Slashdot Mirror
China Passes Law Requiring Tech Firms To Hand Over Encryption Keys (betanews.com)
Mark Wilson writes: Apple may have said that it opposes the idea of weakening encryption and providing governments with backdoors into products, but things are rather different in China. The Chinese parliament has just passed a law that requires technology companies to comply with government requests for information, including handing over encryption keys.
Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists. China already faces criticism from around the world not only for the infamous Great Firewall of China, but also the blatant online surveillance and censorship that takes place. This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists. China already faces criticism from around the world not only for the infamous Great Firewall of China, but also the blatant online surveillance and censorship that takes place. This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
China gets.
It's kinda horrifying that we are so close to chinese draconian laws or even further advanced that we can't even complain about them. This is about to be implemented in the U.S. and in U.K. you get to stay in jail until you reveal your password.
Please stop being the UK govs role model...
If a key which is in the hands of a company (Apple, Huawei, ...) is your only line of defence WRT the security/privacy of content you supply or save, then you should regard this content to be public and open for preying eyes already. I think it is called "trusted" in that negative, military sense.
Just like email sent to a @gmail.com account or company secrets in an office365 account. Your grandma and neighbour won't get there, police/law enforcement will have sever problems. But 3LetterAgencies of many governments will read it if they want to.
605413? Yes, it's a prime.
Just like the USA distanced itself from eugenics (such as the mandatory sterilization of people with mental disabilities) when it got popular with the Nazis, maybe China demanding encryption keys will get some American politicians to back off of the idea.
>> What is the implication for companies that don't have keys to hand over then? Backdoors, key escrow pushed into the applications, etc.
Don't the Democrats want basically the same thing?
Wait, if the Chinese are doing it, doesn't that mean that it's an evil commie tactic that no God-fearing American would ever even suggest using?
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
.
If Apple wants to continue selling devices in China (which is a needed market for Apple, as the US market is becoming saturated), then Apple will comply with the laws of China.
It's as simple as that.
Give Chinese consumers crippleware products so no company cares enough to protect its Chinese sold IP.
Seems simple enough. An iPhone 666.
Yet another reason for companies to make sure they don't have the keys to their users' data. You can't provide what you provably never had.
Of course, if governments require vendors to escrow the keys that strategy won't work. But it doesn't appear that China has gone that far.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
That is a fucking atrocious idea. Giving into China here nullifies their "we don't play that" stance. Uncle Sam will know that they DO play that way; if you threaten Apple's profits. Once that door is open Uncle Sam will get what he wants.
This isn't a vague slippery slope fallacy either. This is a direct consequence.
This latest move is one that will be view very suspiciously by foreign companies operating within China, or looking to do so.
Why would they view it suspiciously? They'll fall into line and do what the Chinese government requires of them because they'll deem it worth the cost. Money and profits above all else.
Yep. Research In Motion paved the way when they handed over BES encryption keys to the Indians.
...and removing all Chinese certs from my trusted certs list in 5....4....3...
There's no place like
then Apple will comply with the laws of China.
As most of us have found out when going for PCI compliance, the best way to protect data is often not to possess it. If the keys are generated by the consumer, than it is the consumer that needs to hand over the keys, and not Apple. My understanding is that Apple cannot decrypt customer data, even if they wanted to, as only the customers possess the key(s) to do so.
Sanders voted against CISA while Clinton wants a "Manhattan Project" where Google, Apple, and MS give the government your keys "voluntarily".
If Apple wants to continue selling devices in China (which is a needed market for Apple, as the US market is becoming saturated), then Apple will comply with the laws of China.
Which is why it is better for all tech firms to not have access to encryption keys. End to end encryption needs to be the standard, so there are no keys to turn over.
Wait, if the Chinese are doing it, doesn't that mean that it's an evil commie tactic that no God-fearing American would ever even suggest using?
Not if they sell them in Wal-Mart.
A difficult choice for tech companies is coming. If they provide the Chinese with the backdoors they ask for, they can't very well deny any other governments who ask for the same thing now can they ? They'll have to build country compliant models to appease every little dictator on the planet :|
Otoh, if they refuse to play ball, they'll be blocked from selling products in the country, depriving them of large amounts of revenue. Perhaps this is how China will force it's citizens onto China authorized products instead of Apple, Androids, etc.
After all, it's easier to control people when you limit their choices.
My guess, however, is that the dollar signs are flashing before their eyes even as I type this. If we know Google and Apple half as well as we think we do, you know they're going to cave in because it's just too much money to give up. In the business world, $$$ > morals every time.
...The law establishes basic principles for counter-terrorism work and strengthens measures of prevention, handling, punishment as well as international cooperation, he said.
Under the new bill, telecom operators and internet service providers are required to provide technical support and assistance, including decryption, to police and national security authorities in prevention and investigation of terrorist activities.
They should also prevent dissemination of information on terrorism and extremism.
Li Shouwei of the National People's Congress (NPC) Standing Committee legislative affairs commission, said the rule accorded with the actual work needed to fight terrorism and was basically the same as other major countries.
"The clause reflects lessons China has learned from other countries and is a result of wide solicitation of public opinion," he added.
"(It) will not affect companies' normal business nor install backdoors to infringe intellectual property rights, or ... citizens freedom of speech on the internet and their religious freedom," Li said.
China's national security law adopted in July also requires Internet and information technology, infrastructure, information systems and data in key sectors to be "secure and controllable"....
Why not? Region coded crypto keys...
Nah, it only means that China is now imitating the west.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Apple should comply with this request, it is actually a very good thing for the US (and terrible for china). By creating this backdoor, China is painting a huge target on the server(s) that store these 'master keys'. Every foreign intelligence agency in the world will want in and they will get in. Someone will forget to check a password buffer when coding it, or someone with an admin password will be presented with embarrassing pictures, and then wham! every western Intel agency will have access to the phone data for all the important people in China. This data will need to be used by so many people that it should be trivial to compromise someone with a master key.
Apple will then be complying with China's laws, and can keep raking in the bucks by selling them easy to compromise phones and personal gadgetry. Nothing requires them to then cripple their phones in other parts of the world, which they will presumably not do so they can claim that they have a secure platform as a sales point every else. Win Win.
Of course, the person getting fucked is the average Chinese person. They are being ass-reamed even harder by the government stooges, but perhaps this will be the thing that finally pisses the populace off enough to finally rise up and start hanging all the communist stooges running the country.
I bet the NSA is having a massive Christmas circle jerk over this one. Their job just became a million times easier...
HA! I just wasted some of your bandwidth with a frivolous sig!
How would Apple not be complying with China's laws if they had no keys to hand over? Or would they assume that Apple was simply lying?
File under 'M' for 'Manic ranting'
It's quite interesting actually because now we get to see what sort of price Apple places upon its principles and core values.
An Apple's core is the part you throw out.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Not to mention things like open source encryption software like GnuPG or Signal. They sell nothing so need no local front to deal with payments. Only remaining option is they get blocked (hi Brasil).
Always mind you wording in reporting of such things.
If China does it, it's oppression of liberty. If we do it, it's the fight against crime an terrorism.
" Good luck buying enough rare earth elements for Your electronics, because we control 97% of worlds market for them." Too bad you posted as AC, because I think this is actually the biggest "risk" in general, and not just because of this recent encryption issue. All of our modern electronics needs these, the US shut down it's major rare earth mine at Mountain Pass, CA several years ago. We could try to recycle more phones...but once again most recycling centers are also over in China. Even if we found a new amazing rare earths deposit it takes years to build a mine. The most abundant source we've found so far is probably the Moon, but it will probably be another 25-50 years before we have a functioning mining colony there if ever.
This is a great opportunity for hackers to exploit back doors and move money from the Chinese economy to (say) the Russian economy.
A government mandated back door is otherwise known as a zero-day exploit.
Woohooo....
Don't take life too seriously; it isn't permanent.
"But also the blatant online surveillance and censorship that takes place." Just like America... And Brazil....
Companies / service providers which maintain access to locked containers may be compelled to unlock them upon government request.
In which country is this NOT true?
Of course the state of encryption nowadays is that companies are using the same lock combination for ALL their containers. That is a problem that needs to be fixed (perfect forward secrecy).
Another problem is that companies who carry information often do this by accepting a message from person A and then repackaging it for person B -- which makes them liable for the contents of the message. This is also also fixable (messages sent from person A should be locked only for opening by person B).
I fully support the content of this news article insofar as it has not infringed on The Universal Declaration of Human Rights and as it is bringing more attention to these two existing issues above.
-- I was raised on the command line, bitch
"Under the guise of counter-terrorism, the controversial law is the Chinese government's attempt to curtail the activities of militants and political activists."
This is always the case, whether it's the Chinese government or any other. I wish more people in the general public understood that. At least I don't have to change my sig.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)
You are suggesting this is a recent change. China has been imitating the USA for a long time. It's likely the US also demands encryption keys, but the law is probably secret.
I don't think the US government would allow Apple to sell a product that they couldn't spy on.
They already are.
File under 'M' for 'Manic ranting'
Now that IBM has sold of the last of their server systems to Lenovo, after following dumping all their PC operations to the same Chinese Lenovo a few years ago... The legacy of IBM is compromised crap.
China is here, Mr. Burton!
Yay, go Trump!
Only I can judge you.