Remix.run Logo
auscad 8 months ago

What makes this different from a typical attack on encryption is that this company (probably) knowingly distributed to and worked with criminal enterprises.

But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.

Cthulhu_ 8 months ago | parent | next [-]

> (probably) knowingly

That's doing a lot of heavy lifting. I'm sure they knew, personally, but since everything is encrypted, even for themselves, they have plausible deniability. If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking.

And even then, criminals can talk using e.g. commercially available phones and mobile networks; are those networks / manufacturers / anyone but the criminal responsible for what is talked about?

Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication. It doesn't make them guilty themselves.

gambiting 8 months ago | parent | next [-]

>>If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking.

If you look at the article it has examples found of the company employees explicitly saying they are meeting with criminals so to play it safe. It doesn't get any more "solid proof" than that.

>>are those networks / manufacturers / anyone but the criminal responsible for what is talked about?

No, but again - read the article. There are examples of their employees saying that a client of theirs was arrested so they proactively wiped their phone - that could be interpreted as knowingly destroying evidence. They did end up changing this policy to not wipe phones of people who have been arrested, precisely because of this concern.

>>Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication

The difference is most likely in how it's advertised and sold. Whatsapp is a free app that anyone can use, Facebook can reasonably claim that they don't advertise to criminals or encourage illegal use because the app is free to anyone. The owners of this app made it paid and they actively pursued clients they knew were members of criminal rings. Whether that passes the threshold for holding the company liable - that's for courts to decide. But that's generally where I think the line is. Anyone can make and sell a knife, but start selling knives(knowingly) to gang members and you're going to be in trouble even though selling a knife isn't illegal in itself.

or_am_i 8 months ago | parent | prev [-]

> there's nothing to be done, legally speaking.

Even if true, this sure feels like a loophole though, like the Saul Goodman's burner phone side business, doesn't it? Should there perhaps be a stricter KYC requirement/similar measures to the same end when it comes to re-/selling technology explicitly designed for encrypted communication? Note that we are not just talking about an end-to-end encrypted messenger app, it's a whole integrated phone with an explicit special purpose. This feels more like a regulation oversight: the encrypted transmissions in AM/FM bands are outright prohibited in most Western jurisdictions after all, and so is possession of the respective equipment.

devmor 8 months ago | parent | prev | next [-]

>“Privacy is really, really important and we all have the right to our privacy,” said Catherine De Bolle, executive director of Europol, the law enforcement agency of the European Union. “But when we see now that encrypted communication is really an enabler for crime, then we have to do something.”

That was a pretty terrifying line to read - the idea that they feel comfortable assuming a great deal of the public will agree with or find this reasonable is pretty worrisome.

jfactorial 8 months ago | parent | next [-]

"Freedom of movement, freedom of speech, freedom to assemble, freedom of religion, these are really, really important and we all have rights to them..." said a law enforcement director who would soon make clear they didn't believe in rights at all.

"But," they continued rather than stopping at defending rights, "when those rights can be used to enable activity which we deem criminal but hasn't yet been tested in court, we have to take them away."

try_the_bass 8 months ago | parent | prev [-]

I think a great deal of the public does agree with this sentiment, though?

In general, "the public" is usually okay with things that reduce anti-social behavior.

dghlsakjg 8 months ago | parent | next [-]

The public would probably say that they agree that things that reduce anti-social behavior.

But if you instead phrase it as: “should international law enforcement have a perpetual copy of every single written message you have ever sent in order to reduce anti social behavior?” You will discover that there is a limit to what people will tolerate.

lb1lf 8 months ago | parent [-]

There hopefully is, but it never ceases to amaze me how many, even highly intelligent, reasonable people, buy into the 'I don't do anything illegal, hence I have nothing to hide and off to the races we go' mindset.

Heck, even if I try to point out all the fun side effects - say, how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked, or simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar, I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.

Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.

Sigh. Rant over.

dghlsakjg 8 months ago | parent | next [-]

People who say they have nothing to hide can be shut up quickly by asking them to tell you their online banking credentials.

try_the_bass 8 months ago | parent [-]

But this isn't the same, though? People might be more than happy to share information with you, but they're probably not too keen on giving you ownership over it or anything else they might own. There is a bit of a difference between "access to my information" and "control over it", and you're kind of conflating the two

dghlsakjg 8 months ago | parent [-]

I didn’t say I wanted to take control of anything, or even use the information, I just want to know what the credentials are…

The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.

try_the_bass 8 months ago | parent [-]

> I didn’t say I wanted to take control of anything, or even use the information, I just want to know what the credentials are…

But giving you the credentials is giving you control? They're the same thing in this case! The fact that you're asking for them implies that you want to use them, does it not? Otherwise, why would you ask?

> The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.

But they're saying they have nothing to hide because they haven't done anything illegal. The original statement was "I don't do anything illegal, hence I have nothing to hide". They're saying that someone looking through the history of the things they've said and done would find no evidence of wrongdoing.

If you asked for their banking records, that might be an appropriate thing to ask for in the pursuit of evidence of wrongdoing. But asking for the ability to control their finances isn't the same thing. The ability to control their finances has no relevance to any illegal behaviors they may or may not have partaken in. So you're not really finding the "right piece of information to ask for". Instead, you're cleverly moving the goalposts from "information relevant to the search for wrongdoing" to a much broader scope.

I don't think anyone who says "I have nothing to hide" believes that law enforcement should have access to your bank account to spend your money; but they're probably fine with some level of law enforcement having the ability to view their financial records under the right circumstances. Since they've committed no financial crimes, there will be nothing to see.

Of course you'll argue the hypothetical that "everyone has committed some crime" (which is probably true!), but plenty of people commit crimes accidentally and are let go with no punishment (or never even prosecuted) when it became clear that there was no intention of breaking the law. This obviously isn't true in call cases, because lack of criminal intent does not prevent damages, etc. However, the best way to prove that there was no criminal intent is by having more information about that person, to demonstrate that their previous actions are consistent with such a narrative.

try_the_bass 8 months ago | parent | prev [-]

> There hopefully is, but it never ceases to amaze me how many, even highly intelligent, reasonable people, buy into the 'I don't do anything illegal, hence I have nothing to hide and off to the races we go' mindset.

I think this is due to a very large difference in mindset. Let's use your "fun side effects" as examples:

> how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked

Maybe this embarrassment would be deserved? If you're having inappropriate conversations at work, maybe you should get called out on it? I'd argue that being able to hide these kinds of things contributes to a toxic work environment. So a) I wouldn't be having any correspondence with the cute intern, and b) I'd want to know if I'm working at the kind of place where that kind of behavior is acceptable (so I could not work there).

> simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar

Big deal? If that's my only interaction with that person, no one who has access to that kind of information is going to care. I'll be accurately classified as a spurious contact and promptly ignored. I might be watched for future interactions, but since the interaction truly was a one-off, there will be no future interactions, and none of my other actions will be of interest to those who are watching.

So again... big deal?

> I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.

If they mean "they" as in "themselves", why would you disbelieve them? They probably would never do any of those things.

> Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.

Because there are increasing numbers of people who share the view "the authorities have no business snooping on me" and who are in fact exactly the people who the authorities should be snooping on. However, none of them would ever admit to that, so they prefix that view with the same thing you did: "seeing as I am not doing anything criminal". Ostensibly the difference between you and them is that they're lying about the first part; but given that others have no way of verifying whether or not you're lying, can you fault them for assuming the worst and lumping you in with the actual criminals?

Because this is literally a thing criminals say, and criminals generally aren't beholden to telling the truth.

To put a finer point on it: the vast majority of criminals in the world are privacy advocates out of necessity. They may or may not be good at exercising privacy, but the easier it is to achieve effective levels of privacy ("effective" meaning "keeping their activities hidden from the relevant authorities/groups"), the more of them become good at it by default. It is becoming easier and easier to achieve effective levels of privacy (especially online), which means the privacy advocates are actually winning. As a consequence, so too are the criminals. You, as a non-criminal, non-antisocial privacy advocate might not want criminals to be your allies in this, but they are out of unavoidable necessity. (feel free to s/criminals/antisocial individuals/g, if you want to consider the point even more generally)

lb1lf 8 months ago | parent [-]

OK, poor choice on my part. Let's say that your correspondence with the neighbour's wife, or for that matter your love E-mails to $CONSENTING_ADULT_OF_SAME_SEX got aired. Point is, there's all sorts of communication we desire to keep private - some of it because parts of society frowns upon its contents (infidelity, above), some because it is illegal or otherwise puts you at risk (same sex relations), or some just because you would feel embarrassed if it was made public, and it's nobody else's damn business anyway.

As for the watchlist part, yes, it is hyperbole - but the assumption that your contact would be readily dismissed as random relies on the authorities collecting said information being competent. I think it is naïve to assume that such info will never be misinterpreted and that it will never be retained just in case it proves useful later on. The 'they' I referred to were the authorities collecting and analysing the information, by the way.

And yes, I fault the powers that be for assuming criminal intent in all of the citizenry.

try_the_bass 8 months ago | parent [-]

> OK, poor choice on my part. Let's say that your correspondence with the neighbour's wife, or for that matter your love E-mails to $CONSENTING_ADULT_OF_SAME_SEX got aired. Point is, there's all sorts of communication we desire to keep private - some of it because parts of society frowns upon its contents (infidelity, above), some because it is illegal or otherwise puts you at risk (same sex relations), or some just because you would feel embarrassed if it was made public, and it's nobody else's damn business anyway.

I may be biased in the particulars, but I think it's good that society frowns upon certain behaviors. So if you're cheating on your spouse, I would rather they find out than be kept in the dark. If you're secretly embezzling money from the city government, I think the public has a right to find out about that sort of thing. Better still if there's enough transparency that you can't get away with it in the first place. You say "it's nobody else's damn business anyway", but in the example of infidelity, it isn't exactly a victimless thing. If everyone's informed and consenting, it's not really "infidelity" anymore, and not really a problem if you want to keep your swinging a secret from your family.

Your examples so far have mostly been cases where the behavior is inappropriate in some way:

- Infidelity: the ignorant spouse is a victim, so this isn't a victimless behavior

- Flirting with the intern at work: probably against the workplace policies you and they agreed to when you took the job.

- Giving money to an Islamic militant: If you were actually ignorant, this is generally appropriate behavior and anyone who looks at your history will probably agree. However, if you knew they were a militant and gave them money anyway, this is probably not appropriate behavior and your history would show that

I guess it's not very convincing to argue that people doing inappropriate things should be allowed to get away with it? It seems like in each of these contexts, privacy is only in service of hiding bad behavior? It's somewhat worrisome that these kinds of examples are also the examples most predominantly offered by privacy advocates. You're not the only one who gives examples like these, and the shared themes have concerning implications. Examples like these definitely do not work in favor of arguing for more privacy, because people will pick up on this throughline and start to associate "people hiding things they shouldn't be doing" with "privacy advocacy".

The only example you've given so far that seems convincing is the "love emails to consenting adult of same sex", which case I'd argue that it being embarrassing is probably more a problem of assholes in society than anything else. Someone giving you shit for that (and anyone who cares to listen to their shit-slinging) is probably saying more about their own antisocial tendencies than anything else. This is also a victimless thing, so I'm more amenable to just agreeing that folks should have privacy in this case... they're not doing anything wrong, after all.

However, the other solution to that particular issue is to make society more tolerant of people with differing harmless beliefs. I'm generally in favor of solutions that improve society overall and seem to have fewer downsides, rather than the solutions that prioritize empowering individuals in antisocial ways. To use an extreme example to illustrate the point: I don't think anyone is in favor of allowing folks to freely kill each other. Having the freedom to take someone else's life is in some ways the ultimate expression of an individual's freedom, but I think almost everyone would agree that the downsides heavily outweigh the upsides of that particular freedom.

devmor 8 months ago | parent | prev [-]

I mean that it is worrisome that the public would agree with this, or at least that public sentiment is shifting in that direction enough that this statement doesn't cause visceral outlash against anyone that would say it.

try_the_bass 8 months ago | parent [-]

Why would it?

As encryption and other privacy technologies become more widespread, so too have those who take advantage of them for the sake of enabling their anti-social behaviors. It also allows people with anti-social behaviors to coordinate in ways that are increasingly hidden from the groups they are working against.

So yeah, people are going to have an increasingly negative response to something they generally used to have neutral-to-positive responses to.

No one should be surprised that this is the case, least of the very people advocating for more (and more widely available) privacy tools! Ubiquitous privacy leads to ubiquitous distrust. After all, how do people know someone is trustworthy? By being able to see their actions, and see how they compare to their stated intentions. A mismatch between stated intentions and actions is evidence that a person is not trustworthy; the more of their actions they can hide from others, the more duplicitous they can be without being discovered.

Put differently, and more personally: In my face-to-face interactions, I may have never met a person before, but I can still "vibe check" them based on the wealth of side channels available to my senses and intuition. It's subject to my own personal biases and things, but I have come to trust my intuitions. Online, I have next to none of those same contextual clues, so my default is to just not trust anyone. If I choose to do something online that requires trust, I appreciate the fact that people have online histories; and if someone has chosen to scrub theirs, this isn't so much of a red flag as it is a reason to not diverge from the status quo. So when I imagine the world that privacy advocates want, where you know nothing about anyone that isn't voluntarily disclosed, I see a vary dark, mistrustful place where effective social cooperation has been utterly neutered. Even when people are willing to share information that "validates" their trustworthiness, the fact that _all_ information about them would be voluntarily disclosed convinces me that it would be so curated as to be useless for the task. This is made even worse if you imagine the deniable authentication folks get their way.

I also personally believe that the effective anonymity of the internet is in large part behind the decay of trust in general, for many of the same reasons. We no longer trust each other because we know so little about each other; and what we do know we trust less and less, because it's becoming increasingly easier to hide or curate that information. Online privacy advocates have already largely gotten their wish: it's not terribly difficult to be anonymous online, and I think our online discourse has been decimated as a result. Obviously not only due to accessible anonymity, but it's certainly a substantial factor.

I'm pretty sure the vast majority of my interactions online these days are with people I've never seen before and will never see again. And the people I do recognize are generally the people I'm least inclined to want to interact with (i.e. basically any Twitter personality). It's all pretty fucked up, if you ask me

devmor 8 months ago | parent [-]

Your belief that no one has the right to privacy because you feel personally feel uncomfortable interacting with people you don't know is not a very convincing argument for the explicit support of a core tenet of fascism.

I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.

try_the_bass 8 months ago | parent [-]

> Your belief that no one has the right to privacy because you feel personally feel uncomfortable interacting with people you don't know is not a very convincing argument for the explicit support of a core tenet of fascism.

Wow, way to completely lose the plot. You didn't respond to a single thing I said, and what you're claiming I'm saying wasn't what I said at all. Like, where did I say no one had a right to privacy? I didn't. What I said was if everyone utilized privacy the way you and others in this thread are advocating for, the world would be even more distrustful than it is today, that I think the downsides of increasingly ubiquitous privacy vastly outweigh the upsides. I also think that the majority of the world agrees more with me than you, given the lack of the visceral reaction you seemed to expect from TFA. That lack of reaction would at least indicate they don't agree with you, even if they don't agree with me, either.

Like, it's perfectly fine if you want to share nothing with the world rest of the world. I'll just consider you to be a wildly selfish individual (because your position amounts to "fuck you I got mine"), and probably not interact with you unless I can avoid it. But please, consider the consequences of your philosophy, both good and bad! I feel like you're trying to avoid addressing the downsides with this deflection. After all, you'd apparently rather call me a fascist and put words in my mouth than even bring attention to these downsides.

You kind of missed the mark with this response entirely. Maybe it's the halo effect (or whatever the inverse is), but when you and others who share your beliefs respond like this, you're really not making me trust you all that much, which means I also will think even less of your beliefs.

Maybe reflect on that, too? If you want to advocate for privacy, you'd do a lot more good if you actually came across as an attractive individual.

> I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.

Cool, way to discount my entire lived experience entirely out of hand. You could, you know, try some empathy, and consider that I'm likely just as intelligent and learned as you are (or maybe even more so? Again, with internet anonymity the way it is, who can tell?)

petesergeant 8 months ago | parent | prev | next [-]

> which makes sense considering that it is a government-owned news outlet in a Five Eyes member state

re the mention of FVEY, I strongly suspect it's law enforcement rather than the spooks who have any issue with encryption there. I don't think FVEY SIGINT are having any issue reading the messages they want to read, it's the City of Spokane Police Department, FBI Tampa, and the Manitoba RCMP who are struggling, and would like Apple to give them decryption keys. SIGINT would love you to believe they can't read your messages because of encryption.

lyu07282 8 months ago | parent [-]

> SIGINT would love you to believe they can't read your messages because of encryption.

I think this line of thinking can lead to a sort of defeatist ignorance. For example, can anyone break the default cipher suite of wireguard or gpg? I really don't think so.

petesergeant 8 months ago | parent [-]

> can anyone break the default cipher suite

I think one would be very lucky to have an adversary who’s focusing their attacks at the strongest points

lyu07282 8 months ago | parent [-]

fine just give up then, you already lost? Fuck that, let's not pretend like they are omnipotent all the fucking time.

petesergeant 8 months ago | parent [-]

You seem to be passionately arguing against a point of view I haven’t expressed

mistrial9 8 months ago | parent | prev | next [-]

There are thousands of millions of people who are not criminals, who are not trying to be criminals.. yet somehow the literate audience is led by media such that a small, dedicated bunch of adults half-way around the world is proof positive that all encryption is "for me, not for thee"

MadnessASAP 8 months ago | parent | prev | next [-]

> But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.

While neither of these points is completely incorrect, that is a heck of a connection to make without evidence.

8 months ago | parent | prev [-]
[deleted]