Signal says it'll shut down in UK if Online Safety Bill approved
- Reference: 1677323887
- News link: https://www.theregister.co.uk/2023/02/25/signal_uk_online_safety_bill/
- Source link:
The [1]Online Safety Bill contemplates [2]bypassing encryption using device-side scanning to protect children from harmful material, and coincidentally breaking the security of end-to-end encryption at the same time. It's currently being considered in Parliament and has been [3]the subject of controversy for months.
[4]The bill as currently formulated would obligate social media companies to prevent children from being exposed to harmful content online and would hold executives criminally liable for harms like failing to remove illegal content or failing to censor posts implicated in cyberbullying or self-harm.
[5]
The legislation contains what critics have called " [6]a spy clause ." [PDF] It requires companies to remove child sexual exploitation and abuse (CSEA) material or terrorist content from online platforms "whether communicated publicly or privately." As applied to encrypted messaging, that means either encryption must be removed to allow content scanning or scanning must occur prior to encryption.
Signal draws the line
Such schemes have been [7]condemned by technical experts and [8]Signal is similarly unenthusiastic.
"Signal is a nonprofit whose sole mission is to provide a truly private means of digital communication to anyone, anywhere in the world," said Meredith Whittaker, president of the Signal Foundation, in a statement provided to The Register .
[9]
[10]
"Many millions of people globally rely on us to provide a safe and secure messaging service to conduct journalism, express dissent, voice intimate or vulnerable thoughts, and otherwise speak to those they want to be heard by without surveillance from tech corporations and governments."
"We have never, and will never, break our commitment to the people who use and trust Signal. And this means that we would absolutely choose to cease operating in a given region if the alternative meant undermining our privacy commitments to those who rely on us."
[11]
Asked whether she was concerned that Signal could be banned under the Online Safety rules, Whittaker told The Register , "We were responding to a hypothetical, and we’re not going to speculate on probabilities. The language in the bill as it stands is deeply troubling, particularly the mandate for proactive surveillance of all images and texts. If we were given a choice between kneecapping our privacy guarantees by implementing such mass surveillance, or ceasing operations in the UK, we would cease operations."
In response to Whittaker's remarks, Dr Monica Horten, policy manager for freedom of expression at [12]Open Right Group , urged the UK government to drop the clause.
"The spy clause in the Online Safety Bill will give Ofcom the power to ask private companies to scan everyone’s private messages on behalf of the government," Horten said in a statement. "Quite simply, it is state-mandated private surveillance of the kind that we see in authoritarian regimes.
[13]
"Signal’s announcement highlights just how seriously these proposals will threaten encryption and undermine our right to communicate securely and privately.
"If Signal withdraws its services from the UK, it will particularly harm journalists, campaigners and activists who rely on end-to-end encryption to communicate safely."
[14]Internet Society condemns UK's Online Safety Bill for demonising encryption using 'think of the children' tactic
[15]UK Online Safety law threatens Big Tech bosses with jail
[16]UK's Online Safety Bill drops rules forcing social media to remove 'legal but harmful' content
[17]Signal CEO Moxie Marlinspike resigns, leaves WhatsApp co-founder to run things until a successor is named
The UK is targeting encryption on another front, too. Last month, the UK Home Office opened consultation on [18]a set of proposals to address serious and organized crime.
One of these contemplates criminalizing the manufacture or possession of "sophisticated encrypted communication devices," an ill-defined category that encompasses the software and hardware used on supposedly secure (and since seized) phone networks like [19]ANOM , [20]EncroChat , [21]Phantom Secure , and [22]Sky Global .
"These sophisticated devices provide access to encrypted communication platforms used by serious and organized criminals to plan their illicit activities," the Home Office argues. "The highly encrypted nature of such devices and the way they have been modified create considerable barriers to law enforcement agencies collecting intelligence and evidence in respect of serious crimes."
Back in the Land of the Free
US officials frequently have expressed similar fears that encryption will leave them [23]in the dark , and have likewise tried to promote [24]unworkable rules to ensure only "the good guys" get protected by encryption.
The proposed UK ban would be aimed at "bespoke devices … where the software/hardware has been developed to anonymize its users and their communications and its user base is assessed to be almost certainly criminal."
It would not apply to off-the-shelf, commercial mobile phones "nor the encrypted messaging apps available on them." So in theory, Signal would not be implicated. But other security technologists take issue with the Home Office proposals.
In a [25]blog post on Thursday, Riana Pfefferkorn, a research scholar at the Stanford Internet Observatory, published her response to the government's request for comments (which the Home Office won't do until June 2023, and then only in summary form) and elaborated on her concerns.
"Where’s the line between 'bespoke devices' and 'commercially available mobile phones [and] the encrypted messaging apps available on them'?" she asks. "People must be put on notice of what is and isn't criminal so they can comport their behavior accordingly. A lax definition coupled with strict criminal liability makes a mockery of due process."
Pfefferkorn is unsparing in her skewering of the Home Office's approach, characterizing it as a continuation of "UK's long, ignoble history (RIPA, DRIPA, IP Act) of surveilling people." And she twists the knife by turning to the commercial consequences of overbroad restrictions.
"If you get this wrong, you’ll end up criminalizing a lot of people whose only offense is using or selling a phone that is too abnormal for the Government’s official tastes," she writes. "Either you’re an obedient consumer who uses what Samsung, Google, Apple, and Meta have to offer, or you’re a criminal. Good luck developing your moribund tech industry with that attitude."
At least Northern Ireland and Scotland will be spared. The Home Office legislative proposals, if adopted, will apply only to England and Wales. ®
Get our [26]Tech Resources
[1] https://bills.parliament.uk/bills/3137
[2] https://www.eff.org/deeplinks/2022/08/uks-online-safety-bill-attacks-free-speech-and-encryption
[3] https://www.theregister.com/2023/01/18/social_media_uk_online_safety/
[4] https://bills.parliament.uk/publications/49376/documents/2822
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y-o@tdX6e@amKMtnhBw58gAAAI8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://blogs.soas.ac.uk/cop/wp-content/uploads/2022/12/SOAS-ICOP-Briefing-Online-Safety-Bill.pdf
[7] https://www.theregister.com/2022/10/13/clientside_scanning_csam_anderson/
[8] https://signal.org/en/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-o@tdX6e@amKMtnhBw58gAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y-o@tdX6e@amKMtnhBw58gAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y-o@tdX6e@amKMtnhBw58gAAAI8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.openrightsgroup.org/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y-o@tdX6e@amKMtnhBw58gAAAI8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://www.theregister.com/2022/01/28/internet_society_calls_out_uk_encryption_war/
[15] https://www.theregister.com/2023/01/18/social_media_uk_online_safety/
[16] https://www.theregister.com/2022/11/30/uk_online_safety_bill/
[17] https://www.theregister.com/2022/01/11/signal_ceo_moxie_marlinspike_resigns/
[18] https://www.gov.uk/government/consultations/strengthening-the-law-enforcement-response-to-serious-and-organised-crime/consultation-document-accessible#executive-summary
[19] https://www.justice.gov/usao-sdca/pr/fbi-s-encrypted-phone-platform-infiltrated-hundreds-criminal-syndicates-result-massive
[20] https://www.europol.europa.eu/media-press/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe
[21] https://www.fbi.gov/news/stories/phantom-secure-takedown-031618
[22] https://www.justice.gov/usao-sdca/pr/sky-global-executive-and-associate-indicted-providing-encrypted-communication-devices
[23] https://www.theregister.com/2018/01/09/fbi_boss_backdooring_encryption/
[24] https://www.theregister.com/2016/12/21/encryption_vital_to_us_interests/
[25] https://cyberlaw.stanford.edu/blog/2023/02/my-comment-uk-government-its-proposal-ban-%E2%80%9Cbespoke%E2%80%9D-%E2%80%9Csophisticated%E2%80%9D-encrypted-phones
[26] https://whitepapers.theregister.com/
Re: Care
After all, how are they going to calculate your social credit score if they don't have any data on you?
Quite easy... they will be making it up as they go. It is the best "calculated" score one can get. Just like always, they "calculate" your next move and adjust their moves. It is only "calculated" to hit those that must be hit, honest.
And, by the way, it is dark in the daytime and light at night. Just so that you know the answer to the next calculated questionnaire.
Re: Care
I mean given that Treasury and HMRC have been making up numbers for ages and nobody cares... you have a point.
Re: Care
I suppose in the same way you get a zero credit score if you have never been in debt in your life, and a much better score if you have consistently lived beyond your means and proved yourself incapable of managing your finances.
It sounds as though anyone using an android device with a custom ROM will be criminalised. Does the UK government even know what a custom ROM is?
Yes, whatever ROM hasn't got mandated backdoors installed.
Will this cover
the chat app MI6 agents use in the field to securely communicate with head office? if not... why not?
And besides ... as has been pointed out lots of times.
If I'm a child pornographer... I'd be hosting my services on a secure FTP server, rather than sending cp via farcebook messaging
And if I was a terrorist, There would be innocent sounding messages posted in a forum somewhere... trainspotting+timetables.com for example(dunno if this is a real site)
"I'll be at Paddington at 3pm to see the King off, bring camera" takes on a whole new meaning......
I wonder what messaging app MPs will be using and will they be aware the government can read ALL their messages as a result....
Re: Will this cover
"I'll be at Paddington at 3pm to see the King off, bring camera" takes on a whole new meaning......
I posted this a few years back about phrases someone I knew would deliberately use on emails, such as "I was bombing along the Queen's highway"
[1]https://forums.theregister.com/forum/all/2016/03/18/web_ads_are_reading_my_keystrokes_and_i_cant_even_spell_propperlie/#c_2813863
He'd have to update that now to "I was bombing along the Queen's [King's] highway"
[1] https://forums.theregister.com/forum/all/2016/03/18/web_ads_are_reading_my_keystrokes_and_i_cant_even_spell_propperlie/#c_2813863
Re: Will this cover
>I wonder what messaging app MPs will be using
A while ago Tory bosses told them to switch from WhatsApp to Signal. I read that on several reputable news websites so it's probably true.
Re: Will this cover
You can still do good old key exchange and use steganography so that the key exchange looks like a normal conversation and then use the same method to conceal the encrypted messages.
It means that the next step for the government will be that people should communicate in a way that one can make sense of.
So next time you will be sending a drunken message at 3am to your ex, this could be misconstrued as a key exchange and get you charged with an offence.
Given the nature of cryptography it will be circumstantial whether you actually wanted to exchange keys or it was just a hopeless cry for help.
That being said, it is clear that government is backing themselves to a corner and this Online Safety Bill has been mandated to be made into law regardless of consequences.
It has a chance to take the crown of most stupid legislation after IR35 changes.
Back to sticking things in envelopes and sending 1st class then....
Post Office
I'll think you'll find that the Post Office has been tasked with intercepting snail mail since 1660.
Re: Post Office
The only way the Royal Mail can sift through all the mail, is to discourage the huge volumes that currently go through the system, as it isn't yet possible to automate steaming the envelope open and reading the contents, often written in a font only intelligible to a lesser mind.
Oo. hang on I see now why the government have been chopping away at the service now.
Mirror mirror...
I'm not totally across UK politics but this looks to me like the mirror of the DCMA. The former seeks to make breaking encryption illegal while this proposal seeks to make encryption illegal.
Bet'cha those nasty pedos use DRM to hide their kiddie porn viewing from the authorities. Won't somebody think of the children!
Stop operating?
What does this mean? They won't have offices here? You'll need a SIM that isn't +44 to initiate the service? Or use of Signal will become illegal?
Because none of these things will "shut Signal Down"
Re: Stop operating?
Signal will refuse to comply with UK government demands and then UK ISPs will be forced to block Signal traffic.
Re: Stop operating?
My nice new Pixel7 comes with a "free" VPN. Now, while this is of dubious effectiveness, it should at least make the type of communication I am using unclear to my provider.
I suppose that banning working VPNs will be part of this. But this would mean the back door would have to be passed from the government to the phone providers.
Are we all going to have to set up our own?
Re: Stop operating?
Police doing stop and search will have another reason to stop someone.
Copper: "Oy mate, what are you typing there? Why the app look blueish? Is that Signal? Set your phone aside and put your hands above your head slowly and don't move!"
*puts phone aside and takes hands slowly above head*
Copper: "I said don't move!"
Joe: "But with all due respect, office, you told me to put my hands above head, slowly"
Copper: "Are you questioning my orders? I said are you questioning my orders?"
Joe: "I am just trying"
Copper: "That's it smart arse! You are under arrest!"
Banning encryption fixes what?
I k now I w ill th ink em ergency solutions to encryption. Banning it will just create new methods, for example reread this unencrypted illustration.
Re: Banning encryption fixes what?
for example reread this unen cr ypt e d illustra ti o n .
Instructions unclear.
edit: I mean a police officer inspecting this concealed message could think it is meant to insult them.
Re: Banning encryption fixes what?
insult them
There used to be a definition of "insult" that said, "if it's true, it is not an insult".
Did this ever carry any legal weight and if so does it now?
The old "think of the children" bullshit
The title says it all.
Whatever form this law takes, it will be misused
We've been down this route many times. RIPA was intended for the usual "terrorists and serious crime" purpose. Then it was used to catch parents trying to get their children into a better school. The congestion charge cameras were intended for that purpose. Then they were changed to a full time police surveillance system. Then it turns out that most police officers are corrupt, while the "good honest officers" (how many of them are there really? 2%?) are busy turning blind eyes to the crimes committed by their colleagues.
How much the establishment hates the people of this country. How much they do not being at the business end of a camera. Go and have a look on YouTube for people pointing cameras outside police stations. The police turn out in force for that despite it not being an offence. But if you are burgled, they are too busy to get off their arses.
Government implementation of *anything* vaguely attached to IT is suspect at best, and over schedule and over-cost. I don't think Signal has anything to worry about for some years to come.
"At least Northern Ireland and Scotland will be spared. The Home Office legislative proposals, if adopted, will apply only to England and Wales. ®"
I mean its already failed then, as what is to stop someone setting up a business to sell such devices based in Scotland or NI where it is perfectly legal to do so and selling them to people from England and Wales, after all they don't check your phone for compliance as you cross from one part of the UK to another.
Plus what about none UK residents who visit the UK, is their none compliant device going to get seized by border patrol if they landed at Heathrow but they are allowed to keep it if they arrived via Belfast or Edinburgh?
I wonder which muppets come up with these schemes? I expect people who are just trying to justify their jobs by spending time and tax payers money coming up with legislation which has no chance of working in the real world, to keep the won't someone thing of the children brigade happy.
So will Element (Matrix)
Matthew Hodgson, CEO of Element, the home of the Matrix secure messaging platform also said he will move their HQ away from the UK if this passes:
https://news.ycombinator.com/item?id=34923544
This is one of the problems of having a left wing government. They think they have a right to know and control everything.
Unfortunately the opposition is even more left wing. Tragic times.
This has more to do with stupid people in high office, lacking the capability that the post requires, focussing on laws which make no sense so it looks like they are doing something worthwhile.
It will also be used as a critique of the opposition (Labour, Lib Dems et al) when they oppose it in any way.
Absolutely. I mean, just how the bloody hell has a filthy pinko like Suella Braverman managed to wangle her way into the big chair at the Home Department? It's intolerable!
You know ...
... that "degrees to the left" is not a measure of authoritarianism? Authoritarianism is almost entirely orthogonal to the L/R spectrum.
Re: You know ...
I like the Political Compass https://www.politicalcompass.org/.
It shows me as left of centre and very anti-authoritarian.
So how does that work then ?
How will signal know it's on a UK based device ? By IP. By pinky promise ?
Re: So how does that work then ?
Pretty much. This won't work to catch any actual criminals for exactly the same reason the piracy URL bans didn't work. Not that these laws are ever really used against CSAM or terrorists. The German government passed laws years ago to allow search histories to be acquired by court order, only 2% were ever used for underage porn cases, over 60% were used for drug cases.
Apps make encrypted communication convenient. There many ways for the bad guys to encrypt and then send via other channels.
Exactly. All that people have to do is encrypt before sending by the messaging app.
Bring it in
They cannot police the streets
They cannot stop boats from France
They cannot stop abuse images being sent
What makes anyone think they will be able to police this at all
Next new Law
“Don’t do crimes”
Next headline
“The problem of crime has been solved”
Politicians are truly useless
God help us all
Care
I don't think government cares whether people will be using some Signal or not.
Government is fixated on spying on people and becomes paranoid.
This should be a huge red flag for everyone and the fact that this bill is even taken seriously by journalists should reveal you the level of corruption in this country.
After all, how are they going to calculate your social credit score if they don't have any data on you?