The message he sent right before the attack will likely not have been his first communication about it. There's been a pattern of Isis operatives abroad guiding and supporting terrorists in detail via end-to-end encrypted messaging for weeks or months, right up until the moment they attack: https://www.nytimes.com/2017/02/04/world/asia/isis-messaging... Presumably the British police are assuming that this is like those previous attacks, but they haven't managed to obtain the actual message contents after the fact this time around for some reason.
Come on. If this was really ISIS, then we plainly have nothing to fear.
My bet is that he's just a random crazy, but of course these days it suits the political narrative to brand such people 'terrorists' to stoke public fear
Stop tossing out mental health as a reason. There's nothing to say he had mental illness, and you cause harm to people with mental illness when you incorrectly link violence to mental illness.
I used the word 'crazy', rather than mentioning mental health issues. 'Crazy' does not just refer to people with mental health issues, if refers to irrational acts.
To expand on my point, some of these small-scale 'terrorist' attacks show very little evidence of being coherently planned, and it's difficult to believe that an organised terrorist group is behind them. It seems more likely that some of these acts were performed by people acting alone, or vulnerable people provoked to it - and yes, some of these people may well be mentally ill; that hardly means they cannot be capable of violence.
Suppose they intercept WhatsApp. The need to react to each suspicious message within the minute, and be perfectly efficient in catching terrorists while avoiding innocents.
Of course they would need to intercept all other communication services, including home-made ones.
They have access to library records because of that scenario. They would be able to access online bookstore records.
The book may not have been purchased of course, or may have been banned for sale in a country - many illegal copies of books were made in Communist states in the 80s for that reason.
Possession of The Anarchist Cookbook has been used as evidence against terrorist suspects in Britain, and also as a crime itself, "Possession of terrorist material". In the latter case, the 17 year old's argument was pretty much what you suggest, and he was cleared.
I wonder how they are not even busy explaining how this could happen with all that surveillance already in place. I mean no camera jumped down the pole to stop the car...
There is a way to suspect someone may at some point, which is what the UK security apparatus is aiming for but this kind of profiling will end up being a psychological analysis of whole groups of the population. The results won't be great for any of us.
How do they want to prevent someone from creating his own end-to-end encryption app? It may use other protocols to encode content (images, tweets, fb posts etc.).
For me it seems to be more in a direction of so called "Big Brother" than real counter-terrorism.
> How do they want to prevent someone from creating his own end-to-end encryption app?
It's basically impossible. One can also use steganography to hide messages in lolcat pictures, or music files. The only way to prevent this, I think, is to start a totalitarian surveillance state where using Free or custom software or hardware is punishable by death. Even then, I'm not sure this will be enough.
Given that even the most totalitarian states eventually fail and don't ever have complete and total control over the entire populace, I think you're correct that it will not be enough.
What they really need is to invent time travel, and murder Ada Lovelace.
Not "we" as in "we the general public with no specific interest in staying hidden". But of course criminals, terrorists or secret services do have the right incentive structure to always benefit from circumventing encryption bans.
Exactly, and given we live in a "walled garden" society now, all they need to do is require google or apple to remove from the app stores any app that implements encryption for messaging.
It's actually easier than ever to ban encryption for messaging.
Would that stop determined people? No, but it's never been about that anyway. Just make the pool small enough and it becomes too difficult to use. (See PGP / email).
Also, if you genuinely legislate against encrypted messaging then it's easy to pick up on the relative handful of people who go outside the app stores to get encrypted messaging applications.
And it shouldn't come to technical solutions, we should have people challenge the notion that two people should never be allowed to share a private message, because that's why Rudd and the government is suggesting.
> we should have people challenge the notion that two people should never be allowed to share a private message, because that's why Rudd and the government is suggesting.
+1. This is the crux of the matter, although unfortunately I don't think the average person realises it.
Well, the Pirate Bay probably never really caught the interest of totalitarian states that really wanted to suppress its existence.
Now, the UK isn't at that point obviously, but if they really wanted to use draconian measures against encryption, it probably would be somewhat effective.
How do they want to prevent someone from creating his own end-to-end encryption app?
That's not an issue. Writing solid encryption software is very difficult on its own. You will hear "do not roll your own crypto" all the time from security experts. We don't live in a James Bond universe and it's beyond the reach of terrorist organisations.
You don't really have to roll your own crypto to create such an app. There's always openssl and the signal protocol, which you'd only need to implement without designing anything.
Sure that can go wrong as anything can, but it's far from rolling your own crypto and makes things a lot easier.
I think you've missed the point.. Not talking about writing own crypto.. Talking about not using applications which the western security services have ability to force backdoors.
Are you suggesting gpg has been backdoored? A simple wrapper around gpg is not-beyond terrorist organisations.
You don't have to roll your own crypto to create an own end-to-end encryption app. You can use existing crypto. Writing a user interface around it is not so difficult.
Beyound the reach of the terrorist organisations? We have already seen pretty sophisticated operations by relatively small crime organizations (like exploiting pseudorandom generators in casino slot machines). There's an established black market for exploits. I think writing an end-to-end encryption app is not much more difficult compared to this. What's more, it will even be perfectly legal in many countries, meaning you could legally hire professionals to do the job. Terrorist organisations won't need to esablish a development office in SV to write the app, they will only need to know how to use Tor and wire money to the app producer. Which isn't such a huge competence to ask for.
> small crime organizations (like exploiting pseudorandom generators in casino slot machines)
If all you do is pushing the buttons of the slot machine in the right order with the right timing, that's hardly a crime —and I don't care about court judgements to the contrary. If a slot machine has a crappy pseudo random number generator, they're just asking for it. I'd rather sue the slot machine's maker for providing a machine that's not fit for its intended purpose.
It is a crime as in "unlawful act punishable by a state or other authority". You are welcome to disagree, but I'd be interested in your definition of "crime" then.
My point is, there is nothing wrong with pushing a slot machine's buttons, even if it is done in a way that defeats the RNG. The difference between this and counting cards in a game of Black Jack is, the RNG can easily be fixed to prevent this.
You provided it as an example of "organized crime", and doing so heavily suggests that it is wrong.
We tend to conflate "wrong" and "unlawful", and for good reason: the law is supposed to prevent wrong things from being committed. There are exceptions however, and this is one of them. I'd rather use another example if possible.
My argument is that even small organized crime groups were capabale of sophisticated operations so it's absolutely not far-fetched to assume that they may be able to implement end-to-end encryption apps. Whether this "organized crime" is "wrong" does not make much difference. It might be even easier to find people to implement it as not many would have moral issues.
Speaking of moral issues, cheating on casino is pretty much off limits on my personal moral compass. That the attack was possible within the normal mode of operation does not make it less of a fraud. Imagine if the casino would reverse-engineer a slot machine and find a way to abuse it within the normal mode of operation, making odds (even more) in their favor. That would be fraud, plain and simple, and I don't see why a player should be held to a different standard.
You are absolutely right, not everything unlawful is wrong. But I fail to see which benefit we as a society would have by allowing exploitation of technical deficiencies in slot machines for profit. It is a crime and it is wrong in my book.
OK, so our disagreement is very simple: exploiting the flaws of a slot machine is not cheating in my book. Neither is counting cards now that I think of it.
The rules for slot machines are ostensibly very simple. As long as you're only pushing the buttons that are supposed to be pushed without deteriorating them, you are acting within the rules of the slot machine, and as such cannot cheat.
The presence of hidden rules such as "don't push the buttons in this particular order and timing", or "don't push the buttons in a way that reliably causes you to win", are just silly and unfair. Especially considering casinos are exploiting gamblers' minds in the first place. Don't like slot machine exploiters? Fix your slot machines.
Likewise for counting cards: the player is merely acting upon information naturally gathered buy observation and play. Asking players not to act upon such information is intrusive —and unheard of in competitive play. Don't like card counters? Invest in a continuous shuffling machine.
"The presence of hidden rules..." except they are not hidden. IANAL and don't have link at hand, but there was recently a legally pretty well based argument in a case of a player who had an assitant able of recognizing cards from the back pattern.
"you're only pushing the buttons" except they were not only pushing a button, they were also recording sequences and sending them abroad for analysis.
But as you directly say that exploiting the flaws of a slot machine is not cheating and that it's fair, I guess I won't be able to persuade you otherwise.
> that's hardly a crime —and I don't care about court judgements to the contrary
Either you meant something along the lines of "that shouldn't be a crime" or you're essentially saying "it's not crime even though it is a crime" - which doesn't make terribly much sense.
> Writing solid encryption software is very difficult on its own.
It's not. You can use existing software, reuse existing protocols, and stick to safe languages as much as possible. Even implementing your own crypto isn't all that difficult¹. I have written my own crypto library², and I can almost recommend it for production use.
You vastly overestimate the difficulty. The reason we're commonly told not to roll our own crypto is because it's easy, and also easy to get wrong and possibly catastrophic if you do. But many perfectly serviceable algorithms are simple and public knowledge. Arguably a scenario where everyone's using their own crypto and half of it's broken is still better than everyone using the "industry standard, pre-backdoored for your convenience" version.
Of course it's utterly trivial to make a one-time-pad cryptosystem, and more practical in 2017 than ever. So what if the keylength must match the message length, my phone has a 32gb uSD. That's a lot of text messages.
She's probably being led by the intelligence services on this, and of course they have ulterior motives, their ultimate project is to collect all signals, or as many as they can manage, which apps like whatsapp are thwarting at present.
Why can't we collect all the signals all the time?
This is incredibly dangerous for our society, no-one should have that much power. That power isn't about terrorism (or even very useful against terrorism), but about subverting governments, judiciary and businesses.
Yes, this: she might as well just be ignorant (not that it is any justification), but her supposedly competent advisors are actually frauds, fakes and spooks, that's what truly scary to me.
Probably more blackmailed than led by the intelligence services. This is why the deep state is so intent on surveilling the politicians. And why when they discover the political class engaging in crimes they do not bring them to justice (like the Westminster paedophilia scandal). They like to keep all their dirt on file so they are easily controlled and can be forced to enact the draconian laws the deep state wants.
An intelligence led response to terrorism is a result of learning from Northern Ireland. Internment caused harm; talking to the terrorists brought peace.
Don't forget that while they were talking to the IRA politicians were saying in public "we don't talk to terrorists".
Ironically the early stages of such talks were held in a chip shop via a senior civil servant as a proxy, because it was vital to keep this "collusion" away from the awareness of security forces.
(There was a great documentary about this on TV, but I cannot remember the name of it)
> How do they want to prevent someone from creating his own end-to-end encryption app?
They can't. The US tried it in the 90's when SSL sites could not use strong encryption outside the US and you'd need a license to "export" PGP... That went well! :-/
They wouldn't prevent you from making encryption apps. It would be about regulation. You can regulate kinds of encryption (the strength of the algorithms/keyspace etc), and you can regulate who can use it (licensed copies only, or specific businesses only, or types of businesses, non-messaging platforms only, etc).
Then there's how you use it. They could mandate all of X businesses could only use encryption that could be inspected by the state, so either weak encryption, or PKI where you send the government your site's private key or use the state's CA or something. They can also mandate backdoors in encryption used in certain ways. And they can mandate that weak encryption be used outside their country's borders.
All of these are real parts of US laws on cryptography from WWII to 2000 to prevent "export" of "strong encryption", because of course evildoers around the world might make use of these "munitions". US law still regulates how we can use or distribute cryptography around the world. It is illegal in the US to release open source crypto on the internet without notifying the Bureau of Industry and Security. And 41 other countries (including the UK) have similar laws.
The one thing the US has going for it is the 1st Amendment, which makes it illegal for the US to prevent its citizens from making or using crypto within the US.
If you ban encryption and monitor all traffic in the world then you can easily flag messages you can't read as suspicious.
You can then hunt down people using the encryption.
Yes, and then he went and did something stupid with easily accessible tools and acted alone.
You might have an argument if he was part of a coordinated attack against something but lone-wolf terrorism has always been defined as unpreventable by security services such as SIS. Once radicalised it's impossible to prevent individuals doing stupid stuff.
The only thing she has revealed his the conservative parties desire for totalitarian control. :(
> You might have an argument if he was part of a coordinated attack
No.
Even ignoring the erosion of privacy angle, this just doesn't work. Outlaw encryption, and only outlaws will use encryption. Provide government backdoors into the popular commercial messaging apps, and people coordinating terror attacks will just use custom, unknown, private encrypted messaging apps.
I'm going to play devils advocate here, I also dislike the erosion of privacy (enough that I even left the UK).
But you _can_ make the argument that if only outlaws use encryption then they're painting a target on their back, which leads to greater scrutiny by security services.
This is reasonably achieved by the current dragnet surveillance systems in place, along with ISP's logging everything.
I don't agree with it, of course I don't, but that's probably an angle people could take- But the angle Amber Rudd took is even more starved of sense.
It's like she didn't ask the appropriate question: "What could we have done to prevent this attack" and the follow up "If we had direct access to his phone and all of his communication information, what could we have caught" and the answer is _nothing_. He used tools commonly available to him, acted alone, probably told nobody.
Anyway, tell the bad guys you're watching the comms and they'll figure out how to talk, they're motivated and smart.
We can't help everyone. It's naïve to think we can, 100% of the time, help all people.
Even the most socially progressive system on the planet will have people slipping through the cracks- we have to be able to deal with that eventuality too.
True but at the moment we have a particularly poor record of helping people with mental illness. This guy didn't slip through the cracks, he was totally ignored along with many others who are struggling.
There's absolutely no evidence he had mental illness, and you do harm to people with mental illness when you incorrectly link violent behaviour to mental illness.
More important is his time in prison - where most UK terrorists were radicalised - and if you were saying that UK prisons don't rehabilitate I'd agree.
Violent people aren't violent because they are violent. There is an underlying cause for someone to use force against another, especially when it is socially unacceptable.
Perhaps it doesn't fit under the "common" mental illnesses of depression, anxiety, etc. but it lines up well with thought disorders. A sane and well person would not jeopardize themselves, and their fellow species.
> A sane and well person would not jeopardize themselves, and their fellow species.
Sane (by the usual definition, though it's possible you are using an unusual definition of your own) people jeopardize themselves to harm other members of the species all the time.
In fact, societies tend to have organized groups of people who are expected to do this when the targets are enemies of the group, and who are honored for it; they also not infrequently honor people who independently do it against people theor society has decided are "the enemy".
We're not talking about "most violent people" or regular domestic violence. We're talking about someone who ran random pedestrians down on purpose on a footpath and stabbed a police officer for no reason. This is an outlier.
Even though it doesn't fit your ridiculous PC SJW agenda, I would be willing to bet he's got some kind of mental health issue. I don't think that's a controversial opinion to hold.
You didn't ask a question. You saw behaviour that you didn't understand and immediately made an assumption: it must be the result of mental illness.
You are saying two things:
1) He is violent because he has a mental illness.
2) People with mental illness are violent because of their illness
The reality is very simple: he was a violent man. He had always been a violent man. He had a long history of violent behaviour. He doesn't have a long history of contact with MH services, and he never had (as far as I know) any contact with secure MH units[1]. Some men are remarkably violent, but most of them know exactly what they're doing and they're not controlled by an illness.
The prevalence of violence, and mental illness, means that obviously there's some overlap between "people who are ill" and "people who are violent", but you need to be really careful not to say "the violent people in that overlap are violent because of their mental illness".
When looking at predictors of violence we see that mental illness doesn't give you much if any predictive power.
Substance misuse does; previous episodes of violence does; and any (especially all) of these combined does.
The reason it's important to avoid incorrectly linking violent behaviour to mental illness is seen in the stats of people shot and killed by US police: about half the people shot and killed each year are people with mental illness. The vast majority of them pose zero risk of harm to other people, maybe some risk to themselves, but they get killed because people like you keep pushing the "mental illness == violent and dangerous" myth.
I didn't ask a question because I stated my opinion as to the single mass-murderer's state of mental health. I made no comment about the larger mentally ill community.
Just by virtue of his actions, and also because the news mentioned that he's been in jail, I think he's probably got some kind of mental illness or thought disorder. I could be wrong or I could be right, but for the moment I'm going to stick to that opinion.
I never said all mentally ill people are violent or dangerous, because I don't have some concealed anti-mentally ill agenda.
I do however have a bias in thinking that mass-murderers are generally mentally ill, and a quick google implies I'm factually correct in having that bias.
> He doesn't have a long history of contact with MH services
Hmm. Just the fact that he has had contact with mental health services strengthens my opinion that he's probably mentally ill.
As you've said yourself, some mentally ill people are violent and dangerous, some are not. I am aware of that.
When people are around trigger-happy US cops with guns pointed at them, they get shot, which is no surprise with such a militarised police force. Unfortunately that's the society some people live in.
If cops shoot mentally ill people, that's a problem with the cops and the society that tolerates that behavior, not me for speculating about whether or not a single mass murderer has a mental illness or not.
Don't try to imply that my opinion of a single case is in some way responsible for trigger-happy police in a country I don't even reside in.
I'm neither in the US, a cop, nor mentally ill so none of those are my responsibility.
Once again, I'm talking about this particular mass-murderer, and I think he's probably mentally ill. Nothing you have mentioned has swayed me from that opinion.
>Outlaw encryption, and only outlaws will use encryption.
Well, if only outlaws used encryption and you sent a non-plaintext message then the police would knock on your door at 04:00 the next morning. That's what happens in Morocco if you like something related to terrorism on Facebook. A bit extreme, yes, but that's how some countries do it.
Sure, technically sophisticated enemies know not to like things on Facebook and know to use steganography, but most don't know and those that learn it through terrorist networks have a long vulnerable period where they are malicious but before they become sophisticated.
> "That is my view - it is completely unacceptable, there should be no place for terrorists to hide."
I am sure a ban on encryption would work.
Hey, guys, I just had a great idea. Let's ban bombs, knifes, and driving into people. That would fix the terrorism problem. Once it is illegal, no terrorist would dare do it!!!
I'm wondering why Churchill didn't think to ban the Enigma machine. If only England was led by smart people like the British interior minister...
It's, in my view, more akin to trying to ban mathematics in a world in which mathematics exist. Tools and weapons don't exist indenpently from us, mathematics do.
> Hey, guys, I just had a great idea. Let's ban bombs, knifes, and driving into people. That would fix the terrorism problem.
They started banning guns almost a century ago. While it did probably reduce the number of gun murders, it certainly didn't make terrorist organisation like the IRA any less effective — and it probably made non-gun crime worse.
Possessing encryption tools, lockpicks, knives, guns &c. is a fundamental human right of free men.
Sure, but how do you feel about a person's right over their personal information being systematically collected by their government, several large corporate entities, and a dozen or so international spy agencies? What about when this information is used to economically bind them into submission?
Ah, but that's about how the tools are used, not what they are and who has them.
I believe, any entity, from a mere individual to a government agency or multinational corporation should be free to possess any software tools they may desire. How they use those is another matter.
I do "spy" on my own traffic on my own network running on my own hardware on my own premises. I've had some audits for possible malware/spyware, did reverse engineering protocol analysis, etc - and believe everyone should be able to do that. I shouldn't be able to do this on someone's else traffic without their informed consent - nor technically, neither legally (I believe, both of those aspects are important).
As for your question - I don't like this, of course. Don't think there is anyone well-informed and in their sane mind who does.
We're talking about what are essentially cyberweapons and surveillance tools.
Why can I not own a nuclear warhead, as long as I promise not to do anything with it?
Why can I not put cameras and 3D radio imaging equipment up across the street on a small private plot of land and spy on you and your children's home without being visited by the police at your request?
If you don't have a problem with how those two cases are legislated then you might be able to understand how this could relate back to software.
Should you have access to any program you want? I guess so, if you can get it in a licensed manner. If it's FOSS or something similar, that will be easy. But using these tools to collect surveillance data and PII is an entirely other issue because of the potential weaponization of collected data and the harm that can result from it.
I supposed I did not fully understand what the OP was asking, because I do believe you should be able to own these tools and test them on your own equipment, and that the issue is that we need to ensure proper protections against these tools are in place for the average uninformed user.
The difference is that it's relatively easy to detect when people use encrypted communication. You can just arrest them. It's not so easy to detect whether someone is planning to drive into people.
Compare like with like. It's plenty easy to detect whether someone is driving. Whether they're planning to drive into people has the same level of difficulty as whether their encrypted communications are about terrorist activity, so shouldn't we ban cars? And buses and planes and anything else with wheels or an engine?
If we banned planes that would certainly have prevented 9/11. What better argument could there be?
...we've all been there in US before 1999 where exporting strong crypto had $1mln penalty with long prison terms, basically classified together with chemical/biological weapons.
It was recognised that it's impossible to enforce, ie. PGP is there, in general tech is just available to anyone and what about research papers and academia? Treat them as criminals? Even if banned in UK, it's available in the rest of the world.
It would be nice if politicians were banned from saying stupid things.
How difficult would it be for these so called terrorists to develop their own end to end encrypted app? Perhaps something masquerading as something common like any port under 1000?
It is feasible that the elimination of whatsapp/telegram/signal encryption would just lead to a way more complicated encryption system developed internally to these organisations.
Not that difficult, but it'd almost certainly have major security flaws that GHCQ and the NSA could exploit, because homebrew end-to-end encryption tends to. The bigger problem is that merely using an Isis-branded chat application is the equivalent of sending a text message to the security services saying "hello, I'm a potential terrorist, please pay special attention to my every movement". Even the Tor project hasn't actually managed to reliably disguise their protocol as something else, and they have a bunch of smart people working on it with the advantage that countries tend to reveal the fact they've been detected through blocking rather than just quietly monitoring the people using it and rounding them up the moment they try something.
I generally agree, but intelligence groups have to first find the signal they want to monitor. Modern steganography techniques coupled with the free randomness you get from the physical world gives you much to work with. And that's assuming common tech will be used.
Also, designing a secure general purpose messaging system is much harder that designing a system tailored for a specific use case.
Banning encryption by law is like demanding, loudly, that people not talk behind your back. Some will listen, and some will not. Only legitimate users and use cases will suffer.
Well, ISPs could implement a whitelist of communication methods. Maybe all content would have to be signed by a whitelist of apps before it's allowed through the network. Images would have to be signed by the camera app, so no steganography would be possible.
From a business perspective it would be like going back to before the internet, but many of the services we associate with the internet like Facebook, Netflix etc. would survive.
What about using latency or throughput as a signal? What about tunneling data over seemingly normal pictures taken by said camera app? What about switching the "User Available online" indicators at a seemingly natural rate? What about all three at the same time?
I assure you, steganography will always be possible. The only think a ban on encryption would do is hurt (badly) society, personal privacy, and those who want to follow the law.
Yes, this was revealed by the recent agency leaks. Cracking end to end encryption is still extremely difficult (currently impossible?). It's much easier to get root on a target's phone and run a keylogger or break into the app. The messages are still end-end encrypted, but you can sniff them before they're sent and after they're received since they're shown to the user in plaintext.
The recent wikileaks documents from the CIA say that yes it is possibly but instead of blanket backdoor they have to be specifically targeted. Whether that's the current state of affairs of not, I dont know.
The definition of end-to-end encryption is that the decryption keys are only available to the client. Now your question asks the question of where the backdoor should be.
It is feasible. The backdoor should be at a very low level (not say a sandboxed application) from which basically nothing can hide on the device.
It's an incredibly foolish thing for a minister to suggest. She demonstrates a complete lack of understanding on the subject and has commited political seppuku. Has she never read Orwell, Huxley, seen articles about tyrannical governments or even heard about the reasons the US constitution was drawn up?
Since the current prime minister supports her, I doubt it. It's an absurd position, but not without support in the current administration, just like her outspoken views on immigration.
And, I'm sorry to say, a large chunk of the public, who have for years been force fed rubbish from politicians and the media alike about the huge terrorist threat that threatens to destroy our country (when in reality just about anything else you can think of is more of a threat than the odd crazy with a knife and car...)
If you are referring to the current state of the Labour party then that's irrelevant. Even when Labour were "strong" opposition, or were in power with large majorities, they have had very authoritarian positions on this kind of thing.
Labour were supporters of the recent IP Bill (it actually applied restrictions to some of the crazy powers the last Labour government gave to the police, which gives you an indication of their general position on these things). Labour have had authoritarian positions on crime and policing issues since Blair became shadow Home Secretary (1992). It has been part of their 'tough on crime' strategy of attacking the Conservatives from the right since that point and was a core part of the New Labour strategy.
The only thing a "stronger" Labour opposition would get you in this situation is a parliament even more united in support for restrictions on encryption.
It's a damn shame as a Communist myself to agree with Labour on various issues, but so vehemently disagree with them on the abstention or even outright support of spying bills.
For two decades I've been waiting for popular support for a complete or at least Clipper-chip-style encryption ban in the "free world". It always was on the other far end of the spectrum, directly oppsite questions like IV/nonce choice, PRNG initialization flaws, RSA attack vectors. I have great fear for the freedom and living standard of my kids when I read these top-level news pieces. We stand a real test and we will have to argue against hatred, fear and terrorism. Let's just hope our leaders have no-nonsense advisors as well as those that inspire such news.
I understood that UK IP Bill already mean that she already has the ability to e.g. demand a backdoored version of Whatsapp be sent to a target device, but that's not covered in the interview.
From [1], linked elsewhere in this discussion, and referring to a failed plot in India:
"The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Mr. Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork."
"the handler taught Mr. Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive."
Even if the British government is successful with WhatsApp, can they do much against free, open source tools?
"Even if the British government is successful with WhatsApp, can they do much against free, open source tools?"
Why would they care about open source tools and niche use of encryption? Of course they don't. They are after mass surveillance and use fear of terrorism to push for it. It's very logical of them.
It's not entirely by accident that the UK current ramp up of legalized government surveillance coincide with Brexit, as the UK doesn't actually have a democratic constitution limiting government surveillance outside of the ECHR treaty they signed as a prerequisite for joining the EU/EEC.
thanks for correcting my sometimes failing memory though the reality is more complex then that everything ECHR related was defined by 1950, as the active component of the ECHR did not come into existence until 1959 and was not acknowledged as superior court by the UK prior to the UK joining the EU.
The fact that EU membership demand actual rather then pretend ECHR compliance is a fairly big deal in the anti-EU Tory circles currently running the show in the UK and some of them seem to presume that leaving the EU will absolve the UK of any duty to submit to the ECHR court http://www.telegraph.co.uk/news/2017/01/26/theresa-may-prepa... even though I am sure they think otherwise in Strasbourg.
but you are correct in stating that officially the ECHR came into dejura effect in 1950 under the Council of Europe where the UK unlike for the ECSC(1951) and the EEC(1957) was a founding member, but it's worth nothing here that the Council of Europe is a far more toothless organization(like the UN) then either the ECSC and the EEC.
That's the beauty of it; even with their more restrictive measures and massively increased surveillance, they won't make a significant dent in these sorts of attacks.
So they'll never run out of reasons to push further. Hooray.
UK's best shot at surviving Brexit is become stronger on value added industries. They have a very good head start over any other EU country in IT and in some research areas.
Amber Rudd seems hell bent on destroying their only chance.
They all are intent on crippling any chance the UK has at becoming stronger in high tech industries.
I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information about a drug (pharmaceutical, not just "weed LSD and lols").
Great fucking way to encourage your future chemists. Maybe ban keywords like JavaScript, PHP and SQL while at it, them's the powerful drugs maaan.
As far as I'm aware all new accounts in the U.K. do this unless you call to have it disabled (and give personal information). I mean, how else would you protect the children...
Andrews & Arnold is unfortunately many times more expensive than the more "mainstream" ISPs. Much cheaper to get a Sky/Virgin connection, and then route all your traffic off their networks over a VPN to a cheap couple of quid VPS per month.
My point was more about them offering a mobile service - many here know of them as a good ISP, but it is less well known that they offer the same quality of Internet access via mobile.
I was going to suggest them as well. My boss used to use them back when I was in the UK ten years ago and now I would definitely pay the extra for what they provide. Unfortunately I am in Spain now and the choice of ISP's is far more limited.
>> As far as I'm aware all new accounts in the U.K. do this unless you call to have it disabled (and give personal information).
Usually you can have it disabled while you sign up (and they usually ask if you want it). As for giving personal info - they're you're ISP. They have your name, address, billing details, have done a credit check...what else are they going to ask for that you haven't already supplied?
I can buy a 'burner' SIM when landing at Heathrow without giving any information - paying in cash. However, to disable the content filter requires giving up personal information.
A VPN is a way to circumvent surveillance but make no mistake: We must press with all our power for legislation which guarantees privacy, all over the world. This is a battle that in the long run, we can't win with tech. We need to become more privacy-aware.
"Those who surrender freedom for security will not have, nor do they deserve, either one."
It's completely optional, turn it off. It also tends to only be mobile networks that do that kind of filtering by default, ISP's ask you when you sign up if you want 'parental controls' or not.
Funnily enough, I just signed up to 3 mobile broadband last week, and I was pleasantly surprised that I didn't have to call and get it turned off (always have before)
Being ahead of all other EU countries in some field can be something significant while they're inside the EU, in those cases when an investment or purchase needs to be made inside the EU for any reason. But when they're out, what difference does that make?
That's not what I meant or wish. But it's a (for me sad) fact that at that point the expression "compared to the other EU countries" won't have any sense anymore. And if May will go with hard Brexit, as many predict, it will even become easier to trade with eg Canada than with the UK.
You can say "compared to the other European countries" instead. It has the bonus of being more inclusive! No longer will your statement exclude Norway, Switzerland etc.
Depending on context, this comparison may or may not make sense. Keep in mind that Norway and Switzerland are both part of the single market, which the UK will probably opt out of (as it would require the free movement of workers).
My point is that in case British businesses have to overcome barriers (e.g. tariffs), their best bet at not going bankrupt is selling non-physical goods and services with as much added value as possible. That implies high technology and investment in research.
Non-physical so selling to America, Africa or Asia is as cheap as selling to Europe and added value to absorb the new cost of doing businesses (in case the UK does not remain in the Single Market).
If e22 encryption is outlawed in the UK, their businesses would be less trusted (harder to sell expensive things) and will be at the mercy of other countries' intelligence and espionage services.
The thing that concerns me about this perspective that everyday use of encryption is bad is that it makes no damn sense. Pandora's box is opened; if you force software solutions to backdoor their technology, someone will just step up who doesn't care about your laws. There are no global treaties on software development, and we aren't going to be signing any such thing any day soon. Even if we could force something like that down the throats of every country on Earth, the knowledge exists, and anyone can roll out their own solution with a high-school level understanding of the topic.
It's absurd to think this can be resolved through legislation or cajoling companies into cooperation. But what really bothers me about this whole issue is that we already have laws in place that handle this situation, at least in the USA. In the USA, if you refuse to hand over an encryption key (or can't) and are being compelled to by a court, you can and will be held in contempt of court, and possibly convicted of destruction of evidence. The only thing that forcing people to backdoor their crypto does is allow government entities to investigate people without having sufficient evidence to compel them to give up their keys, and destroy the marketability of large scale, centralized end-to-end encryption solutions.
I mean, you could make the argument that end-to-end encryption restricts the ability to wiretap people, sure, but a wiretap warrant should require a decent amount of evidence, and at that point, there are most likely other options.
That would be somewhat entertaining, and reminds me of someone I read about years ago who was accidentally added to a watchlist, and no one was willing to remove him, so he started generating as much data as he could, just to keep them busy. I can't find a link, sadly.
I don't think it's a good solution, though. This is going to sound like an argument that you hear about privacy by people who don't understand why privacy matters, but I think on this issue, it holds a little more truth: To be honest, I think the people who are likely to care to do this are people who are advocates for privacy and are tech savvy, and people who have something to hide. I don't think it's terribly difficult, with the resources the global Intelligence Community has to build a profile and dump people into those two buckets with a fair degree of accuracy. Everyone who's not generating random garbage data would still be observable, so it wouldn't really change much outside of the group that's acting. But for those acting, suddenly there's a red flag that they can look for, and then when they see it, start building a profile to figure out if you're a tech person with an interest in privacy, or someone doing something they don't want seen, and act accordingly. In the mean time, we waste time generating garbage instead of just using good enough encryption, and making it so easy to use that people don't even have to know they're using it.
Now, if we could somehow implant babies with a chip that causes them to generate random noise (something babies are already pretty good at, mind you) from birth, that might be worth something. There's no profile building if the noise is just something that humans make by being alive.
I'm surprised I haven't heard the IP bill mentioned other than here in this whole matter. Why all the fanfare? Especially if it's something they can already just do quietly; the public controversy from that law has mostly passed over.
Hmm, this definitely brings up an interesting discussion I don't think HN has had before, especially something in a similar vein since Apple+San Bernardino fiasco.
Obviously privacy is something that HN holds very close to its heart. But I'm interested in what do people here have to say about the privacy features are used by terrible people to do terrible things.
I strongly believe that tools are ethically neutral.
A hammer, a knife or a government can be pretty useful, or pretty violent - depending on how you use it. This alone does not imply that a hammer, a knife or a government should not exist or be banned.
It's interesting when you extend that discussion to guns, in the UK guns are quite difficult to get hold of, I wonder what the incident at Westminster would have looked like if they were as available as they are in the US.
As always it's a trade off, some people loose the right to arm themselves at home but that means other people may not loose their life to a shooting.
Well, there are very good reasons to hide messages.
First of all, I don't want any company in transit, from my ISP, to the message broker, to the receivers ISP to mine my data and use/sell it for profit.
Secondly, there are a lot of messages which are not illegal, but can be personally embarrassing if they were to become public. Think of sexually-tinted messages, psychological help, a kid who lives in a very conservative community and has doubts about their religion, discussions about a candidate for a job position, etc.
The problem with backdoor is that the question is not if they are exploited, but when they are exploited. And this is all assuming that the organization that has backdoor access is not of ill will.
I had this thought as well. However, the comparison to knives seems better. It's pretty hard to make your own gun. It's pretty straight forward to make your own encryption app on top of existing OSS libraries. Like it's pretty easy to make your own makeshift, large knife. Maybe I just see it like that because I'm a software developer though.
> I strongly believe that tools are ethically neutral.
Well, that's a very evasive argument in my opinion. It's absolutely true that objects are neutral, but you can't make a blanket argument with topics like these. That argument has been made lots of times by many (including me).
But it eventually breaks down. You can't give a child a gun and when the kid shoots someone say it was the kid's fault. Whose fault is it? I'm guessing you're going to say the adult responsible for putting the gun within the reach of a child. You're still taking away an object from the kid. In this case it was a kid who didn't know better.
Now this isn't a narrow argument. This becomes interesting when you get to powerful things, like say nuclear weapons. They aren't inherently evil too. But if you look around, UN is trying to ban them[1]. Shouldn't UN ban them?
What I'm trying to get at is that you can't always but the blame on people. Just like you can't blame a child for not knowing better, you can't blame a person for knowing better (although people do). Sometimes you just have to take the gun (or nuclear weapons or encryption) away.
What if the huge nuclear arsenal was in the wrong hands? That begs the question, what is 'wrong'?
Your definition of peace was probably characterized as oppression/dominance by the people who did want to revolt. You don't account for the extremely subjective nature of things, especially when it comes to nationalistic actions of people.
I always thought that putting the blame on actual agents instead of stuff is the direct opposite of being evasive.
You rightly said that I will answer that it was the adults fault. The bad act done with the weapon was giving it to a child, not the childs shooting someone. It gets clearer if the adult hands the weapon to a monkey or a randomized shooting machine. All three scenarios change nothing in regard to the moral responsibility of the adult.
I do not know whether the UN should ban nuclear weapons, but if someone uses a nuclear weapon and we would check out who might be morally responsible for the attack, I'd point at the attacker.
> I always thought that putting the blame on actual agents instead of stuff is the direct opposite of being evasive.
Well I meant evasive argument as in statements which directly avoid the question. Because the thing is, we don't live in a perfect world. So putting the blame on agents doesn't solve the problem. That's why I brought up that sometimes things have to be taken away from people. The question is when and how.
> The bad act done with the weapon was giving it to a child
I didn't say the adult gave the weapon. I just said the adult left it within the reach of the child. One is direct, the other is indirect. I wouldn't even say indirect, but lets go with it.
> I'd point at the attacker
It gets blurry deciding who the attacker is, depending on whose side you are on. Things aren't always so clear.
In a perfect world, government would be good, capable not oppressive and there would be zero reason for anyone not to trust them with private data - but government would not want it, since they would not be immoderate and power hungry but perfect.
But we both believe that the world is not perfect. This is why we need to talk about moral responsibility in the first place. Blurry definitions might only make us even more humble while proposing new, disruptive power centralizations like an encryption ban.
With their utterly poor understanding of encryption and the harms of compromising it, people in governments who want to do so might as well be monkeys.
By providing backdoored encryption products, we would as you put it be handing out randomized shooting machines to monkeys.
I believe the same. But what if these tools have too great impact if everything goes south? It happened with dynamites before, now look how jittery we are about nuclear.
You can flip this for privacy too. The more governments can spy on everyone, well sure we may catch more terrorists and terrorism might even decrease. But at what cost? Totalitarianism? Shudder.
I was with you up until 'government'. I regard states as exercising unjust authority over people and defenders of private property which is why I'm an anarcho-Communist. The way in which the modern world is divided up means that one must be a subject of some state, which I believe makes there no way to provide proper consent to be governed.
The thing is, banning encryption to fight terrorism makes as much difference as banning knifes to fight murder. Encryption is simple enough (in theory at least) and prevalent enough that banning it will only stop legitimate usage (e.g. personal privacy) without having any real impact on those who want to break the law. Modern steganography techniques make it easy for enterprising individuals to tunnel encrypted data over unencrypted channels; there is just too much randomness in the real world to exploit.
Regardless of what delusional politicians want, encryption is here to stay. It's just a matter of how much people are willing to give up to feel safe.
I personally think if there is a warrant the company should provide information. The same way my house is private but if there is any kind of problem police has access to it.
Although we should have mechanism to protect from mass random surveillance.
So, no matter how bad the government, and how ridiculous its laws (let's say they ban music, and dole out harsh punishments to people who dare listen to music), then we as technology providers should enable them to catch such people and punish them for their "crimes"?
Saudi Arabia punishes rape victims. We should help with that?
China punishes people who try to air grievances about government abuse and corruption. Again, we should enable them to be more effective in their invasive prying into those individuals than they already are?
In North Korea, your entire family can be punished if you dare be disobedient to the government.
In the US, we recently elected Donald Trump.
Etc. etc... why do you think governments can be trusted with this power?
On top of all that, once the technical means exist, they will also be discovered, cracked, and used by fraudsters, extortionists, and anyone else who can figure out a way to abuse the information.
I can ask the same. Why should a suspected rapist, assassin, drug dealer, corrupt politician, be free or unjustly imprisoned, because of lack of evidence? Do you think we should help criminals?
Nowadays here are other more efective ways, than encrypted WhatsApp (secrecy), to fight bad governments and ridiculous laws.
North Korea and Saudi Arabia are obviously very extreme examples. Internet encryption must be the least of their worries.
Governments with working justice systems should be trusted with power to provide security.
There should be No technical means or backdoors globally accessible.
Information should be provided on request basis, based on a warrant for that suspect. And data stored should follow data protection laws.
If you think you country justice system is not working properly there are ways to fight that. And probably there will be people and institutions already doing.
If the suspect definition is wrong should be changed. Of course I am not aware how.
But I cannot feel safe just because one application company is saying everything is encrypted.
I am just afraid the day security is so good, there will be no more corruption leaks, and the ruling classes can do whatever they want with total privacy.
My unfair imprisonment is less important, than a fair imprisonment of a corrupt politician. I think...
I like how you leap from "suspected" to "Do you think we should help criminals?"
North Korea and Saudi Arabia and China and the UK would claim that their justice systems are working just fine.
As would my local sheriff jurisdiction where they can't even manage to hire anybody who bothers to do so much as use turn signals. If they can't even manage to do that tiny thing, greatest country on earth or no, I don't trust them with the temptations of the kind of power you're talking about.
>If you think you country justice system is not working properly there are ways to fight that.
LOL! Good luck! Strictly speaking, you are correct that "there are ways to fight that" but the consequences are brutal! It's a pretty big ask for most people. And that possibility will be eroded and, more likely, wholly negated by such systems.
It was the same leap you made with
> "Saudi Arabia punishes rape victims. We should help with that?"
There is no temptation if they need a warrant issued by judge authorizing for the officer to request to the company information related with that suspect. Upon which the company might charge administrative costs to handle the request.
I am saying suspect of a crime committed or with complaint filed against. As stated before I am against mass surveillance and crime "prediction". Even terrorism is a small problem compared with economic/political corruption.
Otherwise the governments might block applications. Or secretly spy on us, with the company help if needed. All done without any supervision.
In some sort of abstract theoretical vacuum I might be persuaded to support some form of limited targeted warrant-based intercept.
However, this is the real world, and I'd want the serious trust issues fixed first. Surveillance of journalists. Invasion of privacy by journalists with the complicity of corrupt police. Surveillance of peaceful left-wing and environmentalist groups.
Let's not be ignorant of history either, of secret prisons and unaccountable courts. Let Martin McGuinness' death remind us of H block and the Maze. Who here is old enough to remember the bizarre compromise where Gerry Adams appeared on TV with his words read by an actor, because he was deemed too dangerous to listen to?
Then there is the business of foreign intelligence agencies. If some communication isn't completely private, can it be compromised by the Russians? Remember the US election?
We need to have a conversation about radicalisation, but much of it happens in public or verbally, and it's not at all limited to Islamic fundamentalism. It needs to include the far-right too.
We all hope for a perfect world. But the problem is none of our perfect worlds are the same, so everyone of us end up living in our imperfect world.
The expectations you have are something I'd agree with too, but many other don't. So how do you reconcile this? Again the reconciliation process you will come up with is perfect according to you but most likely not according to others.
Terrorism, and crime in general is a nuisance that we have to live with. You can have a society with no crime. All you need is a super repressive totalitarian state, total transparency with citizens reporting on each others, state surveillance everywhere. It will work. But first I don't want to live in such a state. And second these totalitarian states slide invariably toward corruption and state crimes.
So we have to live with some level of crime. It doesn't mean we shouldn't be tough on criminals, but we have to accept that it is not possible in a free society to reach zero criminality.
I think the paradox is that people are reasonably relaxed with some level of criminality but are absolutely intolerant to any form of terrorism. And this intolerance is a new phenomenon. Terrorism isn't new. There isn't more terrorism in Europe than 20 or 40 years ago. In fact a few months ago I compiled the number of incidents and victims from a wikipedia page [1]:
As you can tell, the 70s and 80s were rather more brutal, with far-left, IRA and Palestinian terrorism. And our democracies resisted much better the temptation to introduce more surveillance.
Now why have we become intolerant to terrorism? There are literally tens of thousands of knife attacks every year just in London. Most don't even make it to the local news. Why would this particular incident be treated as a state affair? Terrorism is the buzz of a mosquito. In itself pretty much harmless. But most people will not sleep in a room where they can hear the buzz. I don't have a good explanation. The only thing I can think of is the 24h news cycle where the media will make a big deal of anything that can push the audience up. But that doesn't explain everything. They do the same with plane crashes, but still repeat over and over that though spectacular, plane crashes are extremely rare and flying is extremely safe. Whereas when there is a terrorist attack, the message is "this could happen to YOU!"
That gave me actual shivers. I can't believe the general populace (especially in the USA and UK) fall for this garbage. The bread and circuses must be really good. Ok maybe just circuses, I think Trump wants to cut SNAP.
So we have to live with some level of crime. It doesn't mean we shouldn't be tough on criminals, but we have to accept that it is not possible in a free society to reach zero criminality.
As the saying goes, "insecurity is freedom." I've always found it somewhat disturbing that people have welcomed the walled-garden ecosystems popular today, which are essentially the cyber-equivalent.
>> But I'm interested in what do people here have to say about the privacy features are used by terrible people to do terrible things.
Giving up such a valuable right to possibly stop attacks which, in the grand scheme of things actually harm very few people, is idiotic. Terrorism is obviously awful but the number of people in the UK actually affected by it is far, far too small to consider forgoing such an important right. And IMO, once you do that, the terrorists have won.
Take the attack in London last week for example. It doesn't require planning. Anyone could get in a car and mow down a lot of people in seconds. It doesn't need discussion on WhatsApp. It doesn't require purchase of weapons. It doesn't require you to do anything shady that could give you away more than a second before you do it. No amount of intelligence gathering could figure it out. You could force every citizen to wear a mic and body cam and you still wouldn't be able to stop it.
How about tackling the actual problem - terrorists seem to have resorted to using cars and trucks to kill people. Lets put up some metal/concrete bollards alone the edge of pavements that have no 'escape route', such as the one on Westminster Bridge.
> How about tackling the actual problem - terrorists seem to have resorted to using cars and trucks to kill people. Lets put up some metal/concrete bollards alone the edge of pavements that have no 'escape route', such as the one on Westminster Bridge.
Nice post. I agree almost entirely with you, but you can't put a bollard everywhere, and even if you could, bad people would find a way around or between the bollards, or simply another way to hurt people. It would be like playing a futile game of whack-a-mole.
At the end of the day, there are people who are so mean-spirited that they want to hurt innocent people for no reason, and they will find a way to do that no matter what we do. Honestly I think a lot of it is mental health more than anything we can really protect against.
It's not possible to wrap everyone in cotton wool, and in order to have some freedom we risk a small percentage of harm. There is no way around that. Without that freedom, there's also the IMO much larger risk of harm from the authorities themselves.
There's no way around it, living in the world involves some risk. It's unrealistic to not accept that risk and fantasize that all outcomes are preventable.
Like another comment mentioned, there are literally tens of thousands of stabbings in the UK every year. Why are we even talking about removing fundamental freedoms (the right to privacy) in order to probably not prevent a few unfortunate deaths per year? The payoff is so small and the cost is much too great.
I agree, this wasn't my suggestion. I was thinking more of areas like a bridge where if a car does start speeding along the pavement, even if you are further along and see it, there is nowhere for you to go. Your choices are stay put (and get hit), run into the road and probably get hit by traffic, or jump off the bridge (dangerous). Bollards along pavements like that would be useful. Even just one at each end and one in the middle would halve the damage by 50% at least. My greater point though is that something like bollards tackles the problem directly and is much more effective than SIGINT for these type of attacks yet nobody is talking about it.
The real problem is not the fact that we have places where pedestrians can be hit. It's the fact that there are people who would want to hurt innocent people for no reason. TBH I don't really understand why these crimes should be treated in any special way other than any other murder/assault crime. What difference does it make what ideology they are claimed to identify with? I am not convinced that the volume of such crimes (assault with relevant ideology) is enough to warrant putting them in a special category in the first place.
I do think that the bollard solution is a bit unnecessary though, as there'll always be a place where pedestrians would be vulnerable, and many other ways that people could be hurt besides.
At least it's something that could have an effect though. Snooping on emails would have almost no effect, and I hope everyone knows that. Snowden/William Binney, etc, should have made it patently obvious to everyone that there is no shortage of data flowing in, and I'm sure any successful preventative efforts would have been trumpeted to the rooftops with the way those agencies love to pat themselves on the back to justify bigger budgets.
More crap data, from millions of law-abiding innocent citizens, is not going to make it any easier for them to separate out the signal from the massive amount of noise.
The fact the media is not presenting real solutions to either of the actual problems - people being run down by cars or trucks, and people wanting to hurt other innocent people, or even questioning the imaginary solutions makes me strongly suspect there's ulterior motives at play.
To be quite blunt, this is such a blatant and transparent power grab by the authorities that I can't help but think that if the average person cannot see that our media is not interested in presenting the true story, with real facts that make sense, and our government representatives aren't addressing any of the real issues and just trying to remove our freedoms at every turn in order to not even solve imagined problems, then our society is already doomed, and not at the hands of terrorists.
They have the means to break, degrade or bypass the encryption and they emit statements like these so people remain confident that they're not being spied on.
This routinely happens after leaks reveal that certain type of traffic is being targeted. In this particular case, Wikileaks.
In the past after all the PRISM collusion was revealed, all the PRISM partners started their PR campaigns showing their "commitment to privacy", and the soap opera with law enforcement agencies claiming they couldn't decrypt devices. In reality they have many tricks they have used for years now, like setting up a fake cell antenna, impersonate a phone carrier to take over a device.
precisely. I was around when only hatters and nutjobs talked about echelon, getting ridiculed on internet and the outernet, only to be proven correct decades later
So they get a backdoor into WhatsApp and terrorists just move onto some other non-compromised tool. Rinse and repeat. You can't ban maths ffs.
TBH I am surprised attackers do not better destroy their electronic equipment just before they carry out their attack. Pop your phone and SSD/flash drives in the microwave on high for a few minutes is pretty much going to destroy all evidence on them, and if not then chances are you are dead anyway so whatever data they might be able to get off will most likely be useless to them anyway.
Not sure about banning maths, but back when I was in school I had to suffer through a couple of maths teachers who were so bad that they might as well have been trying to instill a life long hatred for maths.
I think this is not about terrorists (that is just a side effect), but for state ability to know what people think and talk about. That is very powerful thing to have.
Coming from the same government that wants all ISPs to keep a log of all the sites you visit. These people are beasts and as dangerous, if not more, as the perils they are supposed to save us from.
If people knew the damage these idiots do, they would be in the streets.
If I have to choose one from end-to-end encryption and security, I will choose security. I don't mind my WhatsApp chats are scanned by police's software, if it can reduce terrorism. Of course, we need to make sure it is used for anti-terrorism only.
Update: One solution of 'make sure' is the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts.
PS. Downvoting my post doesn't solve any problem. If you have any better idea, welcome to post it out. Thanks
> Of course, we need to make sure it is used for anti-terrorism only.
See that's the problem everyone is talking about. The thing, is, turns out you can't. That's was the ENTIRE point of the Snowden revelations.
No sane person is okay with terrorism, but at what point are you going to stop relinquishing your rights?
First, texts with Whatsapp. Then your phone calls. Then your bags and notes when you go through airport security. Then bugs in your house. All of these will help curb terrorism. But where will you stop? Will you lose all your private life in the name of law?
I actually didn't suggest a complete solution. You seem to judge the proposition without any further questions.
I said the monitoring software having access to the data was a solution. But you're probably thinking of a case where there is a master encryption key which we just hand to the government. But have you thought of a solution where we can be sure of the access that the software will have?
Something like a infallible way we can choose only the software can view the data. Sure, you're quick to dismiss it because it doesn't exist. That's why I said it didn't exist
There needn't be centralized way of communication you're thinking of now. It can be public software that people can choose to run.
> Assuming these experts are perfect and infallible
Well, you can have the same skepticism for the end-to-end encrypted software you use. How can you assume that it isn't broken?
Nobody is saying you did. You yourself said "that is a perfect solution actually" in response to vinceyuan, who had a one-liner comment about "the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts."
Maybe we are interpreting this in different ways.
How do you envision this "solution" working? It is a bit vaguely specified.
Who is doing the monitoring? What or who is being monitored? For example are we talking about monitoring the authorities to see if their access is done properly? Or are we talking about something / someone monitoring communications, on behalf of the authorities? Not sure what you had in mind. Can you explain how what you called "perfect" might work, were it to be developed at some point in the future?
I'll say up front that I'm skeptical, but let's see if we are even talking about the same thing. As long as you're being super vague, you don't have a solution at all.
And if you're just saying: there's no solution now but maybe one can be developed, fine (I believe you're wrong) but please clarify how you think it might work.
> That means there are still problems for you and me to solve.
This was my last sentence. With which I tried to say that we have to still solve the problem and come up with the solution. My comment "that's a perfect solution" was about the answer "software that can effectively monitor communications with proper privacy" to the question about properly reconciling privacy and security, in a situation where the people are okay with their communications being monitored.
But are you are expecting a answer to the question, "How will the software work?" from me.
I have no clue as so how it'll exactly work. But since you're so interested, I'll take a stab:
> Who is doing the monitoring?
The software. No humans will ever see the raw communications which haven't been flagged. Now this is obviously the tricky part. This is not a backdoored system with a magic decryption key. What I had in mind was a software possibly in-built with the communications protocol, which will, with near perfect accuracy flag suspicious communications. This is will need a leap of tech in Machine learning with NLP.
> What or who is being monitored?
All the communications (through the node) are being monitored.
> For example are we talking about monitoring the authorities to see if their access is done properly?
'They' have no access. Only the software does. How that is done is up to the "engineers/experts" to figure out. This will obviously need a change in communications architecture. When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
> As long as you're being super vague, you don't have a solution at all.
See my first line in this comment. I don't have a solution, but I do believe that a solution exists to a problem. They're very different things.
As an analogy, in mathematics, that's similar to me saying the problem is solvable, but you're talking about the actual solution.
And sure, this is a 'perfect' solution where monitoring communications is even a possibility. I don't even support that possibility. The first comment I replied to does, which said:
"If I have to choose one from end-to-end encryption and security, I will choose security. I don't mind my WhatsApp chats are scanned by police's software, if it can reduce terrorism. Of course, we need to make sure it is used for anti-terrorism only."
So in the first place, monitoring is something that will be done. Now in that scenario, there's a solution (In retrospect, I don't think I should've said perfect).
I don't think you are going to be happy with this solution. I don't expect everyone to be. I probably will be, because while I want privacy, I'm amenable to a solution I can trust in a situation where there has to be some kind of monitoring.
Since we live in a democracy (I hope you don't live in an oppressive monarchy), it can happen when the majority of the people (senators, actually, because it is a Republic) agree with a situation when monitoring is okay.
Your opinion or my opinion is not enough to change everyone else's opinions. So we might have to learn to live with it.
We live in a world, not a democracy. There are many different countries, with many different systems.
Any proposed solution has to deal with that reality, not with the little bubble of one democracy which may arguably in the questionable opinions of some subset of people have a good government.
The reality includes police states where the police are truly evil.
It also includes police states where the software is written by truly evil people, to do evil things, with evil experts overseeing it all and approving evil behavior in the software they are checking.
Please tell me how you can be confident that there can be a solution that addresses this reality while protecting the privacy of users. Sometimes all the user wants to do is send a message to their boyfriend, without getting thrown off a building, burned, flogged, or killed, possibly having several generations of your family killed as well (see North Korea).
The system has to work for this reality. I'm pretty sure that simply drawing a line and fully protecting the privacy of users' messages, full stop, is a better solution than whatever you and your senators will come up with.
And yes, the security of a crypto system can be verified. If it's designed to be secure. Not if it's designed to be monitored. Even if the experts are perfect angels and absolutely competent, if there is a way to monitor, hackers will find a way to get access to it.
>When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
You're dreaming. Remember, the authorities will have full power over that system, and even in countries where the authorities are not evil, the authorities as a rule are inevitably corruptible if not corrupt. This isn't just cynicism, it's reality. Look around.
> And yes, the security of a crypto system can be verified. If it's designed to be secure.
Theoretical security and actual security are two very different things. Once is mathematical which can be verified by equations. Other deals with software and imperfect developers. Software can't be verified for perfect security in a deterministic way, no matter how hard you try. Vulnerabilities pop up all the time. Your expectation that theoretical security translates to real world security is something I believe you need to think about again.
>Not if it's designed to be monitored. Even if the experts are perfect angels and absolutely competent, if there is a way to monitor, hackers will find a way to get access to it.
You seem to miss the part where I said a new protocol, not something which is modified, or backdoored. I'm surprised at you being so sure about the failure of a non-existent protocol. Do you have anything to back up your claim that any such protocol wouldn't work? Remember, it doesn't exist yet.
I honestly didn't find most of your post very coherent. There is no avenue for free speech in North Korea and other authoritarian regimes so it is a waste of time talking about working around the existing government for privacy and free speech rights. The only place where the masses can bring about change is in a democracy.
>not with the little bubble of one democracy
Last time I checked, most countries are democratic. Please show me the case where democratic countries vastly differ in how their government is organized.
> The reality includes police states where the police are truly evil.
Again, I talked about a democracy since we really can't do anything to help them with encryption and code. If there are no rights, strong encryption doesn't really matter. Look up rubber-hose cryptanalysis.
> The system has to work for this reality. I'm pretty sure that simply drawing a line and fully protecting the privacy of users' messages, full stop, is a better solution than whatever you and your senators will come up with.
It is of course is a better solution for individual privacy, I thought I talked about this at the end of my last comment. I don't have much control over my senators.
>>>When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
>You're dreaming. Remember, the authorities will have full power over that system, and even in countries where the authorities are not evil, the authorities as a rule are inevitably corruptible if not corrupt. This isn't just cynicism, it's reality. Look around.
Full power? I don't believe you have understood what I said.
At this point it feels like you're arguing for the sake of an argument.
... and everybody who uses a different software not approved by state will be flagged as a criminal. This will make the job of police and spooks easier, we know there was order and security in East Germany or other countries of the Soviet block.
Now consider the cost of such 'solution'. Free speech gets redefined, most of the people get divided into informants,opportunists, naive state suckers and silent fragmented opposition. Is that kind of security and police state an acceptable cost? For preventing small number of violent deaths each year?
There are much bigger problems in Western societies than a bunch of lunatics killing small number of people, but those can't be used so easily to make a power grab.
How do you ensure that what was the reviewed source is what is actually being used? Also, how do you encode in source code who is the correct target to use this against, for now and in the future?
Freedom and openness comes at a cost; this applies just as much to individuals as it does to countries. So then the ends of the spectrum are "I can take anything that comes at me, let the chips fall where they may"; and "Mummy make the bad man go away".
Unfortunately maths doesn't work that way, there is not much in the way of a spectrum when it comes to encryption, there is a very steep cliff from secure to insecure.
So then you are faced with a very stark contrast; the security afforded by a surveillance state, or freedom with the possibility of terrorism. Personally I prefer the latter.
The trick is there is no spoon, just like there is no control; only influence.
The better idea is to achieve security by encouraging people of different cultures to get along with each other. So, don't give free housing and support to people who fight against harmony and promote anger.
Two questions for you.
>One solution of 'make sure' is the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts.
What does that help with? (Because trusted expert aren't perfect, right?)
And second question, what if the police and government are evil, then how does your plan help?
> if it can reduce terrorism
It can't. If these supposed hoards of terrorists have half a brain cell between them, they'd simply communicate using something else.
> Of course, we need to make sure it is used for anti-terrorism only
Hah, not likely in the UK - if sweeping powers exist, there will be a creeping escalation of their use by different government bodies, and for purposes not related to terrorism.
that's the blindspot isn't it ? What's the one common thing about recent terrorist acts ? Vehicles used as weapons. Yet nobody's calling for a ban on the use of vehicles
Even one level up... Since when is a crazy individual with a knife in a car a terrorist? He's just a crazy idiot and we should call him so. If this is modern day terrorism we have nothing to be worried about.
Only because it is not yet feasible. Once autonomous vehicles become common there will be pressure to make driving a car manually difficult, expensive, and ultimately a crime.
I'm surprised it took this long for her to bring up the subject – Theresa May would've had her soundbites prepared in advance and released within hours of the attack if she was still Home Sec.
> That is my view - it is completely unacceptable
You know what else is completely unacceptable? Technologically illiterate, authoritarian jobsworths capitalising on tragedy to push through their agendas. But that's just my view.
Home Office always seems to attract the nastiest and dumbest of politicians, but this is a whole new level of dumb, and sadly will only gain her more support, because the general public either have no idea about the implications of backdoored crypto, or simply don't have any expectation of privacy and are happy to give up what little they have left in order to feel safe.
Sure she'll get support and they may even be stupid enough to attempt to enact this stuff. But rest assured there'll be a massive backlash from big business and various political fallouts from the scandals that will ensue.
Then some genius will come up with what's essentially an "encryption is illegal for terrorists" bill and we'll have the best of both worlds: full use of encryption where we need it, whilst the terrorists can't use it because it's illegal!!
Yeah that'll be totally humane, just like how it's illegal to commit crimes while wearing body armor in most of the US! Or like how street dealers and felons aren't allowed to carry guns or vote! We are being declawed.
Listening to some old episodes of 'The News Quiz', and I'm struck by the fact that this is not a whole new level of anything at all. If anything, this is par for the course, and Theresa May being in power at all is a result of that.
If I may ask a very naive question:
Do politicians like her really think encryption is dangerous or is it a devious way to expand mass surveillance?
Attacks of the past have shown that terrorists don't have a need to resort to encryption. The people involved in the Berlin attack last year, for instance, were monitored. Authorities knew they would strike but they didn't have sufficient incriminating evidence that would count in court to lock those guys up.
Even if encryption on messaging services were forbidden (which would make millions of law abiding people vulnerable in some way), terrorists could use throwaway email accounts from internet cafés and wrap their messages in password protected attachments.
> really think encryption is dangerous or is it a devious way to expand mass surveillance
The latter her and the precious home secretary (now PM) have been banging on about how under threat we are from the terrorist hoards for years now - all so they can erode freedoms and increase mass surveillance under the guise of 'keeping Britain safe'.
The idea that banning encryption of private conversations will prevent these few crazy people from causing damage is of course ridiculous.
They must know enough to know that this won't actually fix the problem, so I would have to surmise that they are just trying to do something and stay somehow relevant before their term comes to an end.
"Never mind the collateral damage, I'll be retired on a government pension by then."
Isnt it weird that drasticly restrictive all encompassing rules are hastily pushed after attacks? Blanket Decryption of messages, and other privacy suppression rules will make intelligence agencies into super powers with too much control at a very reduced cost (less messy assassinations, or physical threats needed)
Some people will simply refuse to let all and sundry (we have no idea as to who reads and acts on intercepted emails) to read private emails and they will therefore turn to steganography or one time pads with a seemingly ambiguous pre-arranged code. Good luck with reading the latter or even thinking it has a hidden message.
The British gov is looking more and more like the Finger from V for Vendetta. The US president more and more like the one from Idiocracy. That we tend to live up to caricatures should be an alarming sign, but I only see worries on sites like HN. Most people still don't see the catastrophy in it.
> I only see worries on sites like HN. Most people still don't see the catastrophy in it.
I'm not in the US. I have actually been very impressed by the outspoken actions of anti-Trump people in the US, with the massive protests and constant (well-deserved) media scrutiny. Also I never knew I could have so much respect for Hawaiian judges.
Why they didn't bother to vote is beyond me, though. Trump is a buffoon, but he was able to successfully motivate other buffoons to actually vote.
I did hear the description of their vote as being force to choose "between a disaster and a catastrophe" though, so that might go some way to explaining it.
393 comments
[ 2.6 ms ] story [ 298 ms ] threadMy bet is that he's just a random crazy, but of course these days it suits the political narrative to brand such people 'terrorists' to stoke public fear
To expand on my point, some of these small-scale 'terrorist' attacks show very little evidence of being coherently planned, and it's difficult to believe that an organised terrorist group is behind them. It seems more likely that some of these acts were performed by people acting alone, or vulnerable people provoked to it - and yes, some of these people may well be mentally ill; that hardly means they cannot be capable of violence.
Of course they would need to intercept all other communication services, including home-made ones.
Right?
http://news.bbc.co.uk/2/hi/uk_news/7030096.stm
https://en.wikipedia.org/wiki/The_Anarchist_Cookbook#Legalit...
Stories like this fill me with a slight bit of hope that encryption works
There is a way to suspect someone may at some point, which is what the UK security apparatus is aiming for but this kind of profiling will end up being a psychological analysis of whole groups of the population. The results won't be great for any of us.
For me it seems to be more in a direction of so called "Big Brother" than real counter-terrorism.
It's basically impossible. One can also use steganography to hide messages in lolcat pictures, or music files. The only way to prevent this, I think, is to start a totalitarian surveillance state where using Free or custom software or hardware is punishable by death. Even then, I'm not sure this will be enough.
What they really need is to invent time travel, and murder Ada Lovelace.
Don't think we can "tech" our way out of this.
It's actually easier than ever to ban encryption for messaging.
Would that stop determined people? No, but it's never been about that anyway. Just make the pool small enough and it becomes too difficult to use. (See PGP / email).
Also, if you genuinely legislate against encrypted messaging then it's easy to pick up on the relative handful of people who go outside the app stores to get encrypted messaging applications.
And it shouldn't come to technical solutions, we should have people challenge the notion that two people should never be allowed to share a private message, because that's why Rudd and the government is suggesting.
+1. This is the crux of the matter, although unfortunately I don't think the average person realises it.
Just because something is illegal doesn't mean it is enforceable.
Now, the UK isn't at that point obviously, but if they really wanted to use draconian measures against encryption, it probably would be somewhat effective.
That's not an issue. Writing solid encryption software is very difficult on its own. You will hear "do not roll your own crypto" all the time from security experts. We don't live in a James Bond universe and it's beyond the reach of terrorist organisations.
Sure, but what's to prevent someone from building something on top of OpenSSL or PGP or whatever? Can't be that hard.
Sure that can go wrong as anything can, but it's far from rolling your own crypto and makes things a lot easier.
Are you suggesting gpg has been backdoored? A simple wrapper around gpg is not-beyond terrorist organisations.
Beyound the reach of the terrorist organisations? We have already seen pretty sophisticated operations by relatively small crime organizations (like exploiting pseudorandom generators in casino slot machines). There's an established black market for exploits. I think writing an end-to-end encryption app is not much more difficult compared to this. What's more, it will even be perfectly legal in many countries, meaning you could legally hire professionals to do the job. Terrorist organisations won't need to esablish a development office in SV to write the app, they will only need to know how to use Tor and wire money to the app producer. Which isn't such a huge competence to ask for.
If all you do is pushing the buttons of the slot machine in the right order with the right timing, that's hardly a crime —and I don't care about court judgements to the contrary. If a slot machine has a crappy pseudo random number generator, they're just asking for it. I'd rather sue the slot machine's maker for providing a machine that's not fit for its intended purpose.
You provided it as an example of "organized crime", and doing so heavily suggests that it is wrong.
We tend to conflate "wrong" and "unlawful", and for good reason: the law is supposed to prevent wrong things from being committed. There are exceptions however, and this is one of them. I'd rather use another example if possible.
Speaking of moral issues, cheating on casino is pretty much off limits on my personal moral compass. That the attack was possible within the normal mode of operation does not make it less of a fraud. Imagine if the casino would reverse-engineer a slot machine and find a way to abuse it within the normal mode of operation, making odds (even more) in their favor. That would be fraud, plain and simple, and I don't see why a player should be held to a different standard.
You are absolutely right, not everything unlawful is wrong. But I fail to see which benefit we as a society would have by allowing exploitation of technical deficiencies in slot machines for profit. It is a crime and it is wrong in my book.
The rules for slot machines are ostensibly very simple. As long as you're only pushing the buttons that are supposed to be pushed without deteriorating them, you are acting within the rules of the slot machine, and as such cannot cheat.
The presence of hidden rules such as "don't push the buttons in this particular order and timing", or "don't push the buttons in a way that reliably causes you to win", are just silly and unfair. Especially considering casinos are exploiting gamblers' minds in the first place. Don't like slot machine exploiters? Fix your slot machines.
Likewise for counting cards: the player is merely acting upon information naturally gathered buy observation and play. Asking players not to act upon such information is intrusive —and unheard of in competitive play. Don't like card counters? Invest in a continuous shuffling machine.
"you're only pushing the buttons" except they were not only pushing a button, they were also recording sequences and sending them abroad for analysis.
But as you directly say that exploiting the flaws of a slot machine is not cheating and that it's fair, I guess I won't be able to persuade you otherwise.
Either you meant something along the lines of "that shouldn't be a crime" or you're essentially saying "it's not crime even though it is a crime" - which doesn't make terribly much sense.
Plus, they don't have to write it. They could just 'pivot' from an existing open source messenger.
Anyone have a link about this story? I'm curious to read about it.
It's not. You can use existing software, reuse existing protocols, and stick to safe languages as much as possible. Even implementing your own crypto isn't all that difficult¹. I have written my own crypto library², and I can almost recommend it for production use.
[1]: http://loup-vaillant.fr/articles/rolling-your-own-crypto
[2]: http://loup-vaillant.fr/projects/monocypher/
Of course it's utterly trivial to make a one-time-pad cryptosystem, and more practical in 2017 than ever. So what if the keylength must match the message length, my phone has a 32gb uSD. That's a lot of text messages.
If we outlaw encryption, then only outlaws will have encryption.
Why can't we collect all the signals all the time?
This is incredibly dangerous for our society, no-one should have that much power. That power isn't about terrorism (or even very useful against terrorism), but about subverting governments, judiciary and businesses.
Links to any credible sources?
Don't forget that while they were talking to the IRA politicians were saying in public "we don't talk to terrorists".
vs.
https://en.wikipedia.org/wiki/Human_intelligence_(intelligen...
(There was a great documentary about this on TV, but I cannot remember the name of it)
They can't. The US tried it in the 90's when SSL sites could not use strong encryption outside the US and you'd need a license to "export" PGP... That went well! :-/
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
I expect it's quite likely this one was using WhatsApp because that's what he used; not because he read about its end-to-end encryption.
Install a device on one's head?
Then there's how you use it. They could mandate all of X businesses could only use encryption that could be inspected by the state, so either weak encryption, or PKI where you send the government your site's private key or use the state's CA or something. They can also mandate backdoors in encryption used in certain ways. And they can mandate that weak encryption be used outside their country's borders.
All of these are real parts of US laws on cryptography from WWII to 2000 to prevent "export" of "strong encryption", because of course evildoers around the world might make use of these "munitions". US law still regulates how we can use or distribute cryptography around the world. It is illegal in the US to release open source crypto on the internet without notifying the Bureau of Industry and Security. And 41 other countries (including the UK) have similar laws.
The one thing the US has going for it is the 1st Amendment, which makes it illegal for the US to prevent its citizens from making or using crypto within the US.
Yes, and then he went and did something stupid with easily accessible tools and acted alone.
You might have an argument if he was part of a coordinated attack against something but lone-wolf terrorism has always been defined as unpreventable by security services such as SIS. Once radicalised it's impossible to prevent individuals doing stupid stuff.
The only thing she has revealed his the conservative parties desire for totalitarian control. :(
No.
Even ignoring the erosion of privacy angle, this just doesn't work. Outlaw encryption, and only outlaws will use encryption. Provide government backdoors into the popular commercial messaging apps, and people coordinating terror attacks will just use custom, unknown, private encrypted messaging apps.
But you _can_ make the argument that if only outlaws use encryption then they're painting a target on their back, which leads to greater scrutiny by security services.
This is reasonably achieved by the current dragnet surveillance systems in place, along with ISP's logging everything.
I don't agree with it, of course I don't, but that's probably an angle people could take- But the angle Amber Rudd took is even more starved of sense.
It's like she didn't ask the appropriate question: "What could we have done to prevent this attack" and the follow up "If we had direct access to his phone and all of his communication information, what could we have caught" and the answer is _nothing_. He used tools commonly available to him, acted alone, probably told nobody.
Anyway, tell the bad guys you're watching the comms and they'll figure out how to talk, they're motivated and smart.
Actually there is a lot they could have done to help him in his obviously troubled life but that doesn't fit with conservative ideology.
Even the most socially progressive system on the planet will have people slipping through the cracks- we have to be able to deal with that eventuality too.
More important is his time in prison - where most UK terrorists were radicalised - and if you were saying that UK prisons don't rehabilitate I'd agree.
In this specific case there's no suggestion he had mental illness, and it's ignorant to suggest he did.
Perhaps it doesn't fit under the "common" mental illnesses of depression, anxiety, etc. but it lines up well with thought disorders. A sane and well person would not jeopardize themselves, and their fellow species.
Sane (by the usual definition, though it's possible you are using an unusual definition of your own) people jeopardize themselves to harm other members of the species all the time.
In fact, societies tend to have organized groups of people who are expected to do this when the targets are enemies of the group, and who are honored for it; they also not infrequently honor people who independently do it against people theor society has decided are "the enemy".
It's a bit odd to pretend those are the actions of a well-adjusted, sane person.
You cause harm to people with mental illness when you ignorantly link violence to mental illness.
Even though it doesn't fit your ridiculous PC SJW agenda, I would be willing to bet he's got some kind of mental health issue. I don't think that's a controversial opinion to hold.
I don't think it's ignorant to ask the question if someone who did that is right in the head.
You are saying two things:
1) He is violent because he has a mental illness.
2) People with mental illness are violent because of their illness
The reality is very simple: he was a violent man. He had always been a violent man. He had a long history of violent behaviour. He doesn't have a long history of contact with MH services, and he never had (as far as I know) any contact with secure MH units[1]. Some men are remarkably violent, but most of them know exactly what they're doing and they're not controlled by an illness.
The prevalence of violence, and mental illness, means that obviously there's some overlap between "people who are ill" and "people who are violent", but you need to be really careful not to say "the violent people in that overlap are violent because of their mental illness".
When looking at predictors of violence we see that mental illness doesn't give you much if any predictive power.
Substance misuse does; previous episodes of violence does; and any (especially all) of these combined does.
The reason it's important to avoid incorrectly linking violent behaviour to mental illness is seen in the stats of people shot and killed by US police: about half the people shot and killed each year are people with mental illness. The vast majority of them pose zero risk of harm to other people, maybe some risk to themselves, but they get killed because people like you keep pushing the "mental illness == violent and dangerous" myth.
Just by virtue of his actions, and also because the news mentioned that he's been in jail, I think he's probably got some kind of mental illness or thought disorder. I could be wrong or I could be right, but for the moment I'm going to stick to that opinion.
I never said all mentally ill people are violent or dangerous, because I don't have some concealed anti-mentally ill agenda.
I do however have a bias in thinking that mass-murderers are generally mentally ill, and a quick google implies I'm factually correct in having that bias.
> He doesn't have a long history of contact with MH services
Hmm. Just the fact that he has had contact with mental health services strengthens my opinion that he's probably mentally ill.
As you've said yourself, some mentally ill people are violent and dangerous, some are not. I am aware of that.
When people are around trigger-happy US cops with guns pointed at them, they get shot, which is no surprise with such a militarised police force. Unfortunately that's the society some people live in.
If cops shoot mentally ill people, that's a problem with the cops and the society that tolerates that behavior, not me for speculating about whether or not a single mass murderer has a mental illness or not.
Don't try to imply that my opinion of a single case is in some way responsible for trigger-happy police in a country I don't even reside in.
I'm neither in the US, a cop, nor mentally ill so none of those are my responsibility.
Once again, I'm talking about this particular mass-murderer, and I think he's probably mentally ill. Nothing you have mentioned has swayed me from that opinion.
I think we're done here.
Well, if only outlaws used encryption and you sent a non-plaintext message then the police would knock on your door at 04:00 the next morning. That's what happens in Morocco if you like something related to terrorism on Facebook. A bit extreme, yes, but that's how some countries do it.
Sure, technically sophisticated enemies know not to like things on Facebook and know to use steganography, but most don't know and those that learn it through terrorist networks have a long vulnerable period where they are malicious but before they become sophisticated.
I am sure a ban on encryption would work.
Hey, guys, I just had a great idea. Let's ban bombs, knifes, and driving into people. That would fix the terrorism problem. Once it is illegal, no terrorist would dare do it!!!
I'm wondering why Churchill didn't think to ban the Enigma machine. If only England was led by smart people like the British interior minister...
Come to think of it...
Sorry, he is a she.
They started banning guns almost a century ago. While it did probably reduce the number of gun murders, it certainly didn't make terrorist organisation like the IRA any less effective — and it probably made non-gun crime worse.
Possessing encryption tools, lockpicks, knives, guns &c. is a fundamental human right of free men.
I believe, any entity, from a mere individual to a government agency or multinational corporation should be free to possess any software tools they may desire. How they use those is another matter.
I do "spy" on my own traffic on my own network running on my own hardware on my own premises. I've had some audits for possible malware/spyware, did reverse engineering protocol analysis, etc - and believe everyone should be able to do that. I shouldn't be able to do this on someone's else traffic without their informed consent - nor technically, neither legally (I believe, both of those aspects are important).
As for your question - I don't like this, of course. Don't think there is anyone well-informed and in their sane mind who does.
We're talking about what are essentially cyberweapons and surveillance tools.
Why can I not own a nuclear warhead, as long as I promise not to do anything with it?
Why can I not put cameras and 3D radio imaging equipment up across the street on a small private plot of land and spy on you and your children's home without being visited by the police at your request?
If you don't have a problem with how those two cases are legislated then you might be able to understand how this could relate back to software.
Should you have access to any program you want? I guess so, if you can get it in a licensed manner. If it's FOSS or something similar, that will be easy. But using these tools to collect surveillance data and PII is an entirely other issue because of the potential weaponization of collected data and the harm that can result from it.
I supposed I did not fully understand what the OP was asking, because I do believe you should be able to own these tools and test them on your own equipment, and that the issue is that we need to ensure proper protections against these tools are in place for the average uninformed user.
If we banned planes that would certainly have prevented 9/11. What better argument could there be?
It was recognised that it's impossible to enforce, ie. PGP is there, in general tech is just available to anyone and what about research papers and academia? Treat them as criminals? Even if banned in UK, it's available in the rest of the world.
It would be nice if politicians were banned from saying stupid things.
Also, designing a secure general purpose messaging system is much harder that designing a system tailored for a specific use case.
Banning encryption by law is like demanding, loudly, that people not talk behind your back. Some will listen, and some will not. Only legitimate users and use cases will suffer.
From a business perspective it would be like going back to before the internet, but many of the services we associate with the internet like Facebook, Netflix etc. would survive.
I assure you, steganography will always be possible. The only think a ban on encryption would do is hurt (badly) society, personal privacy, and those who want to follow the law.
It's technically impossible to do perfectly, but as we all know, perfect is the enemy of good enough ;)
It is feasible. The backdoor should be at a very low level (not say a sandboxed application) from which basically nothing can hide on the device.
Since the current prime minister supports her, I doubt it. It's an absurd position, but not without support in the current administration, just like her outspoken views on immigration.
And, I'm sorry to say, a large chunk of the public, who have for years been force fed rubbish from politicians and the media alike about the huge terrorist threat that threatens to destroy our country (when in reality just about anything else you can think of is more of a threat than the odd crazy with a knife and car...)
Our Government is an absolute disgrace; and unfortunately, one to which there is currently no credible, strong opposition.
(from https://www.buzzfeed.com/matthewchampion/necessary-hashtags)
Labour were supporters of the recent IP Bill (it actually applied restrictions to some of the crazy powers the last Labour government gave to the police, which gives you an indication of their general position on these things). Labour have had authoritarian positions on crime and policing issues since Blair became shadow Home Secretary (1992). It has been part of their 'tough on crime' strategy of attacking the Conservatives from the right since that point and was a core part of the New Labour strategy.
The only thing a "stronger" Labour opposition would get you in this situation is a parliament even more united in support for restrictions on encryption.
Because that's where we're at currently.
"We need to make sure that our intelligence services have the ability to get into situations like encrypted Whatsapp."
She has said she is "calling in" technology companies this week to try to "deliver a solution".
Marr asks if they refuse to do that, will you legislate to force them to change? She's not drawn on that.
Interview is here:
http://www.bbc.co.uk/iplayer/episode/b08l62r7/the-andrew-mar... [from 45:18]
I understood that UK IP Bill already mean that she already has the ability to e.g. demand a backdoored version of Whatsapp be sent to a target device, but that's not covered in the interview.
https://www.theregister.co.uk/2016/11/30/investigatory_power...
"The Hindi-speaking handler guiding the men in Hyderabad also insisted on using a kaleidoscope of encrypted messaging applications, with Mr. Yazdani instructed to hop between apps so that even if one message history was discovered and cracked, it would reveal only a portion of their handiwork."
"the handler taught Mr. Yazdani how to use the Tails operating system, which is contained on a USB stick and allows a user to boot up a computer from the external device and use it without leaving a trace on the hard drive."
Even if the British government is successful with WhatsApp, can they do much against free, open source tools?
[1] https://www.nytimes.com/2017/02/04/world/asia/isis-messaging...
Why would they care about open source tools and niche use of encryption? Of course they don't. They are after mass surveillance and use fear of terrorism to push for it. It's very logical of them.
It's not entirely by accident that the UK current ramp up of legalized government surveillance coincide with Brexit, as the UK doesn't actually have a democratic constitution limiting government surveillance outside of the ECHR treaty they signed as a prerequisite for joining the EU/EEC.
The UK signed the ECHR in 1950 (and were involved in writing it); the EEC did not exist until 1957.
The court http://www.coe.int/t/democracy/migration/bodies/echr_en.asp is what makes the ECHR significantly more effective then the unenforceable UN Declaration of Human Rights signed in 1948 only came into effect in 1859 and was only explicitly acknowledged as superior in British law with the still controversial Human rights act of 1998 https://www.supremecourt.uk/about/the-supreme-court-and-euro....
The fact that EU membership demand actual rather then pretend ECHR compliance is a fairly big deal in the anti-EU Tory circles currently running the show in the UK and some of them seem to presume that leaving the EU will absolve the UK of any duty to submit to the ECHR court http://www.telegraph.co.uk/news/2017/01/26/theresa-may-prepa... even though I am sure they think otherwise in Strasbourg.
but you are correct in stating that officially the ECHR came into dejura effect in 1950 under the Council of Europe where the UK unlike for the ECSC(1951) and the EEC(1957) was a founding member, but it's worth nothing here that the Council of Europe is a far more toothless organization(like the UN) then either the ECSC and the EEC.
Edit: fixed links
So they'll never run out of reasons to push further. Hooray.
Amber Rudd seems hell bent on destroying their only chance.
I'm so sick of getting "this is an adult resource and you can't view it" anytime I search for information about a drug (pharmaceutical, not just "weed LSD and lols").
Great fucking way to encourage your future chemists. Maybe ban keywords like JavaScript, PHP and SQL while at it, them's the powerful drugs maaan.
Switch ISP, or contact your current one to disable this. They don't all do it by default, or at all.
compare BT[1] (£44.99 for 12 months, then £53.99) with AAISP[2] (£45)
once you add on "a couple of quid VPS a month", you could even go for the AAISP 1TB package at £60/month
[1]: https://www.productsandservices.bt.com/products/broadband-pa...
[2]: http://www.aaisp.net.uk/broadband-home1.html
Usually you can have it disabled while you sign up (and they usually ask if you want it). As for giving personal info - they're you're ISP. They have your name, address, billing details, have done a credit check...what else are they going to ask for that you haven't already supplied?
A VPN is a way to circumvent surveillance but make no mistake: We must press with all our power for legislation which guarantees privacy, all over the world. This is a battle that in the long run, we can't win with tech. We need to become more privacy-aware.
"Those who surrender freedom for security will not have, nor do they deserve, either one."
With the current trend, how long until VPNs are made illegal? "For the children!"
Those filters, if they're ISP supplied, are optional. You can turn them off.
Non-physical so selling to America, Africa or Asia is as cheap as selling to Europe and added value to absorb the new cost of doing businesses (in case the UK does not remain in the Single Market).
If e22 encryption is outlawed in the UK, their businesses would be less trusted (harder to sell expensive things) and will be at the mercy of other countries' intelligence and espionage services.
It's absurd to think this can be resolved through legislation or cajoling companies into cooperation. But what really bothers me about this whole issue is that we already have laws in place that handle this situation, at least in the USA. In the USA, if you refuse to hand over an encryption key (or can't) and are being compelled to by a court, you can and will be held in contempt of court, and possibly convicted of destruction of evidence. The only thing that forcing people to backdoor their crypto does is allow government entities to investigate people without having sufficient evidence to compel them to give up their keys, and destroy the marketability of large scale, centralized end-to-end encryption solutions.
I mean, you could make the argument that end-to-end encryption restricts the ability to wiretap people, sure, but a wiretap warrant should require a decent amount of evidence, and at that point, there are most likely other options.
I don't think it's a good solution, though. This is going to sound like an argument that you hear about privacy by people who don't understand why privacy matters, but I think on this issue, it holds a little more truth: To be honest, I think the people who are likely to care to do this are people who are advocates for privacy and are tech savvy, and people who have something to hide. I don't think it's terribly difficult, with the resources the global Intelligence Community has to build a profile and dump people into those two buckets with a fair degree of accuracy. Everyone who's not generating random garbage data would still be observable, so it wouldn't really change much outside of the group that's acting. But for those acting, suddenly there's a red flag that they can look for, and then when they see it, start building a profile to figure out if you're a tech person with an interest in privacy, or someone doing something they don't want seen, and act accordingly. In the mean time, we waste time generating garbage instead of just using good enough encryption, and making it so easy to use that people don't even have to know they're using it.
Now, if we could somehow implant babies with a chip that causes them to generate random noise (something babies are already pretty good at, mind you) from birth, that might be worth something. There's no profile building if the noise is just something that humans make by being alive.
Obviously privacy is something that HN holds very close to its heart. But I'm interested in what do people here have to say about the privacy features are used by terrible people to do terrible things.
And I want to share something that I think is one of the best arguments for privacy, complete privacy. I do agree with this completely: https://moxie.org/blog/we-should-all-have-something-to-hide/
A hammer, a knife or a government can be pretty useful, or pretty violent - depending on how you use it. This alone does not imply that a hammer, a knife or a government should not exist or be banned.
edit: words
As always it's a trade off, some people loose the right to arm themselves at home but that means other people may not loose their life to a shooting.
It's whole purpose is, to hurt someone; i think that's some point to acknowledge first.
//Playing devil's advocate
First of all, I don't want any company in transit, from my ISP, to the message broker, to the receivers ISP to mine my data and use/sell it for profit.
Secondly, there are a lot of messages which are not illegal, but can be personally embarrassing if they were to become public. Think of sexually-tinted messages, psychological help, a kid who lives in a very conservative community and has doubts about their religion, discussions about a candidate for a job position, etc.
The problem with backdoor is that the question is not if they are exploited, but when they are exploited. And this is all assuming that the organization that has backdoor access is not of ill will.
Well, that's a very evasive argument in my opinion. It's absolutely true that objects are neutral, but you can't make a blanket argument with topics like these. That argument has been made lots of times by many (including me).
But it eventually breaks down. You can't give a child a gun and when the kid shoots someone say it was the kid's fault. Whose fault is it? I'm guessing you're going to say the adult responsible for putting the gun within the reach of a child. You're still taking away an object from the kid. In this case it was a kid who didn't know better.
Now this isn't a narrow argument. This becomes interesting when you get to powerful things, like say nuclear weapons. They aren't inherently evil too. But if you look around, UN is trying to ban them[1]. Shouldn't UN ban them?
What I'm trying to get at is that you can't always but the blame on people. Just like you can't blame a child for not knowing better, you can't blame a person for knowing better (although people do). Sometimes you just have to take the gun (or nuclear weapons or encryption) away.
[1]: https://www.un.org/disarmament/wmd/nuclear/
What if the huge nuclear arsenal was in the wrong hands? That begs the question, what is 'wrong'?
Your definition of peace was probably characterized as oppression/dominance by the people who did want to revolt. You don't account for the extremely subjective nature of things, especially when it comes to nationalistic actions of people.
You rightly said that I will answer that it was the adults fault. The bad act done with the weapon was giving it to a child, not the childs shooting someone. It gets clearer if the adult hands the weapon to a monkey or a randomized shooting machine. All three scenarios change nothing in regard to the moral responsibility of the adult.
I do not know whether the UN should ban nuclear weapons, but if someone uses a nuclear weapon and we would check out who might be morally responsible for the attack, I'd point at the attacker.
Well I meant evasive argument as in statements which directly avoid the question. Because the thing is, we don't live in a perfect world. So putting the blame on agents doesn't solve the problem. That's why I brought up that sometimes things have to be taken away from people. The question is when and how.
> The bad act done with the weapon was giving it to a child
I didn't say the adult gave the weapon. I just said the adult left it within the reach of the child. One is direct, the other is indirect. I wouldn't even say indirect, but lets go with it.
> I'd point at the attacker
It gets blurry deciding who the attacker is, depending on whose side you are on. Things aren't always so clear.
But we both believe that the world is not perfect. This is why we need to talk about moral responsibility in the first place. Blurry definitions might only make us even more humble while proposing new, disruptive power centralizations like an encryption ban.
With their utterly poor understanding of encryption and the harms of compromising it, people in governments who want to do so might as well be monkeys.
By providing backdoored encryption products, we would as you put it be handing out randomized shooting machines to monkeys.
You can flip this for privacy too. The more governments can spy on everyone, well sure we may catch more terrorists and terrorism might even decrease. But at what cost? Totalitarianism? Shudder.
I was with you up until 'government'. I regard states as exercising unjust authority over people and defenders of private property which is why I'm an anarcho-Communist. The way in which the modern world is divided up means that one must be a subject of some state, which I believe makes there no way to provide proper consent to be governed.
Regardless of what delusional politicians want, encryption is here to stay. It's just a matter of how much people are willing to give up to feel safe.
Although we should have mechanism to protect from mass random surveillance.
Saudi Arabia punishes rape victims. We should help with that?
China punishes people who try to air grievances about government abuse and corruption. Again, we should enable them to be more effective in their invasive prying into those individuals than they already are?
In North Korea, your entire family can be punished if you dare be disobedient to the government.
In the US, we recently elected Donald Trump.
Etc. etc... why do you think governments can be trusted with this power?
On top of all that, once the technical means exist, they will also be discovered, cracked, and used by fraudsters, extortionists, and anyone else who can figure out a way to abuse the information.
Nowadays here are other more efective ways, than encrypted WhatsApp (secrecy), to fight bad governments and ridiculous laws.
North Korea and Saudi Arabia are obviously very extreme examples. Internet encryption must be the least of their worries.
Governments with working justice systems should be trusted with power to provide security.
There should be No technical means or backdoors globally accessible. Information should be provided on request basis, based on a warrant for that suspect. And data stored should follow data protection laws.
If you think you country justice system is not working properly there are ways to fight that. And probably there will be people and institutions already doing.
"suspected"
That includes you, so... be careful.
But I cannot feel safe just because one application company is saying everything is encrypted.
I am just afraid the day security is so good, there will be no more corruption leaks, and the ruling classes can do whatever they want with total privacy.
My unfair imprisonment is less important, than a fair imprisonment of a corrupt politician. I think...
North Korea and Saudi Arabia and China and the UK would claim that their justice systems are working just fine.
As would my local sheriff jurisdiction where they can't even manage to hire anybody who bothers to do so much as use turn signals. If they can't even manage to do that tiny thing, greatest country on earth or no, I don't trust them with the temptations of the kind of power you're talking about.
>If you think you country justice system is not working properly there are ways to fight that.
LOL! Good luck! Strictly speaking, you are correct that "there are ways to fight that" but the consequences are brutal! It's a pretty big ask for most people. And that possibility will be eroded and, more likely, wholly negated by such systems.
There is no temptation if they need a warrant issued by judge authorizing for the officer to request to the company information related with that suspect. Upon which the company might charge administrative costs to handle the request.
I am saying suspect of a crime committed or with complaint filed against. As stated before I am against mass surveillance and crime "prediction". Even terrorism is a small problem compared with economic/political corruption.
Otherwise the governments might block applications. Or secretly spy on us, with the company help if needed. All done without any supervision.
However, this is the real world, and I'd want the serious trust issues fixed first. Surveillance of journalists. Invasion of privacy by journalists with the complicity of corrupt police. Surveillance of peaceful left-wing and environmentalist groups.
Let's not be ignorant of history either, of secret prisons and unaccountable courts. Let Martin McGuinness' death remind us of H block and the Maze. Who here is old enough to remember the bizarre compromise where Gerry Adams appeared on TV with his words read by an actor, because he was deemed too dangerous to listen to?
Then there is the business of foreign intelligence agencies. If some communication isn't completely private, can it be compromised by the Russians? Remember the US election?
We need to have a conversation about radicalisation, but much of it happens in public or verbally, and it's not at all limited to Islamic fundamentalism. It needs to include the far-right too.
The expectations you have are something I'd agree with too, but many other don't. So how do you reconcile this? Again the reconciliation process you will come up with is perfect according to you but most likely not according to others.
No one can ever win I guess.
So we have to live with some level of crime. It doesn't mean we shouldn't be tough on criminals, but we have to accept that it is not possible in a free society to reach zero criminality.
I think the paradox is that people are reasonably relaxed with some level of criminality but are absolutely intolerant to any form of terrorism. And this intolerance is a new phenomenon. Terrorism isn't new. There isn't more terrorism in Europe than 20 or 40 years ago. In fact a few months ago I compiled the number of incidents and victims from a wikipedia page [1]:
https://zbpublic.blob.core.windows.net/public/Deads.png
https://zbpublic.blob.core.windows.net/public/Injured.png
https://zbpublic.blob.core.windows.net/public/Incidents.png
As you can tell, the 70s and 80s were rather more brutal, with far-left, IRA and Palestinian terrorism. And our democracies resisted much better the temptation to introduce more surveillance.
Now why have we become intolerant to terrorism? There are literally tens of thousands of knife attacks every year just in London. Most don't even make it to the local news. Why would this particular incident be treated as a state affair? Terrorism is the buzz of a mosquito. In itself pretty much harmless. But most people will not sleep in a room where they can hear the buzz. I don't have a good explanation. The only thing I can think of is the 24h news cycle where the media will make a big deal of anything that can push the audience up. But that doesn't explain everything. They do the same with plane crashes, but still repeat over and over that though spectacular, plane crashes are extremely rare and flying is extremely safe. Whereas when there is a terrorist attack, the message is "this could happen to YOU!"
[1] https://en.wikipedia.org/wiki/Terrorism_in_Europe
I have to ask, what's up with the domain name? Is that some sort of public windows share folder?
Like this? https://www.youtube.com/watch?v=RIuf1V1FhpY
(Tom Scott's "Oversight" from 2013)
Baxter and Clarke: The Light of Other Days: https://en.wikipedia.org/wiki/The_Light_of_Other_Days
People should be careful what they wish for.
As the saying goes, "insecurity is freedom." I've always found it somewhat disturbing that people have welcomed the walled-garden ecosystems popular today, which are essentially the cyber-equivalent.
One difference is that airlines advertise in mass media, terrorist organizations don't.
Giving up such a valuable right to possibly stop attacks which, in the grand scheme of things actually harm very few people, is idiotic. Terrorism is obviously awful but the number of people in the UK actually affected by it is far, far too small to consider forgoing such an important right. And IMO, once you do that, the terrorists have won.
Take the attack in London last week for example. It doesn't require planning. Anyone could get in a car and mow down a lot of people in seconds. It doesn't need discussion on WhatsApp. It doesn't require purchase of weapons. It doesn't require you to do anything shady that could give you away more than a second before you do it. No amount of intelligence gathering could figure it out. You could force every citizen to wear a mic and body cam and you still wouldn't be able to stop it.
How about tackling the actual problem - terrorists seem to have resorted to using cars and trucks to kill people. Lets put up some metal/concrete bollards alone the edge of pavements that have no 'escape route', such as the one on Westminster Bridge.
Nice post. I agree almost entirely with you, but you can't put a bollard everywhere, and even if you could, bad people would find a way around or between the bollards, or simply another way to hurt people. It would be like playing a futile game of whack-a-mole.
At the end of the day, there are people who are so mean-spirited that they want to hurt innocent people for no reason, and they will find a way to do that no matter what we do. Honestly I think a lot of it is mental health more than anything we can really protect against.
It's not possible to wrap everyone in cotton wool, and in order to have some freedom we risk a small percentage of harm. There is no way around that. Without that freedom, there's also the IMO much larger risk of harm from the authorities themselves.
There's no way around it, living in the world involves some risk. It's unrealistic to not accept that risk and fantasize that all outcomes are preventable.
Like another comment mentioned, there are literally tens of thousands of stabbings in the UK every year. Why are we even talking about removing fundamental freedoms (the right to privacy) in order to probably not prevent a few unfortunate deaths per year? The payoff is so small and the cost is much too great.
I agree, this wasn't my suggestion. I was thinking more of areas like a bridge where if a car does start speeding along the pavement, even if you are further along and see it, there is nowhere for you to go. Your choices are stay put (and get hit), run into the road and probably get hit by traffic, or jump off the bridge (dangerous). Bollards along pavements like that would be useful. Even just one at each end and one in the middle would halve the damage by 50% at least. My greater point though is that something like bollards tackles the problem directly and is much more effective than SIGINT for these type of attacks yet nobody is talking about it.
I do think that the bollard solution is a bit unnecessary though, as there'll always be a place where pedestrians would be vulnerable, and many other ways that people could be hurt besides.
At least it's something that could have an effect though. Snooping on emails would have almost no effect, and I hope everyone knows that. Snowden/William Binney, etc, should have made it patently obvious to everyone that there is no shortage of data flowing in, and I'm sure any successful preventative efforts would have been trumpeted to the rooftops with the way those agencies love to pat themselves on the back to justify bigger budgets.
More crap data, from millions of law-abiding innocent citizens, is not going to make it any easier for them to separate out the signal from the massive amount of noise.
The fact the media is not presenting real solutions to either of the actual problems - people being run down by cars or trucks, and people wanting to hurt other innocent people, or even questioning the imaginary solutions makes me strongly suspect there's ulterior motives at play.
To be quite blunt, this is such a blatant and transparent power grab by the authorities that I can't help but think that if the average person cannot see that our media is not interested in presenting the true story, with real facts that make sense, and our government representatives aren't addressing any of the real issues and just trying to remove our freedoms at every turn in order to not even solve imagined problems, then our society is already doomed, and not at the hands of terrorists.
Now, private conversation is illegal.
I guess it leads to "ownlife".
They have the means to break, degrade or bypass the encryption and they emit statements like these so people remain confident that they're not being spied on.
This routinely happens after leaks reveal that certain type of traffic is being targeted. In this particular case, Wikileaks.
In the past after all the PRISM collusion was revealed, all the PRISM partners started their PR campaigns showing their "commitment to privacy", and the soap opera with law enforcement agencies claiming they couldn't decrypt devices. In reality they have many tricks they have used for years now, like setting up a fake cell antenna, impersonate a phone carrier to take over a device.
people have very short memory, it seems.
TBH I am surprised attackers do not better destroy their electronic equipment just before they carry out their attack. Pop your phone and SSD/flash drives in the microwave on high for a few minutes is pretty much going to destroy all evidence on them, and if not then chances are you are dead anyway so whatever data they might be able to get off will most likely be useless to them anyway.
Wow, that sentence got away from me.
Terrorists just use something else while the populace feels gradually more oppressed/controlled/...
In a way they get something for nothing.
(Then again, a 4 Lions moment where an intrepid terrorist slits his own throat with a molten SSD wouldn't be the worst thing in the world...)
If people knew the damage these idiots do, they would be in the streets.
Oh wait, they already are in the streets...
Update: One solution of 'make sure' is the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts.
PS. Downvoting my post doesn't solve any problem. If you have any better idea, welcome to post it out. Thanks
See that's the problem everyone is talking about. The thing, is, turns out you can't. That's was the ENTIRE point of the Snowden revelations.
No sane person is okay with terrorism, but at what point are you going to stop relinquishing your rights?
First, texts with Whatsapp. Then your phone calls. Then your bags and notes when you go through airport security. Then bugs in your house. All of these will help curb terrorism. But where will you stop? Will you lose all your private life in the name of law?
So humans have to do it till then. We were maybe born too early. But I think it makes things interesting.
That means there are still problems for you and me to solve.
Assuming these experts are perfect and infallible (a bad assumption), then what does it prove?
That only an authorized government agent can have access?
Can you not think of any problem with that whatsoever?
I said the monitoring software having access to the data was a solution. But you're probably thinking of a case where there is a master encryption key which we just hand to the government. But have you thought of a solution where we can be sure of the access that the software will have?
Something like a infallible way we can choose only the software can view the data. Sure, you're quick to dismiss it because it doesn't exist. That's why I said it didn't exist
There needn't be centralized way of communication you're thinking of now. It can be public software that people can choose to run.
> Assuming these experts are perfect and infallible
Well, you can have the same skepticism for the end-to-end encrypted software you use. How can you assume that it isn't broken?
Nobody is saying you did. You yourself said "that is a perfect solution actually" in response to vinceyuan, who had a one-liner comment about "the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts."
Maybe we are interpreting this in different ways.
How do you envision this "solution" working? It is a bit vaguely specified.
Who is doing the monitoring? What or who is being monitored? For example are we talking about monitoring the authorities to see if their access is done properly? Or are we talking about something / someone monitoring communications, on behalf of the authorities? Not sure what you had in mind. Can you explain how what you called "perfect" might work, were it to be developed at some point in the future?
I'll say up front that I'm skeptical, but let's see if we are even talking about the same thing. As long as you're being super vague, you don't have a solution at all.
And if you're just saying: there's no solution now but maybe one can be developed, fine (I believe you're wrong) but please clarify how you think it might work.
This was my last sentence. With which I tried to say that we have to still solve the problem and come up with the solution. My comment "that's a perfect solution" was about the answer "software that can effectively monitor communications with proper privacy" to the question about properly reconciling privacy and security, in a situation where the people are okay with their communications being monitored.
But are you are expecting a answer to the question, "How will the software work?" from me.
I have no clue as so how it'll exactly work. But since you're so interested, I'll take a stab:
> Who is doing the monitoring?
The software. No humans will ever see the raw communications which haven't been flagged. Now this is obviously the tricky part. This is not a backdoored system with a magic decryption key. What I had in mind was a software possibly in-built with the communications protocol, which will, with near perfect accuracy flag suspicious communications. This is will need a leap of tech in Machine learning with NLP.
> What or who is being monitored?
All the communications (through the node) are being monitored.
> For example are we talking about monitoring the authorities to see if their access is done properly?
'They' have no access. Only the software does. How that is done is up to the "engineers/experts" to figure out. This will obviously need a change in communications architecture. When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
> As long as you're being super vague, you don't have a solution at all.
See my first line in this comment. I don't have a solution, but I do believe that a solution exists to a problem. They're very different things.
As an analogy, in mathematics, that's similar to me saying the problem is solvable, but you're talking about the actual solution.
And sure, this is a 'perfect' solution where monitoring communications is even a possibility. I don't even support that possibility. The first comment I replied to does, which said:
"If I have to choose one from end-to-end encryption and security, I will choose security. I don't mind my WhatsApp chats are scanned by police's software, if it can reduce terrorism. Of course, we need to make sure it is used for anti-terrorism only."
So in the first place, monitoring is something that will be done. Now in that scenario, there's a solution (In retrospect, I don't think I should've said perfect).
I don't think you are going to be happy with this solution. I don't expect everyone to be. I probably will be, because while I want privacy, I'm amenable to a solution I can trust in a situation where there has to be some kind of monitoring.
Since we live in a democracy (I hope you don't live in an oppressive monarchy), it can happen when the majority of the people (senators, actually, because it is a Republic) agree with a situation when monitoring is okay.
Your opinion or my opinion is not enough to change everyone else's opinions. So we might have to learn to live with it.
Any proposed solution has to deal with that reality, not with the little bubble of one democracy which may arguably in the questionable opinions of some subset of people have a good government.
The reality includes police states where the police are truly evil.
It also includes police states where the software is written by truly evil people, to do evil things, with evil experts overseeing it all and approving evil behavior in the software they are checking.
Please tell me how you can be confident that there can be a solution that addresses this reality while protecting the privacy of users. Sometimes all the user wants to do is send a message to their boyfriend, without getting thrown off a building, burned, flogged, or killed, possibly having several generations of your family killed as well (see North Korea).
The system has to work for this reality. I'm pretty sure that simply drawing a line and fully protecting the privacy of users' messages, full stop, is a better solution than whatever you and your senators will come up with.
And yes, the security of a crypto system can be verified. If it's designed to be secure. Not if it's designed to be monitored. Even if the experts are perfect angels and absolutely competent, if there is a way to monitor, hackers will find a way to get access to it.
>When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
You're dreaming. Remember, the authorities will have full power over that system, and even in countries where the authorities are not evil, the authorities as a rule are inevitably corruptible if not corrupt. This isn't just cynicism, it's reality. Look around.
Theoretical security and actual security are two very different things. Once is mathematical which can be verified by equations. Other deals with software and imperfect developers. Software can't be verified for perfect security in a deterministic way, no matter how hard you try. Vulnerabilities pop up all the time. Your expectation that theoretical security translates to real world security is something I believe you need to think about again.
>Not if it's designed to be monitored. Even if the experts are perfect angels and absolutely competent, if there is a way to monitor, hackers will find a way to get access to it.
You seem to miss the part where I said a new protocol, not something which is modified, or backdoored. I'm surprised at you being so sure about the failure of a non-existent protocol. Do you have anything to back up your claim that any such protocol wouldn't work? Remember, it doesn't exist yet.
I honestly didn't find most of your post very coherent. There is no avenue for free speech in North Korea and other authoritarian regimes so it is a waste of time talking about working around the existing government for privacy and free speech rights. The only place where the masses can bring about change is in a democracy.
>not with the little bubble of one democracy
Last time I checked, most countries are democratic. Please show me the case where democratic countries vastly differ in how their government is organized.
> The reality includes police states where the police are truly evil.
Again, I talked about a democracy since we really can't do anything to help them with encryption and code. If there are no rights, strong encryption doesn't really matter. Look up rubber-hose cryptanalysis.
> The system has to work for this reality. I'm pretty sure that simply drawing a line and fully protecting the privacy of users' messages, full stop, is a better solution than whatever you and your senators will come up with.
It is of course is a better solution for individual privacy, I thought I talked about this at the end of my last comment. I don't have much control over my senators.
>>>When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
>You're dreaming. Remember, the authorities will have full power over that system, and even in countries where the authorities are not evil, the authorities as a rule are inevitably corruptible if not corrupt. This isn't just cynicism, it's reality. Look around.
Full power? I don't believe you have understood what I said.
At this point it feels like you're arguing for the sake of an argument.
/s
Now consider the cost of such 'solution'. Free speech gets redefined, most of the people get divided into informants,opportunists, naive state suckers and silent fragmented opposition. Is that kind of security and police state an acceptable cost? For preventing small number of violent deaths each year?
There are much bigger problems in Western societies than a bunch of lunatics killing small number of people, but those can't be used so easily to make a power grab.
Unfortunately maths doesn't work that way, there is not much in the way of a spectrum when it comes to encryption, there is a very steep cliff from secure to insecure.
So then you are faced with a very stark contrast; the security afforded by a surveillance state, or freedom with the possibility of terrorism. Personally I prefer the latter.
The trick is there is no spoon, just like there is no control; only influence.
Two questions for you.
>One solution of 'make sure' is the source code of the monitoring software must be reviewed by independent and trusted software engineers/experts.
What does that help with? (Because trusted expert aren't perfect, right?)
And second question, what if the police and government are evil, then how does your plan help?
> Of course, we need to make sure it is used for anti-terrorism only Hah, not likely in the UK - if sweeping powers exist, there will be a creeping escalation of their use by different government bodies, and for purposes not related to terrorism.
> That is my view - it is completely unacceptable
You know what else is completely unacceptable? Technologically illiterate, authoritarian jobsworths capitalising on tragedy to push through their agendas. But that's just my view.
Home Office always seems to attract the nastiest and dumbest of politicians, but this is a whole new level of dumb, and sadly will only gain her more support, because the general public either have no idea about the implications of backdoored crypto, or simply don't have any expectation of privacy and are happy to give up what little they have left in order to feel safe.
Then some genius will come up with what's essentially an "encryption is illegal for terrorists" bill and we'll have the best of both worlds: full use of encryption where we need it, whilst the terrorists can't use it because it's illegal!!
Attacks of the past have shown that terrorists don't have a need to resort to encryption. The people involved in the Berlin attack last year, for instance, were monitored. Authorities knew they would strike but they didn't have sufficient incriminating evidence that would count in court to lock those guys up.
Even if encryption on messaging services were forbidden (which would make millions of law abiding people vulnerable in some way), terrorists could use throwaway email accounts from internet cafés and wrap their messages in password protected attachments.
The latter her and the precious home secretary (now PM) have been banging on about how under threat we are from the terrorist hoards for years now - all so they can erode freedoms and increase mass surveillance under the guise of 'keeping Britain safe'.
The idea that banning encryption of private conversations will prevent these few crazy people from causing damage is of course ridiculous.
They must know enough to know that this won't actually fix the problem, so I would have to surmise that they are just trying to do something and stay somehow relevant before their term comes to an end.
"Never mind the collateral damage, I'll be retired on a government pension by then."
I'm not in the US. I have actually been very impressed by the outspoken actions of anti-Trump people in the US, with the massive protests and constant (well-deserved) media scrutiny. Also I never knew I could have so much respect for Hawaiian judges.
Why they didn't bother to vote is beyond me, though. Trump is a buffoon, but he was able to successfully motivate other buffoons to actually vote.
I did hear the description of their vote as being force to choose "between a disaster and a catastrophe" though, so that might go some way to explaining it.