UK Online Safety Bill to become law – and encryption busting clause is still there UK Parliament has passed an Online Safety Bill offering the government powers to introduce online child protection laws, one that includes clause 122, the infamous "spy clause," albeit with some caveats. The most recent published version of the bill includes the contentious passage that if comms regulator Ofcom considers "that …
This atrocious piece of legislation will only serve to further balkanise the Internet and assure that the UK's citizens remain the most spied upon in the western world.
Why do UK citizens keep letting your government take away your rights? They won't be giving them back any time.
Thing is the whole bill is such a unworkable mess that it is likely to collapse under its own weight, Ofcom is likely to be super underfunded and unable to enforce 90% of the bill so its likely the rules will not be effective.
In my more optimistic moments, I think to myself that it has been designed that way.
It is legislation that is not to be used in reality, but more that it has been put through to appease the Govt. puppet masters, "think of the children" pressure groups, and screeching tabloid grifters.
In my pessimistic moments, I know it has been put in place to crush the inevitable dissent amongst the population that will occur repeatedly as we move towards a country and a world where democracy evolves into nothing more than performance art.
Just to clarify, does calling the new law an unworkable mess violate the new law? What about calling ofcom underfunded?
It sounds a lot like this law is intended to impose hefty prison sentences for claiming to have seen the emperor's hairy arse cheeks.
Quite. It's just pandering to the base -- pig-ignorant pensioners who think democracy means if enough of them vote for it it will have to happen.
Just to support my claim they are pig ignorant, very many of them, probably a large majority, left school aged 15 (some even at 14). School leaving age in the UK did not increase to 16 until 1972, 51 years ago, so 67 year olds are the first forced to stay on to 16. This group were key Thatcher supporters. And now polling for UK in a changing Europe shows they are the least likely to have engaged with the issues with brexit and still think leaving was good. But then again, the University of Live has never offered a critical thinking course.
They hate immigrants. They hate Europe. They hate paying tax -- but love to take everyone else's tax in the form of the Socialist pension payment.[1] And don't you dare think of taxing these buggers. We are not allowed to raise far more Council Tax against hugely inflated property prices to help pay for government services. Hell no! And there'll be no sneaking of tax payments after they've gone. They vote Tory for a reason. It's their house. They bought it when it was a good price and now, with clever investment kudos, some of them live in million pound assets. Wow. My kids will look forward to that when I'm gone.
No siree. It's computers innit. They can do anything. We want them to spy on the paedophile scum so go ahead and force these humongous tech behemoths to do our democratic bidding. No, I'm not listening. Just force the to do what I want. We are Engerland. We are the bestest country in the world. Britannia ruled the waves, and with brexit it will again.
Nurse? NURSE? Do you know where my pills are?
/rant
[1] I know, I know. They've paid their stamp for forty years, a piddlingly small amount, but now expect to get far more back for maybe another thirty years. And they don't have to think how that works. They were never very good at maths.
Well, well, that's who objects to the cagefighters enabling fraud, terrorism and crimes against children. They're bigots, bigots I tell you! And worse than that, they're old!
"Progressives" are never too great on age discrimination when they're pulling at the equality strands.
@RegGuy1
I was going to answer your appalling comment sensibly.but then I read some of your others.
You are Alf Garnet. A very stupid bigoted idiot.
So I won't bother answering you. My apologies for using words with more than 3 letters....
Because virtually no one knows this was on the cards - it's not really been covered by "the main-stream media", and, even if it is, people fall for the "think of the children" quotes.
I tried to get my (Conservative) MP to engage with me on this, but he never even replied. Time to submit a formal complaint, I think.
Will be tricky at the next election - do I vote the ignorant incompetents to the left, or the entitled incompetents to the right?
It can and it will.
"A notice can be issued only where technically feasible and where technology has been accredited as meeting minimum standards of accuracy in detecting only child sexual abuse and exploitation content orders to scan user files"
Such a notice could be served on Apple, who demonstrated such technology two years ago, and by extension can be served on everyone else, because Apple have proved it is technically feasible.
You should therefore expect your WhatsApp and Facetime clients to have government-mandated background content scanning shortly after this bill becomes law. It will of course only be scanning for child porn. Initially.
Could these platforms disclaim being social media, and say they are purely private communication? Given how WhatsApp is famously being used for disseminating information about the progress of the war in Ukraine, I don't think they will be able to argue that one.
We could hope that Signal and friends follow through on their threats to withdraw their services in the UK. Unfortunately, the warm fuzzy noises they are now making suggest that they won't.
"We could hope that Signal and friends follow through on their threats to withdraw their services in the UK."
Since they stopped supporting bog standard SMS in the android client full stop, I stopped using them anyway. What I thought might end up as a decent WhatsApp replacement that I could use for everyone encrypted or not, has to my mind now shot itself in the foot. I even donated to them.
> Since they stopped supporting bog standard SMS in the android client full stop, I stopped using them anyway.
I'm surprised that Signal ever supported SMS in their app. I would consider that a potential security breach waiting to happen. You receive an SMS message and idly assume that it is an encrypted Signal message and disclose sensitive information in a reply. I would image that is probably why it was removed.
Since people using Signal are typically using it because they desire its privacy and security, I certainly wouldn't expect it to be supporting non-encrypted messaging options.
You receive an SMS message and idly assume that it is an encrypted Signal message and disclose sensitive information in a reply.
Signal made it pretty obvious in the UI that text messages were not encrypted, every SMS message bubble in a chat conversation had an open padlock in the corner and so did the send icon in the textbox where you write the reply.
In my opinion the app is less useful now, supporting SMS was another reason to install the app in the first place and unlike other SMS apps it's trustworthy, meaning the user base grows meaning there are more people who can use encrypted messages as well.
> Signal made it pretty obvious in the UI that text messages were not encrypted, every SMS message bubble in a chat conversation had an open padlock in the corner and so did the send icon in the textbox where you write the reply.
You can make it as obvious as possible, but it still doesn't prevent casual errors. For some people, this might not be a big deal, for others perhaps so.
I did look up Signal's reasoning and the reasons they stated are not particularly convincing and accidentally sending SMS was one of the stated reasons, albeit for avoid unexpected cost.
"Such a notice could be served on Apple, who demonstrated such technology two years ago, and by extension can be served on everyone else, because Apple have proved it is technically feasible."
Have they? Having a piece of software that reads files and gives some answers falls short of technical feasibility. How many of those answers are false positives and how many are false negatives? What are the allowable percentages? If the allowable percentages of false positives is greater than zero what redress has an innocent user who is hit with a false positive and against whom, the service provider or OFCOM?
The bill says that it only needs to meet "minimum standards of accuracy".
Will there be people negatively affected? Sure. But stupid laws can still become law.
If you are negatively affected will have no redress, although the government still has to prove in court you had the CSAM material in your possession beyond reasonable doubt. They have the powers to get you to hand over your phone and your encryption keys.
It's not hard to find, and it has consequences for the whole world if it passes.
https://bills.parliament.uk/bills/3137/publications -> https://bills.parliament.uk/publications/52368/documents/3841
An order requires the provider to:
(i) use accredited technology to identify terrorism content communicated publicly by means of the service and to swiftly take down that content;
(ii) use accredited technology to prevent individuals from encountering terrorism content communicated publicly by means of the service;
(iii) use accredited technology to identify CSEA content, whether communicated publicly or privately by means of the service, and to swiftly take down that content;
(iv) use accredited technology to prevent individuals from encountering CSEA content, whether communicated publicly or privately, by means of the service; or
(b) to use the provider’s best endeavours to develop or source technology for use on or in relation to the service or part of the service, which [achieves those purposes]
"Accreditation" of the technology is punted to the Secretary of State in 126(12) and (13):
(12) For the purposes of this Chapter, technology is “accredited” if it is accredited (by OFCOM or another person appointed by OFCOM) as meeting minimum standards of accuracy in the detection of terrorism content or CSEA content (as the case may be).
(13) Those minimum standards of accuracy must be such standards as are for the time being approved and published by the Secretary of State, following advice from OFCOM.
So at least the standards have to be published, and are not kept secret. It's unclear to me whether the notices themselves will be published, and/or whether the recipients of such notices will be able to publish their existence.
However, note also 126(5):
A notice given to a provider of a Part 3 service requiring the use of accredited technology is to be taken to require the provider to make such changes to the design or operation of the service as are necessary for the technology to be used effectively [my emphasis]
That is: not only could WhatsApp be required to implement client-side scanning, they could even be told to stop using end-to-end encryption, if that were to interfere with the government order.
FaceTime uses private live calls and live video between two individuals without sending/receiving recordings, which makes it out of scope. In theory, both WhatsApp and iMessage both provide messaging where users send data from one phone number to another, which happens to technically meet their definitions for both Short Message Service and Multimedia Messaging Service (even if unintentional) which are both excluded. Either way, Email is also excluded, even if it’s encrypted with S/MIME or GPG, so someone need only make an instant messenger which piggybacks off that as a workaround. These controls also do not apply to general-purpose infrastructure, nor to traditional client software like web browsers, meaning one can install unsanctioned open-source browser extensions as yet another loophole.
In theory, this legislation in its final form can only police “harmful content” which is being openly disseminated using crappy mainstream social networking services..
The system is rigged such that the only thing which might send a message is a large number of votes for independent or small-party candidates. But because the system is rigged people are reluctant to do that because they view it as a 'wasted' vote due to the very low likelihood of such a candidate getting elected.
If there is such a candidate and they don't have any policies which I massively disagree with then I might well vote for them, but there probably won't be in my constituency - and I am not prepared to vote Tory / Labour / LibDem or Green. Have voted for all of them apart from Tory at various times, but no more - I have no respect for any of them now.
How about, Mishak .....democratically insisting on a politically correct, general election vote able to be simply indicative of one’s true feelings and displeasure about the likely suitability for Parliamentary office with its very healthy public purse benefits and expenses in the choice of candidates presented ....... in order to kick start a very much needed, radical change?
amanfromMars [2309170823] ..... airs on https://sluggerotoole.com/2023/09/17/open-sunday-discuss-what-you-like-79/ for informative transfer of intel further afieldJust in case you missed it, and it is not going away, you know. Not nowadays.
Taking Back Command and Control
In all future popular elections for politically charged, and supposedly democratic administrative office, ..... and although this post is UKGBNI specific and directly targets the Stormont and Parliamentary Westminster candidature process, it is both extremely easily applied at practically zero extra cost, with a fair and reasonable expectation to be a universal default anywhere where the voice and choice of the people is touted as being the will of, and legitimate direction to be taken by elected representatives chosen to exercise whenever able and experienced, or practice if untested and inexperienced, good beneficial government ...... we, the people targeted and with an inalienable right to cast a vote in any such election, demand, in order to show any profound and irrevocable dissatisfaction with the selection of candidates chosen for election to political office, a default ballot paper provision of a box to tick at the bottom of any candidate list simply entitled, to register a loud and clear vote for all of the above ...... None of the above
And it should be well known that to stand for election and then refuse to enter office is both fraudulent and offensive, and has one immediately disqualified from service and ineligible for expected public purse benefits and also most likely to be suitably prosecuted for the arrogant intent and wilful ignorant offence caused.
It is a simple undeniable fact that if things are not changed, everything remains the same, and that is paralysis and stagnation and indicative of a bankruptcy of novel thought and creative innovation which never ever delivers the chances and paths that supply progress and prosperity.
And that is where youse is all at, are you not ...... wannabe lions led by dead wood donkeys ‽ .
And although such is a very simple and easily applied democratic accommodation advising leaderships of the clear wishes of the population they are being elected to serve, one can fully expect it to be desperately resisted by such leaderships because of the information it provides them regarding their perceived suitability for future public office reflecting an earnest discontent and honest disappointment with past serially sub-prime performance in such a position.
'We' are not letting them do anything, 'they' are just riding roughshod over our civil rights and freedoms.
Lets see what happens when a promenant MP or someone rich enough gets their private comms exposed. Then we will see what light his sh*tstain of a law gets portraid in then...
The Data on the device is easily accessible and you can always photo or screenshot what appears to the user .. which is why they think it's easy to scan all messages...
It's not as if any MP or most civil servants in central government are experts at anything technical.
... Michelle Donelan told newswire Reuters shortly after this that the government would, if necessary, require tech platforms to "work to develop technology to scan encrypted messages as a last resort."
Just what the governments of Iran, Russia, China, Belarus and every other despotic country would like. Because if you can scan for stuff the UK government doesn't like (CSAM, for now) you can scan for things other governments don't like. Pictures of Tiananmen square, gay dating messages, reports from Ukraine, that sort of thing.
This post has been deleted by its author
I read
"The government is not requiring companies to use 'off the shelf' products and where appropriate encourages firms to use their vast engineering and technical resources to develop solutions that work for their own platforms. Technical solutions should be designed with a particular focus on safeguarding people's right to privacy and data protection," it said.
and thought "Politicians, all washed-up ex-lawyer arseholes with zero appreciation of science or mathematics."
This needs royal assent before it becomes law. There is still time for the companies in question to pull out or do something although, realistically, what's the point? It's not technically possible to do what the law requires. Meta go to court over it, court rules against the Government as the law in it's current state is unworkable.
What's more though, it is typical of the current British mindset to think that the world can't survive without it. There are 2 billion active users on WhatsApp (as an example). There are 30 million active users in the UK. You'd think after Brexshit we'd have a bit of cop on about ourselves. But the penny is still falling it seems.
Also even if it becomes law Ofcom will likely struggle to implement it and it seems they Ofcom be doing it in stages with draft code of conduct for how to deal with illegal content set for sometime just before Christmas.
The article says Ofcom was already prepared to enforce the bill but I don't think it is, Many parts of the bill may be delayed over and over again.
The ability of the King to actually refuse to sign a bill into law is very limited indeed, mostly by convention but also currently the monarchy is relatively weak and there are enough people in the media who would take extreme umbrage.
The law wasn't enacted, so how do you figure the government won? That can only happen if the law is enacted and those services knuckle under and modify their software to provide a backdoor for the UK.
How would the UK even take action against companies that don't do any business inside the UK such as Signal? They can get shouty shouty all they want, and Signal can give them the big middle finger. The worst the UK could do is pass a law that required Apple and Google to drop non compliant apps like Signal from their UK app stores, which is the same "pull out of the UK market" that Signal was saying they would do anyway. The UK market isn't nearly big enough to force anyone to do anything. I think those lawmakers must believe they are still living in the times of the British Empire when they could make the rules.
.....but what do I know?.....
Everything I send is privately encrypted BEFORE it gets into email or WhatsApp or....!!
Everything I receive was privately encrypted BEFORE it got into email or WhatsApp or....!!
So....E2EE is doing double duty.......that's fantastic......but the backdoors used by GCHQ are delivering.......more encryption!!
Online Safety Bill.......looks like it's for other people!!!
> Everything I send is privately encrypted BEFORE it gets into email or WhatsApp or....!!
If you choose to PGP-encrypt everything before you paste it into WhatsApp, well good for you, but it's probably best not to brag about it. Plod can demand your decryption keys, and you can be jailed for not providing them.
For most people, they use the WhatApp client application directly, typing their message in or attaching images to it. The WhatsApp application then encrypts the message before sending it to their servers and on to the final recipient, who is the only one with the decryption key.
WhatsApp supply both the client software and the servers as part of the service they provide. The government will be able to order them to put content scanning in the WhatsApp client, and if it gets a positive match, it will send a notification to the mothership.
There's a more complete description of Apple's version of the technology, in FAQ form, here.
In Apple's case, the on-device scanning is only triggered for photos that you choose to upload to iCloud. It scans them as part of the upload process, on your device, against a database of CSAM hashes which is downloaded locally to the device. Just as the UK government wants. In fact, this bill could have been worded exactly to require Apple to do something they decided *not* to do under public pressure.
(Note: there is a separate feature for general nudity detection in messages, which notifies parents if their children are sending or receiving nude photos. Don't be confused by the two types of scanning).
@Crypto_Monad
Quote: "...Plod can demand your decryption keys..."
So....every message uses a new random key, destroyed after the message is sent, and unknown to either the sender or the recipeint.
Try looking up "Diffie/Hellman".
So...I guess I get to go to jail for NOT KNOWING THE KEYS....and for using some simple software which I didn't write!
Welcome to the new Crypto_Monad world.....jail time for something I never knew!!!
"Everything I send is privately encrypted BEFORE it gets into email or WhatsApp or....!!"
...except where, as in this case, the intended recipient isn't as paranoid as you and can't/won't decrypt at their end.
You have, however, demonstrated the mindset that will ensure that the only people whose comms aren't snooped are the original targets of the legislation.
El Reg readers really don't like people who buck the EFF consensus, do they? The OSB is great news for children, for public safety, for victims of fraud. Not so good for the cagefighters who will have to divert some of the billions they are currently randomly splurging on AI, into some simple measures on scanning messages on the initial hop.
will be used to protect you and your loved ones and your children from terrorists and online child abuse and other sexual abuse
And we also promise that it wont be used to spy on what you put in the recycling bins, where you send your children to school and who let their dog shit on the village green.
Dont they know that if they put a 'backdoor' in the encyrption program, the first guy with a de-compiler will find it.........
Yes, it is the biggest act of censorship for centuries, comparable to the Licensing Act of 1737 that imposed state censorship on the stage. That's what governments do - control and suppress their citizens. Shepherds and sheep. Most democratic freedom is illusory at best. The courts only function for the wealthy. Super-Injunctions and D-notices etc. Your greatest enemy is always your own government, because they are the control freaks who feel that it is their duty to control and limit what you do. That's why most people don't vote for politicians, but against the ones they fear and hate the most. But don't assume that having the right to do something means they will.
The government want to win votes from the mumsnet lobby. They also want to be able to tap GAFA for very large sums of money (more easily and more frequently than they already do).
There are enough back doors in OSs, ISPs, software and VPNs for state spooks to check out anyone they want to already, and they don't need it to be legal.
Most people using social media (or even adult websites) have never seen cheese pizza on them. Hate is not new. Celebs' agents used to block the green crayon letters. Having it online makes it easy to trace. Driving it underground will make it more dangerous (and certainly won't reduce it - it is a human problem not a tech problem). The BBC have been running internet scare stories for decades to support this eventual censorship and these restrictions on the net, but unless you go looking for this sort of stuff, it is quite rare that you will see it in mainstream surfing.
I'd be more concerned about other stuff that may be buried in the legalese - licensing websites, rating them like movies, banning distributed services, age/ID checking, blocking foreign content and cross border data flows etc. Governments want internet services to stop at their national borders, and want to end Web 2.0 (unrestricted commentary on their corruption). These are things to worry more about.
Governments do like to give themselves God-like powers so they can do anything they want. They rarely have the competence or cash to actually do it all, 24/7. They pick targets for a reason.
I'd expect they would use the powers to take down some wretch every now and again to warn others off, and to bag a few hundred million from GAFA.
If the EU and UK start to regularly tap GAFA for free money, Washington might not be pleased. And if services pull out of the UK/EU, aside from voters hating their governments even more than they already do, the NSA lose the global access that global use of US net services gives them.
The content scanning will already be happening, from online services to HDDs. Giving it legal status doesn't make much difference. You have no privacy anyway. Western governments take the Chinese line: no secrets from the state in the name of public safety and good order.
But the government have broken Britain offline with Brexit - 25% off sterling, one-third poorer, short of workers, services like the NHS, local councils and railways collapsing. Maybe this is the companion piece to break Britain online too. If you break something, it is easier to control. The solution to that may be to emigrate and go somewhere nicer. Unfortunately, other governments will be planning something similar. The model for government today is taken from Orwell and beta tested by China. After decades of globalisation, low prices, freedom to travel and work and the empowerment that the global internet gave us, the Empire may now be striking back. The good times may be over, permanently. The bad guys won. I guess we shall see.
The "cheese pizza" thing is one of the weird products of conspiracy theory culture. In this case, it comes from hacked emails from the 2016 US presidential election. Russia hacked a person running a campaign of the candidate Hilary Clinton and dumped the emails online. People who didn't like the candidate started reading them, looking for evidence. They didn't find the clear emails they were looking for, though there was some stuff for somewhat sane people to complain about. The insane people weren't worried about bureaucratic details of party politics and needed something much more intense, but one of them noticed that the various members of the party did discuss both cheese and pizza on occasion. They decided that this could mean child abuse. In exactly the same way that The Register becomes very concerning if you replace words like "cloud" with "secret plot to kill innocent people hidden in this article", this made all the people in the campaign look like child abusers if you were thinking too hard with too few brain cells. The most famous result of this particular theory was that a group of people decided that a pizza restaurant at which some campaign staff would meet must be the storehouse for child abduction victims (they had concluded it must be in the basement, even though that building didn't have one), and one of them charged in firing a gun, though nobody was hit. This is not the only consequence, just the most potentially lethal one.
Why the poster to whom you replied chose to use the term is another question. If it was intended as humor, I suggest that people not do that. In addition to the communication problems we've just seen, it could cause people to misconstrue your views.
Social media platforms will be expected to:
- remove illegal content quickly or prevent it from appearing in the first place, including content promoting self-harm
- prevent children from accessing harmful and age-inappropriate content
- enforce age limits and age-checking measures
- ensure the risks and dangers posed to children on the largest social media platforms are more transparent, including by publishing risk assessments
- provide parents and children with clear and accessible ways to report problems online when they do arise
As with everything with this 'government', its all about money. Had said companies come up with a brown envelope stuffed with cash for conservative party funds and MP hospitalities, this would never have even made legislation.
Given that the ICE has been given a 5 year reprieve it seems that this type of transaction does actually work. I guess Mr Fishy and co will be able to hold their breath whilst they count their money.
Upvote, downvote, do what you will, this 'government' is shit for you too, whether you have the intelligence or personality to admit it.
Not sure I agree with you as the car makers and various other groups set to profit hugely from the ICE cutoff along with gas boiler phase out are pretty upset. Mostly cos they are going to have to wait longer for their govt handouts.
You might say 'this is playing into the hands of the fossil fuel industry' but they are very good at profiting no matter what.
It still doesn't stop you from getting an EV or a heat pump before 2030.
This post has been deleted by its author
How far does "technically feasible" extend?
The only thing that stopped massive adoption of PGP when it released was (a) getting the src (b) compiling it (both of which are probably complicated for the average internet surfer) and (c) running it - as you had to copy/paste things, or attach files, which hampered "ease of use". Mailvelope exists on GMail (on PC anyway) to identify a PGP mail and decrypt it, once you enter your key - and obviously someone could 'accidentally' copy/transmit those keys.
And a bad example, but if apps like Signal provided any form of API to allow 'additional layer of functionality' server (ala "We'll PGP this over the top, so even if we could see your message, and had keys to it, we can't see the additional layer' then presumably another set of actors would target the API.
Signal is obviously therefore bolstering defences first....https://www.phonearena.com/news/signal-wants-to-be-quantum-proof_id150847
The answer is the poor educational standards (narrowness) exhibited nowadays by members of the Houses and by people appointed to high office of state, the rarity of exceptional intelligence among legislators (bright people have better things to do than climb the greasy political pole), and the questionable probity of people in the British legislature.
Meanwhile, countering Lord Parkinson's earlier comments, UK technology minister Michelle Donelan told newswire Reuters shortly after this that the government would, if necessary, require tech platforms to "work to develop technology to scan encrypted messages as a last resort."
.
What can't exist will be made to exist because that is the Will of the People !
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
