Hacker News Reader

Comment by tptacek | Hacker News Reader

What these analyses always miss is that providers on foreign soil have even less protection against the US IC: breaking into foreign providers is literally NSA's chartered mission. That's not to say you should deliberately use US providers! Unless, that is, abuse of legal process in the US motivates your decisionmaking, in which case: an abused legal process beats no process requirements at all.

View on HN

It’s not even that they have to “break in.” The government allows big tech companies to basically do whatever they want as long as big tech provides the government with an easy way to move forward with the parallel construction needed to bring case against literally anyone should officials be motivated to see that person imprisoned. Everything you’ve ever done can and will be used against you to maximum effect.

It's the NSA's job to do that domestically, it's just supposed to be firewalled by some hidden kangaroo court that absolutely doesn't do its job: FBI agents have been busted stalking women/exs several times.

Has been since 9/11. Remember, there's the omnipresent neverending war on terror.

I mean, sure, stipulate that. But there isn't even a kangaroo court for a service hosted in Europe.

Europe has plenty of “Kangaroo courts” of their own and partnerships like five eyes encourages authorities to share information. The UK’s NSA equivalent doesn’t need to worry about infringing on an American’s 4th amendment right and technically (if you don’t think about it) the NSA has plausible deniability if the UK shares this information. And vise versa with UK citizens or any western government.

I think OP meant the EU. The UK is known to be a totalitarian surveillance state and has been less free than the US in that respect for a long time.

“Surveillance state” is debatable. I would disagree, but I’ve had that debate too many times on HN recently, and don’t propose to start it again here.

However, to call the UK “totalitarian” is just an abuse of language. The country is not run by a single all-powerful party or dictator. It’s especially odd to use this word and then make a comparison to the US, which (though it is not totalitarian either by any stretch of the imagination) is currently in the midst of an executive power grab, with demands for a level of partisan loyalty from civil servants that remains unthinkable in the UK.

I don’t know what your goal is here, but if you want to persuade the average person in the UK to change their minds about the extent to which the government should be able to access surveillance data, it helps not to bundle your arguments together with wild misstatements.

You're right I shouldn't have used the adjective "totalitarian." It was the kind of mindless parroting of phrases that I dread myself, so thank you for pointing that out! The UK has extremely strict surveillance laws, which are incompatible with EU legislation by now, so it's not a typical example of European countries in that respect. That's all I meant to say.

Are you referring to this? https://www.theguardian.com/uk-news/2018/sep/13/gchq-data-co...

If so, that was a judgment about legislation that is no longer current (and wasn’t when the judgment was issued). It may be that current legislation is also incompatible with EU law (IANAL, I’m not arguing that point), but AFAIK there is no court judgment to that effect.

No, I didn't talk about court judgments. Yes, I had various aspects of the Regulation of the Investigatory Powers Act and recent additions to the Investigatory Powers Act in mind.

> It may be that current legislation is also incompatible with EU law (IANAL, I’m not arguing that point), but AFAIK there is no court judgment to that effect.

Quite possibly but that wasn't my point. The point is that the UK is by far more of a surveillance state than any EU country, at least to my knowledge. UK legislation is not typical for a European country in that respect. People can go to prison in the UK for not handing over an encryption password and the UK has just effectively banned end-to-end encryption (if you put a backdoor in it, it's no longer end-to-end encryption).

I’m just responding to the specific claim regarding the incompatibility of current UK legislation with EU law. AFAIK this is not an established fact. It’s an increasingly hypothetical question, though not entirely so.

There are EU countries with key disclosure laws. See e.g. France and Ireland on this list: https://en.m.wikipedia.org/wiki/Key_disclosure_law

Of course, it's not an established fact. Who would establish that fact? The UK is not a member of the EU. I was talking about the current UK legislation and I stand by what I stated. You disagree but have not presented any reasons why I should change my mind. You even said you're not a lawyer and have not displayed any knowledge of EU or UK legislation and practice. So you disagree. I understand that. There is no need to further continue this discussion.

What I do know is that I won't be able to sell my software in the UK or to any UK citizens or to any citizens who want to use to to communicate with UK citizens because it uses secure end-to-end encryption. That's the important bit for me personally.

When a famous media personality was assassinated the police managed to catch the killers within hours. Turns out they really DO track every car on the highway- it wasn't just bragging.

Every rich country is a surveillance state.

I don't mean that Europe has worse processes. I mean that the US IC doesn't care about those processes. They can just take whatever they want from European providers.

Whatever legal requirements might be at play, the fundamental difference is that a US company will comply, whereas a non-cooperative external party would still need to be broken, which is very much non-trivial in the age of strong cryptography, even if you're NSA.

Reply on news.ycombinator.com