Slashdot Mirror
UK Government Says App Developers Won't Be Forced To Implement Backdoors (betanews.com)
Mark Wilson writes: The UK government is sending mixed messages about how it views privacy and security. Fears have been mounting since Prime Minister David Cameron wondered aloud 'in our country, do we want to allow a means of communication between people which we cannot read?' — his view obviously being that, no, we don't want to allow such a thing. Following the revelations about the spying activities of the NSA and GCHQ, public attention has been focused more than ever on privacy and encryption, Cameron having also suggested a desire to ban encryption. Today, some fears were allayed when it was announced that the government was not seeking to require software developers to build backdoors into their products. That said, the government said that companies should be able to decrypt 'targeted' data when required, and provide access to it.
That Cameron dude seems to have lost it completely.
Unfortunately, Mr Cameron lacks even basic knowledge of technology, so is unable to appreciate that his expectations of making encrypted data readable by the NSA/GCHQ/Stasi, are completely unrealistic. Cameron should keep his slimy far right persona out of areas that he can't understand - since that appears to include most areas of government, maybe he'd be better seeing employment that is more fitting for his level of ability - perhaps as a clown or jester.
And, to answer Mr Cameron's question as to whether we want to allow means of communication between people which can't be read by the secret police - I think anyone supporting of democracy will be screaming 'yes - of course we do'. This is fundamental to any democratic society. Cameron might want some kind of despotic right wing regime, but most people here don't. Remember - Cameron was elected by a very small minority of the British people (~20%), because of the way the antiquated electoral system has failed. He most certainly has no democratic mandate to rule.
in every major encryption algo. So why do they worry?
Any data flow could be of interest to the UK gov at some time for some reason and UK staff will have to provide gov/mil access when demanded.
A brand thinking their data sets will not be of interest and not build in UK ready traps doors or back doors would be offering a "means of communication between people which we cannot read".
By default UK based brands will have to build in trapdoors, backdoors just to cover that UK gov request eventuality ie "companies must be able to provide targeted access"".
Nobody Expects the targeted data request.
Domestic spying is now "Benign Information Gathering"
The politicians deciding these rules have no idea how this stuff works. "We're not asking for back doors. Back doors are bad. We just want a way to access the contents of encrypted messages when we deem it necessary."
It'd be funny if the stakes weren't so high.
#DeleteChrome
"'in our country, do we want to allow a means of communication between people which we cannot read?"
No, no of course not. You wouldn't. Secret terrorists would be communicating in secret anywhere. Can't have that.
Something of a turnaround though, since the principles behind postal services were established.
From wikipedia, on Secrecy of Correspondence (https://en.wikipedia.org/wiki/Secrecy_of_correspondence):
"The secrecy of correspondence or literally translated as secrecy of letters, is a fundamental legal principle enshrined in the constitutions of several European countries. It guarantees that the content of sealed letters is never revealed and letters in transit are not opened by government officials or any other third party. It is thus the main legal basis for the assumption of privacy of correspondence."
To think how many terrorist attacks, civilisations destroyed and governments toppling over we could have prevented back then, if only we're allowed officials to peer through our mail.
It's high time the governments of the world started cracking down on the terrorist nests that are analog books. It's impossible to know if thought crimes are committed with ink and paper. Perhaps a mandatory legal waiver of ones human rights with each purchase of writing materials?
It might be best to just proceed to the inevitable conclusion and burn every literate human being at the stake unless they agree to live with a government approved guardian overseeing their every action and thought.
Of course internet companies won't be forced to implement back-doors: It will be totally voluntary, just like IRS audits and protection of corporate rights. The US national security industry has been there, done that. It will be interesting to see if Apple's improved security policies survive the 'encryption is evil' propaganda.
"...the government said that companies should be able to decrypt 'targeted' data when required..."
In other words "We want a backdoor, but we don't want to call it that".
David Cameron made a speech. He said the government wants it to be impossible for terrorists to hide from the security services.
Tech media sites assumed that Cameron knew exactly what he was talking about while at the same time having no idea what he was talking about. They concluded that the only way this would be achievable would be to ban encryption. In fact, given that pretty much everyone who talked about it mentioned WhatsApp and Snapchat, and no other services, it makes it pretty obvious they were getting this from each other.
Of course people took this speech as gospel and completely ignored other statements saying this was not going to happen, just like they'll ignore this
Nobody thought that Cameron didn't have a clue what he was asking for. Nobody considered that he does actually have the option to compromise; Cameron's actually pretty good at that. Everyone assumed that this vague speech was explicit unwavering government policy to ban WhatsApp and Snapchat based on a stupid echo chamber and ridiculous assumptions.
That's functionally the same thing.
"It's OK guys, GCHQ don't have the ability to remotely access all your data but they do have the ability to compel us to access all your data on their behalf."
App developers just use the libraries with backdoors.
Answer: "When you can see their lips moving".
Cameron is an ex-PR flack who never lets truth get in the way of the message.
That's not the situation. Publicly Cameron is distanced from the mass surveillance, Theresa May, is the front for that.
She's trying to get Snoopers charter through AGAIN, behind backdoors. Since we don't know the details she's pushing behind the scenes, it will likely be an omnibus bill with all the themes thrown into one: backdoors, domestic mass surveillance, hacking rights,... the lot.
http://www.theguardian.com/politics/2015/jun/13/snoopers-charter-theresa-may-refuse-to-share
All the stuff that GCHQ are doing now, rolling into one 'make it legal because they're doing it now and they have all this shit on you' bill.
Apparently Parliament can't be trusted with democracy.
NO developers were forced to add back doors to these apps, but most of them voluntarily chose to live peacefully with their families.
I'm reminded of the idiotic bogus distinction some such politicians (e.g. James Comey) try to make, saying they don't want a "back door" but a "front door".
Comey: """
There is a misconception that building a lawful intercept solution into a system requires a so-called "back door," one that foreign adversaries and hackers may try to exploit.
But that isn't true. We aren't seeking a back-door approach. We want to use the front door, with clarity and transparency, and with clear guidance provided by law.
"""
Bruce Schneier did a nice takedown of that stupidity: https://www.schneier.com/blog/archives/2014/10/more_crypto_war.html
They may as well be saying "We don't want a triangle! We want a polygon with 3 sides" or "We don't want the number 2; we want an even prime number".
Threatened, Coddled, Compelled, Menaced, Bribed, Made-to-comply-with-mandatory-regulations, 'Served', Subpoenaed, Conscripted, Coerced, Bound and Obligated.
But not Forced.
Clearly you don't follow the news about our PM.
A better haiku would be
The Turgid Member,
Slipped into a dead pig's mouth,
Like he fucks the poor
What's the difference here? Companies like Apple are designing their systems such that they never have the key to the data. They hold the data, but have no way to access it, by design. The UK is saying they're not going to require back-doors, (presumably this means "they won't be required to provide a way for us to decrypt the customer's data") but at the same time they're saying "we should have access to the data anyway".
The only three ways I see to reconcile these two statements is to do one of:
- not encrypt the data in the first place.
- use worthless encryption
- keep a copy of the key
Apple's current method of "we use strong encryption and don't have your key" would seem to voilate their requirement. But since the government wants to have a way in, without a back door, it means the company itself is required to have a back-door of their own built into the system, that allows the company access to your data. From there, the government can issue an NSL or something to force you to hand over the data.
So we're going from a back-door that lets only the government to have access to your data, to a "better model" that lets them have access to it, because the company also has access to it? How is this BETTER?
I say NO to both!
I work for the Department of Redundancy Department.
The majority of the public won't understand that "should be able to decrypt on demand" is the same thing as a back door. To them, what he said was good and fair. This is just another case of a politician playing with words in order to manipulate the electorate.
linquendum tondere
Never trust a politician's word. If the law allows them to do something they will do that thing.
Developers "Won't be forced" because they will otherwise be motivated (i.e. what just happened in the US where telcos get immunized against lawsuits in exchange for providing customers' private data to the Feds).
blindly antisocialist = antisocial
I'm more concerned about North Korea because they didn't elect their dictator, but Britain elected Cameron and so deserve him. Let him do whatever he wants to them. They deserve no better. I've no patience for morons who vote against liberty. Fuck them.
Benjamin Franklin said "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
As long as they are insecurely secure.
In classic government oxymoronic style. Governments are full of oxymorons.
Some government "adult male" in their "arrogant humility" engaged in "a just war" wants us to "agree to disagree" to introduce "astronomically small" insecurities into our "insecurely secure" systems so that "military intelligence" can "read unreadable" messages.
It all makes sense.
I'll see your senator, and I'll raise you two judges.
But if they know what's good for them...
You are welcome on my lawn.
So I'm confused. They won't make app developers put in a back door (to allow them to intercept communication) but will require them to have a method to intercept communication on demand. How exactly is that not a backdoor?
The idea is that companies are not even leaving a backdoor for themselves to be able to decrypt the data.
This is really the best of both worlds: Force backdoors (which are insecure, of course) in there, but make it right again forcing the people involved to lie about it. Everybody that does not comply is obviously a terrorist and will go into an isolation cell in prison for his remaining lifetime.
In particular the British administration is lying habitually and pathologically and nothing they say can be trusted.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Today, some fears were allayed when it was announced that the government was not seeking to require software developers to build backdoors into their products. That said, the government said that companies should be able to decrypt 'targeted' data when required, and provide access to it.
Requiring companies to have a backdoor to give data to the government is the same as requiring companies to have a government back door where the government can take the data themselves. This is just rhetoric and means absolutely nothing but typical political smoke and mirrors double-talk worthy of the US government.
Anything that can be decrypted by someone other than the user is, by definition, not encryption.
And not understand this cat is out of the bag and you will never be able to put it back in.