Open Letter from Security Researchers in Relation to the Online Safety Bill [pdf]
haddadi.github.io
haddadi.github.io
I think technology must provide ways to ensure free and secure communication without a possibility of surveillance. The political class cannot be entrusted to shield essential freedoms, so technology has to provide it. Large tech companies are a single point of failure and we already have seen political influence there. While much of it is now challenged at least, I think we can all be glad the the internet provided some resilience against surveillance and propaganda attempts.
In that regard the panic about disinformation is also mostly manufactured in my opinion and the voice of experts will be disregarded anyway.
The truth is that power (aka money) is heavily concentrated in global society. It's a worthwhile goal to break it up, and maybe there are some technical tricks to help people toward that end, but even if we woke up tomorrow with a perfectly decentralized and anonymous network culture, we would still be under the rule of oil interests/unelected bureaucrats/unaccountable intelligence agencies/the finance industry/your bogeyman of choice.
We shouldn't give up just because a bad thing already exists.
Very unlikely on average, because they cannot (and are not interested) in arresting everyone. Internet surveillance, however, makes it easy to spy on everyone all the time.
This is also why it is vital to have approximately everyone using secure technologies.
This is surprisingly often the case, not just for criminal law (or "security law") changes, but even in general lawmaking. And way more often than not those experts are spot on. Be it obvious loop holes in regulations, tax code issues, eroding civil rights, obvious unconstitionality of many surveillance (and many other) laws, obvious abuse potential and so on. It's a very long list.
And while I appreciate the level tone... I do wish they'd at least wink at the real reasons this is being put forward. I get why they don't, to maintain respectability and deniability etc.
But look at the sheer hypocrisy on display here. I kinda wish they'd take the gloves off and say, hey - Look at Prince Andrew, Ghislaine Maxwell, Jimmy Savile and Gary Glitter, and God Knows how many others.
Look at how those horrifying scumbags walked around free, for decades, as if authorities didn't know full fine well what they were doing. Look at how they were not just ignored, but protected by the establishment that now wants a backdoor on every private communication.
The plan to bring back "Imperial" measurements still isn't dead, for example.
Liz Truss, worst and shortest PM in living memory, is back after a few months as if nothing had happened. Why? It's not because she has any good ideas; it's because she's a vessel for a particular faction of bad ideas.
Exactly.
He wasn't held to account for "an inappropriate relationship" (which is a fucked up way to describe multiple statutory rape allegations).
Instead, he was protected; given interviews where he practically hanged himself with ridiculous claims ("I don't sweat", "no recollection" of photographic evidence, etc); and still hasn't been investigated, even after refusing to cooperate with investigations.
And, you're dramatically underplaying his relationship with Epstein and Maxwell, which goes back to 1999 and includes weddings, Royal parties, topless Thai festivities, international visits, etc; even after Epstein's conviction: [0], [1]
It's not hyperbole to put him in this list; not at all. His inclusion illustrates the extent of power getting away with crimes in Britain. He was never arrested - but the protester who heckled him was. That says a lot.
0 - https://www.bbc.com/news/uk-49411215 details the absolute bare minimum extent of it.
1 - https://www.theguardian.com/uk-news/2019/dec/07/prince-andre...
The Conservatives (aka Tories) are conservatives. The Labour party are also conservatives as much of the voting public in the uk is small-c conservative and also authoritarian.
But like I said, I’m not a political historian just an idiot with a half baked opinion.
All political movements and all politicians are convinced that their power is 100% legitimate and they should therefore be able to have 100% control of and visibility into everything that's going on.
The idea is compatible with most peoples' definition of democracy. You don't need to support other aspects of authoritarianism usually associated with right or left wing dictatorships.
As to your question: yes, most authoritarians are conservative in nature, given that the world has mostly been moving away from authoritarianism over the past few decades.
Also, I completely disagree that the world has mostly been moving away from authoritarianism. On the contrary. There was a time when at least the direction of travel seemed assured. Now I'm no longer so sure.
[Edit] Just so you know where I'm coming from. As someone who would never remotely associate himself with anything "conservative", I wish I could just blame conservatism or right wing authoritarians for this surveillance drive. But I can't honestly do that, and I have to accept that it is not just a right wing idea historically.
So please, debate policies on their content, not on their label. Reducing everything to a binary decision only serves authoritarian agendas.
But the Labour party have never been especially liberal. They're just as likely to enact controlling social policy. And, again, the press are extremely illiberal, they're likely to campaign for more surveillance.
(Don't try to jam the American two-party lens onto UK four-plus party politics, it will not help you make sense of the actual situation).
Because the UK has FPTP elections, in practice it's a two party system but which two parties varies by locale, resulting in some weird interactions that aren't really seen in the US.
You aren't going to get elaborate rainbow coalitions under that model, as you might in say Germany.
Labour are the party who passed that very nasty "Tell us your password or go to prison" law under "If you've done nothing wrong, you've got nothing to hide from law enforcement or the government." mentality.
Red Tories are still Tories.
This leaves the Lib Dems, who sadly have zero interest in repealing the Online Safety Bill if it passes.
While conservative news sources historically act in bad faith here, non-conservative news sources lose all reasoning ability, when it comes to Gov surveillance. They rarely hold Gov accountable unless they have little choice.
The latter probably happens because the public endlessly gives news orgs a pass about it.
You can discuss how high that cost should be, but there is a cost to state surveillance as well.
And I think those who are proposing these kinds of bills know this, and are protected by how unlikely it would be to reach any kind of critical mass organically.
I'm sure there are laws against the encouragement of others to commit a crime, but ... wink wink.
Should — but based on what else this particular group have demonstrated about understanding cause and effect, won't.
Do you understand this from polling? Can't trust UK media outlets on public opinion, they push, they don't pull. If the public doesn't agree with them, they all will run variations of the same story, aimed at the same targets, for years until they do.
The public tend to believe what they've been informed and the press tend to be inept when it comes to Gov surveillance.
The history of editors and journalists is 1) they reprint Gov Natsec claims w/o analysis or a single thought about Gov's history and 2) will only report surveillance wrongdoing when their nose has been dragged to it and they've been booted from behind.
And to clarify here, NatSec and Child Safety are just different food colors in the same poisonous water.
This letter is a "nice try", but pretty late and lacking media-awareness. People certainly won't read a 4-page PDF. They should have led with:
> There is no technological solution to the contradiction inherent in both keeping information confidential from third parties and sharing that same information with third parties.
But would that be a part of the population that actually partakes in the discussion to begin with?
If you cannot say something more simple without making a mess of it, don't.
Cleland lost three limbs in Vietnam. None of his opponents had ever served.
>...On October 25, the Act passed the Senate with a vote of 98–1. Russ Feingold (D-WI) voted "no"
https://en.wikipedia.org/wiki/Patriot_Act#:~:text=The%20thre....
https://www.esquire.com/news-politics/politics/a38201636/max...
The public have largely been sold nothing and are completely, blissfully, ignorant of this legislation. The legislation is being pushed through by politicians who have been sold two lies:
1. The legislation, and 2. the idea that the public care.
The people are always sold a lie. But in a democracy, it is the responsibility of the voter to identify when they are being lied to and to search for the truth.
As much as you claim that media isn’t free and isn’t good, I look around and see the opposite. Now is the best time in the history of the world to get amazing journalism. You are just too focused on the media you dislike to admit that with selection comes lots of terrible choices.
The fact that people don't pay attention means that they're vulnerable to accepting the framing that they get the first time they're forced to hear about it.
In this case it will be from slightly rewritten press releases sent from the people pushing the bill to the kind of UK papers and TV stations that can't find a single journalist who objects to censorship or surveillance.
In the UK there’s a concept of the “Westminster bubble”. Politicians believe that people care deeply about “online safety”, which is all that matters really.
Same thing happened in many countries with terrorism and loss of rights/super authoritarian/inconstitucional powers for govs, and it was fine... Because the risk is too great and "are you a <insert label here, such as terrorist sympathdizer, grandma killer, etc>
Let's not pretend the UK is particularly bad. Many countries are pushing the same old "destroy encryption" because I need to "tap the bad guys" and people are always fine when given the flimsiest of excuses/narrative.
Yes, HN "tech crowd" too.
https://www.institutmontaigne.org/en/expressions/past-virus-...
A telling thing is that you said people who have diseases and here it was prevent movement from everyone. Prevent the movement of the non sick. Remove human rights and civil rights. Implement inconsistent security theater and censor debate, and a long etc you don't care for because you just answered in the laziest of ways.
> Most of the populations around the world were in favor of locking people down
These were common sense measures known by people in the 500s
From the article about what happened centuries ago:
> He imposed isolation for both travelers and food coming to Constantinople from North Africa, hit by the terrible plague outbreak (541-542 A.D).
> Freedom of movement was only granted to those who obtained "a sanitary certification" from the authorities. In Venice, foreigners and passengers coming on ships needed to show a "certificate", to prove that they came from contagion-free places. In times of plague or cholera those who entered the cities were obliged to present a "health certificate" ("Patente di sanità")
But the same people were arguing right here on HN about studies showing that preschoolers in day care spread Covid even though every parent knows that preschoolers in day care have always been walking Petri dishes that spread diseases like a hooker on a crack.
Heck, since many of the people who were complaining about masks are self proclaimed “Christians”, even the Bible had “mask mandates”
https://web.mit.edu/jywang/www/cef/Bible/NIV/NIV_Bible/LEV+1....
>The person with such an infectious disease must wear torn clothes, let his hair be unkempt, [4] cover the lower part of his face and cry out, `Unclean! Unclean!' As long as he has the infection he remains unclean. He must live alone; he must live outside the camp.
Background: https://www.theverge.com/23708180/united-kingdom-online-safe...
Labour's Lucy Powell:
“The weakened bill will give abusers a licence to troll, and the business models of big tech will give these trolls a platform.”
So the Labour government will get to decide who's a "troll," and whether they're de-platformed AKA cancelled.
Likewise Labour's desire to curb "legal but harmful" speech means that Labour will get to decide, on an ongoing basis, which speech is "harmful." It won't be defined in law, so the definition will be completely subjective, and ripe for corruption and chilling suppression of innocent people.
The bill mandates an end-run around E2E encryption. Government spokespeople are deeply disingenuous about this; the two ends are me and you, metaphorically; two users. If there's anything in the channel before the content is encrypted or after it's decrypted, then it isn't end-to-end any more.
It's going to drive the people who have the know how underground, and anyone engaging in protecting their privacy will be considered a criminal. We're already creeping toward that IMO.
It's going to be no different at all from the current situation.
That's not true at all. If OSB is passed, things will be quite different in the UK afterward.
For everything else there are foreign agencies who are not limited by uk legislation.
Encryption can hide web browsing and a lot more, which they don't like.
- All online messenger providers (Whatsapp, Signal, Telegram) e.g. withdraw from the UK market. Meta and Google gave a taste for this after Canadian link law.
- UK needs to come up with a crappy homebrew messenger ecosystem no one uses. Maybe a messenger.gov.uk?
- People download applications with privacy and sideload them to their mobile phones, keep going with their business as usual
- The number of childs protected or caught pedophiles stays unchanged
- UK parliament members who proposed the bill will look like idiots, not getting re-elected
- The "compliance" companies who promoted these solutions, as it's driven by commercial interest that guides the political discussion, go bankcrupt
However I remain doubtful if we have this ideal scenario.
Some things never change.
No one will lose re-election over a technical or scientific issue such as this. 99.9% of the public can't understand the position, the discussion, and will only listen to what fluff websites, and the parties tell them.
Now, is any party going to take up a "soft on pedophiles!" position? Because that's how it will be played...
It's already a nonissue on the most popular device.
Eventually the sale of devices that don't include cryptographic controls to prevent terrorists from misusing them to evade terrorist surveillance will be outlawed.
*If you choose to fact-check this, be aware that technically the European Commission will be designating Alphabet, Google’s parent company, rather than one of the multiple subsidiaries with Google in its name. So the official EU communications about this may not mention the word Google.
This law doesn't just apply to messenger apps. It applies to almost every single act you perform on the internet. Everything will be mandated to be broken, including your browser. If you run a web server using https, you'll be breaking the law. If you ssh to another computer over the internet, you'll be breaking the law. If you connect to a VPN to access a work/university/school network or indeed a commercial VPN, you'll be breaking the law.
In fact, I very see the opposite. Passing this kind of legislation will kill e-commerce for sure, so it will never happen.
It would be a return to the pre internet era, so probably is the will of the people and on form for the UK. I kind of hope they pass it then realise what it actually means.
Honestly, it kind of needs to happen properly, otherwise people will never learn. Allowing these half baked pieces of legislation to pass and then not implementing them except for some edge case allows the idiots who write it and promote it to claim they were right all along.
And this is a silly law. Everyone will break it, every time they use an encrypted communication, which is pretty-much every single thing one does on the internet these days. It's a perfect recipe for the authorities to let everyone carry on as normal, then when they want to crush someone they're certain to find some law that they have broken like this one.
We should be throwing out such laws.
The will get a prosecution after catching red-handed a mass murdering terrorist or a pedo with kids locked in their basement because they did an online shop which "used encryption". The authors will claim victory, without these protections we couldnt lock these people up, the Sun and the Mail readers will lap it up. 5 counts of murder and 1 count of doing an online tesco shop.
Remember that Al Capone was jailed for tax evasion.
Carlinhos: so I want you do vote in favor of [law X, which toughened restrictions on the kind of gambling Carlinhos promoted]
Demóstenes (naively): but, professor, that will make things harder for you, won't it?
Carlinhos: oh, don't worry, it's not going to be used against me.
Has anyone checked if the legislation has the special clause for "prosecutions require permission from the Attorney General"? (i.e. politically motivated prosecutions only - this has been seen before)
Hold on! Kill all HTTPS? Biometric passports? I haven't tried to read the bill, but AFAIK there are no provisions in the bill that attack HTPPS, and given that biometric passports are not a communications technology, I don't see how they could be impacted.
I don't see how the bill impacts email at all; opportunistic SMTP encryption isn't E2E in the first place, and PGP is rarely used in email. And when it is used, it's usually to sign rather than to encrypt.
TLS / HTTPS would be included in my definition; the purpose of which is that the two parties are the only ones that can see the traffic.
My money is on Canada. The Trudeau Liberals passed their first of three internet control and censorship bills, C-18, and it has already backfired stupendously. It's quite similiar to Australia's similiar bill to force some companies to pay for linking to news content, but the Liberals saw that and thought "we should try it too!". Same result, Google basically said "no problem, we won't link to news in Canada".
However, unlike Australia, the Canadian Liberals are doubling down. New tax payer-funded subsidies for Canadian news are already being discussed to make up for the lost revenue the legislation caused. The Liberal-funded media is also trying to paint this as evil greedy foreign capitalist technology companies refusing to pay their fair share for exploiting Canadian news companies.
But that's why my money is on Canada. It has the perfect blend of incompetent leadership, empowered by another party that helps them pass any legislation no matter what, and constituents that are largely apathetic to anything that happens.
Raid warrants are already being signed off based on the tiny window into an IP address' life provided by legislated metadata retention. And no further actual police work is done on backgrounding the persons or households involved before choosing to suspend their rights.
Beyond the security researchers' own little "computer savvy 1%" bubble, is there any intended audience for such Open Letters?
Could they actually communicate with normal people if they (somehow) wanted to?
Are there laws in the UK that make it too risky to just say something like "This bill will make it so much easier for the next Wayne Couzens to find his perfect Sarah Everard."?
Could you tell us about the historical effectiveness of such open letters to UK politicians, from tiny numbers of technical experts, on issues politically similar to this?
Assume that we've heard of Performative Activism.
https://en.m.wikipedia.org/wiki/Einstein%E2%80%93Szilard_let...
Context: The President it was addressed to had been working to prepare for war against Germany for most of a year. Einstein's "famous, politically ~neutral super-genius" reputation was far loftier than that of any signatory to this Open Letter. And it warned the U.S. President about a super-powerful type of bomb which Germany might develop (and use against the U.S.A.) during a period when both bomber and bombing technologies were obviously advancing very rapidly.
If a "smartest in the world" mathematician wrote the current U.S. President, to warn that the crypto algorithms currently used by the U.S. for uber-secret stuff might quite possibly be fully broken by China in the next few years - then I suspect that the current U.S. President might be fairly willing to take action. That is not the scenario around this Open Letter.
This actually happens all the time between experts and legislators, they just call it lobbying and it unfortunately lacks the “neutrality” that should be assumed, corrupting the whole thing in the process.
> There is no technological solution to the contradiction inherent in both keeping information confidential from third parties and sharing that same information with third parties.
It would be more effective to tweet that sentence wherever the discussion is remotely touched. Nobody, including politicians, reads such lengthy letters.
That have that comm channel. It's the press and the press instantly loses it's way, the moment Gov puts on a NatSec or Child Safety mask.
At least where I live, the middle-aged owner of a small-town ice cream parlor is 99% likely to know how to do an effective press release. The "news" can be a new ice cream flavor, with the colors of the local HS sports teams...but you carefully write that press release in such a way that any over-worked bottom-rung reporter can spend 30 seconds adjusting the pronouns & such, then publish it in their paper.
I will agree that local news orgs tend to show ineptitude whenever local LEO issue a PR. They'll just parrot what is said - no analysis at all - not even when a 5 sec search would reveal blatant misinfo (re:kids are at meaningful risk of stranger kidnapping).
There aren't a lot of people who are at the intersection of technology and advocacy, but they do exist and would be able to help us know what effective advocacy looks like. We just need a little guidance as a community.
How so?
Will people need a number for a privacy friendly foreign nation to continue access?
We have been conditioned to view branding as the certificate of legitimacy, and that simply is not true for the Internet where branding can be copied and pasted in seconds.
Bet it saw very few installs wonder if we'll go full circle.
The micronation thing is silly, as is relying on a shrinking number of countries which claim they won't enforce these laws. We need satellite-based servers. If I were Musk and had that chain up in the sky, I'd open a simple E2EE Whatsapp for anyone who could ping them directly. At this point, anyone who wants private comms is going to need to go to space for them.
If you were Musk, and if Musk were some sort of superhero fighter for communications freedom. If Musk wants private communication for himself and his friends, I'm sure he can manage it.
I should've said, "If I owned a global chain of communications satellites, I would..."
But then again, would I? I'm not so sure. I ditched and walked away from a really brilliant E2EE platform I had built before I launched it in 2012, whose purpose was to touch off and gamify democratic revolutions in totalitarian states, precisely because I had a dream about it being used by nazis in the west to carry out mass organized violence. I woke up and realized it probably would be used for that, and I shut down the whole project. As a matter of fact, I have a 14 page long handwritten note I wrote addressed to Elon Musk warning him not to do things like that when he tries to de-moderate Twitter, which (since I don't know him, and he wouldn't care) I never sent.
So yeah, even if I were him, I probably wouldn't do what I just said. But it was a really douchey way that I put it. Sorry.
Or do you just refuse to read anything that contradicts your world view?
I'm sure I deserved that for asking your opinion.
That’s an easily verifiable fact that you could have found out about just by reading the link you refused to read.
It's not an excuse but I thought your opinion might provide me insight, but your behaviour makes clear it'll be utterly worthless.
Where?
For all I know it's selling me essential oils.
Is it so much to ask for some basic human decency?
Once you have have spent years whipping up fear over non-issues, you inevitably have to do something about them.
But you cannot actually do something that doesn't have side effect worse than the intended effect. But you can't just admit that or walk away. You have convinced your electorate these are the number 1 issues facing the nation.
So you write a law that's meaningless nonsense, and poop it out into Parliament.
That is how we got this bill. That's how we got Brexit.
Whether we can overcome this sort of disfunction will basically decide whether algo-sphere style democracy is sustainable...
I've personally never used Tor, but the moment this bill goes live, I'll be setting up Whonix in a VM on Linux OS.
They don't care what the people want after campaign season is over, however they will back off from anything that generates genuine outcry, for a while, then they'll try it again later.