UK surveillance powers bill could force startups to bake in backdoors

http://techcrunch.com/2016/03/10/uk-surveillance-powers-bill-could-force-startups-to-bake-in-backdoors/

by benevol • 10 years ago

280 150 10 years ago

pmontra• 10 years ago

If this gets approved and you're based in the UK, that's it. If you're based somewhere else are you safe or should you refuse to create accounts for people from the UK?

s_kilk2• 10 years ago

Piggybacking a bit here: would a startup based in the UK (as in, devs and managers live in the UK), but incorporated in the US (maybe through the new Stripe service), be held to this?

coreyp_12• 10 years ago

IANAL. International laws probably vary, but by having employees in a country, you may be subject to its laws.

For example, I am part owner of a Canadian company that sells an online service. If we hire US employees (developers), then we must collect sales tax and pay income tax for sales originating within the governing municipality.

Obviously, I am talking about US tax law, and your question is of a different nature, so the best thing to do is to contact a lawyer who has expertise in that area. I only offer my experience as evidence that the location of employees can impact the legal responsibilities of a foreign business.

pjc505• 10 years ago

Yes. You'd get leaned on personally, see Matrix-Churchill.

NetStrikeForce• 10 years ago

It's mostly irrelevant. The government can probably harass the executives and relevant employees and basically strong-arm them into cooperation.

As long as you need to live in the UK, you're at their mercy.

If only there was a bigger power that looked a bit more after people's privacy and could stop local governments from doing this...

mseebach2• 10 years ago

Yes.

"7.14 Section 217(8) provides that obligations may be imposed on, and technical capability notices given to, CSPs located outside the UK and may require things to be done or not done outside the UK. Where a notice is to be given to a person outside the UK, the notice may (in addition to electronic or other means of service) be given to the CSP:

-- By delivering it to the person’s principal office within the UK or, if the person does not have an office in the UK, to any place in the UK where the person carries on business or conducts activities; or

-- At an address in the UK specified by the person."

https://www.gov.uk/government/uploads/system/uploads/attachm... -- page 59

hlandau4• 10 years ago

The key issue, I think, is not what law-theoretically does and does not theoretically oblige you to comply with a jurisdiction, but the assets and people which are within reaching distance of the applicable government. Whether a service is accessible from the UK is irrelevant so long as you have no assets, no employees in the UK. Conversely, if you have assets or employees in the UK, you can expect them to be under threat of seizure or coercion, respectively.

I also don't think it's a safe assumption in any jurisdiction nowadays that the person who gets served with a notice will be an executive. It seems quite plausible to me that a front-line engineer could get served with a notice, and not even be allowed to tell an executive. Thus, even if your employees in the UK don't appear to have been coerced, this appearance could be deceiving.

There may be some limited countermeasures to this sort of thing, like regular audits of system configurations, etc. performed by a different group of people, and who will thus cry murder if they find any anomalies. This should work because the second group of people will not be the target of a notice, and thus not bound by its secrecy provisions. Possibly this group could do their auditing remotely, from outside the UK. Of course the in-UK group could, under coercion, rootkit the system to hide these changes, probably by being told to install government-issued software. Hmm...

mtgx• 10 years ago

This is why I've been saying from day one that an Y Combinator focus on UK was the wrong move, because I expected the authoritarian mentality to only increase there over the next few years. The focus should've been on Germany, which at least has a strong Constitution (UK has none) and judges tend to be pro-privacy (although I imagine some data-mining/advertising startups would hate that).

Perhaps even more importantly, it's the people that care deeply about privacy there, too, and would protest obvious authoritarian moves by the government, while in the UK they seem to care almost as little about it as the Americans do.

opsunit• 10 years ago

https://www.schneier.com/blog/archives/2007/08/new_german_ha...

maze-le3• 10 years ago

Germany has a strong constitution, yes, and an even stronger constitutional court... but: Take a look at poland and see how fast things can change.

It is frightening how fast a government can eviscerate the very foundations of democracy. This is even more appaling when you look at the fastest growing political power in Germany: The rightists from the AFD. I have no doubt that, what is happening right now in poland can happen in germany too, given enough time.

type0• 10 years ago

What if you operate in UK and have an office there? So from the privacy conscious user perspective one would need to check that a company operating the specific website doesn't have anything do with UK, it's not very practical and makes GCHQ kinda happy.

mhandley• 10 years ago

It becomes interesting when a company operates in the UK, but does all its software development elsewhere. UK law can't compel foreign software developers not to talk about what they've been asked to do, so I don't really believe the law will be successful in keeping such monitoring secret.

Even more interesting is how this would work regarding open-source software. You can't keep such a backdoor secret in GPL'ed software and comply with the license, but a UK company couldn't release changes they'd made to comply with the law either. So if you suddenly see UK companies move away from GPL'ed software for no obvious reason, that may be a clue.

madaxe_again6• 10 years ago

Let's have a show of hands of founders/folks with technical control, shall we? I for one will risk prison rather than put several hundred million consumers at risk, and will publish any such technical capability letter we receive.

nixgeek6• 10 years ago

They've already demonstrated with RIPA that they are perfectly willing to convict and sentence in these sorts of situations. Failure to disclose encryption passphrases can (and does) result in jail times of up to 2 years, or in cases which are deemed to have national security implications, 5 years. [1-3]

Talk on HN is comparatively cheap, and I suspect most people would reconsider their position when facing down the very real prospect of serving 5 years in HM Prison Belmarsh.

[1] https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... [2] http://arstechnica.com/tech-policy/2007/10/uk-can-now-demand... [3] https://www.schneier.com/blog/archives/2007/10/uk_police_can...

deepnet• 10 years ago

Lie to the machines !

Under the spreading chesnut tree, I sold you and you sold me.

Be Vigilant. Be Pure. Behave.

reacweb• 10 years ago

Would you accept a bill to force TSA locks on all houses ?

nixgeek6• 10 years ago

This is a slightly different situation since it's within the realm of possibility for companies to implement security measures which make it difficult (or impossible) for interception of data by LEO.

That isn't really true in the case of houses so there's no need to legislate for "TSA locks" (master key system). Obtaining a warrant is still required but once you have authority, you can bash in the door, drill the lock, etc.

AnthonyMouse2• 10 years ago

This is a slightly different situation since it's within the realm of possibility for companies to implement security measures which make it difficult (or impossible) for interception of data by LEO.

I don't understand why people imagine this to be a novel situation. LEOs can't get documents if the suspect always destroys them immediately after reading them. If you keep your secrets in a box in a hole in the middle of the desert, a warrant isn't going to find it or even prove it exists.

That has never been an excuse to ban paper shredders or track everyone's movements 24/7 in case they ever went to a secret place to do a secret thing.

hathym• 10 years ago

admit it, we live in a fu* up world.

huuu• 10 years ago

People who can enter a back door:

  1. people with a key
  2. people with the skill to open the door (burglar)

It's strange the UK thinks number 2 will never happen.

xrorre3• 10 years ago

The second occurrence is not only inevitable, it refutes the notion of a door in the first place, which is supposed to be fully opened at some stage for long periods, not temporarily opened in-case-of-emergency, or half-shut just-in-case.

adventured• 10 years ago

They know it'll happen. The terrible part is, they don't care. It's a risk they're willing to take to acquire the power they're after.

elcct• 10 years ago

And people with a key could take your data and sell it.

CJefferson• 10 years ago

Playing Devil's Advocate, couldn't the company require something signed with their private key to open the back door?

Apple (for example) would already be in serious trouble is someone got their private keys, they use them to sign OS updates for example. If they could generate a device-specific signed cookie to say "open up", what harm would that do?

coreyp_12• 10 years ago

#3. People who receive the key from #1 (in the future).

This may be next year's elected official, or the official elected in 10 years, or the spy who will work in the office 7 years and 2 months from now. Can you guarantee the intentions and actions of every single future government employee and official? This, in my opinion, is the biggest threat!

jacquesm• 10 years ago

You can't even guarantee the intentions and actions of the government in its entirety, good governments have historically been succeeded by bad ones in roughly the same way that rain eventually follows sunshine and the other way around. To assume infinite stability of government is a major mistake.

joosters• 10 years ago

...and yet we all still have door locks?

I don't think your analogy is going to help convince people that the policy is bad.

GordonS• 10 years ago

These things also have a habit of growing arms and legs - so another issue is the number of people with the key. I can almost guarantee that at some point the number of people with the key will grow (police forces, councils...)

Yet another issue is oversight of those with the key (who watches the watchers)

madaxe_again6• 10 years ago

No, they do think and know (2) will happen, and are probably hoping it does, as they realise that when it happens they can use it as an argument as to why they need MORE surveillance powers and MORE backdoors because "the bad guys" are STILL getting through, so more surveillance powers will be needed to keep you safe from the evil without, and to help you keep your British values good and strong.

nomercy400• 10 years ago

I wonder how people in the UK will respond if, for example, Google, Apple, Facebook and Microsoft all decide to no longer provide their internet services in the UK. How long would this bill last?

Also, it's quite concerning that four US based companies could influence a country's policies so much.

chei0aiV• 10 years ago

IBM managed to convince Pakistan and India not to go to war!!

eni2• 10 years ago

can you elaborate on how that happened and when?

pritambaral• 10 years ago

Uhh ... some source on that please? I couldn't find anything related

verytrivial• 10 years ago

I am non-UK citizen living in the UK. People will not respond. The government and business can literally do anything here regarding sharing of private data with whomever they chose and barring a few "miscreants trying to stir up trouble", the general population will bend over, twice if you say please. Mustn't grumble!

madaxe_again6• 10 years ago

Most folks in the UK support this bill, support the UK leaving the EU, support the scrapping of all human rights legislation.

It's a pretty regressive, insular country, ruled by fear.

aidos• 10 years ago

The list of "equipment interference agencies" includes "Her Majesty’s Revenue and Customs" (HMRC). For those of you not in the UK, that's the people responsible for collecting tax.

Why would the tax department ever be allowed to do something like this directly? They seem incapable of fairly collecting the taxes of the country, what business do they have acting as an "equipment interference agency"?

dingaling• 10 years ago

And also the Competition and Markets Authority, who will be able to obtain a warrant to hack corporate servers in order to investigate 'serious crimes' as defined by the Enterprise Act.

nixgeek6• 10 years ago

They have an investigatory arm of their own and have been known to go after corporate data, particularly email, as part of looking into what they believe may be tax fraud.

One could reasonably question why this isn't a department or division of another agency, perhaps NCA, but I think it's a fair statement that forensic accounting and investigation is a somewhat specialised skill.

philip142au• 10 years ago

So simply if someone hacks into that startup company they can use all those backdoors to spy on what the government employees do with their phones.

People need to think of the consequences of getting what you want.

xrorre3• 10 years ago

Better wording of a back door is donwgraded security. For an institution whose sole purpose is to engender security, they do the opposite. It's like saying they have better, more expensive guns than the rest of us.

Which collectively if you think about it, and round up all the PCs in each home, and all the security that goes into them, it's (collectively) the most militarized group of computers there is, and they obviously don't feel outgunned.

diskcat• 10 years ago

For an institution whose sole purpose is to engender security, they do the opposite.

Well the security they engender is mostly physical security i.e. not getting blown up by terrorists while the security they want to breach is information security. I could see why some people would not mind trading privacy for reducing the chance of getting blown up, all else being unconsidered.

pjc505• 10 years ago

The problem is that some privacy is essential for democracy to function: you can't have the secret police going around bugging political parties and feeding information to their preferred candidates. Breaching encryption is like Watergate but without all the tedious need to physically break into a hotel.

xrorre3• 10 years ago

Well the security they engender is mostly physical security i.e. not getting blown up by terrorists while the security they want to breach is information security.

This is exactly my point. They use the terrorist strawman to frame their agenda; which is to hack all the internets without anyone batting an eyelid.

Information technology is but one facet of reality, and a reflection. It is not the whole thing. It's for this reason it is more suitable to get to the core of why anyone would want to commit an act such as blowing oneself up in the first place.

It's like going all guns blazing on the symptoms of flu. Unless a cure is invented it will haunt us and we only have symptomatic relief.

I can understand the motivations for going after anyone doing something technically interesting with a computer (actually a rare thing unless you are supremely skilled and have chosen a life of learning systems and divulging technical manuals). Also see: homebrew crypto

Huhty• 10 years ago

Little by little, month by month, our privacy is going out the window.

It's similar to how they are making smoking less and less popular by making new laws, increasing prices, and raising the legal smoking age.

pif3• 10 years ago

That's not different from what has always happened with telephone companies in many countries, maybe worldwide. And nobody was ever shocked about it!

spacecowboy_lon2• 10 years ago

I think tech crunch is panicking Given that this is for CSP ie ISP or Telco to facilitate tapping (as all ready happens)

It looks likely that 95% of the startups in the UK wont be covered

TheOtherHobbes• 10 years ago

No - because the definition of CSP is vague enough to include any professional provider of online content and/or services.

So it's more likely that 100% of UK startups (with at least 10,000 users) will be covered.

This doesn't mean that startups have to build in backdoors now. But it does mean that if someone from the Ministry of Something or Other or MI5/6 or the Police turns up and demands a backdoor and/or access to records, the startup has to comply.

I have no idea where this leaves Apple, providers of VPNs, or startups trying to provide secure communications.

At a guess it means they'll probably try to stay outside of UK jurisdiction. And I won't be even slightly surprised if banning VPNs is the next step.

It's obvious this is going to collide head-on with the Apple vs FBI case in the US. But this time we won't be able to follow it, because the legislation includes a press and reporting gag.

The UK's Home Office is notorious for being stuffed full of authoritarian paranoiacs, and they're always doing stupid shit like this. You can't even blame the current gov because it was the same story with the previous crowd - although the authoritarian paranoiacs in power now seem to be trying to take things to the next few levels.

spacecowboy_lon2• 10 years ago

The definition of CSC is key and I suspect will need to be defined in law quitly lobbying a few Lords or sympathetic MP's to ammend the bill would be better - praying Apples very weak case against the FBI in aid wont help.

wepple• 10 years ago

it mandates providing capability for interception, interference, and acquisition.

I wonder if we're going to see companies making increased efforts to make as much customer information completely unavailable to themselves to make these warrants not worth applying for? Unfortunately most businesses cannot operate in this manner fully, obviously.

mseebach2• 10 years ago

You wouldn't know from reading the TC article (which is almost criminally poor), but yes, this is very, very bad.

Read the actual proposal instead, it's written in natural language and perfectly readable: https://www.gov.uk/government/uploads/system/uploads/attachm... -- Chapter 7, begins at page 57.

benevol2• 10 years ago

All these new US & UK laws literally scream "Snowden is a traitor!".

Who wants to live in such a society?

noir_lord2• 10 years ago

Would I want to? Hell no.

Unfortunately the sands are shifting under me and since we are about two steps back from full idiocracy I can't see it changing.

We have an electorate is willfully almost gleefully uninformed, ruled over by politicians who are venal and rarely if ever held to account.

The whole system is bullshit from council to ministers.

The interesting question for me is more "has it always been this bad and we didn't know or are things actually worse now", I'm leaning towards the former as if you look at the history of government (in this country and most countries tbh) it's a litany of abuse after abuse.

andy_ppp3• 10 years ago

I looked through the draft bill a few months ago and I couldn't find the "we will force you to put backdoors in your software" anywhere in the bill.

Most of it seems like bureaucrats trying to get access to information after they have obtained warrants. It all seems a lot more boring and a lot less cloak and dagger if you actually dredge through the bill here:

https://www.gov.uk/government/uploads/system/uploads/attachm...

The document mentions encryption four times and backdoors no times. One of those times is to say that the bill does not change anything about encryption that isn't already in law under this bill, RIPA: https://en.wikipedia.org/wiki/Regulation_of_Investigatory_Po...

Really actually more scared of RIPA (which is already law) than this:

"In October 2014, it was revealed that RIPA had been used by UK police forces to obtain information about journalists' sources in at least two cases. These related to the so-called Plebgate inquiry and the prosecution of Chris Huhne for perversion of the course of justice."

It's amazing to me that the first two cases are absolute abuses of power; I thought we were still being told that these laws were to stop terrorists and paedophiles, not find out journalists sources...

sh1989• 10 years ago

Section 189(4)(c) of the Draft Investigatory Powers Bill places "obligations relating to the removal of electronic protection applied by a relevant operator to any communications or data".

A relevant operator includes telecommunications services, defined in s193(11) as "any service that consists in the provision of access to, and of facilities for making use of, any telecommunication system (whether or not one provided by the person providing the service)"

This has been slightly changed, now that the IP bill is no longer a draft: http://www.publications.parliament.uk/pa/bills/cbill/2015-20...

The above draft is now re-written as:

s217(4)(c): "obligations relating to the removal by a relevant operator of electronic protection applied by or on behalf of that operator to any communications or data".

There's an appeals process, but the gist is that they're not outright banning backdoors. But if they come knocking, you better find a way to remove any protection that's there. Which is rather chilling.

andy_ppp3• 10 years ago

If the government goes to a judge and gets a court order to access information this is what I consider reasonable and in fact a good thing!

It seems to suggest that technical feasibility and cost needs to be taken into account as well. If it's technically impossible due to Spider Oak style end to end encryption or for example the new iPhones (6+6s) having some very advanced encryption features I'm not certain that there is a requirement to insert a backdoor.

If the security services were monitoring a person who was genuinely planning to kill people and they asked you to put in a limited back door?

Most services remember do not have encrypted backend systems and it'll probably always be this way.

Mass surveillance is the complete opposite of this and is a totally unreasonable intrusion.

Ensorceled• 10 years ago

I guess it depends on what you mean by a "backdoor"; being able to remove any CSP added encryption upon request and being forced to explicitly add easily enabled monitoring tools (only if above a certain size or if the CSP is considered likely to be served warrants) is a backdoor by quite a few people's definition.

hlandau4• 10 years ago

See the provisions for technical capability notices. I covered the draft version here: https://www.devever.net/~hl/investigatorypowers

Kenji• 10 years ago

Am I mistaken or is the UK moving more towards authoritarianism every time its politics hit the news? Disgusting.

tehwalrus• 10 years ago

You are not mistaken.

Nursie• 10 years ago

While there has been a lot of bad news in this area, and a lot of nonsensical lawmaking, there has also been a lot of internet hysteria over very little.

We have problems. It's not a police state (yet) any more than the US or other western nations.

collyw• 10 years ago

Its definitely the direction it is heading.

Chestofdraw• 10 years ago

One of the most worrying things is how the Tories are changing the game to try and make sure they remain in power.

Changing boundaries in a way that disproportionately benefits themselves.

Changing voter registration / deregistration to make non tory voters more likely to become deregistered.

Lowering short money when they rely on it the least.

Changing the way donations from unions work to drastically lower Labours funds.

So we can probably expect a Tory gov for a long time. Not that Blairs labour were much better...

ZenoArrow2• 10 years ago

"So we can probably expect a Tory gov for a long time. Not that Blairs labour were much better..."

I beg to differ. I was no fan of Blair, but the current Tory government is absolutely blatant in its disregard for public service. Here's the latest example, from earlier today...

http://www.mirror.co.uk/news/uk-news/iain-duncan-smith-claim...

"Heartless Iain Duncan Smith today claimed people thanked him for taking their benefits away.

He was accused of "losing the plot" after making a string of increasingly bizarre claims about his department's cruel benefit sanctions regime.

The Tory Work and Pensions secretary said 75% of people who have had their benefits stopped under his department's cruel sanctions regime said it helped them "focus and get on."

A spokesperson for the Department for Work and Pensions (DWP) was not immediately able to back up Mr Duncan Smith's claim.

But the sister of ex-soldier David Clapson, who died starving and penniless after having his benefits stopped said: "I don't think my brother said it had helped him get on.""

P.S. I know the Mirror isn't the best news source, but in this case the evidence is pretty clear.

EliRivers• 10 years ago

It's moving towards a kind of Daily Mail fantasy land, in which there are peedos and brown-skinned terrorists everywhere, simultaneously wanting to live their lives taking advantage of the country, and also destroy it.

I see my tax bill going down, knowing that the few hundred quid extra I have per year (which is basically lost in the financial noise for me - meaningless) means that somewhere someone who really needed that money or the service it paid for is now being fucked over. I don't even know who; Cameron and chums (I go sailing sometimes with a chap who used to share a house with Dave Cameron; apparently he was a self-entitled tosser then as well) are fucking poor people over on my behalf, presumably thinking that this is what I want. Or maybe they don't even think it's what I want; maybe they're on some bizarre Randian kick, living in the Westminster bubble in which poor people simply don't deserve any help, and this is some kind of moral crusade from their messed-up Westminster bubble. The benefit to me; zero. The cost to the people at the bottom; devastating.

I see our "leaders" acting as absolute cowards; these are the people who should be inspiring us, but instead they rush to surrender our freedoms as fast as they can. Again, presumably because the Daily Mail tells them that this is what we want. The other lot aren't any better. Remember when Harman wanted to introduce compulsory ID cards? She had a long record of voting in favour of more government power and fewer civil liberties. Intellectual and moral cowards, the lot of them.

alextgordon• 10 years ago

This is what I struggle with. Are they evil, blind, or both? The Conservatives are firmly in power now. Labour, the Lib Dems and even UKIP have been neutered. Corbyn is not going to lead Labour to victory in 2020.

You would think that they could relax. They no longer need to pander to the tabloids. If they liked, they could dismantle the media and rebuild it in their image. They could build a gigantic statue of Theresa May. They could go to war. The potential for evil doings is endless.

Instead they spend their time fucking over disabled people. I mean... why? What's in it for them?

p01926• 10 years ago

"I am leaving it as I found it. Take over. It's yours." Ellis Wyatt

If you feel you're being compelled to act immorally, remember non-compliance — whatever the immediate consequences to yourself — is the only acceptable course of action. When we decide to spend our days building powerful tools, we enter into an implicit agreement not to let them fall into the wrong hands. If the government comes knocking, BURN IT DOWN. Make good on your debt to humanity.

m0nty3• 10 years ago

remember non-compliance — whatever the immediate consequences to yourself — is the only acceptable course of action

Seriously, can we get away from these fine-sounding (but otherwise utterly useless) slogans and clarion calls? There has to be a better response than a scorched-earth policy.

I'm a software developer based in the UK currently working on an app which will probably be affected by this bill. Apart from destroying the product and/or risking jail-time, are there any sensible options? Can I incorporate somewhere else in the EU and run everything from overseas? What if I am not a UK company but a DE company and everything happens from there?

I realise it's early days, but I'd hope HN could come up with some informed suggestions.

madaxe_again6• 10 years ago

No. My response will be one of two things:

1) Shut the company down, lay off 50 employees, leave 100 clients without revenue, damage the UK economy to the tune of £300M/yr.

2) Go public, go to jail, and (1) will then happen anyway.

So frankly throwing the towel in looks like the only sane course of action, unless you have a magic wand to affect government policy.

nixgeek6• 10 years ago

If you physically move to Germany, perhaps, but it appears you would need to discontinue all operations in this country. Nobody employed here, no bank accounts, etc.

Another person posted a somewhat insightful excerpt from the draft which covers this situation:

https://news.ycombinator.com/item?id=11265963

benevol2• 10 years ago

Can I incorporate somewhere else in the EU

In case you want "Europe, but without EU law and surveillance", there is Switzerland.

PJDK2• 10 years ago

Well since this is only a proposed law, writing to your MP would be a good start.

pjc505• 10 years ago

The thing is, the actual probability of being asked to comply with this for a small company is fairly small: it's aimed at Facebook and Apple. And perhaps privacy-orientated services like Lavabit. Your best option is to retain a really good ECHR lawyer, because that's where the fight is going to be.

akhatri_aus• 10 years ago

Make a Societas Europaea instead of Limited company (https://www.gov.uk/government/publications/european-companie...).

Only thing is its a bit more expensive than a typical Ltd.

erkkie• 10 years ago

The threat of a scorched earth policy needs to be strong enough for governments to either not consider these types of actions or suffer the consequences. I can understand it not being practical for the people involved though, and I sympathize.

maze-le3• 10 years ago

I think the only viable option would be to leave the UK. Not just you physically, all bank accounts and insurances too. When you have set up the company somewhere else (maybe netherlands, germany or sweden) you would have to renegotiate all contracts with all your clients, have new laywers, new accountants, etc...

I can not think of any way other than leaving, that will not compromise either your product, your customers or your integrity.

This is 'scrorched earth' if you will, without 'fine-sounding, useless slogans'. Consider this: If this crap becomes law, you certainly won't be alone when leaving. And when a critical amount of developers and entrepeneurs leave the UK permanently, the economy will suffer... greatly I think. And that, sad as it may sound, might be the only argument politicians would consider, when it comes to signing this bill.

SCHiM• 10 years ago

Can't you get a digital citizenship in Estonia and perhaps transfer you company to there?

Frankly it seems like a very good solution if the problem is laws in the UK. This program was launched specifically to attract entrepreneurs and offer them the means to launch tech businesses from anywhere in the world in Estonia.

vox_mollis• 10 years ago

but I'd hope HN could come up with some informed suggestions.

That is an informed suggestion, informed by the reality that participation in the political process does not work, at all.

ocschwar3• 10 years ago

You need to leave the UK. No amount of corporate charter red tape or offshore server hosting will let you get away with developing a secure product if Theresa May doesn't want you to.

nixgeek6• 10 years ago

"the only acceptable course of action".

In your opinion, perhaps, but my gut is that most people would comply rather than spend several years in an 8x10 cell.

https://twitter.com/nixgeek/status/708267763089989632

I'd be interested to see how the numbers turn out on that!

gutnor• 10 years ago

I think quite a few people would not mind being a martyr.

The problem is that the most likely reality is that you will go to jail, your business will be shut down, you will never find another job again, your whole family will be added on all the government shit lists and nobody except your friends will know what happened.

There is a star system to martyrdom too. For 1 Snowden, there are probably thousands jailed and forgotten.

mhurron• 10 years ago

Oh wait, you're serious. Let me laugh harder.

There is money to be made. When it comes down to making money by putting in backdoors or shutting it down and making none, the backdoor will be put in every time.

naveen992• 10 years ago

Wanted: ninja, rockstar backdoor programmer ! Benefits: train your backdoor coding replacement overseas and get 6 month severance !

marcus_holmes• 10 years ago

At least in the short term.

When London fails to become the "Fintech capital of the world" like it wants to be, because any fintech moving there has to main its own security and every potential customer knows it.

When UK companies are continually hacked and ripped off because the bad guys KNOW there's backdoors in every one of them, all they have to do is find them.

When the UK economy has taken enough of a beating. Then they might change their minds. Maybe.

imaginenore• 10 years ago

Or you could just move your project to a different country and give the control to some anonymous corporation that can't be traced to you.

HashThis• 10 years ago

The government actions are immoral. When an entrepreneur has raised capital from investors, his personal reputation is on the line to be a good shepherd for their investment. Shutting down their company destroys the entrepreneur's personal investment and betrays their ability to keep their investors investment safe. This all comes back to the immorality of the government's actions in this area.

CM30• 10 years ago

This times a million. It is better to pay the price for doing the right thing than to turn against your morals because of your comfort. And if enough people and companies do the same, things will change.

Evil prevails because good men do nothing. And this generation seem to be the masters at doing nothing.

A truly gutsy CEO would say screw you to an oppressive law or government. They'd be willing to die in prison for their beliefs, and shut the whole company down in the process. Take the story to media and watch the government's stupidity get them publically humiliated by the press and social media.

Things like this will only stop if they become political suicide for any party or politician that tries to implement them.

jensen123• 10 years ago

I wonder if most of the politicians in the UK actually understand what they're doing here? Some research have shown that in order to recognize brilliance, you basically have to be brilliant yourself:

http://www.livescience.com/18706-people-smart-democracy.html

In another story on Hacker News today, I find the following: "She offers a sample math problem from the test: You go to the store and there's a sale. Buy one, get the second half off. So if you buy two, how much do you pay? "High school-credentialed adults, they can't do this task — on average," says Carr."

http://wamc.org/post/americas-high-school-graduates-look-oth...

Clearly, the majority of the voters in a democracy aren't very intelligent. This probably means that most of the politicians in a democracy, such as the UK, aren't very intelligent either.

rm_-rf_slash• 10 years ago

This subject has received significant attention because as hard as it is to accept, it is all true. There has been a deliberate "Brave New World" effort to control the masses of democracies, under the assumption that leaving people to their own devices will ultimately result in chaos and destruction by someone else manipulating them (case in point: the Republican Party fiasco regarding Donald Trump)

If you are willing to see how your life and role as a passive consumer has been designed, watch the BBC documentary "Century of the Self," read Edward Bernays' "Crystallizing Public Opinion," and "Propaganda," and for an extra dose of depression, Noam Chomsky's "Profit Over People."

Sorry.

logfromblammo2• 10 years ago

I haven't seen any of those yet, but I get the sneaking suspicion that they would all be preaching to the choir.

But I reached my current world view by extensive wearing of foil hats and painstaking calibration of handcrafted bullshit detectors, so it would be nice to see the analyses of those more reputable than my usual sources (by many orders of magnitude), just in case they would ever be useful in an appeal to authority.

For instance, I could tell my spouse something for years, such as "chia seeds are a better source of omega-3s than flaxseed, because the chia seed coat is digestible, whereas the flax seed coat has to be cracked mechanically, which allows the oils inside to become rancid due to oxidation between milling and ingestion." And this is dismissed and forgotten, until Dr. Mehmet Oz features chia seeds on his television show. Afterward, I'm still the only one actually eating the chia seeds, but at least I get less flak for it when I do.

The Cassandra Phenomenon: it's horribly demoralizing.

It's even worse with my homespun political analysis.

CommanderData2• 10 years ago

Don't create start-ups based in the UK.

Founders will think twice and will only add to risk and burdens when you are already competing in an international, competitive, start-up space.

Remove the offending country from the equation by relinquishing legal responsibilities. I know a few founders who have talked about doing this so I hope the UK reverses this or never becomes a prolific start-up space (which would be a shame).

I hope avoidance becomes common practice, the UK is not the only country that incentivise start-ups. Others do and thankfully don't have draconian laws such as this.

degenerate• 10 years ago

It should be easier with Stripe's Atlas: https://stripe.com/atlas

vixen99• 10 years ago

Meanwhile in the UK: "Fingerprints and DNA of at least 45 terrorist suspects must be destroyed after police forces failed to complete paperwork which would have allowed them to be stored indefinitely in anti-terror databases, a watchdog has disclosed. The error means potentially vital forensic evidence will be lost at a time when Britain is in a high state of terror alert. "

http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/1...

easytiger• 10 years ago

People are missing the point a lot here. I have good reason to believe that this is being pushed and supported by those seeking punitive enforcement of copyright laws. Combine this with recent internet tracking laws and you have a serious problem

naveen992• 10 years ago

What stops rich evil people from buying or incorporating a small town (with its own police force) just to get access to these powers nationwide ?

narrator• 10 years ago

I think there was this idea that crypto nerds could just ignore politics and seek liberty via technological solutions and live in their own little make believe geek data haven wonderland. Wrong.

girkyturkey• 10 years ago

After reading this article, news about this scares me. What happens when we leave a governments power unchecked? There have been too many times throughout history where unchecked power can lead to disastrous consequences. We need our voices to be heard, not silenced by the government.

cinquemb• 10 years ago

“Small companies (with under 10,000 users) will not be obligated to provide a permanent technical capability, although they may be obligated to give effect to a warrant.”

I can imagine someone getting creative and redefining what they call a user… though I can imagine this devolving into if you have under x page views… and then x time spent on site… how much bandwidth over the wire… etc.

Such a joke, I hope everyone is enjoying their view of the circus lol

gripusa• 10 years ago

One option could be to introduce a third party user driven based end-2-end encryption on the data. This would mean, you can say "Man i am happy to cooperate but i have nothing in my control".

wuliwong• 10 years ago

I was wondering how I might be affected as a non-UK app user? It sounds like any company which has employees in the UK could be compelled to install a backdoor if this legislation becomes law. I'm not sure how this would play out but I'm hoping that if this becomes law it isn't essentially a law forcing a backdoor into all the apps that I use on a daily basis. My guess is that the companies would release geo-targeted versions of their backdoored apps for UK users downloading them from the various app stores and non-UK users would still be downloading the non-backdoored versions. But maybe not?

Mullefa• 10 years ago

I'm creating my own startup at the moment. I haven't got a front door, let alone a back door...

joesmo• 10 years ago

I think it's safe to say that if this passes, UK security companies will no longer exist for all intents and purposes. I'm not saying they'll immediately go out of business, but I can't imagine anyone in their right mind trusting any UK business again, especially companies outside the UK. I'm not simply talking about companies whose main line of business is security, but essentially every technology company that even has an SSL'd website. Considering the wide variety of global competition, how could a serious CTO allow his company to do business with any UK company knowing he's exposing his own company to risks that could shut it down? No one in their right mind would do that.

The same can be said if the FBI wins the Apple case. I cannot see how this will not destroy at the very least the country's technology infrastructure. I'm not sure about the UK, but certainly in the US such actions would lead to a recession or worse considering that technology is pretty much the only sector to have recovered since the on-going recession. I suspect similar consequences for any country whose economy relies so heavily on technology, however.

throwaway21816• 10 years ago

UK Does something evil

No way!

josscrowcroft• 10 years ago

As a UK-based founder (of a service with more than 10,000 users, which I guess could be targeted): what real steps could I take to make it technically impossible to comply with an order like this?

I would sooner leave the UK than sell out on our users and be forced to keep quiet and carry on.

hlandau4• 10 years ago

Use your imagination.

The key tool in the box, I think, is to give people orders that you expressly state can't be later revoked. You can use this to construct something like the human equivalent of an HSM. (An HSM, after all, is something that you give orders that in general can't later be superceded, namely about how to control access to cryptographic keys, thus allowing you to reason strongly about the security it provides.)

These people will need to be outside the UK, and be people you trust doubly: firstly to secure whatever cryptographic materials you escrow with them, and secondly because they can by virtue of that escrow hold your company hostage.

Some possibilities include setting things up so they have to review all source code changes (making it impossible for you to sneak anything by them); and some manner of non-duress verification protocol. One possibility off the top of my head for such a protocol is to declare that a failure to state a certain password in any conversation constitutes a duress indication. Obviously for this to work all such conversations must be secure. The idea is that when you're the subject of a notice and are asking them to backdoor things with the government breathing down your neck (possibly literally), the person on the other end starts acting oddly mutinous, but you appear to be doing everything you can to get them to comply. So long as the government can't prove you've done anything to be unhelpful - can't prove the existence of the non-duress password - it seems like it would be hard to find a case to prosecute you.

merpnderp2• 10 years ago

It doesn't sound like you can. Once you've created a secure system you can't be forced to open, the government will simply tell you to add a backdoor and not allow you to talk about it.

ConfuciusSay022• 10 years ago

Please, I urge you to put backdoors in all your startup apps.

Sincerely, Russia & China

merpnderp2• 10 years ago

How will this impact operating systems like Ubuntu? Will they be forced to put a back door into anything that connects to the internet?

chippy• 10 years ago

I believe that whilst a CSP (small IT company with >10K users) cannot directly publish details about a warrant, they are able to publish things like "We have responded to 2 warrants in the first quarter".

7.21 in the notes pdf about section 115 in the Bill

"This includes provision for CSPs to be able to publish information in relation to the number of warrants they have given effect to. In order to ensure that this does not reveal sensitive information that could undermine the ability of the security and intelligence and law enforcement agencies to do their job, further information on the way in which this information can be published is set out in regulations. The regulations make clear that statistical information can be published on the number of warrants that a CSP has given effect to within a specified range rather than the exact number. "

So a company can both disclose the number of warrants and are authorized to disclose information about warrants in general and not particular ones.

For example, a company would be allowed to publish how much warrants have cost them and taxpayers.

MarcScott• 10 years ago

I suspect that there will be a massive drive from early adopters, such as HN readers, to shift toward FOSS and decentralised services, where such laws wouldn't apply (I'd have thought), in order to avoid state intrusion on their private affairs.

Others would then follow, and although a lucrative industry might suffer, in the long run we may all be better off.

UK surveillance powers bill could force startups to bake in backdoors

Related Stories