago for organized crime type people.

https://www.google.com/search?client=firefox-b-d&q=phantom+s...

Then google "Vancouver Canada casino money laundering".

I would think that any sufficiently sophisticated organized crime group in 2023 would consider any "special" secure phone sold with such software to be a honeypot, and either DIY it or come up with some other method. This sort of thing would be purchased by clueless/gullible mid and low level people only now.

> This sort of thing would be purchased by clueless/gullible mid and low level people only now.

And therefor should actually be subsidized immediately.

Yes... Waste your time and resources on the mitifable or manageable agents, and leave the high-threat, throughput multiplying organizers to just continue the churn.

Low-hanging fruit collection, while looking good on a poster, will never be as effective as neutralizing high-level actors.

This is the same logic that makes it a jailable offence to steal a loaf of bread, but stealing someone's life savings and disappearing it through fraud or malfeasance gets you a shot on getting on a Board someday.

Yet the tone of the later paragraphs in that section is axiomatically assuming they should be able to prosecute the makers of the encrypted devices, or anyone possessing such a phone, in addition to the 2,864 criminals they already caught using them. All while implicitly admitting there's nothing fundamentally illegal about building or possessing a strongly encrypted device.

Seriously police should be thanking the makers of this device that enabled the UK to arrest 2,864 criminals.

The encrypted phone services mentioned in that tweet have been breached by the police and thousands of arrests have been made.

In the case of encrypted phones the current laws are working.

From what I have read [no1bc](https://no1bc.com) has been one of the more popular devices after the Sky ECC takedown, and it's basically just an iPhone with their special messaging app installed and an MDM setup to disable a bunch of settings and allow remote wipe. An iPhone is "commercially available" and some of these services even have their apps on the app store. Would that be a sophisticated encrypted communication device? It will be interesting to see what definition they come up with but it seems likely it will include some false positives.

I looked at the no1bc thing and their ONEKEY is literally just a commercial off-the-shelf Bluetooth smartcard reader (the Certgate AirID Mini).

Would this make any smartcard-enabled messaging or email client suddenly "sophisticated encrypted communication"?

Given the knife laws in London - you must have a valid reason for carrying a knife - making certain apps illegal to have on your phone without reason is suspicion enough!

Sure. But what happens when just takes normal phones, installs signal, and sells them to criminals?

Reply on news.ycombinator.com