Petition UK government to not ban encryption(petition.parliament.uk)
petition.parliament.uk
Petition UK government to not ban encryption
https://petition.parliament.uk/petitions/106369
112 comments
banning encryption today because "criminals use computers" is equivalent to banning locks 100 years ago because "criminals use doors"
They should try to ban it, just so they can really see how much stuff depends on it and how vague 'Banned Encryption' is.
I think it could be better worded as "Please stop being so bloody stupid"
Honestly. I'd like to see them try to ban it. They'll see their entire internet economy crash and hell will break loose. People getting pissed why they can't login to gmail or facebook or paypal or do any online shopping. It's such an entirely ridiculous idea that i can't even describe it in words.
Okay to be honest I haven't really read into the material. but is their actual plan to "ban" encryption? Or do they want to license it to certain parties? Or have a weakened "export" encryption scheme like the US government tried? What's the plan?
Okay to be honest I haven't really read into the material. but is their actual plan to "ban" encryption? Or do they want to license it to certain parties? Or have a weakened "export" encryption scheme like the US government tried? What's the plan?
They'll see their entire internet economy crash and hell will break loose.
The point is that the government want to ban encryption that they can't can't view. That essentially means you'll only be able to run an encrypted service if you're happy to hand over the unencrypted data to the government. It might also mean that end-to-end encrypted services are blocked by ISPs. But the average internet user will still see the little padlock in their browser, so they'll believe it's all still fine, and will carry on as normal.
What the government really seems to fail to understand[1] is the principle that if they can view the decrypted information then so can the bad guys.
[1] Or, I suspect, they do understand but they arrogantly believe they're better at security.
The point is that the government want to ban encryption that they can't can't view. That essentially means you'll only be able to run an encrypted service if you're happy to hand over the unencrypted data to the government. It might also mean that end-to-end encrypted services are blocked by ISPs. But the average internet user will still see the little padlock in their browser, so they'll believe it's all still fine, and will carry on as normal.
What the government really seems to fail to understand[1] is the principle that if they can view the decrypted information then so can the bad guys.
[1] Or, I suspect, they do understand but they arrogantly believe they're better at security.
I don't think anyone is dumb enough to actually prevent the electorate logging into facebook.
I expect the language to be broad and the enforcement narrow.
I expect the language to be broad and the enforcement narrow.
> I expect the language to be broad and the enforcement narrow.
That's the worst kind of law - you can be locked up at a prosecutors whim.
In the UK, it's already illegal not to disclose the key to an encrypted file.
That's the worst kind of law - you can be locked up at a prosecutors whim.
In the UK, it's already illegal not to disclose the key to an encrypted file.
Well, kinda. A RIPA s.49 notice can be defeated with s.53 defenses.
Some people have failed to pass the test of "reasonable doubt" for s.53 (3) / (4) defenses e.g. ( http://www.alphr.com/news/361693/teenager-jailed-for-refusin... ) but in other cases they have succeeded (e.g. Lauri Love had his hdd's taken and the NCA couldn't decrypt them but had to release him on bail; http://www.bbc.co.uk/news/uk-england-suffolk-31544346 and subsequently returned some of the storage (before arresting him again))
There are also people out there working to help the reasonable doubt argument; https://brasshorncommunications.uk/projects/s53/
Some people have failed to pass the test of "reasonable doubt" for s.53 (3) / (4) defenses e.g. ( http://www.alphr.com/news/361693/teenager-jailed-for-refusin... ) but in other cases they have succeeded (e.g. Lauri Love had his hdd's taken and the NCA couldn't decrypt them but had to release him on bail; http://www.bbc.co.uk/news/uk-england-suffolk-31544346 and subsequently returned some of the storage (before arresting him again))
There are also people out there working to help the reasonable doubt argument; https://brasshorncommunications.uk/projects/s53/
NB: Lauri is now facing three parallel extradition request to the USA as an indirect consequence of failure to comply with a court order to facilitate decryption.
This is not ideal, but will probably fail, hopefully with some precedent set.
[http://theconversation.com/hactivists-arent-terrorists-but-u...]
This is not ideal, but will probably fail, hopefully with some precedent set.
[http://theconversation.com/hactivists-arent-terrorists-but-u...]
It's fun, in Argentina we've had a case were a criminal releasing the key nullified the evidence, because the criminal's lawyer argued that (under Argentinian law):
* He was forced ("tortured" was the word used) to disclose the key by the police.
* You can't accuse yourself or direct relatives, and disclosing an encryption key that resulted in incriminating evidence was argued to be a form of "self incrimination".
* "Best" thing about this was that the evidence led to finding a body, but as it was nullified, legally the status of the deceased person changed from "deceased" to "missing" -- because the evidence they had used to find the body had been nullified, then also the finding of the body had to be null (I'm not kidding, people went nuts over this "technicallity").
* Eventually a more reasonable judge turned the previous statement and accepted that the person was deceased indeed.
Working in forensics (I do digital forensics) is weird some times...
* He was forced ("tortured" was the word used) to disclose the key by the police.
* You can't accuse yourself or direct relatives, and disclosing an encryption key that resulted in incriminating evidence was argued to be a form of "self incrimination".
* "Best" thing about this was that the evidence led to finding a body, but as it was nullified, legally the status of the deceased person changed from "deceased" to "missing" -- because the evidence they had used to find the body had been nullified, then also the finding of the body had to be null (I'm not kidding, people went nuts over this "technicallity").
* Eventually a more reasonable judge turned the previous statement and accepted that the person was deceased indeed.
Working in forensics (I do digital forensics) is weird some times...
The rule against self-incrimination is a very important part of Roman law - the government can't force you to do anything that would lead to your conviction.
That's why the Brazilian police has a hard drive that is known to have tons of incriminating evidence against a number of bankers but they can't do anything about it because, well, TrueCrypt.
It sounds ridiculous that the discovery of a body would be nullified because the evidence leading to it was nullified but this is important because it forces the prosecution to comply with the law. It helps avoid the violation of a fundamental right.
I don't necessarily find that Roman Law is superior to Common Law but all of the silliness about people being forced to type passwords could be avoided with this very reasonable provision. Common Law allows you to incriminate yourself by forcing you to prove your innocence by assuming guilt unless you can prove your innocence via decryption - let's hope we can all remember all of passwords!
That's why the Brazilian police has a hard drive that is known to have tons of incriminating evidence against a number of bankers but they can't do anything about it because, well, TrueCrypt.
It sounds ridiculous that the discovery of a body would be nullified because the evidence leading to it was nullified but this is important because it forces the prosecution to comply with the law. It helps avoid the violation of a fundamental right.
I don't necessarily find that Roman Law is superior to Common Law but all of the silliness about people being forced to type passwords could be avoided with this very reasonable provision. Common Law allows you to incriminate yourself by forcing you to prove your innocence by assuming guilt unless you can prove your innocence via decryption - let's hope we can all remember all of passwords!
Is there any scheme which permits a data to be encrypted such that there are two passwords\keys which can decrypt it - one which unlocks the real data and the other to some dummy\innocuous stuff?
Indeed there is, it is called plausible deniability [1]. With Truecrypt, you can nest a hidden volume within another volume, so you can decrypt the latter and it will only show innocuous files, while another password (using other parts of the volume) would provide other (incriminating) files.
I wonder what is in a judge's mind when the encrypted evidence turns out to be kitten pictures and the defendant claims that he does not have any other password to provide.
[1]: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...
edit: clarification
I wonder what is in a judge's mind when the encrypted evidence turns out to be kitten pictures and the defendant claims that he does not have any other password to provide.
[1]: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...
edit: clarification
That is not what OP is talking about. You cannot get different information out of the same chunk of encrypted data. That would basically make infinite compression.
What the methods you mentioned are doing, is hiding information in places which are marked as: random data no information here. But in reality there is information there. You then need to have dummy information somewhere else.
What the methods you mentioned are doing, is hiding information in places which are marked as: random data no information here. But in reality there is information there. You then need to have dummy information somewhere else.
This would be trivial to do with one-time-pads. A bit bulky, but simple. But in a way, you'd still be right. The "dummy information" is (encoded into) the second key.
[deleted]
Storing the different information in the same place is impossible. You could use stenography but then anyone with access to the program/source will immediately discover the deceit.
You can use what hiq is suggesting, https://news.ycombinator.com/item?id=10097533, but that is a different method.
You can use what hiq is suggesting, https://news.ycombinator.com/item?id=10097533, but that is a different method.
[deleted]
[deleted]
Not sure if that petition will be valid, because it is encrypted... ;)
Some people in Britain will always be more equal than the others.
They're not going to ban encryption. Seriously. Stop wasting time on misquotes taken out of context blown up by The Guardian. There's more important things to worry about.
exactly, guardian trolling at it's finest
The point of this petition, even though it looks at first blush to be taking down a straw man, is to send a shot across the bow.
Either:
a) they ban all end-to-end encryption
or
b) this law is ridiculously easy to circumvent for even non-technical users
An example of b) would be: piggyback messaging on an existing service that has a valid reason for being encrypted
a) they ban all end-to-end encryption
or
b) this law is ridiculously easy to circumvent for even non-technical users
An example of b) would be: piggyback messaging on an existing service that has a valid reason for being encrypted
Mandating back doors is banning effective encryption.
I wish they would just go ahead and ban it outright today, and in my naive imagination the whole country would plunge into disaster. Airliner crashes, car crashes, market crashes, the whole lot.
Unfortunately, selective enforcement of this ban will quickly turn it into a tool of tyranny, same as any other.
(Yeah I have a site that doesn't display that stupid cookie notice, but it doesn't matter because I haven't pissed off anybody powerful yet.)
Unfortunately, selective enforcement of this ban will quickly turn it into a tool of tyranny, same as any other.
(Yeah I have a site that doesn't display that stupid cookie notice, but it doesn't matter because I haven't pissed off anybody powerful yet.)
It really worries me that the leader of our nation does not appear to have all the information required in order to make a decision on a topic as important as this. I would have thought that a domain expert within government would have be consulted before Cameron goes off half cocked in debates and discussions.
With technology a key and growing industry within the UK, shouldn't we expect our leaders to at least attempt to understand the issues around governance?
With technology a key and growing industry within the UK, shouldn't we expect our leaders to at least attempt to understand the issues around governance?
What past experience would have given you the idea that a UK prime minister would let domain expects stop them from coming up with stupid proposals?
(I was about to single out Cameron, but while I detest him, and while he seem to have a particular blind spot for technology, the problem is by no means unique to the Tories; e.g. consider when David Nutt was asked to go because his evidence-based advice on drugs didn't agree with the Labour governments policy)
(I was about to single out Cameron, but while I detest him, and while he seem to have a particular blind spot for technology, the problem is by no means unique to the Tories; e.g. consider when David Nutt was asked to go because his evidence-based advice on drugs didn't agree with the Labour governments policy)
You mean had to go because it didn't agree with the Medias Agenda
It's pretty staggering that the FBI and gov.uk should choose now — a time of daily, massive security breaches dominating the headlines — to have the "your security is too good" conversation with tech companies. And, compared to the last time we went through this idiocy, they now refuse to put any specific proposals on the table. The whole enterprise is an embarrassment, and not going to happen in a million years.
For the record Cameron was not suggesting on banning everything that uses encryption. Primary seeking a ban on end-to-end encryption messaging applications (ie, textsecure/signal, whatsapp, snapchat) that does no provide the UK government with a backdoor.
Its still a terrifying idea, and shouldn't be allowed to happen.
https://en.wikipedia.org/wiki/Encryption_ban_proposal_in_the...
Its still a terrifying idea, and shouldn't be allowed to happen.
https://en.wikipedia.org/wiki/Encryption_ban_proposal_in_the...
Seeking a mandatory backdoor is equivalent to banning encryption.
This isn't just metaphorical - it is a practical, provable result of it. The various attempts throughout history have been abysmal failures of security.
The other practical result is that the current UK government appears to believe that citizens are their subjects, whose freedom is a privilege and not a right.
This isn't just metaphorical - it is a practical, provable result of it. The various attempts throughout history have been abysmal failures of security.
The other practical result is that the current UK government appears to believe that citizens are their subjects, whose freedom is a privilege and not a right.
Urgh. This should be better phrased. From the BoingBoing article:
David Cameron says there should be no "means of communication" which "we cannot read"
It's very specific to communication, and reading between the lines, messaging, as opposed to something like HTTP communication between a bank and a customer. Don't get me wrong, it's still incredibly stupid, but the government will be able to reply to this petition with "we do not intend to ban encryption" and close it.
David Cameron says there should be no "means of communication" which "we cannot read"
It's very specific to communication, and reading between the lines, messaging, as opposed to something like HTTP communication between a bank and a customer. Don't get me wrong, it's still incredibly stupid, but the government will be able to reply to this petition with "we do not intend to ban encryption" and close it.
The problem with your interpretation is that bank communications are still a means of communication. So the vagueness of the law allows politicians to extend their requirements to any product they wish without exception. This isn't something I believe to be accidental either as terrorism laws are often written to be vague with the intent of common sense regulation - which often gets bypassed when a jobsworth believes they're in the right.
"means of communication" is not in the text of a law. It was a quote from David Cameron. As yet, there is no law.
I think it's reasonable to assume that the terms would be more explicitly defined in an actual law.
I think it's reasonable to assume that the terms would be more explicitly defined in an actual law.
Reading "between the lines" is not a valid way to interpret laws. What is written is what is valid, not what you think it should mean.
As yourself used the term, how is "communication between a bank and a customer" not a form of "communication"?
As yourself used the term, how is "communication between a bank and a customer" not a form of "communication"?
>What is written is what is valid, not what you think it should mean
I am not sure if it would be a good thing or not if this was the case, but leaving that aside laws are, in fact, liberally interpreted all the time, depending on your jurisdiction's legal tradition. This is why you can't hack the law; the interpretation of the law will change to fill in the gaps, provided that's what the justice system wants.
I am not sure if it would be a good thing or not if this was the case, but leaving that aside laws are, in fact, liberally interpreted all the time, depending on your jurisdiction's legal tradition. This is why you can't hack the law; the interpretation of the law will change to fill in the gaps, provided that's what the justice system wants.
"means of communication" is a quote from David Cameron, and is not the actual valid text of a law. It's hardly uncommon for a politician to sum up the intent of a law while not using the precise language used inside it.
In any case, there is no law yet, so no language to examine.
In any case, there is no law yet, so no language to examine.
Oh right, because laws are ironclad codifications of pure, unadulterated Justice, and that's exactly why you can be imprisoned for collecting rainwater on your property: http://cnsnews.com/news/article/oregon-man-sentenced-30-days...
In reality, the correct way to interpret laws is to think about their real purpose. Who benefits? What is the goal here?
The vast majority of laws have one of these two purposes: to enrich the government's cronies, or to cement the government's continued rule.
In reality, the correct way to interpret laws is to think about their real purpose. Who benefits? What is the goal here?
The vast majority of laws have one of these two purposes: to enrich the government's cronies, or to cement the government's continued rule.
Apparently our politicians should understand infosec to demand policy, but the people don't have to understand their goverment to demand policy.
How can you have a situation where the HTTPS used to secure communication between two peers is different than the HTTPS used between a bank and one of it's clients ?
This just shows serious misinformation on your part.
This just shows serious misinformation on your part.
We do already have different implementations of TLS/HTTPS used for different purposes. They're called cipher suites. There are already weaker cipher suites in widespread use, which are the cause of most of the big security issues with TLS/SSL/HTTPS. (This is pretty good article on the subject: http://blog.cryptographyengineering.com/2015/03/attack-of-we...)
I'd guess all the UK government would do is insist that, by law, all secured P2P messaging goes via a given cipher suite (one with a government backdoor/decryption key and, I guess, no perfect forward secrecy).
It's pretty conclusive how bad an idea it is, when all of the leading security experts in the world have said that this is impossible without weakening the entire security of the system.
I'd guess all the UK government would do is insist that, by law, all secured P2P messaging goes via a given cipher suite (one with a government backdoor/decryption key and, I guess, no perfect forward secrecy).
It's pretty conclusive how bad an idea it is, when all of the leading security experts in the world have said that this is impossible without weakening the entire security of the system.
Presumably the government asks the bank what you're up to, and the bank tells them. Which is exactly what already happens today.
Do you think the reason you use HTTPS to talk to your bank is to prevent the government from seeing your account balance?
Do you think the reason you use HTTPS to talk to your bank is to prevent the government from seeing your account balance?
It's certainly not the only reason but sure it's one of them.
Proof of that is Google forcing TLS encryption of all it's traffic after the NSA scandal.
The number of people that can implement secure communications without relying on third parties is close enough to zero that they basically don't count.
ISIS recruitment would plummet to zero if people had to get TLS working before joining.
ISIS recruitment would plummet to zero if people had to get TLS working before joining.
I don't think that you understand that the TLS technology used for online banking (which would still be legal) is the very same technology that lets you create a secure communication channel with other users.
I don't know why you think that. Perhaps I was unclear.
The average prospective terrorist / criminal etc isn't going to be able to set up TLS. If they encrypt their communications, the odds are it's going to be going via a third party. Next time you send an email, tell the recipient that from now on you're going to communicate directly by TLS, and they'll need to set up a server before you can talk to them again. I believe that most people will have considerable difficulty doing that.
So, you're reliant on third parties who constitute single points of failure and potential targets of legal action.
Individuals who can securely set up TLS (or PGP or whatever) for their own communications are sufficiently rare that they effectively don't matter.
The average prospective terrorist / criminal etc isn't going to be able to set up TLS. If they encrypt their communications, the odds are it's going to be going via a third party. Next time you send an email, tell the recipient that from now on you're going to communicate directly by TLS, and they'll need to set up a server before you can talk to them again. I believe that most people will have considerable difficulty doing that.
So, you're reliant on third parties who constitute single points of failure and potential targets of legal action.
Individuals who can securely set up TLS (or PGP or whatever) for their own communications are sufficiently rare that they effectively don't matter.
TLS is currently simply a matter of point and click on a graphical interface.
For hosting provider setup, to domain name registration and TSL certificate generation there are thousands of online tutorials.
You don't need to be an expert or a developer to know how to setup TLS on a Wordpress blog.
For hosting provider setup, to domain name registration and TSL certificate generation there are thousands of online tutorials.
You don't need to be an expert or a developer to know how to setup TLS on a Wordpress blog.
A Wordpress blog run by a third party does not constitute a secure messaging system, even if you have TLS enabled on it. And it's still a lot less easy than using WhatsApp.
Installing pidging, otr, starting a chat and confirming who you're talking too doesn't exactly require a comp sci degree.
This isn't really about stopping that though, it's about the snooping nanny state plain and simple.
This isn't really about stopping that though, it's about the snooping nanny state plain and simple.
Using PGP securely is as easy as downloading some software, typing in your message, and clicking a button. It's not something that requires any knowledge beyond basic computer usage. You aren't going to be able to stop people from sharing PGP software on the internet.
I think you're severely underestimating the intelligence of people in general. If we're talking about ISIS, all it takes is one moderately experienced computer user to show everyone else how to use PGP.
I think you're severely underestimating the intelligence of people in general. If we're talking about ISIS, all it takes is one moderately experienced computer user to show everyone else how to use PGP.
> Using PGP securely is as easy as downloading some software, typing in your message, and clicking a button. It's not something that requires any knowledge beyond basic computer usage. You aren't going to be able to stop people from sharing PGP software on the internet.
And yet we find a bunch of supposedly encrypted stuff where the user did something wrong, leaving the stuff effectively unencrypted.
See also people uploading keys to github etc.
And yet we find a bunch of supposedly encrypted stuff where the user did something wrong, leaving the stuff effectively unencrypted.
See also people uploading keys to github etc.
What software are you talking about? I've seen very clever people struggle with PGP. In fact Ed Snowden famously screwed up when he first emailed Glenn Greenwald.
GPGTools, for example (https://gpgtools.org)
I suppose I omitted the step of copying and pasting your recipient's public key, but that's not especially conceptually difficult, either.
I suppose I omitted the step of copying and pasting your recipient's public key, but that's not especially conceptually difficult, either.
That does look quite nifty.
There's also keypair generation, which is the step that derails most people I think. Plus the fact that people have to grok the concept of public and private keys, and be able to distribute / not distribute them as appropriate. And revocation certificates. And public keyservers. And trust levels. Etc.
I do think an organised, disciplined group might manage to get PGP working as intended, but I doubt there are many such groups.
My point is, I doubt individuals implementing encryption have much to fear from whatever proposals may emerge from this. Maybe they will later. But it seems to me it's much more likely to target companies that offer/facilitate encrypted messaging.
Edit: Thanks to whoever just put my karma over 2000. Does anything exciting happen when you get to 2000 points?
There's also keypair generation, which is the step that derails most people I think. Plus the fact that people have to grok the concept of public and private keys, and be able to distribute / not distribute them as appropriate. And revocation certificates. And public keyservers. And trust levels. Etc.
I do think an organised, disciplined group might manage to get PGP working as intended, but I doubt there are many such groups.
My point is, I doubt individuals implementing encryption have much to fear from whatever proposals may emerge from this. Maybe they will later. But it seems to me it's much more likely to target companies that offer/facilitate encrypted messaging.
Edit: Thanks to whoever just put my karma over 2000. Does anything exciting happen when you get to 2000 points?
Hmm. I guess my thought is that if it became well-known that using Whatsapp, iMessage, etc. to communicate about illegal activities frequently led to arrest, then knowledge of PGP and the like would spread because it's not too difficult to use. So then government would be able to read everyone's communications through those channels for no appreciable benefit.
Obviously, that's total conjecture, though.
Obviously, that's total conjecture, though.
Using PGP is as easy as understanding PKI, which is beyond most people that don't work in tech, and a substantial amount of people that do.
One would hope that the legislating body would be held to a higher standard.
It would be pretty easy to implement messaging between two people who can log in to the same bank account. There are plenty of places you can store text typically, labels on payees, your details etc. Or one could use two accounts under the same login: person A logs in and sets the balance on account 2 to something which represents a character in binary. Then person B "acks" that character by transferring the money back to account 1. Repeat. Those characters could in fact be cipher text for full end to end crypto that even the bank can't decipher.
I expect that a government may be very interested in the content of communications between a bank and a customer
Banks are so closely regulated that they are not really (in fact not at all) off limit for the government. Unless we are talking about a foreign website of a foreign bank, which would not be required to comply anyway.
Webmails, social medias or dating services are of a much greater interest to a nosy government.
Webmails, social medias or dating services are of a much greater interest to a nosy government.
Oh, I believe you are mistaken. Governments are quite interested in your financial dealings, even with banks. The more they know, the less you can do without their direct knowledge.
I am not saying they are not interested. I am saying that they just need to ask the banks who will hand over everything no question asked. GCHQ does not need to intercept your connection to get your bank statement.
I bet they don't even need to ask..
Many countries still require warrants.
I think in France the taxman can check your bank account directly so it's a fair bet that the intelligence service have access. I have no reason to think things are different in the UK.
I wouldn't be surprised.
Have you ever read about the various French Intel services after the revolution? Talk about convoluted. They trusted no one or even each other.
Have you ever read about the various French Intel services after the revolution? Talk about convoluted. They trusted no one or even each other.
I can't see how, without any context, you can say that "Webmails, social medias or dating services are of a much greater interest to a nosy government".
As to regulations, if it is the law that backdoors are mandatory, then banks have no say in this.
Because they are services hosted outside the UK and which are not heavily regulated. Banks not only provide everything the gvt asks but actually have a duty to act as a law enforcement agency, i.e. watching their customers on the gvt behalf. Facebook or Gmail aren't required to do that.
You seem to imply that currently (retail? investment?) banks in UK are obligated to provide the government with information regarding customer's accounts. Can you provide a reference?
What if the communications are being sent over HTTPS? E.G. facebook messenger
Cameron doesn't want to ban encryption. he wants encrypted end to end messaging services to have backdoor keys for the security services use. which is stupid, but very different to banning encryption.
Don't get me wrong, I'm not in favour of this, but the distinction is clear and false misinformation isn't going to help prevent this.
Don't get me wrong, I'm not in favour of this, but the distinction is clear and false misinformation isn't going to help prevent this.
Sir, the serfs are using HTTPS again!
The government's story has been "we need a way to access people's data so we can catch pedophiles, drug dealers and terrorists" and it seems there is a widely held belief that in order to do this, they would need to either ban encryption or weaken it sufficiently to make it effectively useless. However, as far as I can tell, backdoors into your phone or your desktop PC already exist. All the government has to do is convince Apple, Google, MS or Ubuntu to provide an 'official' update to a target computer, wait for the user to accept (or the OS to accept it automatically) and they have full reign over your device.
Many people say that opening our devices to a special chosen set of good guys is equivalent to opening them to all the bad guys as well. If that's the case, surely we're already vulnerable given most commonly used devices update automatically?
The only purpose I can see for attacking encryption in general is to enable mass surveillance. The government have in fact not been specific about what they are actually asking for, but if they want selective ability to search digital devices, they already have it. If they want further powers, then we need to ask them what they need them for.
Many people say that opening our devices to a special chosen set of good guys is equivalent to opening them to all the bad guys as well. If that's the case, surely we're already vulnerable given most commonly used devices update automatically?
The only purpose I can see for attacking encryption in general is to enable mass surveillance. The government have in fact not been specific about what they are actually asking for, but if they want selective ability to search digital devices, they already have it. If they want further powers, then we need to ask them what they need them for.
Or simply start instilling the idea into ignorant people's minds that crypto is bad and just keep repeating that until it becomes a "truth", or gain votes or leverage on the right occasion when needed with "we told you so".
I'm not sure that's a wise strategy. Try telling the users of Ashley Madison that encryption is a bad thing. For each of the government's examples of where encryption enables criminals to do criminal things, the public are going to hear about the cases where lack of encryption enables criminals to do criminal things. There's just as equal a chance in my opinion that raising the issue in the consciousness of the public that they turn against the government and demand stronger encryption rather than less.
The NSA and GCHQ were able to gain significant powers in the last decade primarily by staying under the radar of public awareness. That is why the leaks we heard in 2013 were so significant. Now the cat's out of the bag, it might be the government are left with no choice but to use propaganda to convince the public to give them what they want but there's no guarantee that it will work.
The NSA and GCHQ were able to gain significant powers in the last decade primarily by staying under the radar of public awareness. That is why the leaks we heard in 2013 were so significant. Now the cat's out of the bag, it might be the government are left with no choice but to use propaganda to convince the public to give them what they want but there's no guarantee that it will work.
Not exactly. Apple, for example, has already begun encrypting so that they themselves can’t decrypt the data.
And that’s exactly how it should be.
And that’s exactly how it should be.
Hopefully we can mostly agree that they're not really going to try to ban encryption.
Would anybody like to speculate on what proposals we might see in reality? Are they going to ban me, as an individual, from using GPG? Are they going to ban companies from operating encrypted messaging services in the UK? Are they going to block traffic from non-compliant overseas providers? Are they going to just have a quiet word with the SnapChat people?
Would anybody like to speculate on what proposals we might see in reality? Are they going to ban me, as an individual, from using GPG? Are they going to ban companies from operating encrypted messaging services in the UK? Are they going to block traffic from non-compliant overseas providers? Are they going to just have a quiet word with the SnapChat people?
I think we are fighting the wrong battle here. The power equation is already in favor of the government snooping everybody, making it law only puts things in the open. We should fight in that direction, making it so that everything is more transparent. Wanna have my data? Okay, but I want to have yours. I specially want to have all the data about what you do with my data. I want to be able to request all the data you got of me. I want to be able to erase some of it (or at the very least mark it as invalid). I want to be able to add directly to it. I want to know whenever it is used. I want a due process every time it is used for something that affects me. And I want people that make use of data for their own purposes or that don't follow protocol to be prosecuted or at the very least banned from public office.
Presumably the people fighting this battle value their privacy. How would their fight benefit from switching to fighting against privacy?
I think your goals are completely orthogonal to the people who made and signed this petition, so your suggestion is unlikely to sway anyone.
I think your goals are completely orthogonal to the people who made and signed this petition, so your suggestion is unlikely to sway anyone.
To all those saying "it's not about banning encryption - only encrypted messaging then surely either:
a) they ban all end-to-end encryption
or
b) this law is ridiculously easy to circumvent for even non-technical users
An example of b) would be: piggyback messaging on an existing service that has a valid reason for being encrypted
a) they ban all end-to-end encryption
or
b) this law is ridiculously easy to circumvent for even non-technical users
An example of b) would be: piggyback messaging on an existing service that has a valid reason for being encrypted
Cameron is not really trying to ban encryption (or even ban end to end encryption apps).
This is misdirection in the run up to new surveillance legislation. The real issue is 'bulk collection'.
The UK government is trying to frame the debate such that the concept of mass surveillance is not challenged.
This is misdirection in the run up to new surveillance legislation. The real issue is 'bulk collection'.
The UK government is trying to frame the debate such that the concept of mass surveillance is not challenged.
Bulk collection is rendered entirely pointless by end-to-end encryption because the government would just end up with vast amounts of data they can't read. I would say the UK government is trying to ban encryption, and for exactly that reason - they want mass surveillance that is 'useful' (for the government's definition of useful, which is not the same as mine or yours).
The GCHQ geeks are not stupid, they know banning end-to-end encryption is not really feasible.
Yes, increased usage of it will harm "bulk collection" but not too much. Your whatsapp might be end-to-end encrypted, but companies such as facebook and google aren't going to change too much because it would harm their business models.
Yes, increased usage of it will harm "bulk collection" but not too much. Your whatsapp might be end-to-end encrypted, but companies such as facebook and google aren't going to change too much because it would harm their business models.
http://www.revk.uk/2015/07/crypto-wars.html
"If a British citizen with an iPhone purchased in France and roaming in Germany iMessages a Chinese citizen roaming in Sweden using an iPhone purchased in Denmark, which government's keys need to be inserted in the iMessage communications by an American company (Apple) legally based in Luxembourg using servers hosted in Eire?"
"If a British citizen with an iPhone purchased in France and roaming in Germany iMessages a Chinese citizen roaming in Sweden using an iPhone purchased in Denmark, which government's keys need to be inserted in the iMessage communications by an American company (Apple) legally based in Luxembourg using servers hosted in Eire?"
The author of that blog post is the same person who started the petition.
[deleted]
No muli no terrorist no terrorist to ban encryption
What is the enforcement plan for this? Will people be taken to jail for sending encrypted communication? How will messaging be differentiated from banking? (if those who claim a more limited scope are correct) The whole plan just seems unworkable.
Would the downvoter please explain? I am genuinely curious about how this could be enforced.
This is a pointless petition.
"We don't want to ban encryption." - Ed Vaizey, Minister of State at the Department of Culture, Media & Sport, on 16 July 2015 - http://www.scmagazineuk.com/uk-minister-cyber-security-a-pri...
"We don't want to ban encryption." - Ed Vaizey, Minister of State at the Department of Culture, Media & Sport, on 16 July 2015 - http://www.scmagazineuk.com/uk-minister-cyber-security-a-pri...
They want to ban encryption which doesn't have a backdoor. It's semantics, but the end result is to make encryption ineffective. Which is practically the same as a ban.
I disagree. Politicians love to leave things vague so they can argue they didn't break their promises later on. Getting politicians to specifically state that they will not do something is always a win.
But they don't want to ban encryption, they just want the keys.
There shouldn't be a need for any petition. A government with the illusion that it can "ban encryption" has already lost all authority and credibility, so should not be governing anyone.
Says somebody with a technical understanding of encryption. The problem is there's a lack of understanding in this area and the headlines play well to the media.
I think this is important and have emailed two friends (a doctor and a lawyer) to ask them to sign it. I described it as:
'It may be similar to how you feel when you watch a B movie lawyer or doctor "making a professional decision". The only difference being I'm watching the people who are running this country.'
I think this is important and have emailed two friends (a doctor and a lawyer) to ask them to sign it. I described it as:
'It may be similar to how you feel when you watch a B movie lawyer or doctor "making a professional decision". The only difference being I'm watching the people who are running this country.'
How does anyone think that a petition to a government will cause that body to change their direction on any topic other than meaningless feel good areas?
Serious policy isn't influenced by petitions. If you don't have a majority of legislators/MPs in your pocket, you're wasting both time and bandwidth.
Serious policy isn't influenced by petitions. If you don't have a majority of legislators/MPs in your pocket, you're wasting both time and bandwidth.
So let's see..
Governments are passing increasingly Orwellian laws, obviously against our wishes. They clearly don't want us to have any privacy whatsoever, and are basically just making that a legal reality too. Hello police state.
In response, people ask governments to stop stripping away their privacy.
How would you expect governments to respond, besides with some PR-bullshit to placate us or give us a false sense of security. "We would never read the contents of your messages, only the metadata! Honest!".. and people buy that as if they didn't know governments lie to us all the fucking time.
Imagine a King telling his subjects he'll raise taxes until the economy implodes. The subjects ask him nicely to please not raise taxes quite that much.
What does the King do? -Whatever the fuck he damn well pleases, as long as people aren't willing to risk their lives in de-throning him. Of course, after a revolution, a new King is throned, because THIS time it'll be different!
This is so fucking insane.. When will people wake up?
Governments are passing increasingly Orwellian laws, obviously against our wishes. They clearly don't want us to have any privacy whatsoever, and are basically just making that a legal reality too. Hello police state.
In response, people ask governments to stop stripping away their privacy.
How would you expect governments to respond, besides with some PR-bullshit to placate us or give us a false sense of security. "We would never read the contents of your messages, only the metadata! Honest!".. and people buy that as if they didn't know governments lie to us all the fucking time.
Imagine a King telling his subjects he'll raise taxes until the economy implodes. The subjects ask him nicely to please not raise taxes quite that much.
What does the King do? -Whatever the fuck he damn well pleases, as long as people aren't willing to risk their lives in de-throning him. Of course, after a revolution, a new King is throned, because THIS time it'll be different!
This is so fucking insane.. When will people wake up?
Just One.
The US has the greatest control over apple. From the US is it shared with the five eyes. GCHQ's oldboys network then passes it on to basically any European who asks, while one of the thousands entry-level "analysts" at the many US intel agencies passes it on to the Chinese. Then the next snowden leaks it to the guardian and every other paper still alive, half of which are under surveillance by various police groups. So within a week the only people who cannot read this text are 50% of us who aren't government employees.
One keyring to rule them all.
The US has the greatest control over apple. From the US is it shared with the five eyes. GCHQ's oldboys network then passes it on to basically any European who asks, while one of the thousands entry-level "analysts" at the many US intel agencies passes it on to the Chinese. Then the next snowden leaks it to the guardian and every other paper still alive, half of which are under surveillance by various police groups. So within a week the only people who cannot read this text are 50% of us who aren't government employees.
One keyring to rule them all.
As if they could, even if they wanted to.
Nice but pious, It would be more useful to find an MP who was lucky in the ballot for private members bills - and try and get a law passed.
EDIT: In fact, I wouldn't even need to go there