Privacy and computer security are too important to be left to political meddling

Welcome to the latest Register Debate in which writers discuss technology topics, and you the reader choose the winning argument. The format is simple: we propose a motion, the arguments for the motion will run this Monday and Wednesday, and the arguments against on Tuesday and Thursday. During the week you can cast your vote on …

[Anonymous Coward]

Thought police? No thank you!

If we could trust our governemnt to be and always remain "good" and its various security service to never overreach their powers,.. - but that is a fantasy world that does not exist. In the real world, governments can and do crack down on political rivals by abusing survellance powers. Members of police and security forces do abuse their ppowers for personal reasons.

Also, strong encryption is vital for doing any kind of transaction over t'interwebs. . Insisting on any kind of backdoor could well kill online business fasterthan just about anything else, once peoplegenerally become aware of its ramifications.

The there's the matter of just what have security services done with the internet surveillance that they have already? I amnot suggesting that it has ot helped them catch at least some criminals, but I seem to recall a number of terrorist attacks where it was stated afterwards that the perpetrators were "known to the security forces", which rather begs the question of why didn't they dosomething about them before they attacked innocents?

Most likely, I think, because due process of law is such that they didnt yet have the evidence needed to arrest the terrorists. So, either (a) if they cant do anything until the attack happens, what was the point of the internet surveillance, or (b) perhaps the laws need tweaking a little to allow reasonable intervention in such cases earlier? In neither case is backdoored encryption the answer.

Also, unfortunately, not all criminals are idiots. There are many ways that they could communicate nefarious intentions to each other without using any encryption (in the computery sense) at all. True, the methods I can think of involve two or more crimnals agreeing upon a sutable system then learnng it sufficietly well that they can exchange messages rapidly, but if they are sufficiently determned, that wouldnt likely put them off.

In any case, just on principle, individual privacy should be a right.. If Boris or anyone else thnks therwise, I suggest they fit themselves with a 24/7/365 webcam livestream to prove it.

[Cederic]

Re: Thought police? No thank you!

Well, sharing messages privately on an E2EE platform still doesn't stop you getting charged and prosecuted:

https://www.bbc.co.uk/news/uk-60418556

Thought crime indeed.

[SundogUK]

Re: Thought police? No thank you!

It was a group chat, so no, not really E2EE...

[gnasher729]

Re: Thought police? No thank you!

First, sending a message is not a thought crime. Second, end-to-end encryption means it is not encrypted where it starts and where it ends. So if the receiver of your message thinks that sending it was a crime, then you are in trouble. That's quite natural, isn't it?

[Anonymous Coward]

What about strategies for "ordinary citizens"??

@John_E_Dunn

Quote: "Criminals would continue their activities using different E2EE apps while ordinary citizens and businesses would be subjected to pointless surveillance."

While I agree with the positions which you argue, I would point out that the use of the word "criminals" in the above quote is quite misleading.

There is NOTHING to prevent ordinary citizens from protecting themselves from snooping by one simple strategy: namely, using private encryption before any message enters any public channel. This strategy make the status of E2EE completely moot!! And supposing that E2EE is used by some public service provider, the snoops are faced with three challenges in place of one:

(1) Break the public E2EE service (Proton, WhatsApp, etc)

(2) Identify the private encryption scheme (AES, chacha, or maybe a private book cipher)

(3) Identify the key(s) used in item #2.

In fact, if the private encryption scheme uses a Diffie/Helman handshake to create different, random (and secret) keys for each message, item #3 also becomes harder.

"Ordinary citizens" can help themselves.....irrespective of snoops and legislation!!

Ref: Bruce Schneier, "Applied Cryptography" (A modern C compiler helps with the understanding of this excellent book!)

*

+0Y4IV3mF178nK3kvHi3ldo/NHdlE2PDaYHPhhAKHlS0wh5KJZq8niqfoJHtz+Aucrd6uY2JNq/j

+U5SZ3N5Pmj8o8UoamXA/yMO1cYHfZTyG3CsefsX72ObIxxSsX1+4hBhl0RGkRmkYDETUTJ5afoE

fJ8bZe78yI13wfqvoMgoSKdx2n3NFuSzI//Ap+ftjK0JLzgxq1FlRPvg4Q/56a5ZSLpxZyjk0XW8

lDiDVCvAcEqqZ1TYeQbXZeu7/MJApjK4A06XqlG9zZO1cdFHobaZeJ4gLJBkwaL4OjLhZpYugaLT

Ghr0yo0PZj2R2GHy+1I2eo0mnEkV/rD8UELUsf7Gy+oIunY+GWmeP9RGUvfKo9O/iSRi/A==

*

[Chris G]

Re: What about strategies for "ordinary citizens"??

Why should private individuals have to encrypt their communications prior to transmission, when in most democratic countries they already have rights to privacy enshrined in their laws?

In addition what is to stop overreaching governments from taking that extra step to criminalise all forms of encrypted communication other than those they licence with backdoors and where does Joe public learn about and acquire the ability to easily and reliably encrypt their comms?

Government needs to be educated and stopped now from eroding privacy and natural rights now.

Ordinary citizens should be respected and not subjected to authoritarian overreach.

[Valeyard]

Re: What about strategies for "ordinary citizens"??

your stuff makes sense if these ordinary citizens are IT security professionals, I just want to send a message to the family group chat without being snooped on with E2E built-in so people are using it without even having to know

[Anonymous Coward]

Re: What about strategies for "ordinary citizens"??

It's called The Price of Admission. Unless you make the effort, you can't be sure it's being done at all, much like locking a door. There's physically no real way around it.

[Valeyard]

Re: What about strategies for "ordinary citizens"??

..actual gatekeeping

[Howard Sway]

the impact end-to-end encryption would have on our ability to keep children safe

But children won't be to use it, to keep themselves safe.

Why does the government want to give criminals potential access to unencrypted messages between children? The argument for backdooring encryption seems to imply that the authorities will be so effective once they can see everything ("our ability"), that they will be able to keep everyone safe from every possible threat. If government ministers were to be held personally liable for any harm that subsequently resulted from effectively breaking encryption, because they hadn't kept one of us safe, they'd ditch the idea in an instant.

[MachDiamond]

Re: the impact end-to-end encryption would have on our ability to keep children safe

It's a parent's job to keep their children safe. If they choose to hand their kids devices that connect to the internet without doing some teaching and monitoring, it can't be the government's job to take over for them. Instead of government surveillance, perhaps it would be better to hold parents accountable if something bad happens. Make the cases very public.

[Charles 9]

Re: the impact end-to-end encryption would have on our ability to keep children safe

And if they get ignored anyway?

Abdication of responsibility seems to be the order of the day...

[Anonymous Coward]

Once again, conflating privacy with secrecy - and messages with life

While they intersect, they are different matters. Even a not encrypted message deserves privacy. For ages, we've used unencrypted communication media expecting privacy nevertheless. Opening a mail envelope, or tapping an analog phone was very easy - but we do expected provisions in place for that not happening without a warrant - and checks in place for allowing a warrant or not. The fact you can't photograph/record people as you like and use their images as you like is another example of privacy. And people can't really encrypt themselves. Street cams do break privacy. Facial recognition do break privacy. Location tracking do break privacy. Beacons do break privacy. Applications telemetry do break privacy. And what do you encrypt here?

Reducing privacy to message encryption is a big mistake. Encryption obviously increment the privacy of a message not allowing it to be snooped easily, but that's just a part of the overall privacy picture. You can encrypt your communication with Facebook, and still Facebook will hoard and use all the data it can - and let the government access them.

Of course we need to encrypt data to make it more difficult to read it by people with illegal access, and we have to ensure safe encryption is allowed. But we also have to protect data from those who can access them because they can see them unencrypted - but have no reason to access them.

We have to rein in governments asking easy mass surveillance - but beware of looking at a finger ignoring the elephant behind. Encryption alone can't save us.

[Cederic]

Re: Once again, conflating privacy with secrecy - and messages with life

Regarding your observation "fact you can't photograph/record people as you like", that's only true if they're not in public.

Disclosure: I'm a street photographer,

[Anonymous Coward]

"that's only true if they're not in public"

There is no global rule- it depend on where you live - usually taking photos is not forbidden - but publishing them without permission often is - with some exceptions. There's a reason why Google StreetView blurs some image parts - and that's Google.

[trifle7]

Re: "that's only true if they're not in public"

...publishing them without permission often is...

It's unlikely that news agencies (print or broadcast) have ever asked all and sundry for their permission to use their images. If it was so then a newscast from any public place would positively bankrupt an outlet in under a minute.

Yellow jacketed jobsworths... (8 mins)

There's a reason why Google StreetView blurs some image parts...

The reason is mainly a social one. Google kowtowed to the vocal minority raising a hue & cry about "privacy". It's the same minority that fails to appreciate how activities like walking down the street or things such as house numbers, number plates etc. are not private in the least.

Still, even Google has to act like the customer is always right.

[jake]

Re: "that's only true if they're not in public"

Of all the evil things that alpha-goo does, why people chose to bitch about streetview images (which any untrained chimp could provide at the drop of a camera) is beyond me ...

Take a look at the image right across Downing Street from Number 10 ... it's blurred. WHY? Everybody (even this Yank in the Wilds of California!) knows it's #23, the Foreign, Commonwealth and Development Office.

Here's a link to the goo-pic.

The mind absolutely boggles.

[MachDiamond]

Re: "that's only true if they're not in public"

I imagine that you'd also be able to find hundreds of images on a site such as Flickr. Higher res too.

[Anonymous Coward]

"It's unlikely that news agencies (print or broadcast)"

That's one of the exceptions - and you can't publish random images of people without being able to demonstrate if falls under the news reporting exception.

Being unaware of laws won't protect you from it.

[jake]

Re: "It's unlikely that news agencies (print or broadcast)"

There are any number of tourist guidebooks with random street scenes from all over the world. These street scenes are often "holiday pics" taken by the author, and contain pictures of all number of people. I can guarantee that not many of those people, if any, has signed a piece of paper authorizing that use.

It would seem these supposed laws of yours are somewhat ineffectual.

[trifle7]

Re: "It's unlikely that news agencies (print or broadcast)"

"...you can't publish random images of people..."

Sounds a bit like a wager to me... but otherwise yes - of course you can; it happens all the time.

"...under the news reporting exception."

And in which part of the world does a reporter or news agency have to be sure they get such an exception? Hint: It will be somewhere that has a regulator in place for such matters e.g. China, North Korea et al.

Disclosure: I don't like yellow-jacketed jobsworths...

[MachDiamond]

Re: "that's only true if they're not in public"

"but publishing them without permission often is"

It would depend heavily on where you live. It's not illegal if the image/likeness is not being used to sell a product or service. That would require a release. There was a case where a photographer was taking photos of people in various states of undress within their high rise apartments from an adjacent high rise apartment and selling limited edition prints. It went to court and the photographer won.

It's not "often" the case that photos made of people in public are not legal to publish. Again, your country's laws might be very different.

Google is just covering their backsides when they blur stuff. It's cheaper to do that than defend thousands of lawsuits even if they could win them all. A funny thing is my old car that was parked along side my house before I got rid of it is blurred on Google street view. No idea why. It didn't even have plates on it since I had transferred them to my new car. The only guess I have is their automated program saw a car and blurred the whole thing as it couldn't target a license plate.

[Anonymous Coward]

"It went to court and the photographer won."

Please, publish the evidence.

"Again, your country's laws might be very different."

Which is what I wrote - it's better to live in a country that protects your privacy better.

[jake]

Re: "It went to court and the photographer won."

So getting your picture taken while you are in a public place is a privacy violation? If you're THAT paranoid, perhaps you shouldn't leave the house? I mean, my gawd/ess, somebody might recognize you while you are out and about! And THEN what would you do? Get them arrested so they can have their minds appropriately wiped?

[MachDiamond]

Re: "It went to court and the photographer won."

"Please, publish the evidence."

It was a story recounted by Ed Greenberg, an IP attorney in NY. I think if you searched for "photographer, High Rise, fine art", and a couple of other terms you might be able to find the case online.

I'm not bothered about having my photo taken when in public. If I were, I'd live underground. What would bother me would be to have the image tagged with my information or used to sell something or advocate for some position. The courts are already clogged up with people suing because their coffee was too hot and they spilled it in their lap.

[F0ulRaven]

Expectation and reality are different

I expect my communications to be private, but I know they are not as if I go and start using multi level encryption and someone notices, I am quite sure there will be a knock on my door asking why is my communications set up so they can't be read - what do I have to hide?!

[tiggity]

You could always try hidden in plain sight.

The occasional rare use of stego in images likely to sneak under the radar.

.. Or maybe we go back to the Jam Echelon days and everyone fills their messages with "terror" related keywords. Years back for fun I wrote code to encrypt / decrypt text where all output of encryption was words* that may well be regarded as suspicious by the security services.

Did it as easy way to generate text that had dubious words, but also the fun of is it a bluff or double bluff, was there actually a message hidden there.

*word lists configurable so could be changed by user, though obviously if actually used for real encrypted communications with AN Other would both need to use the same word list

[jake]

Obligatory Reply

"what do I have to hide?!"

Might I point out that you don't have a plate glass exterior wall in your shower, and you do have drapes over the windows in your living room & bedroom ... and hopefully there is a door between your toilet and the rest of your house. What are you hiding? Are you a criminal?

While I'm on the subject, presumably you don't want me to have access to your banking, health and tax information, and you don't want me to be able to access your computer/phone from my computer/phone without your expressed consent, right?

Privacy isn't always covering something illegal.

[Robert Helpmann??]

Re: Obligatory Reply

I look at the "What do you have to hide?" question in reverse. One of the things a right to privacy ties into is the presumption of innocence as far as the government is concerned. If there is widespread surveillance, then it implies a disregard for this. Also, while this argument is focused on government access to our lives, companies such as Meta profit greatly by eroding the concept of privacy and that we should be concerned with it at all. They have taken the approach of catching users while young and training them up to think that it makes sense to make public their private lives. Government and industry efforts play off each other in this regard and are a blight.

[Anonymous Coward]

That "not" knot is still there..

In the digital age, we should not expect our communications to remain private.

Working through that tangle and seeing most people agree with the above (i.e. disagree with how the statement is presented) gives me hope.

[spold]

While some countries (the US for example) mostly think that Privacy is all about things like encrypting credit card information, the European view has generally been that Privacy is a basic human right - the right to be left alone.

[Throatwarbler Mangrove]

Oh good, you've mentioned Europe. Expect at least one spittle-flecked rant to come your way shortly.

[spold]

Yes I was using it Continetally but I expect you are correct. Whichever way you look at it the statement still applies.

[jake]

You are incorrect on your assumption about the US.

[Anonymous Coward]

Yes, in the US privacy is a commercial issue - not surprisingly FTC is tasked with privacy - "Protecting Consumer Privacy and Security" (https://www.ftc.gov/news-events/media-resources/protec ting-consumer-privacy-security) - see the "consumer" added before privacy? It's not a citizen right, it's a "consumer" right. Something is rotten in the States of America - privacy wise.

When you regard privacy as a commercial issue, someone will think it can be sold, bought and traded.

[jake]

Oh, horseshit.

The Fourth Amendment exists for a reason, regardless of what little fifedoms like the FTC have to say on the subject. As SCotUS put it, the fundamental purpose of the amendment as guaranteeing "the privacy, dignity and security of persons against certain arbitrary and invasive acts by officers of the Government, without regard to whether the government actor is investigating crime or performing another function".

[Anonymous Coward]

As someone once put it, "Ink on a page!" Someone with enough power can change the rules, everyone else be damned. Look what's happening with authoritarians everywhere. They're starting to disregard the rules, figuring they have accumulated enough power to get away with it. Pretty soon one of them will take the bold step of threatening to consider MAD a winning scenario.

[jake]

That particular bit of paper, with that particular bit of ink, has stood remarkably well so far. I rather suspect that it'll stand for a lot longer than I will.

[Anonymous Coward]

Compared to things like the Magna Carta and the Bible, it's relatively young. Plus, it had provisions thst advantaged the elite, so they saw no real reason to ditch it until about the time of the Civil Rights Era.

[jake]

Could you please show me exactly where in the Fourth Amendment "the elite" are given any advantage? For your edification, I'll include the 4th in its entirety here:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

Note that provisions in both the Bible and the Magna Carta that favo(u)red the elite were two of the things the Founding Fathers were trying to get away from.

[Anonymous Coward]

Not the Fourth Amendment, but in the original text that ONLY gave the vote to significant landowners. Hmm...

And the whole Three Fifths Compromise, too.

What in the Bible were the Founding Fathers avoiding?

PS. If the Constitution really matters, why the push to enslave women to their wombs despite a little something called the Thirteenth Amendment?

[jake]

"Not the Fourth Amendment, but in the original text that ONLY gave the vote to significant landowners. Hmm..."

We were talking about the Fourth specifically. However, if you insist, the Magna Carta only gave rights to the barons, The US Constitution, as written, did not specify who was and was not allowed to vote. That little detail was left up to the individual states. Various amendments have, over time, limited State powers over who is, and is not, allowed to vote. See the 15th, 19th, 24th and 26th amendments.

"And the whole Three Fifths Compromise, too."

Repealed 'way back in 1868. No doubt you remember this happening vividly.

"What in the Bible were the Founding Fathers avoiding?"

The entire religion thing. But they weren't avoiding it, they were rejecting it outright.

"PS. If the Constitution really matters, why the push to enslave women to their wombs despite a little something called the Thirteenth Amendment?"

It's a control thing. Brainwashing is ugly both in progress and outcome.

[Anonymous Coward]

"Repealed 'way back in 1868. No doubt you remember this happening vividly."

And it started getting backtracked almost immediately, although via the back door. What we're seeing now is a potential endgame to this by possibly ignoring the whole damn show.

"The entire religion thing. But they weren't avoiding it, they were rejecting it outright."

And yet it came back, much like Washington was against political parties but they happened will him, nil him. Recent psychological research shows humans mentally don't function as well without some kind of last resort belief, and when that gets threatened, they tend to get their most dangerous (such as now).

"It's a control thing. Brainwashing is ugly both in progress and outcome."

But still highly desired by those of an authoritarian mindset, especially when the populace lives precariously. As I've said, once things get bad enough, any legal document or principle can be cast aside. It seems in the end, the ultimate arbiter of social order is pure brute force.

[Anonymous Coward]

Spot on description of the situation.

The issue isn't whether the current politicians mean well; the issue is what future politicians will do to abuse the power they've seized. :(

[Charles 9]

Then you're playing a mug's game, as there's no way to guarantee future performance regardless of your preparations.

If trust can never be regained, then the eventual endgame is a DTA world.

[ShortLegs]

@spold "the European view has generally been that Privacy is a basic human right"

Article 8 of the European Convention on Human Rights provides a right to respect for one's "private and family life, his home and his correspondence",

Thats rather more than a "general view". Its a fundamental right. And yes, despite leaving the EU, it still applies in the UK.

[gnasher729]

If you have nothing to hide...

... then you have nothing to fear. So why do politicians hide their expenses, especially after many were caught stealing from the tax payers a few years ago? Could it be that they have something to hide?