Slashdot Mirror
China Passes Law Requiring Tech Firms To Hand Over Encryption Keys (betanews.com)
Mark Wilson writes: Apple may have said that it opposes the idea of weakening encryption and providing governments with backdoors into products, but things are rather different in China. The Chinese parliament has just passed a law that requires technology companies to comply with government requests for information, including handing over encryption keys.
Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists. China already faces criticism from around the world not only for the infamous Great Firewall of China, but also the blatant online surveillance and censorship that takes place. This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists. China already faces criticism from around the world not only for the infamous Great Firewall of China, but also the blatant online surveillance and censorship that takes place. This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
This is like Sputnik. Now we have to do something "before this decade is out"...
-F
Because you're stuck in the trap now.
It's not like they don't already have a mountain of cash.
that don't have keys to hand over then?
China gets.
It's kinda horrifying that we are so close to chinese draconian laws or even further advanced that we can't even complain about them. This is about to be implemented in the U.S. and in U.K. you get to stay in jail until you reveal your password.
Please stop being the UK govs role model...
If a key which is in the hands of a company (Apple, Huawei, ...) is your only line of defence WRT the security/privacy of content you supply or save, then you should regard this content to be public and open for preying eyes already. I think it is called "trusted" in that negative, military sense.
Just like email sent to a @gmail.com account or company secrets in an office365 account. Your grandma and neighbour won't get there, police/law enforcement will have sever problems. But 3LetterAgencies of many governments will read it if they want to.
605413? Yes, it's a prime.
This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
Why would they view it suspiciously? They'll fall into line and do what the Chinese government requires of them because they'll deem it worth the cost. Money and profits above all else.
Just like the USA distanced itself from eugenics (such as the mandatory sterilization of people with mental disabilities) when it got popular with the Nazis, maybe China demanding encryption keys will get some American politicians to back off of the idea.
Shows they endorse Communism over American freedom.
Sad really actions tell the real story not words ask any American Indian.
if you work on different security models where the keys aren't owned by Apple they can't hand them over and then voila.
Don't the Democrats want basically the same thing?
want for the US.
.
If Apple wants to continue selling devices in China (which is a needed market for Apple, as the US market is becoming saturated), then Apple will comply with the laws of China.
It's as simple as that.
They've tried asking for this before in the past, and also tried asking for complete system blueprints of the things being built as companies outsource components to China but assemble them domestically.
China's rotten history in regards to respect for Intellectual Property and Human Rights aside, if any policing agency attempts to reinforce this law, the company will quite likely move out and then outsource to another country such as Vietnam or Cambodia should they push it.
China needs to find better and less invasive ways to police those who choose to do business with them.
Apple's response will be that they have handed over all the keys they have.
Unless China is mandating that devices can't negotiate their own keys without the involvement of Apple. But that would mean banning entire categories of apps.
Ian Ameline
Give Chinese consumers crippleware products so no company cares enough to protect its Chinese sold IP.
Seems simple enough. An iPhone 666.
If keys were distributed on initial boot by a 3rd party, could the law as it is currently written be circumvented?
Yet another reason for companies to make sure they don't have the keys to their users' data. You can't provide what you provably never had.
Of course, if governments require vendors to escrow the keys that strategy won't work. But it doesn't appear that China has gone that far.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
What does a law passed by the Chinese Parliament have to do with Apple, particularly?
This is a non story China is a communist dictatorship. They can and will do whatever they want. The Chinese people should rise up and destroy the communist party and join the rest of the world as a free and democratic nation.
But um, Apple has no keys. Apple, says, WTF?
What does a law passed by the Chinese Parliament have to do with Apple, particularly?
Apple, in particular, has been fighting against pressure from the US Government to do exactly what this new Chinese law requires. Back in iOS 8 (Or was it 7?) Apple stopped storing the encryption keys for iOS devices on their systems, so they cannot comply with government orders to unlock or decrypt user data on phones. The US DOJ and the CIA have been throwing an fit ever since. Now it looks like if Apple wants to continue to sell phones in China, they will have to give in and then that will give the US government some leverage to try to force them to do it here as well.
I browse on +1 so AC's need not respond, I won't see it.
...and removing all Chinese certs from my trusted certs list in 5....4....3...
There's no place like
then Apple will comply with the laws of China.
As most of us have found out when going for PCI compliance, the best way to protect data is often not to possess it. If the keys are generated by the consumer, than it is the consumer that needs to hand over the keys, and not Apple. My understanding is that Apple cannot decrypt customer data, even if they wanted to, as only the customers possess the key(s) to do so.
Sanders voted against CISA while Clinton wants a "Manhattan Project" where Google, Apple, and MS give the government your keys "voluntarily".
If Apple wants to continue selling devices in China (which is a needed market for Apple, as the US market is becoming saturated), then Apple will comply with the laws of China.
Which is why it is better for all tech firms to not have access to encryption keys. End to end encryption needs to be the standard, so there are no keys to turn over.
The Chinese people will always be able to download non-corrupted OS's and install them, Comrade. The hackers of the free world will see to that.
A difficult choice for tech companies is coming. If they provide the Chinese with the backdoors they ask for, they can't very well deny any other governments who ask for the same thing now can they ? They'll have to build country compliant models to appease every little dictator on the planet :|
Otoh, if they refuse to play ball, they'll be blocked from selling products in the country, depriving them of large amounts of revenue. Perhaps this is how China will force it's citizens onto China authorized products instead of Apple, Androids, etc.
After all, it's easier to control people when you limit their choices.
My guess, however, is that the dollar signs are flashing before their eyes even as I type this. If we know Google and Apple half as well as we think we do, you know they're going to cave in because it's just too much money to give up. In the business world, $$$ > morals every time.
So how is this different from what the UK and the US and other governments want?
http://it.slashdot.org/story/1...
http://tech.slashdot.org/story...
http://yro.slashdot.org/story/...
http://yro.slashdot.org/story/...
etc.
...The law establishes basic principles for counter-terrorism work and strengthens measures of prevention, handling, punishment as well as international cooperation, he said.
Under the new bill, telecom operators and internet service providers are required to provide technical support and assistance, including decryption, to police and national security authorities in prevention and investigation of terrorist activities.
They should also prevent dissemination of information on terrorism and extremism.
Li Shouwei of the National People's Congress (NPC) Standing Committee legislative affairs commission, said the rule accorded with the actual work needed to fight terrorism and was basically the same as other major countries.
"The clause reflects lessons China has learned from other countries and is a result of wide solicitation of public opinion," he added.
"(It) will not affect companies' normal business nor install backdoors to infringe intellectual property rights, or ... citizens freedom of speech on the internet and their religious freedom," Li said.
China's national security law adopted in July also requires Internet and information technology, infrastructure, information systems and data in key sectors to be "secure and controllable"....
They're as bad as the UK.
Apple should comply with this request, it is actually a very good thing for the US (and terrible for china). By creating this backdoor, China is painting a huge target on the server(s) that store these 'master keys'. Every foreign intelligence agency in the world will want in and they will get in. Someone will forget to check a password buffer when coding it, or someone with an admin password will be presented with embarrassing pictures, and then wham! every western Intel agency will have access to the phone data for all the important people in China. This data will need to be used by so many people that it should be trivial to compromise someone with a master key.
Apple will then be complying with China's laws, and can keep raking in the bucks by selling them easy to compromise phones and personal gadgetry. Nothing requires them to then cripple their phones in other parts of the world, which they will presumably not do so they can claim that they have a secure platform as a sales point every else. Win Win.
Of course, the person getting fucked is the average Chinese person. They are being ass-reamed even harder by the government stooges, but perhaps this will be the thing that finally pisses the populace off enough to finally rise up and start hanging all the communist stooges running the country.
I bet the NSA is having a massive Christmas circle jerk over this one. Their job just became a million times easier...
HA! I just wasted some of your bandwidth with a frivolous sig!
How would Apple not be complying with China's laws if they had no keys to hand over? Or would they assume that Apple was simply lying?
File under 'M' for 'Manic ranting'
Assistance to do what? Wire-tapping, mass-surveillance, planting malware/evidence. That's a vague statement.
Is apple required to know the key on the device? Also, is there a time-frame for finding the key to a phone. Otherwise, it's a "Yeah, that'll be ready in 5 years" situation.
What does a law passed by the Chinese Parliament have to do with Apple, particularly?
Money. That's what. How much do you figure the Chinese market is worth to Apple? Suppose that Apple was made "an offer they couldn't refuse" by the Chinese government: "You decrypt whatever devices we ask you to. If you can't or won't, you don't do business in China". It's quite interesting actually because now we get to see what sort of price Apple places upon its principles and core values. Do they sell out? Stay tuned.
It's quite interesting actually because now we get to see what sort of price Apple places upon its principles and core values.
An Apple's core is the part you throw out.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Easy.
China: Hand over the encryption keys to phone X.
Apple: We can't do that, we don't have them. They are generated by the end users.
China: We don't care. Either insert a harware capability for You or us to get the keys from the end users or get the fuck out of our market. You want to try and manufacture Your phones somewhere else? Have fun paying for it several times more. You want to try and fight this regulation? Good luck buying enough rare earth elements for Your electronics, because we control 97% of worlds market for them.
Now please tell me Your response.
Can not Apple give them the key used by NS*?
Always mind you wording in reporting of such things.
If China does it, it's oppression of liberty. If we do it, it's the fight against crime an terrorism.
...unlike the self proclaimed champions of democracy and free speech that go about doing just the same behind everybody's back or pass laws requiring just the same right?!
worthless politicians they will be ruin to all of us for sure. .... back to the topic, it will be interesting to see Apple's response, they're already waist deep in China market and they depend on it for their latest number achievement announcements, as mentioned by others the American market is increasingly tough and since latest designs by Apple like the pencil or the hideous battery pack aren't rising any appraisals I don't think they are going to risk a non compliance to the Chinese government.
" Good luck buying enough rare earth elements for Your electronics, because we control 97% of worlds market for them." Too bad you posted as AC, because I think this is actually the biggest "risk" in general, and not just because of this recent encryption issue. All of our modern electronics needs these, the US shut down it's major rare earth mine at Mountain Pass, CA several years ago. We could try to recycle more phones...but once again most recycling centers are also over in China. Even if we found a new amazing rare earths deposit it takes years to build a mine. The most abundant source we've found so far is probably the Moon, but it will probably be another 25-50 years before we have a functioning mining colony there if ever.
This is a great opportunity for hackers to exploit back doors and move money from the Chinese economy to (say) the Russian economy.
A government mandated back door is otherwise known as a zero-day exploit.
Woohooo....
Don't take life too seriously; it isn't permanent.
"But also the blatant online surveillance and censorship that takes place." Just like America... And Brazil....
China already faces criticism from around the world...
Oh, so when China does it, it's all "evil conspiracy" this and "blatant censorship" that, but when good ol' U. S. of Donald Trump A. says the same thing, it's all about "National Security" against "Terrorism!" and "Immigrants!"
Perfect Sense!
Companies / service providers which maintain access to locked containers may be compelled to unlock them upon government request.
In which country is this NOT true?
Of course the state of encryption nowadays is that companies are using the same lock combination for ALL their containers. That is a problem that needs to be fixed (perfect forward secrecy).
Another problem is that companies who carry information often do this by accepting a message from person A and then repackaging it for person B -- which makes them liable for the contents of the message. This is also also fixable (messages sent from person A should be locked only for opening by person B).
I fully support the content of this news article insofar as it has not infringed on The Universal Declaration of Human Rights and as it is bringing more attention to these two existing issues above.
-- I was raised on the command line, bitch
"Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists."
This is always the case, whether it's the Chinese government or any other. I wish more people in the general public understood that. At least I don't have to change my sig.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
I don't think the US government would allow Apple to sell a product that they couldn't spy on.
They already are.
File under 'M' for 'Manic ranting'
Now that IBM has sold of the last of their server systems to Lenovo, after following dumping all their PC operations to the same Chinese Lenovo a few years ago... The legacy of IBM is compromised crap.
The "that's a Commie tactic and we aren't Commies" interpretation does not favour the Three Letter Agencies. Therefore I predict they will sell adoption of these practices as, "the Commies have it and in order to be competitive, we must have it too!"
No, it will fall to citizens with a different perspective and agenda, to counter this narrative. We must sell this as "it's an evil commie tactic that no God-fearing American would ever even suggest using". In fact we should say that "only a closet Commie-Loving subversive would suggest our side should use such tactics. It's against God, Freedom and The Flag".
Sure, it's extreme. Given the tactics and wins the Three Letter Agencies have against privacy and the constitution, what choice do we have? They aren't even asking permission to spy on the innocent anymore. They just take the data and persecute anyone who calls them out. All in the name of terrorism and when they can't establish any security wins as a result. It's the triumph of a bureaucratic establishment.
China is here, Mr. Burton!
You'll get my encryption keys over my cold dead body, and even then, you'd have to have the tech to hack my brain. Ya, good luck with that.