Signal would 'walk' from UK if Online Safety Bill undermined encryption | Hacker News Reader

Signal would 'walk' from UK if Online Safety Bill undermined encryption

bbc.com

327 pointswalterbell198 comments

> The government, and prominent child protection charities have long argued that encryption hinders efforts to combat online child abuse - which they say is a growing problem.

So take using a sledgehammer to crack a nut.

What they should be doing, is rather then increase the risk of for the majority who use encryption for valid reasons (privacy, not nefarious), is invest in services to allow individuals to gain help, in a manner where they won't be ostracised and at risk, all from trying to come forward and get help to amend their behavior.

I am father myself, and like a majority (being a parent is a moot point really) am appalled and disgusted by CP, but me being that way won't stop individuals from succumbing to obtaining CP. Some of them do this even though they know it could trash their seemingly normal life (they often have their own families who are totally unaware). This to me suggests there is some sort of psychological disorder at play, and these people need professional help and intervention.

Trying to snoop on everyone, to seek these people out won't achieve anything. They are willing to offend even with extreme risks already in place (being labelled as a pedophile for the rest of your life). Them being snooped on won't stop it all, the same vicious cycle will continue to play out, but now with all of us lacking a basic right to privacy.

Make no mistake: the Online Safety Bill has absolutely nothing to do with protecting children. End-to-end encryption is the first line of defence against government approved mass surveillance. If it falls, the rest will follow. It will only be a short period until the operation is expanded under the guise of additional "protections" against the citizens.

The "children" excuse + most of the population saying "I don't need privacy, I have nothing to hide" is a double whammy against any form of encryption and it's just a matter of time before our Internet privacy rights are completely stripped away.

A huge educational campaign is necessary to convince people and the average politician that being pro-encryption doesn't mean being criminals or pedophiles. So it's a lost battle already, and the intelligence services everywhere know it's just a matter of time.

Eventually a pro-privacy activist will be found with child pornography and everybody will cheer and applaud any form of privacy-stripping law.

The children angle is insidious, and where the discussion keep devolving even in tech-savvy forums like this one, instead if seeing it's convenient and very effective marketing to hide anti-privacy goals.

Easy to frame a headline against it. "New bill to allow Jeremy Corbyn to read your secret messages and Tories WONT FIGHT IT"

The poor man’s not even in labour anymore, let him rest!

Nitpick: he is a Labour member but not a member of the Parliamentary Labour Party, so he sits in the Commons as an independent.

He'll stand as independent at the next election, hence getting automatically expelled from the party.

> The children angle is insidious...

The entire rhetorical position is difficult. One of the (somewhat implicit) rules of public discourse seems to be "assume good faith". To make the argument that people should have freedom from government requires an acknowledgement that government officials regularly do more harm than good. It is insanely challenging to carry that position in a debate. Keep your eye out for the handful of people who manage to do it without being tarred as crazy. That rhetorical imbalance makes it safe and straightforward for power politicians and police to argue that they should get to read everyone's emails.

It is tricky to understand why centralised power is a terrible thing that will lead to corruption and injustice. Implementing a system that tolerates privacy requires the bureaucracy to not grasp power. We've always been lucky in a sense that a critical mass of people learned they need to fight to protect freedom as an ideal, even if they can't exactly explain why or if the details seem to lead to bad outcomes (see also "fight for your right to say it"). It may be the only defence against a Stalinist- or Maoist-style collapse.

> requires an acknowledgement that government officials regularly do more harm than good

I don't think it's that. The argument should be similar to the Veil of Ignorance: do you want every conceivable future government to have these powers?

Well, hypothetically, if the government on average does more good than harm why would you not want that? Sure you'd get Hitler-lite on occasion, but that would be balanced out by anti-Hitler-lite doing good.

Of course, the damage the bad apples do far outweighs the benefits of the good so that argument doesn't hold. A century of good governance with global assistance barely balanced out the damage Hitler triggered in 5 years. Destruction is easy and creation is hard. And that plays out on the small scale too with small numbers of corrupt officials undoing huge amounts of work by good people.

If we had perfect information, we'd find that the spying apparatus of the 5 Eyes has done far more bad than good to the general welfare. The political corruption that must be causing is immense, we already know that every president since Obama has been targeted by the intelligence apparatus in some form. It is unlikely it ends there.

I'm less sure about the situation in the UK, but they generally follow the US trend.

> That rhetorical imbalance makes it safe and straightforward for power politicians and police to argue that they should get to read everyone's emails.

The fundamental problem is that given any permission (an extension of trust), individuals will--100% of the time--abuse it in the absence of oversight.

It's not a matter of if/when, only a matter of to what degree. But being individuals, we are empowered to choose how we grant or revoke such permissions to other individuals. If you stop trusting your spouse, you can revoke their access to your email.

Government is a superset of Individuals. There is no greater clique they are accountable to. Any permission extended (surrendered) to it is an implicit conversion of ownership. If you stop trusting your government to act responsibly with surveillance, you can't revoke that permission. It's no longer yours.

...like the toy you hand over to the playground bully because he "just wants to see it for a second." He was polite enough to state the conditions of release upfront-- but nothing on the playground compelled him to actually abide by his own terms. You find out too late he's a liar, and if you're lucky, you'll get your toy back, when he's done with it, and likely in pieces.

It's frustrating trying to protect children from amorphous threats whose access methods are abstract, virtual and obfuscated by incomprehensible technology and encryption. The question is always whether we maintain absolute anarchy or accept nanny-state dystopia.

Maybe it's time we consider kicking kids off the internet altogether before surrendering any more personal rights to a bully with the weight-class of an entire institution.

100%

I see you posting an opinion I agree strongly with here often. Glad you’re still at it.

I will offer a positive side to this situation. Their war against math proves the math works and they don’t have an internal workaround. Since a war against math is bound to fail in long term (just like the war on vegetables aka “war on drugs”), short term victories of oppression won’t shut down the future.

The children angle is insidious, especially when whistle blowers, reporters, and power players in revealing high up people involved in pedophilia seem to all magically have unfortunate accidents. It is a tool to emotionally manipulate a population which is ravenous against pedophilia. A very effective one. I look forward to the day these people are all held accountable.

There is already a more subtle problem here, at least in countries with case law. The people who end up on trial trying to defend encryption are typically guilty (as very roughly 90% of people who go to trial are). Many of them are guilty of things that most of us look very strongly down upon, like possessing and sharing child sexual abuse material. Thus if you want to set a strong precedent for protection of encryption, you end up defending exactly this sort of person.

[citation needed]

> the Online Safety Bill has absolutely nothing to do with protecting children.

I wish people would acknowledge both sides of the coin instead of simply pretending the other side doesn't exist.

Yes society uses surveillance to identify and prosecute criminals (of various ilks, including those who abuse children). If you render that surveillance impossible by construction then people who might previously have been caught will not be.

Instead you pretend that the only goal here is am authoritarian state straight from 1984.

The risk of the second is one reason not to do it. IMO it's easier to think what happens when you make it easier for people to be blackmailed, manipulated, impersonated, defrauded. But again, that's just an opinion.

I remember the UK using its anti-terrorist laws to freeze Icelandic banks assets during the financial crisis. There is a probability 1.00 that this will be used for purposes that have absolutely nothing to do with the pretext used to pass the bill. So it's a pointless exercise to debate about that pretext. The only thing that matters is what right does that give the government?

Do you think pervasive spying would have made it more or less likely that the Jeffrey Epstein case made it to the public eye? Running a paedophile ring is not some small thing that is easy to hide. In all the cases I've taken note of (in churches, schools, local clubs, etc) the problem is almost never that the crime is unknown, it is that the perpetrators have too many tools to shield themselves from consequences and discredit the victims. In the future, maybe tools like going through people's internet history or planting fake evidence using their online accounts.

Society shouldn't use surveillance to identify criminals. We'd look back at dragnets to catch runaway slaves or hunt down the homosexuals with horror (as, indeed, we generally do in states that successfully institute mass surveillance to catch criminals). As recently as a few years ago, 'criminals' were people found outside their own homes and places like China were successfully catching them much to the net loss for everyone. There is a strong - indeed, overwhelming - link between places with good privacy, good protection of freedoms and citizens living happy prosperous lives.

The people pushing mass surveillance know all this. It has been bought up every time some bright spark comes up with the idea of rolling out mass surveillance. These people understand the societal consequences that they are ushering in. Too many of them understand what they are doing to pretend they have pure motives. This is empowering the worst of the authoritarians.

If this is the case, why is the issue of child _privacy_ (and the effect of losing it upon passing of this bill) not considered as part of the "concerns" for online safety (and carefully omitted as part of the risk assessment)?

This is not some spectrum with safety (but loss of freedom) and danger (with freedom) on each end. The results of this bill will be both less freedom and less safety.

30% of child sexual abuse is done by family members. 60% of child sexual abuse is done by acquaintances. 10% is done by strangers, and I am willing to bet that a good fraction is of that is done offline.

If we want to protect children, why are we completely ignoring those 90%? Where are the bills mandating installation of cameras in all households with children?

If you want to protect children from strangers on the internet, perhaps fund schools so they can properly teach children that the internet can be a dangerous place. Bills like this aren't going to do shit to protect children.

It's just like gun control. They're barely enforcing existing laws because of political sensitivities and asking for more power because...?

>Make no mistake: the Online Safety Bill has absolutely nothing to do with protecting children.

I don't think that's entirely true.

I am sure many MPs, charities, and campaigners do only see this as an issue of child (and more generally, public) safety.

I think the difficulty has always been explaining to laypeople that allowing any kind of monitoring or surveillance significantly weakens the security of encrypted messaging.

I think of it another way. The bill itself isn’t anything to do with protecting children - but lots of people (MPs, charities, campaigners) have been misled into supporting it. It’s what makes “think of the children” the best way to pass bad legislation. Not only does it make it very hard to object to a bill that won’t actually help children, but you get lots of free support from well-meaning people who don’t understand the implications of the bad legislation they’ve been conned into fighting for!

https://www.youtube.com/watch?v=3jFqhjaGh30

>Make no mistake: the Online Safety Bill has absolutely nothing to do with protecting children

Exactly, they could start teaching law in a concept understandable manner from primary school age, concentrating on what can cause the damage mentally and physically, like the spread of germs from a young age. But they dont, so kids cant even protect themselves in an offline world and the state gets to maintain its air of pseudo respectability whilst most people dont understand how the state is causing lifelong trouble.

> So take using a sledgehammer to crack a nut.

It is worse. Encryption does protect children instead of endangering them. So these "charities" aren't even doing their job.

Indeed: it is worthwhile to note the nefarious absence of the role of privacy in the laid out "risk assessment" of children's usage of a service, in part 3, chapter 2, point (6) of the bill.

https://bills.parliament.uk/publications/49376/documents/282...

These “charities” are all funded by government grants anyway. You can safely claim they are both the same entity: the government.

Yes. I don't want to live in a world where my kid sends someone a picture of immigrants on a boat and gets a criminal record. It's just a step between abolishing encryption and this.

And the next step is wide scope censorship like that instituted by the CCP. The ideas that we should censor politically inconvenient truths like the migrant crisis are already in the UK.

Really hard to imagine a sane and rational policy maker naming encryption as something that compromises safety. If anything, it facilitates it. But then again, this isn’t about policy, it’s about control and surveillance.

> encryption hinders efforts to combat online child abuse

So do opaque walls and the absence of surveillance cameras in cars and homes. Oh don't worry - the recordings will be securely stored, and only available with a court order, only issued for "serious" crime!

It's strange that as surveillance proliferates, the shrinking scraps of privacy we have left are deemed a growing problem, not a vanishing one.

I don't think breaking encryption is a good idea, but I will say that until recently law enforcement could tap phones, rip open envelopes, and get a court order to break into your house and search it. There was never the level of privacy against law enforcement that encryption offers.

> rip open envelopes, and get a court order to break into your house and search it

One limiting factor was that this wasn't scalable - so a lot of people would be comfortable with it because there is little potential for widespread abuse - there just aren't enough resources to search & monitor everyone's mail and houses at all times.

There are no such limitations online, so better protections such as encryption are required to counterbalance it.

I agree, but that still isn't a net loss in privacy. We can still communicate the way we could, except now we also would like an unbreakable way of communicating online.

I understand of course that scale is an issue online, but that doesn't affect the idea that encryption gives us basically unbreakable communication over a distance, and removing it is not eroding our last vestiges of privacy.

The fact that most communication has moved online means that there's significantly less physical mail traffic than back in the day, so maybe physical mail is not secure either if total capacity is now below what the government can monitor?

It's making privacy more expensive and rare, while making surveillance cheaper and more common. Do we have to wait until it is literally impossible to share a single word in private before we start to worry?

> Do we have to wait until it is literally impossible to share a single word in private before we start to worry?

No one is saying anything like that.

Active effort. It also can't just be done passively or archived for later optional analysis by computers or humans.

Further, usually, a judge has to approve. There's at least some oversight and reasonable cause involved.

> One limiting factor was that this wasn't scalable - so a lot of people would be comfortable with it because there is little potential for widespread abuse - there just aren't enough resources to search & monitor everyone's mail and houses at all times.

It's recently started to emerge that US opened and censored all international mail 1950-1989. We're talking millions of letters a week. It started as a measure to remove all reference to US use of biological weapons in the Korean War and grew from there. (the third season of the Blowback Podcast did a couple of interviews which covered it really well.)

That’s rubbish. Two people could go somewhere they wouldn’t be heard and have a private conversation. Encryption provides no more challenge to investigation than that option that has existed forever…

> Two people could go somewhere they wouldn’t be heard and have a private conversation

This is still the case. That's not a good example of privacy being eroded.

It is, because this used to apply to most conversations. Even when overheard, they would likely be forgotten by who heard them, not have heard everything, not known who was talking, etc. If the conversation became interesting for an investigation, simply finding a witness would take significant time from limited police officers, the witness may not wish to cooperate, their memory would be imperfect, and perhaps most importantly, it would quickly become common knowledge, via gossip, what the police is snooping for.

Now most conversations have moved online, and a secret record can be cheaply created of exactly who is talking to who, when, how often, and in the absence of encryption, even what they are saying. Phones we all carry, even without spyware apps, can be located through signal triangulation, before we even get to facial recognition and omnipresent cameras, smartphone or otherwise.

That, theoretically, we can recover some of the privacy we used to have (so long as we don't get targeted surveillance, which has become so effective defeating it is nearly hopeless), does not mean that, in practice, privacy has been massively eroded for the average person.

You could always just not write things down. The government is prohibited from torturing information out of people.

The numerous people tortured by the government at GITMO and at CIA black sites around the world will be comforted in knowing this.

> So take using a sledgehammer to crack a nut.

It's less of a sledgehammer and more of a ballistic missile. With nuclear payload.

"Think of the children" is one of the 4 horsemen of the infocalypse. It was never about stopping CP. It's about justifying laws that take away privacy, no matter how flimsily.

https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

I agree. Next step. Majority of CP is filmed in homes where children live. To protect the children every home must have a government monitored camera in it so that the safety of the children can be insured. You don't have anything to hide do you? No criminal activity going on?

There is no way this doesn't quickly turn into full government monitoring of everything being sent over technology. Before that even, I assume the search for CP will be done via image hashes provided by a government database. Whats to stop the government from simply putting a hash of information it does not want public? The snowden files or something similar. Quickly identify and remove leakers.

Its a very slippery slope.

And this is from country where certain celebrities abused children for decades in plain site without any encryption. Where children of entire towns were mass-abused also in plain site and under the nose of police. Where members of Royal family are known kiddy fiddlers without anything serious happening to them.

plain sight*

oops

well sure but those are the royals and minorities. Can't be arresting them. Its everyone else that has to be monitored, those are the real baddies.

> "we would absolutely 100% walk rather than ever undermine the trust that people place in us to provide a truly private means of communication."

This from the same signal that refuses to update its privacy policy to reflect the fact that they've started permanently storing sensitive user data in the cloud (https://community.signalusers.org/t/proper-secure-value-secu...). The same Signal that ignored the users who didn't want any of their data kept in the cloud in the first place (https://community.signalusers.org/t/dont-want-pin-dont-want-...).

That, combined with the way they were misleading in their communications (https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin...) already undermined the trust I was placing in them.

At this point I consider the fact that the very first sentence of their privacy policy has been a lie since 2020 to be a dead canary.

What alternatives are there to signal? Reasonable, for a lay person.

Telegram I think is considered safe?

But TBF signal is end to end encrypted which means at least the content if your chats are safe. This is in my opinion safe enough, but YMMV I guess

Telegram is, I believe, generally worse than Signal for privacy.

Both have FOSS clients and offer E2E chats (good), although Telegram doesn't make them the default. Both require the use of phone numbers for identification and store some of your metadata in their central servers (bad). Both dabbled with the idea of privacy-preserving monetization via cryptocurrencies, and both failed spectacularly (funny).

Telegram is run by a swashbuckling Russian expat in Dubai; Signal is run by an American security nerd. You might prefer your metadata to be in Pavel Durov's hands than Moxie Marlinspike's, depending on your threat model, but probably not.

I stand corrected! I might have actually confused the background of the two apps with eachother...

Telegram doesn't do E2E group chats at all.

Depends on your use case. Signal has the largest user base.

* Matrix (you don't have to selfhost) is ok. Consider not using matrix.org (it's "decentralized" for a reason)

* Quicksy is nice but has no userbase at all.

* Threema, but look at https://breakingthe3ma.app/ first and https://threema.ch/en/blog/posts/news-alleged-weaknesses-sta... and https://soatok.blog/2021/11/05/threema-three-strikes-youre-o...

* Wire https://en.wikipedia.org/wiki/Wire_(software)

* Telegram is the worst of the bunch (imho). Just don't use it...

Last I checked, and it's been awhile, Wire is not only centralized, but also keeps contact lists online --- in other words, they've kept an SQL database of who's talking to whom across their whole service, serverside.

If that's changed (or if someone wants to point out that I'm wrong about that, which is always possible), I'd appreciate the update.

AFAIK that's still the case. Who messages who is saved with matrix as well though. This shouldn't be a comprehensive list of what's better than signal only a list of everything available in the space. Imho everything in the list is better than telegram and whatsapp, but depending on your use case nothing is good enough and you must fall back to briar or something similar.

If you don't mind the lack of polish I've been using Jami for secure communication and even file sharing and I've gotten a couple lay people set up and running without much trouble. Set up is pretty easy. They don't even need you to give them an email address, but it's different. It's not going to look or act like Signal.

What I loved about Signal on mobile was how it handled both encrypted messaging and plain old SMS/MMS in the same app and I don't have a real alternative for that.

Honestly, this government has some balls. Signal won't be the only one leaving the UK - it's becoming a really poor place to live with high taxation, stalling economy, low consumer rights, environmental protections being stripped away and erosion of civil liberties and rights to privacy.

Only when there's enough brain drain might they backtrack but politically we have a party in power that is susceptible to infighting and not at all focussed on actually serving its citizens.

With many reputable universities and large companies, brain drain isn't a realistic outcome.

Many of the people who make those universities reputable are foreigners. If the UK goes down an extreme path, the ones who are there will start leaving and new ones will stop coming.

There was a story about researchers leaving because they wouldn't take part in European funded work anymore... that's that sort of bureaucratic stuff that researchers will not put up with when they feel like they're not able to keep up with their peers.

TIL Element (the Matrix.org client) is based in UK.

This is extremely worrying.

It is dual French and British. That said, France's record on freedom of encryption is not that stellar either, even if it is not as bad an enemy of the Internet at the UK. Element should preemptively move its HQ to Iceland or similar.

Element was founded as half French/British, but we also have German & US legal entities now, and we will shift our HQ out of the UK if forced to.

What do you think of the EU "Chat Control" proposals?

https://www.patrick-breyer.de/en/posts/messaging-and-chat-co...

> The European Commission went a step further on the 11 May 2022 by presenting a proposal which would make chat control mandatory for all e-mail, chat and messenger providers and would even apply to so far securely end-to-end encrypted communication services ... All of your chat conversations and emails will be automatically searched for suspicious content. Nothing remains confidential or secret. There is no requirement of a court order or an initial suspicion for searching your messages. It occurs always and automatically.

One way to increase awareness of these proposals would be for E2EE messengers to include an in-app notice and call to action, for customers in affected countries.

> One way to increase awareness of these proposals would be for E2EE messengers to include an in-app notice and call to action, for customers in affected countries.

I think this is a really cool, low-cost/effort way to raise awareness.

Makes me wonder if this could be used against those apps somehow. We all know some countries' governments are quite coerceful and scummy...

> used against those apps somehow

Speech about _draft_ laws is known as debate in a democracy.

Coercion about _draft_ laws would remove any illusion of consent and illustrate why the proposals are misguided.

That is reassuring, thank you!

Have you considered moving the HQ to some more privacy-friendly place? (Switzerland would be an obvious choice, but I've heard good things about Seychelles too, for example.)

> The government said its proposal was not "a ban on end-to-end encryption".

> Critics say companies could be required by Ofcom to scan messages on encrypted apps for child sexual abuse material or terrorism content under the new law.

So, what's going on here? Is it going to be E2EE between user and user and then also a copy E2EE between user and the government? What a time to be alive.

Or is the law going to require them to scan encrypted messages for child abuse and terrorism content? Unless they are required to hand over the keys then... how is that going to work?

Government policy on encryption (along with many other things including Brexit) relies on "magical thinking". They don't understand the problem so they assume there's an easy solution that's just being withheld from them by nefarious third parties.

It's a classic misleading but true statement from the government. They can mandate apps scan messages client side before sending E2E.

What stops a company from making a PWA that ignores the UK rule? UK can't block it, especially if they host on aws or gcp servers. So long as the company isn't headquartered in the UK, nothing can be done.

Just scan the encrypted data stream and call it a day. "Well, we tried and did not find anything"

If governments suddenly wanted to ban fire extinguishers, I think most people would be very concerned about what these authorities might be planning, but instead of fire, when they go to ban the tools we use to protect ourselves from crime and corruption, they get the benefit of the doubt?

There is no principle for anti-encryption policy, it's not worth arguing with them, as these policymakers are not moved by reason. You can only organize and get them out.

Who are the faces of this bill?

I'm picturing a webcomic where a ~25 year-old's boyfriend asks her for some nudes, she strips to take them and freaks out because [politician] is suddenly sitting there, leering and smiling. "Oh don't mind me, I'm just here to protect children and prevent terrorism."

Any other ideas for a series?

To be clear, this is a really serious situation.

The current Online Safety Bill wording from https://bills.parliament.uk/publications/49376/documents/282... (https://bills.parliament.uk/bills/3137) is as follows: clause 124(3) declares that OFCOM (the telco industry regulator) can impose "proactive technology" to comply with or remediate illegal content, child safety or fraudulent advertising(!):

    (3) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—
      (a) section 9(2) or (3) (illegal content),
      (b) section 11(2) or (3) (children’s online safety),
      (c) section 23(2) or (3) (illegal content),
      (d) section 25(2) or (3) (children’s online safety), or
      (e) section 33(1) or 34(1) (fraudulent advertising).

and clause 202(1)(a) then defines "Proactive technology" to mean:

    202 “Proactive technology”
     (1) In this Act “proactive technology” means—
       (a) content moderation technology,
       (b) user profiling technology, or
       (c) behaviour identification technology,

In other words, the Bill gives the industry regulator the ability to impose a requirement that communication apps implement content moderation technology - which for an end-to-end encrypted system, obviously means the ability to scan and exfiltrate encrypted content to moderators (as how else can you moderate content). As a result, anything that whatever scanning technology deems illegal would have to end up in an unencrypted moderation queue (presumably provided by the app vendor?!), thus completely violating the encryption privacy guarantees. For instance, folks in Ukraine using Signal/Element/etc to discuss being bombed might end up with their messages exfiltrated by the scanning software to a moderation queue because they include the word 'bomb', which is then a sitting target which bad actors would use to gather intelligence and entirely sidestep encryption.

The penalty for not complying is still being determined, but could mean jail time for those building the apps: https://www.telegraph.co.uk/politics/2023/01/16/rishi-sunak-...

This is LITERALLY the online equivalent of putting a CCTV camera in everyone's bedroom, hooking it up to an machine learning classifier to detect 'illegal activity', and then sending unencrypted recordings to a moderation queue run by the CCTV vendor.

It's terrifying, and we have to stop it, before it sets a precedent that the EU follows with ChatControl, or that the US follows (or uses it as an excuse to remove E2EE entirely).

The way to stop it is to yell about it loud on social media, talk go the press, and if you're in the UK, write to your MP (they do actually read these letters).

Signal & others, if you're reading this: we need to coordinate on an open letter to UK Parliament (probably the House of Lords Committee) to present a united front against this; please ping me at matthew[at]matrix.org to sync.

The OSB is alarmingly advanced through the legislative process, and we are running out of time to stop it.

I have a question: what does it mean for the _users_ of messaging applications? If the OSB passes am I still within my rights to PGP encrypt my messages before sending them?

That may depend on whether operating systems (including app stores and package managers) are also regulated, e.g. via the EU Cyber-Resilience Act, https://news.ycombinator.com/item?id=34760173

Worst case you could always roll your own based on proven open source libraries, down to the metal.

In the current wording: yes, you can go encrypt your messages with PGP before sending them.

However, the worst-case scenario is that Ofcom would then say to Apple and Google: "Hey, you are communication service providers (thanks to iMessage and Google Messages/Chat/etc). We believe you are failing to adequately block illegal content. Therefore we legally require you to perform content moderation. And given you also provide the operating system for your services, and given you've already demonstrated you are willing to do client-side scanning at the OS layer (https://www.siliconrepublic.com/enterprise/apple-csam-child-...) clearly we expect you to scan for illegal content in the OS. Therefore, please scan all content for illegal content, otherwise we'll send your UK-based staff to jail. By the way, have you considered putting scanning in the graphics pipeline? Then we can make sure that you do OCR and image-classification on all pixels that users see, to make sure that after users PGP-decrypt their messages we can spot words like 'bomb' or worse, and send evidence through Apple/Google's moderation teams, so they can be able to block the illegal content and uphold their obligations to report CSAM etc to the authorities."

To be clear, this is a worst-case scenario, but it's the logical extrapolation of what the OSB allows. (That said, IANAL).

Also if I understand correctly it would be illegal to build and distribute gpg without the scanning bit

>and if you're in the UK, write to your MP (they do actually read these letters)

I've written to my MP on a number of things I'm passionate about, and he has written back on every occasion. The problem is that he's disagreed with me on all of these points, so I've stopped bothering. He's Conor Burns, for the record.

> The government, and prominent child protection charities have long argued that encryption hinders efforts to combat online child abuse - which they say is a growing problem.

Translation: can u give us a backdoor in Signal, plz? for the kidz, promiss.

Never mind signal, what would Apple do if the UK government forced them to compromise E2E crypt? Someone hasn't thought this thorough properly...

I'd like to think that the UK is small enough of a market for Apple to not give a single flying fuck about the govt forcing them to compromise E2E crypto.

Apple willingly handed over all iCloud data on Chinese citizens upon request. They don't care about privacy at all. They won't abandon the U.K. They'll comply with every single legal directive, as they have pledged to do on multiple occasions.

China is a far more crucial market for them for a wide variety of reasons.

They have virtually no operations in the UK. If the PR impact will cost them more than ditching the UK, they will ditch the UK.

What would they do with the people who has the Advanced Data Protection for iCloud on?

As someone who doesn't have children, I am appalled that there is no mandatory government surveillance in every home that contains a child.

We must protect those children!

Anyone against such reasonable child safety measures must have something to hide.

Thankfully the internet is (almost) entirely decentralized, so it doesn't really matter.

No matter what ban on Signal the UK puts in place, I'm relatively confident that everyone who already uses Signal will be able to find a way how to keep using it.

Textbook case https://en.wikipedia.org/wiki/Think_of_the_children

This is part of Boris Johnson's Red Meat™ tactics. Red Meat tactics means pushing clickbait/culture war bullshit ideas that are idiotic, cruel, or non-working. The goal is to stir up fight over them.

Boris has build his career on running across rivers on the backs of alligators. He avoids being caught by scandals, lying, fraud, infidelity, abuse by throwing Red Meat to distract.

You do know Boris hasn't been in charge since last July, right?

The bill was introduced by Boris Johnson.

And they are free to let it die..

He is still MP and has considerable influence in the Conservative party.

I wish this older generation of politicians who grew up without the internet would hurry up and retire, and let some people who have at least a vague grasp of technology take over. It is painful to watch these people grapple incoherently with the basic idea of how encryption works and what is fundamentally possible or impossible to achieve.

They should allow accounts without phone number or with an nft number, the way telegram does.

Can they force Apple and Google to add backdoors or monitoring at mobile device level? Is it even technically feasible if signal does not enable it?

The NSPCC is one of the biggest risks to internet freedom globally, and it's time everyone started taking that seriously.

Setting aside the question of whether signal are the good guys or not it's important for non-UK people to understand the political context here.

The conservative party is eating itself. They have forced 2 leaders to resign in the last year and are trailing in the polls so are terrified of the next election. They won convincingly at the last election on the basis of a "red wall" strategy that involved an appeal to traditionally labour voters who were Euroskeptic and by throwing dog-whistles about immigration to appease people on the right wing of their own party who were thinking of defecting to the UK independence party. All that support is unravelling and they ended up having to do a humilitating deal with the Unionist party in Northern Ireland which is unravelling because their policies there (the so called "Northern Ireland protocol") threaten to undo the peace process and importance of preserving the peace process is just about the only thing the two sides in Northern Ireland agree on.

There is also a cost of living crisis with strikes across multiple groups of public sector workers.

So right now there is lots of "Performance politics" with policies designed to look tough and appeal to socially conservative right-wingers in an effort to shore up a weak government. Just this week we had the policy to insist that asylum seekers fill in a questionnaire in English no matter where they came from, and now this which they can spin as being tough on crime. I would highly doubt any of the people behind this bill have any interest in the technical pros and cons.

So what is Labour's position on this? Aren't they demanding the exact same thing using slightly different rhetoric?

The only principled parliamentary opposition to undermining encryption that I'm aware of has been coming from David Davis, conservative MP and arch-brexiteer [1].

Maybe there are others like him, but this is by no means a polarising issue in British politics.

[1] https://hansard.parliament.uk/commons/2022-12-05/debates/E15...

Probably. One of the problems of "tough on crime" framing in politics is no politician wants to be seen as "weak on crime" so it ends up being a race to the bottom on civil liberties.

I like when commercial conservatives like to blame the government for always being too big, inefficient and useless, and then go around and sign off all of their rights to privacy of communication thinking that government is going to do a better job with their private messages (or otherwise using their private communications only for the specific reasons they state, such as child abuse) compared to everything else they do.

incredible if UK were to ban Signal, but I guess national sovereignty and security are always going to be higher priorities for the state than user sentiment

I don't think the bill will pass in its current form. Can't see it happening.

I don't know, man. After Brexit, it feels anything can happen.

Lots of bills people thought would never pass have.

The recent legislation undermining of protests being one of them.

I can see it happening too.

That bill passed the Commons, but has been amended by the Lords

(I know the Commons can override the Lords if it wants to, but it's not at that stage yet)

https://bills.parliament.uk/bills/3153/stages

When the right wing, small state, less regulation party is obsessed with implementing this sort of policy - who exactly is going to stop them?

They're not really small state, and have never been. They're small state about certain things.

They're small state about consumer protections to make it easier for their corrupting donors to pillage Britain and it's workers. They're small state about not letting public bodies solve big problems like forbidding councils from building houses.

They're big state about controlling the population. They're big state about centralizing government control. They're big state about gerrymandering to impose a minority view on the population.

Very much like the Republican party.

Sovereignty on Internet in the Internet age is a nonsense; Internet is not the possession of a government, participating to the Internet at country level (dot uk) is voluntary, if UK wants to get out of Internet as a mesh of interconnected computer networks then it is free to go back to the Dark Ages.

Security is another practical nonsense. You don't need to use Signal to encrypt things, anonymous or encrypted communications existed since the dawn of times and will continue to exist no matter what the governments want to do. Criminals will always be able to use one time pad encryption at will, so raping everyone's rights to communication and privacy in the name of security and sovereignty is just a false pretext.

>Sovereignty on Internet in the Internet age is a nonsense; Internet is not the possession of a government,

The digital world of the internet exists within physical, analog metal boxes that reside within and thusly are subject to the legal jurisdictions of countries.

Internet can exist without a country or more. It cannot exist if all the countries decide to shut down all the infrastructure in their territories, but Internet can thrive without UK, while UK cannot live without Internet, not today.

Counterpoint: China just makes its own "Internet".

It was widely reported that the Conservative party moved their internal communications to Signal in 2019. I wonder if they still use it?

If yes, I hope that means the bill is unlikely to pass

Remember that they passed an online snooping bill which requires ISPs to log everyone’s internet activity and made it available to all kinds of organisations? They made MPs exempt.

They don’t want to - or have to - live under their own rules.

Isn't this situation the entire purpose of Signal..? Don't they already operate in the most authoritarian countries in the world? I don't understand why they would walk.

This.

I believe the problem is, UK is extremely powerful in terms of asking “please ban this and that app from app stores”, so they can effectively block it (unlike say Russia, which tried to block Telegram and failed spectacularly).

I suppose the difference is negotiation:

You can use leaving as a point of leverage in a country that allows for open debate about end-to-end encryption. You can claim that being in the country is at odds with the country's principles and threaten to pull out, or actually pull out, to make the users in that country aware that their basic privacy is being pulled away from them.

In a country with an authoritarian regime, being an option under the radar provides may be a better option.

There is a difference between an APK being installable or downloadable from a store and your CEO getting into legal heat because they won't backdoor their encryption.

You have to consider how this would happen. If the government bans E2EE, Apple and Google will have to ban E2EE from their UK stores.

Apps like Signal will then have to make a choice. Either publish an app that does not use E2EE or get removed from the app stores. What Signal are saying is that they would accept the ban rather than publish an app with weakened encryption.

Apple users will not be able to make their own choice. Android users will be able to make their own choice thanks to side-loading.

> Apple users will not be able to make their own choice. Android users will be able to make their own choice thanks to side-loading

Recent update on WebKit about PWA, however, makes anything possible now on iOS devices.

https://webkit.org/blog/13878/web-push-for-web-apps-on-ios-a...

Technically you need browser anymore to run proper messaging apps.

There are problems with using a browser for delivery of any secure elements. It's slightly better than nothing, but if the govt can coerce Apple into blocking Signal from the app store, then they can coerce Apple into compromising their browser to deliver a modified Signal web-app for certain people.

If that's the case, why can't they coerce Apple into compromising their phone entirely? Why stop at the app store? Or the browser?

They operate where this is possible; if, for example, Signal operates in North Korea it is not because they have offices there, but because some people in NK can get a client and connect. If Signal would have offices in NK, it is guaranteed they will get to jail, not passing Go and not collecting 200, so Signal is not really operating in the countries you mentioned but users can utilize Signal there.

In UK if Signal has any offices or employees, the UK government can force Signal to either put a backdoor in the product or move out of the country. The second choice is what Signal said it will do, it makes perfect sense - leave instead of bend over.

Try and stop an open source project built on standards

Boris Johnson is shaking at the prospect of "signal" leaving the UK. Isn't that a toothpaste?

Boris Johnson is a backbench MP who rarely turns up for work

A much politer description than I was thinking of.

Unfortunately and remarkably — even when combined with "repeatedly lost jobs due to dishonesty" — that hasn't been sufficient for him to be rendered politically irrelevant.

He seems to be the only Tory politician that has any charisma and the party doesn't appear to have any workable ideas as their previous 12 years in power haven't shown them to be effective.

Yeeeees.

Rewatching HIGNFY recently, and Johnson somehow (to my introspective horror) managed to come across positively even when he was squirming at Ian Hislop asking about the audio recording of Johnson conspiring to assault a journalist.

I half-remember a phrase, but not where from: "people don't remember what you said, just how you made them feel".

I know at least one person that voted Conservative because Johnson made him laugh on HIGNFY. If only he could have been kept as a media personality and not been given power.

No different to when he was Prime Minister.

There was a front page headline "PM turns up for meeting" in the Metro [1], a newspaper that tries to be politically neutral.

[1] https://en.wikipedia.org/wiki/Metro_(British_newspaper)

He doesn't care about the billions they lose because of Brexit either, or about all the UK expats that now need to leave their cosy retirement homes in Spain and France. Boris cares mostly about Boris.

Some people do care though, and most of those people vote. Anyway, Boris doesn't matter anymore.

>Some people do care though, and most of those people vote.

Yes... they voted brexit :')

I suspect if they did, the funding for the project might see a cut.

Russians (gov) would get annoyed since apparently they have broken or bypassed Signal's encryption.

Brits would get annoyed because they can't use something they've funded.

> Russians (gov) would get annoyed since apparently they have broken or bypassed Signal's encryption.

Got a source for that?

Perhaps I was wrong - I've just seen this follow up article https://www.independent.co.uk/tech/signal-messaging-hacked-c...

How is that different from the CIA being able to sniff and access their servers thanks to the US patriot act? will they 'walk' from the US too? [1]

Oh, my bad, i almost forgot! it's the tech that's being tested to power the digital online passport, we'll get to see it first with twitter [2], then meta, then it'll expand everywhere else

Ahh, the joy of the bitcoin, who said china was evil with their social credit system? <:P (i did my best to picture a clown face)

The existence of the patriot act makes everything obvious

[1] - https://www.aquaray.com/en/blog/posts/cloud-act-patriot-act-...

[2] - https://twitter.com/wongmjane/status/1596615573303357440

Flashback, in case people don't have the reference: https://qz.com/1145669/googles-true-origin-partly-lies-in-ci...

Signal seems to have lost the plot, after everything that went down -- the exodus, sudden interest etc etc, right when they prioritised that crypto thing above everything else and actually released it. In my circle across 4 continents only one person knew about that damn crypto. Heard of it. That niche. But then maybe Signal is supposed to be “that niche”.

I don’t know how they spin it (that is if at all they bother), or anyone else tries to explain it, it just doesn't make sense. It simply does not. I’d say it is worse or weirder than Firefox’s Pocket moment, but somehow on the same lines. I uninstalled Signal when that feature was released. I still install it now and then for an hour or so just to spin it, but earlier, whatever those few friends were on it, I used to try to use it. Now I don’t. Now for me Singal is just a useless relic.

Maybe it still works for Snowden and people who are at risk and I hope it keeps working for them. But if they are the only target audience then Signal is already irrelevant and they CAN BE replaced by that small target audience and them “walking” from UK or anywhere else for that matter really doesn’t matter.

What are you talking about? Strong cryptography is Signal's entire point of existence.

I think he’s talking about a shitcoin Signal loaded into their app.

Doh. I often get confused when people use "crypto" to refer to cryptocurrencies rather than cryptography and encryption when the context isn't obvious.

If you're talking about a product specifically built around cryptography, I'm definitely going to not think that the context is actually cryptocurrency without any other clues.

Guess I just spent too long being interested in and reading up on crypto before bitcoin was invented.

> Guess I just spent too long being interested in and reading up on crypto before bitcoin was invented.

There's also the fact that the entire article was about encryption and not about cryptocurrencies...

I honestly don’t understand what this “crypto thing” you mention is or has any relevance with the discussion.

I use Signal every day to communicate with my friends. None of them is a software developer or a technical person. If you are not the target audience of Signal, it does not mean that nobody else is.

I believe he’s referring to this.

https://mobilecoin.com/

https://support.signal.org/hc/en-us/articles/360057625692-In...

Ironically, to actually use this and obtain mobilecoins you need to go through KYC and provide detailed personal information from your name to your great-grandmother's blood group

I will say it again, something has got to give. You can't have humane treatment of child rapists and fear government overreach.

It is in fact possible to backdoor communication systems for lawful intercept access. It is possible to also design public auditing of such systems so that a warrant or lawful order being used to intercept communications can be logged and audited by the public. Warrants are not forever secret, with that stipulation a check against abuse of lawful intercept can be incorporated into non-E2E encrypted protocols.

However, what I have learned is that it isn't just privacy or government overreach technophiles like many on HN seem to use as a reason but also a desire to undermine legitimate lawful intercept in foreign countries.

"What if the Chinese government intercepts dissident communication" they're the legit authority there, it will be publicly audited still but they have every right to do so and you have no say in what a foreign government does in their own jurisdiction.

The internet itself should be eradicated if we can't do everything at all costs to prevent harm against the weakest.

Isn't your argument essentially saying that a nation's sovereign body, no matter what their laws, are not only expected, but also justified and morally correct in enforcing those laws, without any regard to the nature of those laws?

By this argument, one would believe that it is imperative for communications networks to assist Nazi Germany in the location and rounding up of undesired people as a part of Gleichschaltung, and that to not do this is to cede power to pedophiles.

Yes that is my argument. Until Nazis try to invade your country. However, you are free to stop providing seevices entirely in that country if you disagree with their laws.

> It is in fact possible to backdoor communication systems for lawful intercept access

Possible? Yes. Desirable? Absolutely not.

> Warrants are not forever secret

Says who?

> check against abuse of lawful intercept can be incorporated into non-E2E encrypted protocols.

Those checks are already woefully inadequate. There are plenty of examples of abuse of authority/access that just happened to be caught and went on for years. Somehow you claim this is going to stop happening if we give governments MORE surveillance authority?

> The internet itself should be eradicated if we can't do everything at all costs to prevent harm against the weakest.

At least you admit that eradication of the internet is your end goal.

> Possible? Yes. Desirable? Absolutely not.

Then let's bring back public executions and cruel punishment. You know what else isn't desirable? Tolerating CSAM.

> Says who?

Alright, then secrecy of the warrant fails public audit checks.

> Those checks are already woefully inadequate. There are plenty of examples of abuse of authority/access that just happened to be caught and went on for years. Somehow you claim this is going to stop happening if we give governments MORE surveillance authority?

They already have authority just not the technical ability. You should use legal and political avenues to address a naughty government. Tolerating CSAM because you refuse to accept political realities or convince your ow citizens on the matter is a terrible thing. I don't what you are referring to regarding inadequate checks, I am proposing a system similar to CT logs for PKI except new encryption can't happen without public audit log of LEO authorizarion to intercept traffic.

> At least you admit that eradication of the internet is your end goal.

If the choice is between tolerating CSAM and eradicating the internet, the choice is easy for me, why isn't it for you? Fortunately, as you obviously know but chose to ignore for the sake of maligning me, we don't need to eradicate the internet in order to do our best to get rid of CSAM so clearly you knew that wasn't my intention but you misconstructed what I said for the sake of internet rage.

> you have no say in what a foreign government does in their own jurisdiction.

This is a disgraceful, anti-intellectual attitude.

So you were being an intellectual when supporting undermining of a sovreign nation's abilitu to self-determine their fate? Look at the mirror.

Reply on news.ycombinator.com