Hacker News Reader

Comment by mariojv | Hacker News Reader

“If the company refused to do, it could face fines of up to 4% of its parent company Meta’s annual turnover – unless it pulled out of the UK market entirely.”

Wow. I wonder if it got to that point if Meta would change course and disable end to end encryption for UK users and people messaging UK users, if that would be sufficient to comply. If this lobbying causes the UK to change course, I wonder what impact that would have on other countries’ attempts to weaken encryption, if any other such attempts are happening.

View on HN

UK politicians themselves use WhatsApp a lot.

They will strike the law down a day after WhatsApp stops working in UK.

2 days after there will be massive public outrage since everybody uses WhatsApp in UK.

It's an empty threat, just like the internet porn law.

That last bit is exactly right. The UK has proposed all sorts of plainly moronic online restrictions, which never actually get implemented.

They simply don't have the clout to push around enormous American companies. It's a tiny country. If the EU or US were proposing such a law, you should take it seriously, but this is just a joke.

Because these proposals are never intended to be implemented. It is an anchor, which is intentionally ridiculous and outrageous, so that when the next slightly less severe proposal is made it doesn't sound as bad as the previous one.

It's very transparent but also standard operating procedure for the current UK government.

It's a country with 20% of the population of the USA. That's not exactly a tiny country.

> If the EU or US were proposing such a law, you should take it seriously

Judging from a few quick searches, there are more Facebook employees in the UK than in Ireland which is their main base of EU operations. They also have a presence in Switzerland (also not EU). FB apparently have some employees in Germany to comply with local hate speech laws, do marketing and HR work, but it doesn't seem like anything they'd miss much if they had to exit especially as they're laying people off anyway.

Now that said, I think Meta can win against the UK govt if they want to duke it out but the idea that the UK is a "tiny country" vs the EU is not reflective of Meta's actual exposure. The EU is not a particularly attractive place for tech firms to hire.

97% of WhatsApp are outside the UK.

They would drop the UK in a heartbeat.

They also know this happening would topple the government in the UK.

So it will never occur if they threaten it.

But a lot of people outside UK talk with people inside UK. A ban would touch a lot more people than 3%.

That's the same argument made in the article: they'd rather drop the UK and keep E2EE than weaken E2EE to keep the UK market.

May I ask where did you got 97%?

> They also know this happening would topple the government in the UK.

Let's not get carried away. There are other apps with equal parity. Most people in SE Asia use Line perfectly well. There's also Signal and Telegram

> Judging from a few quick searches, there are more Facebook employees in the UK than in Ireland which is their main base of EU operations.

Regardless of employee count in the UK office, it's only 2% of the market. I have no doubt about the choice I'd make if were faced with the same choice: especially since companies already have plans to decrease headcount.

They say that 98% of users are outside the UK (and those users very likely won't want reduced encryption), so whatsapp would probably just exit the UK.

I know in some non-US countries, WhatsApp is the default way of communicating (like SMS is in the US). Is that true in the UK? That could put significant pressure on the government

Everyone I know here (UK) uses WhatsApp as their default communication tool. I have a few friends using Signal or Telegram, but I'd say WhatsApp is by and large the default, at least for my social circle.

Signal said they may have to pull out of the UK if the bill is enacted as well. This would be a major setback for communications here. We'd basically have to go back to SMS/MMS and email as far as I can tell.

I don't know this is a fight the UK government can win. Does anyone else remember that the American government tried to ban encryption (back in the 90's I think it was)? They eventually had to give up because people just downloaded encryption products from the internet and used them anyway.

What does it mean for Signal to "pull out" of the UK? How can the UK government enforce this law against an app whose makers have no physical presence inside the country? Force phone makers to ban the app from app stores?

No +44 number sign-up, no listing in UK app stores.

Just take a foreign prepay number and sideload the app :) It won't really stop people.

1) are you joking, that will stop 99. some number of 9s % of the population;

2) I'm not making any claims about it being desirable or effective, I'm just explaining what 'exiting the UK' means or what they'd be required to do. The crown won't sue a foreign company because a citizen found a way to workaround it not being available here - that would be like criticising the manufactuter of an illegally dangerous electrical item only rated for and sold in 110V markets that someone imported.

People didn't use to be so stupid. If they could manage Word Perfect 5.1 they can surely sideload a little app :P

I think it's more of a "don't want to know" than anything, in which case it's their own problem IMO.

Not phone makers, but Google and Apple. You wouldn't find the app in their App Stores in the UK.

If it's a criminal statute, the UK could fine Signal and the US would help them collect.

https://irp.fas.org/world/uk/us-uk-mla.pdf

Maybe the treaty's exception for offenses of a political character applies here?

I doubt that. Signal themselves say they can't read the content of messages, so the UK prosecutors could argue that they're not being targeted over the content of the messages but the fact of enabling their concealment.

Recall that in the US there is no explicit right to privacy. You might be able to make a 1A argument that manually encrypting a message is itself a speech act, but the government could theoretically ban the distribution tools like Signal and argue they have the authority under the commerce clause, which stands on a equal Constitutional footing to the 1A.

I don't think this is likely, but I could easily see it being offered as the justification to honor a UK ban.

Yeah, app store releases are per-region. They'd just untick the UK region.

France effectively banned encryption in the 90s and had to backtrack, I can't see this being enacted for any length of time before even the most stupid of politicians realise it's a bad idea.

Would you happen to have links to some good reading material on this? People could -eg.- show it to their representatives.

I'm probably not best equipped since I wasn't living in France at the time, but there's a quick summary at the time here:

https://www.theregister.com/1999/01/15/france_to_end_severe_...

Merci beaucoup!

The US said that encryption (well, good encryption) was a munition and so you needed an export license to make it available outside the US, e.g. by putting it on a web site.

Such rules are not unusual for physical objects - why sell your enemies or even potential enemies the rope they will hang you with? But for encryption it doesn't make sense because it's just information, and unlike physical objects, after writing is invented humans can trivially reproduce information, so too bad.

Eventually they whittled the "export license" step to something like a form letter Fax and IIRC Mozilla had a process where you raised a Bugzilla ticket, that caused the appropriate fax to be filled out and sent, so that was part of the release process, making it as painless as possible to comply with the stupid law.

(And now it's gone altogether)

And not a few folks commissioned Perl tattoos with crypto code, thereby becoming human munitions and daring Customs to stop them in ports of entry.

And then came the Clipper Chip...

Or people not on Apple devices side-load the app anyway (F-Droid). Assuming the corporate action is just to remove the market from the Play store.

If the law is enacted, and that seems unlikely, just removing it from app stores doesn’t seem sufficient to comply. Besides side-loading, users will just keep the old version of the app.

WhatsApp can pretty clearly know if a user of the app is in the UK based on their account’s phone number country code and GeoIP. So if they wanted to comply by pulling out of the UK completely they’d probably have to make some attempt to disable WhatsApp messages for those users they’re reasonably expected to know with some confidence are located in the UK.

But as others have said, this all just seems like posturing that’s unlikely to become law.

It is not my responsibility to make sure that citizens of Elbonia aren't able to use my application if I don't operate a business or live in Elbonia.

It comes down to jurisdiction. If you don't have it on the default marketplace for the region, and don't have a physical business presence in the region, it can be argued, you've done enough and aren't subject to the jurisdiction and are not doing business there.

That users may bypass and side-load your application is immaterial. If a user in the UK uses a US based VPN, they can also still use the app even if you added IP blocking, and IP blocking in and of itself is less than perfect often subject to false positive/negatives, and best to be avoided.

Why do countries want to ban E2E anyways? To spy on their citizens?

The excuse being used here is the prevention of child pornography. The bill being proposed puts the onus on tech companies to scan all messages going through their systems for evidence of child pornography. Obviously, E2E messages cannot be scanned so would be in breach of the law.

It's relatively easy for people to switch, compared to other social networks.

What?? if all your contacts are on messenger X, it's easy for you to switch to messenger Y? and do what there, message yourself? It's exactly as hard as any other social network!

P.S. I'm always shocked how people suggest "just use Signal" or something, it's really not up to me what to pick what to use at all, but up to the people I'm trying to connect with. It seems like a very difficult concept for the "just use Signal" crowd to grasp.

Well that's reciprocal, isn't it? You can either be the guy who accommodates all your friends' networks by having accounts everywhere, or you could instead be the guy who's only using Signal, so anyone who wants to stay in touch with you had better get on Signal!

Short answer: yes

Switching costs are free.

Basically everywhere in Latin America you practically could not survive without using WhatsApp, it is that prevalent. It is used for everything from personal communication to business communication.

It's the default way of communicating for politicians that are making this law. Of course, they probably don't see the value of E2E encryption because their messages are inevitably leaked by a defector in the group chat.

I live in the bay area in the US and whatsapp is the default way of communicating here as well

Interesting. I live in Texas and I've used it like... once, many years ago (haven't had it installed on my last two phones). Defaults for me and mine are SMS (iMessage when available), Discord, and then I've got a couple people on Signal

I try to avoid iMessage because when I'm abroad I never know if it's going to fallback on SMS and I'll have to pay for a text

Makes sense, I don't go abroad very often

That shows as soon as you see the field though. So pretty easy to see if it will deliver as SMS.

Not as default as you might think. I made the attempt to get some non-technical friends on WhatsApp years back, and near as I can tell, none of them are on it at all. In fact, most of them never stopped using Snapchat and iMessage is basically dominant.

Interesting. I'm not in the bay area, but I am in the US. I use whatsapp, but purely to talk with my friends who are in Europe. None of my bay area friends (or anywhere else in the US) are using it.

No. It's a common way of communicating, as are email and SMS. Telegram and Signal are less common. There is however a peculiar bubble effect whereby WhatsApp users tend to think that because all their friends use WhatsApp to communicate with them, it is more dominant than is actually the case. It's the same effect as "everyone is on FaceBook/Twitter/Instagram....".

I don't know about the UK, but in Italy everyone is on WhatsApp, grandparents included, and without it the country would shut down in a couple of hours. In addition, Italians create WhatsApp group chats for everything. Heck, my sport club has three separate whatsapp groups: a general one, one for the senior's team, and a third one to broadcast official information.

I doubt that the nation would shit down. But this doesn’t mean we should let WhatsApp do what it pleases.

I would say that WhatsApp is probably the most commonly used chat app in the UK. But most people are also using at least one other chat service such as Facebook Messenger or Instagram's messages. And of course due to the way WhatsApp uses phone numbers as an id, most people also have people's phone numbers and can fall back to SMS if need be.

Yes - especially for politicians - although looking at what’s currently leaking in certain UK newspapers one would think they would already be pushing for /more/ privacy on WhatApp rather than less.

Most of the leaks come from the political community itself of course. Either to gather the response to a particular measure without sticking out their neck to actually propose it, or to thwart opponents.

The risk of US retaliation is too high.

The US routinely use similar bully techniques against their partners (in Iran for instance, pour EU comptines asked the EU commission for help but ultimately we retracted from Iran as asked by the US). They are powerful enough to do that, we (countries in the EU) are not.

Which entity? I'm not sure the UK would have the mandate to fine a foreign company who's not operating in the UK. They'd just create a company whatsapp UK, license technology, have no other links to meta and have a revenue of about 0.

The UK government can legally fine any company doing business in the UK. It can probably fine any company anywhere. A financial fiction that "WhatsApp UK" had nothing to do with Meta is not going to affect that. It's just collection that is the problem, but I would imagine that they would go after Meta's UK advertising revenue.

What does doing business mean in terms of WhatsApp?

Reply on news.ycombinator.com