Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Petition against UK Home Office plans for surveillance and encryption backdoors (openmedia.org)
126 points by ianopolous on May 13, 2017 | hide | past | favorite | 57 comments



Is it safe to share this if a UK citizen? I.e. would a UK citizen be criminally liable under the Official Secrets Act or similar.


If it's a crime to share a draft of a law, you're no longer dealing with a liberal democracy, but a Saudi-style shithole, and it's time for that country to remove its government.


To be honest, what's the alternative? People sticking their head in the sand is what got you guys to this point.


The Official Secrets Act must be signed by you and pertains to 'official secrets' you may become party to as a servant of the Crown. It is not illegal to share this as a common civilian. Whether it is safe to do so is another matter entirely.


If the Official Secrets Act applies to you, it's an offence to break it even if you've not signed it.

http://researchbriefings.parliament.uk/ResearchBriefing/Summ...

edit: beat to it by a minute!


that's not true at all, Section 5 applies to everyone, and deals with passing on secrets you've obtained from people who have signed the act.

That said, and IANAL, this document is not covered because of 5(2) - there's no reasonable grounds for believing that releasing this document is damaging to national security. It's a draft, so does not describe any measures currently in effect, and the draft will be made public in a few days when it is submitted to parliament, before it has any effect.


>The Official Secrets Act must be signed by you

That's not true. It's a law not a contract; everybody is bound by it: http://researchbriefings.parliament.uk/ResearchBriefing/Summ...

>Do you have to sign the Official Secrets Act to be bound by it?

>It is not necessary for a person to have signed the Official Secrets Act in order to be bound by it.


Dangerous and wrong advice. I already knew what the other posters replied with. I was looking for more specific opinions about whether it would be safe to post this link on a Facebook type platform


Not only is this stupid from a technical point of view but it could ruin the UK software industry because who in their right mind would buy any software knowing it is deliberately compromised?


Yet people and governments around the World still use IT services provided by the USA, even though they know their data is utterly compromised by doing so.


The USA does not ban secure software completely. At the moment there is a chance that a US or UK company's software is government compromised. If this bill becomes law in the UK then all UK software must legally be government compromised.


they do. Steven Levy's crypto wars highlights the lengths America went to destroy secure software.


I would refuse to develop or deploy software in any country that mandates such backdoors.


And what would the UK software developers do? It's not always possible to move.


My personal feelings on this is that in many jobs you can face having to do things that go against your principles. It is up to the individual to decide if they are willing to do such work.

However I am also fortunate enough that I can pick and choose what I do for work. If my position were not so safe and it was the difference between buying food or not then I suspect I would take a job I disagree with. Your situation changes your perspective to a certain degree.


Take up farming, or something.

Or, you know, annihilate the Tories, hold the state to account and prevent this shit from happening.


What makes you think this is entirely down to them (other than the usual eating-your-first-born tropes)? This stuff came to fruition under Labour - as I'm sure you'll acknowledge. Why not look at what both governments had in common? I'd be surprised if it wasn't found to be Home Office mandarins driving the agenda.


Corbyn is many things but he is definitely not a Blarite! The Labour party could not be making a cleaner break with the Blair era than that they have made by twice electing Corbyn as leader.


He might not be a Blairite (okay, no 'might' about it), but it doesn't preclude him from authoritarian tendencies - he certainly has sympathies for them.

Regardless, I think we're crediting pols too much with an agenda that, IMO, is likely driven by the Home Office.


I feel the odds are against Labour party although they have the best policies.

The odds are controlled by media bias and collective rhetoric. So much so I noticed some phrases created by newspapers and later repeated by the PM herself.

I'll be voting for the party with the best policies, I have not forgotten that the current PM has championed snoopers charters.

The care for privacy the tech community has is a minority and edge case. Beyond HN the world doesn't really consider the relationship between a political party and privacy laws.


"Or, you know, annihilate the Tories"

That's difficult in a country with largely billionaire-run or staunchly establishment-friendly media.

They may not like all the policies of the Tories but the alternative poses something of an existential threat to their overwhelming wealth.


Well, those in the UK should fight for their livelihood. Educating people, organizing a movement, blacking out their own websites with a message, etc.


interesting loophole:

“relevant telecommunications operator” means a telecommunications operator, or a person who is proposing to become a telecommunications operator( b ), but does not include a person who provides, or who is proposing to provide, a telecommunications service only in relation to the provision by that person of banking, insurance, investment or other financial services.


Smart move. I am planning to add end-to-end encryption to my UK accounting software. Without this loophole I would have been forced to move my business outside the UK.


> 7. To ensure that any hand-over interface complies with any industry standard, or other requirement, specified in the technical capability notice.

... Presumably now that the "industry standard" contains a backdoor, we (the people) can have a backdoor into this hand-over interface too?


It seems there is no official petition https://petition.parliament.uk/


If this comes to fruition, i will never use software originating from the UK again.


Me and a bunch of IT colleagues are all planning to leave and goto Europe once this and the Brexit stuff happens. The UK's going to be left with a bunch of uneducated, old fashioned, racist and obedient zombies. So don't worry, the UK's basically done. I'm guessing less and less products and research will come out of the UK until it basically becomes an irrelevant country.


Support Scottish Independence and move north! Burgeoning games dev industry, along with a couple of unicorn startups based here, and a much more left-leaning government.


With the prospect of 5 more years of Conservative (dictatorship) an independent Scotland would be interesting and would appeal if it offers protections to privacy.

The BBC recently stated in their cyclic review soon after the Scottish referendum they want to strengthen the presence of the BBC in Scotland and increase programming promoting the national UK government interests. So we'll have to see how long the Scots want independence for.


If you're really committed to leaving I suspect it would be better to do so, and get settled, in advance. Instead of on the flag-day when "everybody" else is also leaving.

Moving countries isn't easy, and getting settled in a new location takes time.


It's already too late in most cases, getting permanent residence rights elsewhere in the EU requires you to have lived there for 5 years; but there's under 2 years left before UK citizens lose their rights to work elsewhere in the EU. So you'd have to emigrate as a non-EU citizen, unless you qualify under one of the get-out clauses (eg joint citzenship, or you go to work in the EU and then have an accident that prevents you from ever working again(!))


No, that is not necessarily the case. It will depend on the outcome of the negotiations.

The 5 year rule is part of the existing freedom of movement regulation. It provides additional protection against getting kicked out in case of sickness or unemployment.

Exercising the right to live and work anywhere in the EU before Brexit takes effect may well mean that you can keep those rights after Brexit and acquire permanent residence rights later on.

Anything else would mean that hundereds of thousands of people would have to be deported, which would go against every promise made in the referendum campaign.


The UK is still currently member of the EU right now, so there's nothing stopping you from relocation.

From there you might have to wait N-years for citizenship, but freedom of movement hasn't been curtailed at the moment, even if it might be in the future.

The only potential spanner in the works is the question of what happens to foreigners in the UK, and the reciprocal agreement that has yet to be agreed. But it seems extraordinarily unlikely a UK-citizen who gained residency in German would be told to leave in two years time.


Most of the people who say they're going to leave, are just blowing hot air.


True. We only have to look at how many Americans failed to move to Canada/elsewhere to see that!

I'm not happy about the Brexit vote, but in all honesty even with the "Leave" result I don't think I'd have left the country.

(As it happens I left the year before, for unrelated reasons, but I'm a little glad I left.)


Many of us have already left :)


Where will you be moving?

We're also weighing our options but haven't made a decision yet on whether and where we're going to go.


Personally the Nords seem to have their heads screwed on correctly to me, from what I can tell. Sweden or Iceland need any developers?

Australia has gone down the same path, both parties are in agreement on this stripping back of privacy, metadata collection and (what feels like to me) moving to a totalitarian regime. I don't think this can be fixed.


I've been thinking about Berlin and Dublin.


This is really damaging to the UK tech scene.

I don't blame you and I feel the same way.


Nice annecdote. Here's another one: I work in the IT industry in the UK. Not one of my current or past colleagues has mentioned any desire to leave the UK due to Brexit, and not one of them is a racist zombie either.


"not one of them is a racist zombie either"

How sure are you about that? I was surprised by the number of people who have been holding some unpleasant opinions secret forever, and then felt safe to express them for a short while following the Brexit vote. It seems to have become unacceptable again, but it turned out more people than I realised were holding these views.


Fairly certain. I know people who voted to remain in the EU, and people who voted to leave the EU. None of them are racists; they had valid reasons for voting the way they did, and none of them are planning to leave the UK due to us leaving the EU.

I regularly see people mouthing off on forums about how they're going to leave their respective countries because they're not happy they didn't get their way in one vote or another. But do I see people ever say that they have left their countries? Pretty much never.


That's because as soon as we leave, we forget about domestic politics in the old country and stop reading those forums.

We're too busy whining about domestic politics in the new one and talking about how we're going to leave it :).


Here's one :)


I do think something is a bit wrong when people feel unsafe expressing their opinions. An opinion unexpressed is an opinion unchallenged.


You would think they might be a little less sympathetic to back doors with the NHS currently having problems with ransomware


My bet is they will turn it into an even better reason to have back doors. And no, logic doesn't come into it.


"To provide and maintain the capability to disclose, where practicable, the communications, equipment data and other information in an intelligible form to standards specified in the notice and to remove electronic protection applied by or on behalf of the telecommunications operator to those communications, equipment data or other information, or to permit the person to whom the warrant is addressed to remove such electronic protection."

Could this be interpreted, legally, to exempt end-to-end encryption?

- When implemented properly (i.e. with proper key verification UIs) it should not be "practicable" for communications operators to force disclosure of the contents of users' communications.

- End-to-end encryption is not "applied by [..] the operator" but rather applied by the users' device.


They might argue that it is 'practicable' to force-push a software version of whatsapp that also sends the messages to the government. Alternatively, they could argue that since e2e services can't provide this backdoor, they aren't legal.


Not in any useful way. End-to-end encryption is a joke if you use a client controlled by a corporation. And a corporation can always implement a backdoor without you knowing to help the state.


I've advised a few companies to register (if feasible) a company in the EU or use Atlas to try and complicate being legally compelled in issues like these. These ideas are dangerous and backward.

I can't see overseas companies trusting UK start ups with confidential trade and commercial secrets. There is already enough cooperate paranoia after the NSA was accused of spying on European corps and there seems to be evidence to suggest such a thing actually happened.

Atleast I'm not the only person who thinks these policies are making the UK a unpopular place to open shop as long as there are countries with not so oppressive laws.



Seriously.. how many leaks have there been in the past week?? I'm losing track.


Maybe it's time to watch Yes Minister again.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: