On 17/07/16 02:42, Zenaan Harkness wrote:
On Sat, Jul 16, 2016 at 06:02:57PM +0100, Peter Fairbrother wrote:
On 16/07/16 09:28, Georgi Guninski wrote:
Hope this is not duplicate, the personal drivels were quite
noisy.
http://www.theregister.co.uk/2016/07/14/gov_says_new_home_sec_iwilli_have_powers_to_ban_endtoend_encryption/
UK gov says new Home Sec will have powers to ban end-to-end encryption
Very sound, nice and democratic...
First part:
Things said in the Lords (or Commons), even by Government spokesmen, have
approximately zero legal significance. To a very close approximation.
Practically speaking, indistinguishable from zero.
What the Courts look at is the wording of the Act.
Which in this case is pretty bad, but not a power to ban end-to-end
encryption.
In fact, it doesn't affect most in-use forms of end-to-end encryption at
all.
Second part:
"Relevant operators" are persons who provide "any service that consists in
the provision of access to, and of facilities for making use of, any
telecommunication system (whether or not one provided by the person
providing the service) [... including] any case where a service consists in
or includes facilitating the creation, management or storage of
communications transmitted, or that may be transmitted, by means of such a
system."
That would include many commercial sites who use SSL/TLS. If you put a
"contact me" link on your web pages, you are a "relevant operator". Gimme
your SSL keys!
I'm not sure how you can say the first part above, in the face of
quoting and saying what you do in the second part.
That's what the Bill actually says, if you read it carefully. Like RIPA, it
is opaque beyond the point of obscurity, and it takes a lot of reading.
You quoted the relevant part, thank you. That part does not take much
reading to see how bad it truly is, even though the rest (unquoted) of
the bill may be massively opaque.
Actually, just finding that in the Bill wasn't easy - and it isn't a
single part, it's taken from at least five different places in the Bill.
If it seems clear, then I did a good job putting them together.
Thing is, while the Bill isn't good, it doesn't have anything at all to
do with banning end-to-end encryption. Or banning any sort of encryption.
It can require "relevant operators" to maintain some backdoors, most
obviously in mobile link encryption and some VPNs and other encrypted
links which are operated by "relevant operators".
Less obviously, it can be applied to some websites and the like.
But there is no power to ban encryption anywhere in the Bill.
If you as a private person apply the encryption yourself, there is no
power in the Bill to make you backdoor it (though there have been powers
in RIPA to enforce demands for keys in some circumstances since 2001),
and there is no power to prevent you from using encryption.
Good points? Only encryption which has been applied by a "relevant
operator" is affected -
So something is good, or potentially good - let's find out what:
at least until the Home Secretary makes regulations
otherwise (which under the Bill she can do).
In other words, the bill doesn't automatically affect the status quo of
existing websites (website certificates?) because, well who knows,
that's the current interpretation but tomorrow's interpretation can just
as well be "hand over your keys bitch, or you're going to jail" even if
you are Facebook or Google (though the "going to jail" bit, if it were
possible, would be a good outcome for Facebook for example ... alas, I
dream)!
And the determination of who has to hand over keys (i.e. who is a
"relevant operator") is nothing more than whatever the Home Secretary
(currently female it seems)
Yep, we have a brand new female Home Secretary. The old one is now Prime
Minister ...
(and she's madder than Mad Maggy Thatcher ever was 8-(
says! Perhaps next week is her bad week of
the month and your free speech website (nicely TLSed with personally
issued and in person verified certificate provider keys etc) happens to
have a discussion which pushes her (the Home Secretary's) trigger word
buttons.
And you say this is GOOD?!
WTF? Am I misunderstanding something here?
I was not clear - while the HS can extend the notices to eg include
other forms of encryption not applied by "relevant operators", she
cannot serve notices on, or force any other obligation on, anyone except
"relevant operators".
If you are a private citizen and you aren't providing a service, she
can't prevent you from doing any encryption you like, nor can she make
you backdoor it.
PGP is okay, and there's not a thing in the Bill which says she can do
anything to ban it.
Neither can she stop people using SSL/TLS, or except in the case of some
UK-based servers, mandate backdoors in it.
She could in theory serve a notice on Google, Apple or Facebook - but in
practice, none of these would actually be obligated to obey it.
Sounds as good as North America's endless extra-judicial drone killings
(that's murder, and despotic, in case it's not otherwise obvious to
you).
Bad points? It doesn't do anything at all against the clued-up terrorist or
criminal. It decreases security for legitimate actors and businesses.
You say that as though there are good points, see above.
BTW, things said in the Lords (or Commons), even by Government spokesmen,
have approximately zero legal significance. What the Courts look at is the
wording of the Act.
Thanks for quoting the relevant part of the act, and letting us know
that the definitions for "relevant operator"s will be handed down extra-
judicially by the Home Secretary.
err, no - that one is defined in the Bill, she can't change the meaning
of "relevant operator".
She can change some of the things she requires "relevant operators" to
do - but if you aren't a "relevant operator" she can't require you to do
anything.
How very, democratic we might as well call it..
hmmm
-- Peter Fairbrother
