Slashdot Mirror
Pakistan Tries To Ban Encryption
An anonymous reader writes "Pakistan has a new Telecoms Law going into effect, which requires widespread monitoring of internet usage. In response, new reports are saying that the country is banning encryption, including VPNs, because it would interfere with the ability of ISPs to monitor internet usage."
I think you can monitor internet usage without deep packet inspection and logging. Doesn't
matter what they are bytes are bytes.
I can't wait
...now I just have to get hold of a few Pakistani bank IP addys, set up some sort of listener, and...
Oh, you thought SSL would still be around after this little law gets into effect?
(obviously I'm kidding, at least about wanting to do any such thing. OTOH, there are quite a few folks who probably wouldn't be kidding at all).
Quo usque tandem abutere, Nimbus, patientia nostra?
no more secrets. at all. this time I mean it. now go back to putting your secrets on the internet, in plain text!
The particulars may vary, but the essence is that you try to forbid people to have secrets from you.
Once you see it in this light, the paradoxical futility becomes clear.
any bets this gives some idiot in the US Gov't an idea and they add this to the next save the children legislation.
That'll work about as well as outlawing prostitution has worked for the last several thousand years.
make imaginary.friends COUNT=100 VISIBLE=false
Didn't France ban encryption at least on some strengths years ago? I'm not too familiar with what happened after that, and a quick Googling is just bringing up old hits from when the ban was enacted. Anybody care to fill in the reality of what happens in such a case?
They might actually hide the location of Osama Bin Laden....oh, wait.....
Does anyone remember when an article was posted a while back highlighting techniques for practical stenography based encryption for network traffic? Does anyone remember all the snarky comments and derision because you would never need that kind of encryption? This is how it begins.
So we'll be able to telnet right into pakistani government and military IT infrastructure then? If they ban encryption, they wont have any secured wifi...
Pfft!
Right after hundreds of top secret governments docs are leaked.
Troll is not a replacement for I disagree.
...and I thought the US government was clueless.
By "interfere with the ability of ISPs to monitor internet usage", presumably they mean collecting all their customers' account numbers, PINs, login ids, passwords, etc.
The major effect of banning encryption would be to make electronic commerce impossible. If anyone alone the data path can intercept your names, numbers, and passwords, then people will learn very quickly that the Internet simply can't be used for anything that involves a transfer of money.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
If you've got nothing to hide you've got nothing to worry about.
I worked in an IT shop where they connected several offices via encrypted tunnels through the internet. They didn't want to pay for leased lines and they were willing, most of the time, to put up with the varied response time of using the internet as the path from the branch office to the main office.
BUT, I doubt that these same companies, and I've got to believe that there are more of them out there, would be happy with having all their interoffice traffic monitored by some government agency watching their passwords, transactions, customer orders, etc.
Pakistan to outlaw prime numbers and depictions of the prophet mohammed weeping at their stupidity.
Remember that it wasn't that long ago that the U.S. was trying to peek in on you via the Clipper Chip. After being soundly trounced, they got a little smarter about it. The NSA owns the patent on DES. and can peek in on you anytime they like with your "triple DES encrypted" device. Comfy?
And us government contractors may also have to stop being able to do some work there as well.
In Ruritania we had better policy. We banned decryption.
You could encrypt as you like.
Comment removed based on user account deletion
-----BEGIN PGP MESSAGE-----
Version: APG v1.0.8
jA0ECQMChZ3RwgUsAJdg0lEBYUPJE99vUuXd5HppJFBZM0enqVmr8C8x6BYdUtBi
B1ndcpYpk8T7zotMlr/7SuS13rdg3gvvHsECU8sLNLIeUaWrWNGoMpIvRBosCuLa
dvU=
=OgVf
-----END PGP MESSAGE-----
That should be some interesting logs that your opponents can get your hands on.
..with that..
I'm sorry, I can't hear you over the sound of how awesome I am.
Seriously the Mideast, Near East, Indo East needs a power reset.
I hope they make good use of it.
As Pakistan turns into Talibanistan it will become a massive threat to the region.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
man...if this is this is the case...im closing all my bank accounts...don't want them GAS HOLES snooping around my account...and yes im from Pakistan. USA PLEASE INVADE US !
In Pakistan laws are mostly made for two reasons
1-To collect money from people as Tax system is awful. Poor people literally pay more tax than the rich people.
2-To book people you don't like when nothing else is available.
Otherwise such laws are rarely enforced. and there is no infrastructure to do that.
I can only say I'm glad they're on our side.
That'll work about as well as outlawing prostitution has worked for the last several thousand years.
Outlawing prostitution has worked, if your goal was to have a reason to arrest prostitutes....
HA! I just wasted some of your bandwidth with a frivolous sig!
Duh.
Gently reply
You forgot the last part. It should read: I can only say I'm glad they're on our side, when it is convenient for them to be.
This is a hacked account, for which the owner can not be held responsible.
They have the internet there, you uniformed, racist, insensitive clod! It's Afghanistan where they have just a couple rocks and a donkey, some poppies, and AK-47 rifles.
This is a hacked account, for which the owner can not be held responsible.
Any company I've ever worked at has encrypted traffic outside the private network on a regular basis. It's just common sense. If you don't do it, you're potentially leaking all your plans to the competition. No encryption? That would be like businesses in previous generations sending all their interoffice memos on postcards.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Because after every terrorist exploit, the security agencies make threatening noises about Skype (most favourite) followed by Gmail and then mail in general. How to explain to our dumbos that banning automobiles is no solution to hit-and-run accidents !
Insight into much, Influence over nothing !
That *is* their internet. You put your packets in the donkeys, whack them with the rocks, and away they go. The latency's a bitch, and there's pretty rough packet loss when the donkeys get concussed from the rocks or get lost in the mountains. Still, the bandwidth is surprisingly respectable.
There are a dozen ways to send private information in plain sight, and steganography is just one of the ways. Changing the last two bits in every byte of a picture may not change it very much, but you can pull out another picture from it. Likewise, you can change sound files, video files... you can alter voip packets, use blogospheres as a transmission medium. They could also use Ron Rivests "chaffing and winnowing" which works beautifully for hiding information 'in plain sight'.
That *is* their internet. You put your packets in the donkeys, whack them with the rocks, and away they go. The latency's a bitch, and there's pretty rough packet loss when the donkeys get concussed from the rocks or get lost in the mountains. Still, the bandwidth is surprisingly respectable.
Better than AT&T after they start throttling you?
This will just continue the trend of driving smart and educated Pakistanis out of Pakistan. The USA has a massive opportunity to welcome them with open arms. Are you a Pakistani who is well educated and fed up with corruption and religious hysteria? Please come and raise your family here in America.
Wow, way to make sure your country can never have any outsourcing jobs. No business with a clue would ever set up operations in a country where all traffic has to be open to corporate espionage.
They're going to be in the technological dark ages forever if this persists, vs. following India into the cheap outsourcing market.
It's not encrypted. We're just sending random, meaningless strings to one-another.
As long as you like goats in your porn, totally.
Let's just turn off the internet and be done with it.
How do donkeys compare to pigeons?
They have a couple of nuclear weapons.
(And a donkey.)
What happened to the million US guns that Charlie Wilson so proudly got the CIA to ship to al Qaeda -- don't they have some of those still?
Well of course the US would never introduce mandatory data logging logging and retention https://www.eff.org/deeplinks/2011/07/house-committee-approves-bill-mandating-internet
N.B. this user is far too lazy to write a witty and intelligent sig.
You forgot the last part. It should read: I can only say I'm glad they're on our side, when it is convenient for them to be.
That's international relations for you. Nations can work together but they are by no means friends.
Free speech?
Intelligence?
Intelligent debate?
Reason?
Basic empathy?
They have the internet, and what's more they have access to Stack Overflow, which is why every last fucking one of them is posting absolutely clueless questions which amount to little more than `uhh..hello friendz...uh...i am to be writing iPhone/Android app...i need you to write full tutorial on my app so I can sell it on markety only bugs not working so also plz fix this email me yes?`.
Please make Stack Overflow only accessible via https!
Well at least the US has the decency to simply require access to the data on-demand. The government will store it, analyze it, separate it, ... The US is perfectly happy even to pay for the colocation space for their monitoring equipment. I suppose the disadvantage is that they're actually relatively capable people (as compared to government isps in Europe, I mean).
Unlike the EU governments, and now Pakistan, who expect the isps to design and install these magical tracking systems, and of course the government's demands are extremely unreasonable (just think about how routing works and you'll see the problem : the whole point of networking once you hit a few 10G's is to avoid all traffic passing through any single location, so you won't need 1 monitoring system, you'll need thousands). But frankly is it any surprise ? Every muslim country does this, and worse. The real problem in Pakistan is not that the police and/or government may monitor traffic, it's what they'll do with the data. Pakistan is still religiously and ethnically cleansing it's own population. But you can't complain about this because it's apparently mandated by islam and you can't object to a religion.
Maybe I should start a religion with a god called la-haha to exterminate all brown haired people. I don't like them. What ? You disrespecting to my religion ?
Isn't this one of those countries that's supposedly afraid of foreign agents infiltrating their country and attacking their citizens? At least, that's the excuse totalitarian regimes always use for imprisoning and torturing their own citizens. I'd say this is a call for some actual foreign assailants to launch an attack on Pakistan. All internet traffic is unencrypted. Let's steal some government accounts and passwords. Let's read the government's emails. Let's hack into their public utilities and make 'em explode. There's all kinds of havoc that can be done.
Pakistan is evidently more concerned about its own law-abiding citizens than Chinese hackers, Russian mafia, and the American CIA combined.
I sometimes ask revealing, often ignorant-seeming questions. Maybe they're harder to answer than you think.
They don't even have rocks just the donkey.
Since all data can be represented in binary, two rocks is all you need. The donkey can then serve as the transport layer. The connection can be encrypted by picking up more rocks on the way.
Oh wise council of Pakistani elders, will you ban obfuscation too? Will you have "inquiries" on what our data really means?
What's "encrypted traffic"? Did they define that too? Like, say, "every traffic we can't instantly read"? Then say sayonara to online gaming as well, twice so if it's a MMO which by default encrypts traffic to make cheating and botting harder. And pretty much any traffic that's not following one of the well known protocols, which also means no "nonstandard" remote control software, no file transfer, no streaming, no ... you get the picture.
Talking about streaming, how do you plan to sell streamed movies online if you must not encrypt them? I mean, just to make sure all those pesky pirates don't "crack" the protocol and implement their own solution? No need to offer any computer program that decodes it, as long as there is a TV that can, the protocol can be reversed if it is not allowed to be encrypted.
No VPN? How do you convince the companies to stay instead of moving to, say, India? It's not like it's a far move, and there's plenty of equally qualified staff there. And if we learned anything from corporate business, it's that relocating companies once we don't like the laws anymore is a matter of months. Tops.
Good idea? I kinda doubt it. And while it may work for Pakistan, I somehow cannot see this becoming reality in any country where business and entertainment are more dependent on the internet. Both companies and people would quickly get angry at the mere idea of trying to push something like that.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Memo Australian Government: this is how you make your intergoogle filter work. It comes with the advantage of completely screwing up any credible e-commerce in the country, too, which is handy when you want your economy to be all about being someone else's quarry.
Athy, athier, athiest.
They have the internet there?
Our office in Islamabad gets a speedtest result of 100mbit from a local server, and gets between 20 to 32mbit to a server in the UK.
The pakistan goverment has lost the plot, they really dont have a clue. The banks will be the first to tell them where to stick there laws as they will not allow there data to between sites without using a VPN.
I dont think they will be able to implement this law.
Probably the one country I would say "Go for it", and not get my back all up about privacy etc...
I would, should I live in Pakistan, but I don't, and given all that has happened over say the last 10 years... Go nuts.
That said, nothing to say the government would actually act responsible anyway, or that this would actually be very enforceable. Odds are the people that want to do it would just become very good at hiding it.
This is such fake news. If you had taken even 5 minutes to read through that document you would have seen that its targeted at large-scale unlicensed VOIP operators. PTCL has a monopoly on international calls and this is designed to preserve that. Hell even the PDF is titled "monitoring telephony traffic"! Can't you read? Its got ABSOLUTELY NOTHING to do with general internet traffic. I live in Pakistan and use SSH to log into my US based web server every day. SSL sites work fine. Where are the slashdot editors? You guys published this without getting the facts straight.