Right. It makes no sense.

"Let's bring in a law that logs everyone not seeking to avoid detection."

Any serious criminal/terrorist will use a VPN, disposable phones with end to end encrypted messaging, or pen and paper.

Any criminal/terrorist that doesn't take these measures shouldn't be a problem to prevent in the firstplace.

Well, if memory serves, for the most part haven't most terrorist attacks been coordinated over either completely open channels or over non-technical channels? If I remember correctly, the Bin Laden operations were orchestrated via sneakernet, the more recent attacks in France were orchestrated with check-out aisle cell phones.

The technical difficulties law enforcement faces with terrorism and crime isn't that criminals are upping the ante with complex and difficult to penetrate technology; it's that they're methods are a needle in a haystack, ubiquitous devices and protocols that apparently law enforcement is just having difficulty filtering. Remembering back to a lecture I attended from an officer explaining the technological issues used in modern harassment and abuse cases, often times stalking would be achieved by purchasing a check-out aisle cellphone with a cheap plan, registering it with family tracking from the provider, then putting the phone into Do Not Disturb and hiding it in the victim's car or day bag, using the tracking to get an idea of where the victim went.

Sneakernets and system abuses like this are clever enough certainly, but they're not high-tech solutions for criminal activities. Most of the time just looking at a person's facebook account is enough to get the information you need to do something malicious to them or their property, and terrorists seem well aware of the ease by which they can operate in plaintext or on just normal phone calls. I don't recall any stories about terrorists using an IRC channel, for example, they're just using what they'd normally use.

Most of the surveillance security actions strike me as purely theatre - there's a difficult problem and a convenient scape goat, so rather than do the hard work, law enforcement and governments rely on a scapegoat. Unscrupulous tech vendors abuse law enforcement/government's lack of knowledge and pressure from the public to sell security snake-oil, promising them the answer to keep the people safe.

There probably is a good future where technology does help stop terrorists and criminals, but right now, they're not doing anything special or unique, just different than we're expecting, and apparently that's more than enough.

> Well, if memory serves, for the most part haven't most terrorist attacks been coordinated over either completely open channels or over non-technical channels? If I remember correctly, the Bin Laden operations were orchestrated via sneakernet, the more recent attacks in France were orchestrated with check-out aisle cell phones.

We have no way of knowing. There hasn't been a repeat attack at the scale of 9/11 to date in the US, which either means that people aren't trying or the security services are very effective. Since terrorist organization have been encouraging crazy lone-wolf type people to commit random attacks, that suggests to me that the security services are effective.

All security/law enforcement operations are about managing risk. Criminals and other "opponents" find weaknesses quickly -- remember the early 2000s popularity of Nextel and Boost Mobile devices among drug dealers. Even something as ridiculous and expensive as TSA serves a function... getting contraband on an airplane is a riskier proposition now. You don't need 100% effectiveness -- in a 9/11 type scenario a 40% effective screening process would have likely discovered some conspirators.

IMO, attacking the law enforcement surveillance creep is the wrong approach. That's a symptom of a larger problem, which is this global instability kicked off by Bin Laden and his ilk. That's the disease, and the only way to address surveillance is to attack those political problems and get back to a more balanced system.

If we're to go by this article [1], the TSA is only 4.3% effective.

[1] http://edition.cnn.com/2015/06/01/politics/tsa-failed-underc...

I remember after the Paris attacks hearing about how messages could be sent via game console networks, or even non-verbally in the online multiplayer games themselves.

http://www.forbes.com/sites/insertcoin/2015/11/14/why-the-pa...

Yeah the weird thing is, despite being easy to circumvent these sort of measures are often very effective! So long as using a VPN requires any baseline of knowledge, technical skill and effort, I expect 90%+ of criminals won't do it.

I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. Think about it - any criminal can learn lockpicking today via the internet, but few do. Why? Because if you're capable of investing time and energy into honing a skill, you may as well do something above board. Don't break and enter - become a locksmith instead. Don't manage a team of criminals - become a manager at a company. It pays better. Its less risky. There's more services and social support available. You won't go to jail. You can have friends who aren't criminals.

And because of that the people who are left committing the vast majority of crime do so in part because they're not good at long term planning. Which is something law enforcement takes complete advantage of. So, almost no petty criminals are going to know about VPNs. They aren't going to commit to a monthly subscription to a VPN provider. They won't set up a PP2P tunnel on their phone and laptop. Why? Again because if they knew to do that sort of stuff they could probably hold down a stable job in low level tech support.

Obviously there's exceptions to this, but the bread and butter of law enforcement isn't bank heists. Its someone who's drunk. Its someone who smashed a window and stole some money because they want to get high. Or stole a phone out of someone's hand and ran off with it. Or went out with the boys to beat someone up "who had it coming".

When the (then) Australian minister for communication introduced record keeping laws for ISPs he told people they can bypass it a number of ways. Lots of people were confused by that - but it makes sense. The aim isn't to record data from us, or from our community. They don't care about taxpayers who are gainfully employed. The point is to make it easier to catch that asshole who beat up his girlfriend then bragged about it to his friends on facebook.

And as a result, probably the most annoying thing we can do for law enforcement is introduce apps like Signal and the TOR browser. Stuff that makes it dead simple for anyone to maintain their privacy - you just have to use a different messenger.

(Edit: Re-watched the interview where Turnbull described how to bypass the retention bill and he wasn't as enthusiastic as I remember.)

I would argue that the notion of "crime" is typically biased by the observed criminal acts. For example, criminal theft is usually thought to be some form of robbery, including everything from bank robberies to residential break-ins. However, wage theft, consisting of employers illegally withholding wages, is more than 2.5 times larger than all robberies combined [1].

It isn't that smart criminals don't exist. Rather, smart criminals don't fit our mental image of "criminals", which makes it harder to target laws against it.

[1]: http://www.epi.org/publication/wage-theft-bigger-problem-for...

> Rather, smart criminals don't fit our mental image of "criminals", which makes it harder to target laws against it

I would argue that it has nothing to do with the laws; they're breaking the same laws as everybody else. It's that our justice system, at least in the US, incentivizes law enforcement to focus on easier prey. Smart criminals will probably defend themselves in court and be more likely to be privy to the tricks that police use. It's much easier for them to just arrest a poor person and threaten to throw them in jail for months behind bail that they can't afford unless they plead guilty to something they obviously didn't do. Most poor people will just take the plea, because they can't afford to miss work and lose their job while they wait for their day in court. NYPD in particular are notorious for this.

> the people who are left committing the vast majority of crime do so in part because they're not good at long term planning.

Maybe. But your data could well be flawed. You've only got to watch any of these police shows on TV, and you'll see them pick up a drug dealer because he's driving a car with no insurance, or not wearing a seatbelt, or any number of other minor transgressions. I saw one the other day where a guy yelled obscenities at the officers as he drove past, which caught their attention and caused them to recognise that he was a banned driver. That's just a special kind of stupid.

If these are the guys getting caught, then the most obvious way to not get caught is to dress smartly, drive an insured and roadworthy car at a sensible speed, and generally blend in to the thousands of commuters that take to the road every day.

Equally, while the dumb criminals will look at the new bill and not be too concerned because they don't plan that far ahead, the smart ones have already been using VPNs for years. The really smart ones aren't even using commercial VPN providers - they're using offshore VPS services with a prepaid VISA, and a script to set up OpenVPN in a couple of seconds, so they can rotate providers and destroy the VPS every couple of months or so.

I also see this in my friends that do dumb stuff for their income. Most of them are flat out stupid and the rest are only able to think about the next few days.

TV isn't a good representation of most of it - it rarely shows how little profit drug dealers actually clear, for example.

> I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime.

This is an odd comment. Clearly the mechanism you describe is correct, but there's literally nothing accidental about it at all. The entire stated purpose of the criminal justice system is to create a set of incentives sufficient to ensure this calculus applies.

I fail to see how placing an entire population's electronic communication under surveillance is a proportionate response to this kind of 'low hanging fruit' offender.

This is a great response. And arguably, the argument.

A friend of mine is a policeman, and says exactly that. MOST criminals have a level of ineptitude that allows them to get caught. Except this isn't being sold as "we want to catch the guy who beats his wife". And if it were, why not just install a 'telescreen' in everyone's house and catch them in the act?

Regarding the _encouraging people_ to get a VPN, that shouldn't be the default. The police were already in a position where they can monitor anyone they suspect of a crime. This targets _everyone_, with the false promise of safety.

Adding to that, when you couple this with Claire Perry pushing (_again_) for 'adult' sites requiring 'age verification', you're on a very slippery slope.

Alternatively, if you're competent, there are so many better and safer crimes to commit.

> I've been nursing a theory for a long time that modern society has an accidental saving grace. And that is, if you're competent, its usually better to just not commit crime. Think about it - any criminal can learn lockpicking today via the internet, but few do. Why?

Because it's easier to crack open a window someone left unlocked.

> Stuff that makes it dead simple for anyone to maintain their privacy - you just have to use a different messenger.

Assuming (caveat: big assumption) a legitimate implementation, I bet WhatsApp is the big frustration in the UK - it was already hugely popular here before it went end-to-end encrypted.

> When the Australian minister for communication introduced record keeping laws for ISPs he encouraged people to bypass it using VPNs. Said thats what he was doing.

Do you have a source for that? If true I find it very bizarre.

Re-reading articles about it it seems his comments aren't as cut-and-dry as I remembered:

http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...

> “If on the other hand I communicate with you via Skype for a voice call or Viber, send you a message on WhatsApp or Wickr or Threema or Signal or Telegrammer — there’s a gazillion of them — or indeed if you make a FaceTime call, then all that the telco can see, insofar as it can see anything, is that my device has had a connection with the Skype server or the WhatsApp server; it doesn’t see anything happening with you.

> “There are always ways for people to get around things, but of course a lot of people don’t, and that’s why I’ve always said the data retention laws, the use of metadata, is not a silver bullet. It’s not a 100% guarantee. It is one tool in many tools.”

So where is the conversation about that?

If this measure will not catch the very people it is intending to catch, what is its purpose?

To make you censor yourself so they don't have to. Same deal with the porn one. There was a piece by Alec Muffet not so long ago discussing the consultation process for age verification. All those involved knew that the headline group (teenagers) the law was supposed to protect were by far the most likely to circumvent the measures, so any such system is essentially not fit for its stated purpose.

Even if the intent is to play well with the authoritarian and/or socially conservative portions of the electorate, the effect will still be self censorship.

My SO and I both have to undergo enhanced disclosure and barring service checks on a regular basis for our jobs, one of which is in education. The UK Department of Education just effectively prevented Milo from speaking at his old school 'because extremism'. So how should I be feeling right now about following links from Reddit or other forums discussing US electoral politics that might lead to Breitbart? What if there's another situation like Sad Puppies vs the Hugos and I'm trying to get a picture of what's going on and I click on a link to find a Vox Day equivalent? Did I just endanger one of our prospects for future employment? Hard to say. Will using a VPN service get us tagged as 'something to hide' and affect our eligibility to work with children and vulnerable adults? Don't know. Worth betting someone's career on?

I can't work out the purpose. It feels scary and Orwellian but I don't know why they want to collect all this data. Who benefits?

In a totalitarian regime it makes sense because you can use it to prevent political opposition. But in this case, it's a democratic government that can easily be voted out. It doesn't help anyone cling to power.

Maybe I'm over-thinking, but I can't work out the point.

>it's a democratic government that can easily be voted out.

The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected.

>It doesn't help anyone cling to power.

On the contrary, it is human nature to do so.

> The group of individuals handling this data are more than likely to be bureaucratically appointed rather than democratically elected.

Exactly what I was going to reply. There is no need for any conspiracy theories to acknowledge that in almost any democratic states of these days "states within a state" exist when it comes to surveilance and intelligence services. While political function owners come and go with each election, those organisations seem to be more structural conservative following agendas which reach beyond any legislative period.

The point is the legislations are written by people who are often technologically inept and from a political culture of placing their own opinions above the advice of the experts.

You also see the same nonsensical policies on other topics like global warming, gun control (in the US), the war on drugs, and weird alternative treatments available on the NHS.

A publicity stunt so, come the next election, said government can leverage what the masses might see as a good/harmless idea. The minority of people who know better won't be statistically significant when it comes to the polls.

Democracies can fail, for example the recent rise of Erdogan. Asshats in power want democracy to fail because when it does they will be the ones in power.

Even if only for tactical reasons, it's better to treat this as a well-intentioned mistake, and not as a vast conspiracy to round up dissenters etc.

Taking that point of view, the argument is that there's a subset of criminals that are stupid, or make mistakes. For people who've bought into the "nothing-to-hide" mindset, even a tiny chance to catch a few criminals is enough, because there's precisely zero on the other side.

So the task is: a clearly articulated argument for why privacy is important. I'm not saying someone should leak all the porn-URLs visited from Parliament, but it wouldn't hurt. Although some PG13 reasons may be even more helpful with the conservative crowd: "Prime witness in mafia trial killed after location revealed in log leak"...

The "rounding up dissenters" argument should still be in there – as "we're creating tools that a less benevolent government could exploit." C.f.: Trump/muslims, the Dutch (Danish?) burning their register of Jews

They're not looking for actual terrorists or criminals. They're looking for people like Occupy Wall Street protesters, who actually pose a threat (ie. redistribution of wealth) to those in power. Then as soon as they do something like pirate a movie, they can be thrown in jail (ie politically neutered).

I guess that is true to a first approximation but exceptions perhaps prove the rule

https://magazine.atavist.com/the-mastermind

something about this reminds me of "common-sense firearm safety laws"

> Any serious criminal/terrorist will use a VPN

Or just plain old stenography in very public forums.

Basically impossible to detect.

This is correct. Every serious criminal won't use a VPN or other obvious crypto, because this paints a big target on your back signalling you want to hide something. A serious adversary will, as you say, use a pre-arranged innocent vocabulary that is virtually impossible to detect, or just communicate face-to-face or via written notes delivered by a messenger.

Oh and by the way, remember to buy lettuce today ;) ;)

Terrorists also have mothers, and eat apple pie. This is not about terrorists; this is about frustrated law enforcement who seek to break privacy to facilitate their efforts. When we see it that way, we see the emotional rhetoric for what it is - scaremongering to make enforcement simpler.

To me, even bigger problem is a general fact that a large majority of people easily agree to restrict liberties (some of them hard won) because "terrorists can also do this". A more defensible argument would be "outlaw X if a fraction of law abiding citizens snagged would be tiny".

I would be curious though how big a majority would still support the logic that "we should restrict/track any X if X helps terrorists", if the question were to be posed cleanly (i.e., without scaremongering examples on the same page). If the problem is presentation, not internal beliefs the pendulum may swing back sooner rather than later.

Drugs, child porn (sometimes even adult porn), and terrorism seem to be the most-used arguments for authoritarianism. Unfortunately they are also quite convincing in the "you have nothing to hide" sense.

  "sometimes even adult porn"

Which is also currently up for discussion: "UK to censor online videos of 'non-conventional' sex acts"

https://www.theguardian.com/technology/2016/nov/23/censor-no...

That's true, but on the other hand their assertion is also true - terrorists (both political and paramilitary) do attempt to exploit the infrastructure of an open society, and government (qua public agency) does have a legitimate interest in frustrating some kinds of criminal traffic.

You try running a government and explaining to people that the price of liberty is putting up with a certain level of terrorism and child porn every year. You won't stay in power long if you do. (Mind, I'm not endorsing this new law, which I think is awful. I'm just taking issue with your objection to the political reasoning, and saying that it's self-defeating.)