British government will (unsuccessfully) ban end-to-end encryption
Home Secretary Theresa May has introduced the long-awaited, frequently assayed Snoopers' Charter, and it is a complete disaster.
In the new bill, May says that she will ban products that use end-to-end encryption, whereby the company that made the product can't tell how it's being used. She seems to think that all this will require is orders to Facebook, Apple, Google and perhaps a couple of smaller players to get them to re-engineer their products so that all messages get decrypted at their data-centres, re-encrypted and passed on to their recipients.
She is wrong.
End-to-end encryption can be accomplished with literally thousands of products, many of them free/open source software that can be downloaded from tens of thousands of websites, including websites like Github that are indispensable to UK industry and cannot be blocked without crippling the economy. Even the Chinese government was unable to block Github.
This means that anyone who wants to communicate in a way that cannot be intercepted needs only to go on using the tools that they use presently. It means that anyone who wants to communicate in a way that the government can't intercept can download software from any of many, many, many sites and they're home free.
It also means that law-abiding people who lack technical sophistication will have infinitely large troves of sensitive communications captured and retained by Internet companies. When those companies have a security breach (this is a when, not an if), those innocent and technologically naive Britons will have all of their sensitive, personal information ashley-madisoned all over the Internet.
It gets worse. The Snoopers' Charter also legalises the security services' practice of creating and deploying cyberweapons, which means that they will be accelerating their practice of both introducing and hoarding security flaws in the technology that Britons use. Because these flaws are and will continue to be independently discovered and weaponised by foreign spies, criminals, voyeurs, etc, all of the services that comply with UK law by banning end-to-end encryption and by retaining sensitive personal information will be even more vulnerable.
The government is insisting that every service provider stockpile massive quantities of unstable toxic personal information, and simultaneously taking measures to make those stockpiles much, much less secure.
The government also admitted that MI5 had been spying on Britons for more than a decade without proper legal authorisation, and then used this as a pretense for the Snoopers' Charter, arguing that what was needed here was an expansion of spying power to legalise the practice, rather than an inquiry into why they were doing it in the first place.
Cynically, the government has brought in measures intended to buy off Parliament. They will enshrine the Wilson Doctrine into law, banning the security services from spying on Members of Parliament. They will allow some judges to overrule spying orders by the Home Secretary, but remember that in the US FISA system, the judges with this power have virtually never exercised it, over decades and decades.
This is the exact opposite of cybersecurity legislation. It's rules that will make things less secure for Britons, expand the potential for abuse of powers, and give security forces an incentive to go on weakening actual technical security.
May wrong to say surveillance bill creates judicial authorisation for interception, says Liberty – live [Andrew Sparrow/The Guardian]
(Image: Rt Hon Theresa May MP, Home Secretary, at 'The Pioneers: Police and Crime Commissioners, one year on' [Policy Exchange/CC-BY)
1Password's new travel mode locks you out of your accounts while you're travelling and crossing borders
1Password has taken Maciej Cegłowski’s demand for a “travel mode” for our technology to heart, introducing a new feature that locks you out of your own accounts when you’re in situations where you might lose control of your devices or be compelled to log into your accounts without your consent.
Whoever created the Wcry ransomware worm — which uses a leaked NSA cyberweapon to spread like wildfire — included a killswitch: newly infected systems check to see if a non-existent domain is active, and if it is, they fall dormant, ceasing their relentless propagation.
A UK weapons company called Drone Defence has sold an anti-drone product to Les Nicolles prison on Guernsey that will use 20 nonspecific “disruptors” to do something to drones that will stop them from overflying the prison and smuggling in contraband.
Loot Crate is a subscription service that delivers a box of curated pop culture goods to your doorstep. To sample their geeky wares, you can order a single mystery box exclusively from the Boing Boing Store.Each month Loot Crate sends you 6-7 unique items and apparel, including collectibles, books, and t-shirts. Pulling inspiration from all […]
Yes, yes there is. The ultraportable Twisty Glass Mini boasts all of the simplicity of its forebear, while fitting just a little bit better in your pocket.The Mini is perfect for casual smokers, and anyone who doesn’t have the patience or fine motor skill for rolling papers. This piece keeps the convenient design of its older […]
Learning to code is a perfect way to grow your technical sophistication, and open up a host of new career options. But since most “learn to code” initiatives focus heavily on web development, it can be tough to find good resources for general-purpose computer science outside of a 4-year degree program. To get a broad […]