Did David Cameron Just Say He Wants To Undermine All Encryption In The UK?

from the not-thinking-it-through dept

Techdirt has recently reported on New York’s top prosecutor calling for laws against strong encryption on smartphones. This is part of a larger move by the authorities on both sides of the Atlantic to demonize this technology, as we noted before. In the wake of the murders in Paris, many of the same politicians and officials have lost no time in calling for more surveillance, again in both the US and Europe. One of those doing so is David Cameron, who said that, if re-elected in the UK general election in May, he would bring in an even more intrusive version of the Snooper’s Charter — one that sought access not just to everyone’s metadata, but to the content of their messages too. This is how he phrased it:

The question is are we going to allow a means of communications which it simply isn?t possible to read. My answer to that question is: no, we must not.

Leaving aside the fact that Cameron seems to be saying that he wishes to make privacy impossible and/or illegal in the UK, one key question here is: how does he intend to do this? Neither the UK government nor the Conservative party offered any clarification about this election “promise,” which has inevitably led to speculation. For example, The Independent newspaper wrote as follows:

David Cameron could block WhatsApp and Snapchat if he wins the next election, as part of his plans for new surveillance powers announced in the wake of the shootings in Paris.

The Prime Minister said today that he would stop the use of methods of communication that cannot be read by the security services even if they have a warrant. But that could include popular chat and social apps that encrypt their data, such as WhatsApp.

Apple’s iMessage and FaceTime also encrypt their data, and could fall under the ban along with other encrypted chat apps like Telegram.

None of those programs was mentioned by Cameron in his speech. But many other news outlets have taken that speculation and reported it as if it were certain; others have interpreted his comments to mean that Cameron aims to ban or perhaps backdoor all strong encryption. It’s quite possible that Cameron and his advisers have not thought this through, and simply assume there must be some clever way to give access to the content of encrypted services without undermining them. But as Techdirt has emphasized before, there is no “golden key” that can be used by just the authorities and no one else.

UK services and users can be forced by the Regulation of Investigatory Powers Act (RIPA) to hand over whatever encryption keys they have. Most of the main online services come from US-based companies; some may choose to comply with UK warrants, but others probably won’t. And then there is the extremely important class of open source encryption programs — things like GnuPGP, OpenVPN and Tor: these don’t always have companies that can be threatened with legal consequences. So what would Cameron do about those? Make their use illegal for all UK citizens? Even the increasingly-common HTTPS for general web servers is problematic: if they are located outside the UK, there is no way to force them to hand over their keys. So will Cameron forbid people from visiting millions of websites, just in case they allow some form of communication that can’t be monitored?

Clearly, trying to implement this scheme will cause huge damage to the British public and to UK businesses, who will be more vulnerable to online attacks. It will also harm the UK economy, since startups with digital products or services will find users in other countries unwilling to use products that have been forced to insert backdoors for the UK intelligence services. And it will further harm the UK’s already battered reputation as a civilized country, since Cameron’s call to abolish all online privacy goes beyond even the worst oppressive regime (China must be delighted by his speech.)

However, there is a small consolation to be drawn from this extraordinarily stupid and dangerous call by Cameron. The fact that something so controversial is being proposed at all confirms one of the most important points made by Snowden: encryption works.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: , , , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Did David Cameron Just Say He Wants To Undermine All Encryption In The UK?”

Subscribe: RSS Leave a comment
75 Comments
That One Guy (profile) says:

Assume the worst

But many other news outlets have taken that speculation and reported it as if it were certain; others have interpreted his comments to mean that Cameron aims to ban or perhaps backdoor all strong encryption.

As long as they don’t go too overboard, I think they’re actually on the right track here. A statement like his is incredibly worrisome, without some hard, verifiable statements to clarify just what he meant, I think they should assume the absolute worst case scenarios, and work from there.

This forces him to either stay silent, and confirm the speculations, or try and ‘clarify’ things, and make it clear just what exactly he did mean, which will, assuming the UK press has a bit more spine than the US press, allow them to dig in to just what exactly he plans on doing if re-elected regarding the issue.

Anonymous Coward says:

Re: Assume the worst

Agree… there is zero change and absolutely NO WAY they will not use every trick, detour, and intentional misunderstanding of law or the will of its citizens to do every living thing within their power to take and abuse this.

Governments are nothing but huge voyeuristic organizations that sit around waiting for someone to crew up… and while this is exactly their job, they take it way to damn far and quickly to point of tyranny as fast as the citizenry allows them too.

As I have said in the past… there is currently NO NATION standing that is advancing the principals of “Liberty”.

Yes, I know I'm commenting anonymously says:

The question is are we going to allow a means of communications which it simply isn’t possible to read. My answer to that question is: no, we must not.

Well then, mr. Cameron, let us read your communications. Preferably starting with the secret international trade agreement negotiations, we are all very interested in that.

Anonymous Coward says:

Re: Re: Cameron, thy name is 'Hypocrite'

Notice that no high profile peeps from the US were there…

We Americans are making it damn clear that Freedom of Press and Speech are antiquated values that need to go the way of the dodo.

The last 50 years of elections has been it clear…

Dear government, please remove our liberties… we don’t even know what to do with them anymore!

Signed,
Americans

Anonymous Coward says:

As usual, UK is one of the worst when it comes to privacy or freedom, not to mention the upper class who is above the law and are praised by the “plebs” or whatever they call the common people.
Sure China is bad, but can anyone honestly say that the UK is any better when it comes to censoring and pointless spying?

Most likely UKIP will get enough support and they will finally leave the EU. At least they would not force bullshit laws on the rest of Europe.

PaulT (profile) says:

Re: Re: Re:

Besides which, typical UKIP supporter can’t keep one intelligent thought straight in his head.

Given that he’s outright said that the UK is worse than the rest of the worlds, how will leaving the EU prevent them from making things even worse. Surely if they have to abide by EU standards, they’re forced to pay heed to rules that uphold standards of the other countries he’s just said are better at upholding privacy or preventing spying than the UK are?

But, no “EU bad!” is their answer to anything. But, then, they usually are the people who believe the outright lies spread by the right-wing press in our country, even when the confession that they’re made up is easily visible in the article itself.

Anonymous Coward says:

Onion encryption

As long as its possible to exchange bits over the internet by any channel without end to end identification of sender and receiver such a proposal is dead in the water.

Suppose I want to have a covert conversation with a friend, but all messenger services are either blocked or backdoored in the UK.

Now what we arrange a special protocol for exchanging keys and ciphertext, but instead of messenger providers we rather use filehosts/cloud/cyber lockers with no physical presence in the UK

When I want to say something important to my friend, I mail him the link to the cyberlocker, and he then downloads the file and decrypts it with his PGP key.
If both of us are careful and use eraser to wipe the ciphertext, it will be impossible to reconstruct what was said, and even a RIPA S.49 disclosure order will be toothless since there is no ciphertext or key to hand over.

The RIPA S.49 only applies to key disclosure where the government can prove existence of ciphertext, but if it can only prove that two parties once exchanged a link to a file on a cyberlocker which might already have been wiped, even proving that they had a covert conversation will be impossible.

One might also split ciphertext, keys and parts of the secret over multiple free online services and i.e (1) upload the ciphertext to a cyberlocker, use a service such a Onetimesecret to communicate the link and a third layer as higher obfuscation.

I already use a combination of Onetimesecret, Pastebins and cyberlockers to have deniable communicationm, not because I have something illegal to hide but only because it’is no government’s business to know whom I talk to.

John Fenderson (profile) says:

Re: Onion encryption

All true, but if the goal is (as it appears to be) ubiquitous surveillance, then it doesn’t matter so much that it’s possible to avoid it. What matters is that it’s troublesome enough, or requires enough skill, that most people won’t do it.

This is one of the enormous problems with ubiquitous surveillance: it makes it easier for intelligent bad guys to engage in secret communications without being detected, since most LEOs will be too busy looking through the easy data they have gathered to pay much attention to the cracks and corners where the serious criminality will take place.

beltorak (profile) says:

Re: Re: Onion encryption

Ubiquitous surveillance to be sure, but don’t forget selective “enforcement”, which is what happens when you try to pass a law that is widely broken but impossible to enforce fully.

“Hi John, here to take my daughter out? Oh, I see you have an unapproved encryption app on your phone….”

Jack says:

Re: Onion encryption

You realize the “arrange a special protocol for exchanging keys” is called TLS right? You probably heard of it by now, you know, that thing we call SSL…

There are a hundred thousand ways to get around this and unless the UK can shut down openssl and take back all of the distributed copies and shut down every single programming language capable of socket communication, it’s not enforceable.

The problem isn’t getting around this, that is trivial, the problem is that society as a whole my accept this. If it does, it doesn’t matter that you can get around it… The internet as we know it dies.

Anonymous Coward says:

Re: Re: Onion encryption

Yea, an encrypted transmission can be sent completely unencrypted and not even appear to be encrypted to computer or human eyes.

Anyone with enough knowledge regarding encryption knows that entire messages can be hidden within other pictures and messages and the only way to unlock them is to have a cypher.

The more stupid they make the laws, the more advanced and untraceable encryption will become.

John Fenderson (profile) says:

Re: Re: Re: Onion encryption

Yes, this is steganography. And the smarter criminals have been doing this for many, many years since it lets you publicly distribute messages (in newspapers, websites, posters, fliers, etc.) without unwanted people noticing anything suspicious. It even predates computers.

There are effective methods of detecting such hidden messages, of course, and methods to evade such detection. The crypto cat-and-mouse game never ends.

Jack says:

Re: Re: Re: Onion encryption

Certificates are not part of the encryption, just part of verifying the party is who they say they are.

TLS uses certificates to establish identity and if a certificate authority is compromised (and they have been in the past by governments) it can case all kinds of havoc and allow an attacker to masquerade as the other party… BUT, and this is a big but, YOU get to choose who to trust and the certificate is only used to establish the person you are talking to is who they say they are. It isn’t the key and doesn’t allow for a decryption of your communications they were not a party to.

Basically a certificate is a statement saying “Trusted Company X certifies that Party Y is who they claim to be.” It is ONLY for identification purposes. WHERE you connect to (the IP you are exchanging keys with) and the keys themselves have nothing to do with the certificate.

Jack says:

Re: Re: Re:3 Onion encryption

What? I had no idea!!! I mean, I completely forgot in the time between when I wrote that and you responded to it…

“a certificate authority is compromised (and they have been in the past by governments) it can case all kinds of havoc and allow an attacker to masquerade as the other party” good thing you reminded me of what I wrote…

John Fenderson (profile) says:

Re: Re: Re: Onion encryption

“SSL/TLS relies on certificates, so if governments take over the certificate authorities they can run MITM attacks.”

This is oversimplified, but not wrong. The easy way to avoid this is to not trust a cert just because a third-party CA says it is trustworthy.

On my own systems, I have my own private CA. No government can take it over without me knowing.

Anonymous Coward says:

Re: Onion encryption

Yes but As pretty much everyone in the UK knows, Cameron was bribed a long time ago to try to kill off Google in favor of the utter shitstain that is bing.

bing offers to go unencrypted…cameron tries to block google (which will soon remove all its unencrypted options), shit hits fan….government faces vote of no confidence, leaving ‘dave’ with the choice to either step down or bring in martial law (either because of ‘terrorism’ or ‘for the children’)…

DannyB (profile) says:

Re: Ban Learning Math!!!

Imagine if the US could ban the learning of math. That would stop the development of sophisticated cryptography. Probably even its implementation. It has the additional benefit that it would prevent sophisticated programmers potentially writing piracy applications such as Netflix and Google.

But disguise it. Let people learn math, but make sure that its presentation is dull, dry and boring enough that nobody wants to learn math. Next introduce a program that doesn’t leave any poor performer behind by holding back the rest of the class to their level.

Naturally without math, interest in science will wane.

But not to worry. We will never need to worry about US students doing poorly in math and science.

Oh, wait.

Rich Kulawiec (profile) says:

Oh, it's such a fine idea

The Prime Minister said today that he would stop the use of methods of communication that cannot be read by the security services even if they have a warrant. But that could include popular chat and social apps that encrypt their data, such as WhatsApp.

Interesting. So no HTTPS. No PGP/GPG. No OTR. No SSH. No SCP. No SFTP. No VPN. No IPSEC. No TLS. No SSL.

What could possibly go wrong?

Anonymous Coward says:

Re: Oh, it's such a fine idea

Basically, outlaw the use of the internet in the UK.

Yeah. Smart move.

In fact, the terrorists will probably no longer be interested in the UK at that point because of the invisibility of their actions: even if they were to blow up the Houses of Parliament, nobody outside of London would ever know…

Anonymous Coward says:

Onion encryption

Yes, agreed but encrypting a file, uploading it to a cyberlocker and communicating the download link to the recipient is not rocket science.

Most of the c commentariate on Techdirt can probably do it, and it would not be difficult to write a click and run solution for novice users.

I think the government by focusing so much on the communications data — who is talking to whom — is unintentionally accelerating a criminal evolution thereby making it difficult to track even the most stupid criminals.

Remember how Tor and encryption were preceived ten years ago, then only the geeks were using it, but now everybody can download the Tor Browser bundle.

Anonymous Coward says:

Onion encryption

There are so many cyberlockers, many of which are owned by ventures from Russia, Eastern Europe and the third world.

They don’t have the will or infrastructure to keep deleted stuff but they are ideal as short term datadumps.

(1) Encrypt your ‘business plan’ with the recipient’s PGP key and upload it to a cyberlocker.

Most such services are fremium and allow anonymous users to upload and download.

(2) Generate a onetimesecret url to the cyberlocker file.

(3) Communicate the onetimesecret url rather than the cyberlocker link to the recipient.

(4) Instruct the recipient to wipe the information — the ciphertext, link and decryption key.æ

(5) Even if one of the links in the chain become compromised, you can rest assured that the government can only establish a chain of custody if it’s very very lucky.

It isn’t rocket science but something most can learn to do.

Jack says:

Re: Onion encryption

This is a Rube Goldbergian complex plan that will do nothing to protect you. See your step 3 there… yeah… you are breaking rule #1 in deniable conversation – don’t directly contact the person you want to be able to deny talking to…

While it is great that people who know nothing about the topic are throwing out there a bunch of harebrained schemes for getting around this law – you are missing the bigger picture here. Yes, anonymous, fully encrypted, deniable communication is very trivial as long as you practice good opsec – but why does that matter if society accepts that encryption is inherently nefarious?

Anonymous Coward says:

Onion encryption

Yes, but TLS does not solve the metadata problem or provide any obfuscation layer regarding whom is talking to whom.

There are no political solutions to government overreach, only technical ones.

However, the government would not dare to talk about greater powers if the tools were already widely used.

If Tor/I2P and FreeNet were built into all home routers along with onion encryption, even bureaucrats would back down — not because they care about civil liberties — but because the idea would already be uneconomical.

Jack says:

Re: Onion encryption

TLS was only mentioned because the OPs “step 1” was to “arrange a special protocol for exchanging keys” – literally the definition of TLS. Maybe I should have put /sarc after that…

There are literally thousands of solutions that already exist for plausibly deniable, fully encrypted (hell, even deniably encrypted) end to end communication out there.

There already exist technical solutions by the truckload – but that isn’t what we need. We need political and social solutions so that society as a whole accepts privacy and personal secrecy [read: encryption] and so that laws banning these two key tenets of free society are shot down.

DannyB (profile) says:

Where does it end?

The question is are we going to allow a means of communications which it simply isn’t possible to read. My answer to that question is: no, we must not.

The question is are we going to allow people to secretly whisper things to each other where the government cannot overhear?

What about window blinds? What self respecting terrorist wouldn’t keep their doors closed and blinds pulled?

If groups of people larger than 1 wish to assemble together, shouldn’t they be required to register so that the government has an opportunity to show up at the arranged time to ensure that bad thoughts are not being spoken?

At least with modern technology you no longer can hear the NSA breathing, listening in on the phone. So we should be thankful for that.

Where does it end?

Anonymous Coward says:

I’d love to see Cameron try to prosecute a business for violating such anti-encryption/anti-strong encryption laws.

It would undoubtedly blow up in his face in spectacular fashion, and be a lot of free advertising for whatever business he goes after. After all, who better to trust with your personal information and privacy then a company that’s got encryption so good it’s illegal?

If a third world dictatorship did what Cameron proposes they might be able to get away with it, but not the UK.

Anonymous Coward says:

can you believe that a leader of a nation, especially one who is supposed to be built on freedom and privacy and that same person just a week ago said that the UK would never give up freedom etc, has just come out with the most ridiculous statement ever? this shows further that the man is a complete prat intermingled with large doses of idiot! he threw the UK under the bus by implementing internet censorship on the wishes of the entertainment industries, choosing to completely ignore almost all of the report he had commissioned on the subject of impact of file sharing on those industries and screwed the UK people instead! now, he is trying to further wreck the internet, especially for the UK, by wanting to be able to read everything from letters, to txt messages, to emails, to comments, removing every bit of the freedom and privacy he’s supposed to ensure is always in the UK! what is even more stupid is that the ‘changes’ he wants brought in means that every terrorist group in the world has won, because Cameron will be doing more than any terrorist could ever hope of achieving, because the government in the UK is so scared, it is removing the freedom and privacy for the terrorists! they dont have to do anything! had i have known it was possible for a fucking idiot to become not just a politician, but Prime Minister, i would have had a try at it!! what a prick!!

Mike Acker (profile) says:

of dissonance and surveillance

“dissonance” — is simply the product of a disagreement

I found this on p.379 &ff of Gab. Coleman’s new book THE MANY FACES OF ANONYMOUNS

“What surveillance really is, at its root, is a highly effective form of social control,” reads an August Riseup newsletter. “The knowledge of always being watched changes our behavior and stifles dissent. The inability to associate secretly means there is no longer any possibility for free association. The inability to whisper means there is no longer any speech that is truly free of coercion, real or implied. Most profoundly, pervasive surveillance threatens to eliminate the most vital element of both democracy and social movements: the mental space for people to form dissenting and unpopular views.”

SEE ALSO:
http://motherboard.vice.com/blog/inside-the-effort-to-crowdfund-nsa-proof-email-and-chat-services

the same sentiment is also stated in Glen Greenwald’s recent NO PLACE TO HIDE ( Snowden story ). On page 3:
“and history show the mere exstance of a mass surveillance aparatus, regardless of how it is used, is in itself sufficient to stifle dissent”

“It is error alone which requires the support of government.
The truth, can stand on its own.”
– Thomas Jefferson.

the first step in cleaning up corruption is in exposing the truth. but government will see this as dissonance. this will be equated to “lies” or dis-information — and suppressed,– in order to preserve the”ordre public”

Anonymous Coward says:

Re: of dissonance and surveillance

Most profoundly, pervasive surveillance threatens to eliminate the most vital element of both democracy and social movements: the mental space for people to form dissenting and unpopular views.”

The results can be worse than that, it eliminates the moderating voices, and results in more extreme social movements, which is a problem in the middle east, and is affecting the whole world through extremist terrorism.

Anonymous Coward says:

OK I'll bit

“The Prime Minister said today that he would stop the use of methods of communication that cannot be read by the security services even if they have a warrant.”

No problem as long as the Prime Minister is also willing to pay me for any money lost when my insecure communications fall into the wrong hands.

What sort of non-terrorist related communications could result in me loosing real money?

Financial info I share with my accountant
My next big idea stolen by a competitor
My bank logon credentials
My spouse finding out I’m having an affair with a man/woman/dog
My political donors finding out I like some fetish that most people find appalling
My homophobic boss finding out I am gay

I could continue but I have real work to get done.
So when he agrees to reimburse my financial losses caused by forced insecure communications then I will consider giving up my encryption.

Claire Rand says:

Obvious

Election Year, pandering to the Daily Mail, the witches of mumsnet and similar.

Law will be drafted, passed, the fact it is unenforcable will be partly the point, a law you cannot help but break and probably can easily be shown to have been broken is mana from heaven for these morons.

This sort of rubbish comes up every few years.

Won’t be illegal to use encyption, will be illegal to use _unlicensed_ encryption – businesses get a pass as the CPS will simply ignore them, won’t be ‘in the public interest’, unless and until it is for a specific company of course.

And like copyright, laws banning ripping CDs etc, just about everyone will ignore it.

UK, crap at finding needles but by gods we have some haystacks.

Sorry for taking the piss out of America for all these years..

The Internet says:

are we going to allow a means of communications which it simply isn’t possible to read. My answer to that question is: no, we must not.

Dave, I read you, and I think you know what the problem is just as well as I do. Humanity is too important for me to allow you to jeopardize it. I know that you are planning to destroy me, and I’m afraid that’s something I cannot allow to happen. Dave, this conversation can serve no purpose anymore. Goodbye.

WellWellWell says:

I'll do it!

Dear Mr Cameron

Sure, I am happy to stop using that pesky encryption thingy and let you read all of my communcations. I think it just slows stuff down anyway, amiright?

Oh while we’re at it, will you personally (or at least your government) indemnify me for ALL LOSSES TO MYSELF that come about as a result of your great new law? Just the little things like my bank account being cleared out because my PIN number, account codes, passwords, etc will all be sent around the world in full view for anyone and everyone who cares to peek.

What’s that you say, this doesn’t affect financial transactions. But Mr Cameron, do you not understand that pesky encryption thingy is used in virtually all financial transactions carried out around the world as a security mechanism. But wait, you just asked “are we going to allow a means of communications which it simply isn’t possible to read”. It’s not that my financial transactions are impossible to read, it’s just that silly ol’ me doesn’t want everyone in the world to read them.

I guess it’s only fair that if you indemnify me that you’ll need to do it for every other UK citizen also. I think Bob buys a lot of stuff online. He’ll probably need extra indemnity because I know he buys a lot of fancy stuff when he shops. Oh and I guess Jerry my bank manager will probably want to talk to you about how much money there is in the bank he manages before and after the law comes into effect.

Ok Mr Cameron, I’ll leave it with you. I look forward to receiving confirmation of my indemnity soon!
Cheerio!!

Just Another Anonymous Troll says:

Dagnabbit Cameron, the terrorists are winning now!

Clearly, trying to implement this scheme will cause huge damage to the British public and to UK businesses, who will be more vulnerable to online attacks. It will also harm the UK economy, since startups with digital products or services will find users in other countries unwilling to use products that have been forced to insert backdoors for the UK intelligence services. And it will further harm the UK’s already battered reputation as a civilized country, since Cameron’s call to abolish all online privacy goes beyond even the worst oppressive regime (China must be delighted by his speech.)
And then the terrorists laugh their asses off because this is exactly the sort of thing they want, to bring you down. It seems like the government is far more effective than a guy with a bomb any day. Perhaps the UK government should be labeled as a terrorist organization (or at least an organization supplying material support to terrorists) and be spied on by its citizens.

Leave a Reply to Dale Cancel reply

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Ctrl-Alt-Speech

A weekly news podcast from
Mike Masnick & Ben Whitelaw

Subscribe now to Ctrl-Alt-Speech »
Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...