Hacker News Reader

Comment by mrtksn | Hacker News Reader

Actually, having encryption defeating mechanisms makes a lot of sense when its limited to public servants, like the Denmark's Justice Minister. Those people are trusted with a lot of public resources, in fact all the public servants should have a monitoring device like a black box on them all the time and when something goes wrong that blackbox should be decrypt-able so we can look at the logs and see what went wrong.

Corruption and incompetence, solved.

View on HN

Several years ago the UK government started being defacto run via Whatsapp. I was absolutely furious about this, but seemed to be in a tiny minority of people who cared about it!

Our PM at the time of covid "lost" his Whatsapp backups, and his replacement also had problems getting access to Whatsapp messages. How convenient.

If you worked in a regulated industry this would be instant dismissal. For the UK govt its business as usual.

It may seem like it's "convenient", but whatsapp is truly a nightmare when you try to move it literally anywhere in any way. Huge backups, needing to transfer phone numbers, having to restore from backups, having and moving those backups in the first place, the way it's designed in that regard is the most inconvenient for a platform that doesn't even necessarily provide more security or anything for that to be worth it at all, particularly for people who don't even seek that kind of security or even know about it and just use it for "texting and stuff". Not to defend that or say that it isn't just a convenient excuse (it can be for sure), but just to say that whatsapp is possibly the most annoying app in that regard. It's such a pain in the ass I'd rather store all of that in the cloud. (Which ironically whatsapp pretty much just does anyway if it backs up to google drive, it just makes it the most inconvenient it could be)

Is it that hard? Every time I moved to a new phone, whatsapp's backups are in my google drive and restored without any problem whatsoever

It’s not hard, but if you do one step out of order, your backup becomes unusable and all your history goes bye-bye.

If you don't back up to google drive, the process is much much more hairy. The transfer looks smooth but I have seen it fail in multiple instances.

These days I learn not to get attached to my message history

Trump admin did the same thing with Signal. I'm pretty sure they did it because US gov't emails and IMs are for sure archived.

The US gov started using Signal before Trump and they were backing up Signal chat logs (which it seems the UK wasn't doing with WhatsApp?). It was just controversial which vendor the prior US gov had chosen to handle the backups (an Israeli tech firm) and how it was used by the executive branch. But they were ultimately following transparency/archiving rules.

Politicians around the world do it on purpose because they know they can more easily get away with leaving no trace.

It's not an accident they don't use government email/IM and use WhatsApp/Signal instead.

But then they turn around and want to convince us it's bad when we use it. Because they're the ones handling “acceptable” secrets, somehow.

“For my friends? Anything. For my enemies? The law.” - Óscar Benavides

(Though to be fair, if we’re comparing South American military dictators, he was actually almost reasonable)

I never saw any reporting after those Signal chat stories came out. At the time it was reported that they had a period of time to make sure conversation were archived properly. It would be interesting to know if that actually happened.

Technically speaking WhatsApp is roughly second place on secure messaging behind Signal.

So while there are massive issues wrt. compliance and giving a US company control over all of this from a purely security choice they could have done way worse and still f*up compliance.

I don't really mind someone foreign having access to what is being said, as much as I mind public servants not being able to be held accountable because all of the discussions are encrypted.

If you’re thinking about foreigners in this context being some random person on WhatsApp in the US, that’s one thing.

You really might want to consider however that ‘foreign’ in this case could be anybody from a Russian FSB agent in Moscow, to a pro Project 2025 CIA agent.

It’s not a good idea for a minister in a gov’t to have their ideas spammed to people accidentally or (by hostile action) intentionally that are not within that same gov’t.

Regardless of ‘good’ or ‘bad’, if anything else it’s an operational risk due to misaligned incentives that the voters are really dumb to not make a bigger deal about.

In the US, it's Signal. In the UK, it was WhatsApp.

When researchers dumped 100% of Signal's users in the USA, because its contact discovery API has no rate limiting, they found a huge portion of Signal's US userbase has Washington D.C. area codes.

"Signal; Washington D.C. numbers are more than twice as likely to be registered with Signal than for any other area in the US" https://encrypto.de/papers/HWSDS21.pdf

Meanwhile, in Scotland since the pandemic, Nicola Sturgeon ran her government with an entirely parallel communication network on WhatsApp, explicitly to prevent her government's discussions and decisions from being discoverable by FoI requests.

There was daily deletion of messages. It was drummed into people by Sturgeon's head civil servant, Ken "Plausible Deniability" Thompson: https://archive.is/jK6Bd

> Thomson was head of the Covid co-ordination directorate of the Scottish government and wrote: “Just to remind you (seriously), this is discoverable under FOI [freedom of information]. Know where the “clear chat” button is…”. He later added: “Plausible deniability are my middle names. Now clear it again!”

Sturgeon, just like Boris Johnson, retained zero WhatsApp messages: https://www.bbc.co.uk/news/live/uk-scotland-67949454

Scotland only banned use of WhatsApp in government 4 months ago: https://www.bbc.co.uk/news/articles/c4g8pe585z1o

The beltway people working as public servants are (supposed to be) using the TeleMessage fork of Signal. Specifically designed to archive messages for the public record. That is the reason for the increased representation of federal workers.

The compliance (audibility, recovery, etc) is the big problem, IMO, not the security.

In practice this is not that much different to what went before except that things happen more quickly.

Before people would go down the pub and have a discussion or in the corridor.

Things were never all discussed through official channels.

Now actually is probably more transparent as some of the WhatsApp messages are leaked and people can't deny them.

I'm certain that people will take an emotional reaction to what you've written, but I just want to be the first to say that I think you're right.

"Whatsapp" is the new "talking to the person in the corridor" or "having a quick chat down the pub", it's not the new email, and having them leak is ironically the most accountability we've seen.

I'll use an example of someone I support generally now: Tony Blair was accused of having backroom discussions regarding the invasion of Iraq and secret meetings away from even his cabinet[0]. Since we only have hearsay of what went on, it's very difficult to hold him accountable for this.

[0]: https://www.bbc.com/news/uk-politics-12306377

From what I read, huge decisions were taken over whatsapp, particularly with regard to Covid policy. This wasn't "go for a pint, have a chat" type work.

If it was up to me, using whatsapp for ANY govt business should be an instant sackable offence. I don't conduct my company business on whatsapp. I conduct it on mainly slack and email. Its not hard.

You don’t think most huge decisions are discussed over back channels in addition to or before moving to official channels?

Actually the entire theme of Yes Minister, one of the best parodies of how the government is run is that not a single important decision or discussion is had in a public forum. Many episodes involve burying particularly incriminating official records.

Not only that when learning business one comment made was

Decisions are not made in meetings they are made in discussions before the meetings. Going into a meeting and thinking that your comments will change things is being naive.

From that the thing to be learnt is that you have to have off the record meetings first to convince the powers that be.

Now at least some of these meetings are recorded via WhatsApp and leaks before they never were.

Also see how IBM and Oracle get business - they take the senior C level managers out to lunch or golf and persuade them. They don't bother talking to the people who could evaluate if it was a good deal technically.

The short term problem is, that the government are responsible for sacking themselves in the short term - and those clowns just refused to, which is not the case for the current government who are replacements for the clowns who the electorate firmly sacked at their first opportunity.

So re your comment: 'For the UK govt its business as usual', not really.

You do not have to like the government of the day, but don't fall into the trap of believing that they are all the same.

Our governments have hoodwinked the population into believing that society needs to be surveilled by the government to prevent crime, and not the other way around. We're forgetting who signed off on this whole thing.

The central problem here is this:

In the Physicists from 1961 (German: Die Physiker, F. Dürrenmatt) the central theme is that scientists cannot "uninvent" something. Encryption is here to stay. Mathematically proven. Period.

The criminals will just flock to the "real encryption" and not the honeypots/backdoored messengers as they are being caught. In the end word of mouth will spread: "This is safe, this is unsafe."

Just because a few Kremlin bots on Telegram are brainwashing people in the west, the west doesn't have to become North Korea.

Defending the innocent law abiding adult Joe, just wanting to send their honey pics in private is a distractor in this argument. I will not sacrifice my western standards just because 0.1% people are inherently evil.

>The criminals will just flock to the "real encryption" and not the honeypots/ backdoored messengers as they are being caught. In the end word of mouth will spread: "This is safe, this is unsafe."

Actually the opposite seems to be true. Criminal gangs are particularly susceptible to honeypots precisely because they don't trust the mainstream services.

2 prominent example was that huge sting operation a couple of years back where a supposedly "secure" service was being run by the FBI. And then you have the infamous pager plot, which is admittedly very different but it perfectly illustrates how shaky alternative communications can be.

>Just because a few Kremlin bots on Telegram are brainwashing people in the west, the west doesn't have to become North Korea.

From the hysteria this has generated you would think it was the most crippling threat western democracy has faced since communism.

Oh really?

https://www.computerweekly.com/news/366617630/German-court-f...

Actually the reality was the honeypots were illegal to use as evidence in court. So these criminals are now smarter and more dangerous as we taught them OPSEC.

Chat Control proposal excludes politicians themselves from Chat Control.

Former Dutch PM used to have an old Nokia with a very limited capacity to store messages[0], so he could always say he had to delete messages so he could keep receiving new ones.

[0] https://nos.nl/artikel/2429354-wissen-sms-jes-door-rutte-vol...

Eschewing responsibility through these kinds of "tricks", where the person obviously thinks themselves so above everyone else that they can make them idiots to their face, makes my blood boil.

It's always either public "servants" in power, or the rich people, putting themselves outside of the rules. If you are an elected official, and make a stunt like this, it should be grounds for immediate dismissal, IMO. But, alas, nowadays these kinds of things are so minor and irrelevant, in the sea of ridiculously horrible stuff they do.

It's at least refreshing that there are still places, like the Netherlands in this case, where there are some (even when it's surface-level) repercussions of such behavior.

> makes my blood boil

I don't think off-the-record communication always implies corruption. I imagine it to be impossibly hard sometimes to get people to agree on anything (which is basically a PM's entire job), if all communication must happen out in the open.

Yes, and now he's the NATO Secretary General. As PM, he employed the obvious and straighforward defense against the Dutch version of FOIA of keeping the most important communications in-person behind closed doors[1].

I'd assume many high ranking Western politicians do something similar, while paying lip service to high minded ideals about openness, transparancy and democracy.

[1] https://nl.wikipedia.org/wiki/Rutte-doctrine

messages could be (and usually are) stored server side. Plus SMS is not secure at all and easy to eavesdrop on.

I think the parent commenter was aware of that and was deliberately flipping the tables on these self-serving politicians.

Public servants have a job, outside of their job, they are just regular citizens with the same rights and duties as everyone else.

So, monitoring them of the job, sure, but they have the right for a private life. Or not, depending on the law...

It is a bit more complicated for high ranking official, where immunities and classified information come into play, and they don't really have 9-to-5 jobs. But for lower ranking public servants, like police officers, magistrates, mayors, etc... that would apply.

>when something goes wrong that blackbox should be decrypt-able so we can look at the logs and see what went wrong.

We always check the logs and when something goes wrong we vote for the box to explode

I submitted this some time ago [0]

[0]: https://news.ycombinator.com/item?id=45127521

> all the public servants should have a monitoring device like a black box on them all the time and when something goes wrong that blackbox should be decrypt-able so we can look at the logs and see what went wrong.

no. Regards, Ursula

Reply on news.ycombinator.com