The UK's already done that - the Regulation of Investigatory Powers Act 2000 already made it an offence not to divulge encryption keys when asked. [1]

1 https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

Suspect of being Muslim, wearing a beard and using an ISP that the public hasn't heard of that isn't price competitive is more than enough for a media hatchet job. How low does the bar have to be?

This should be the preserve of Uganda and N Korea.

It might sound OT to bring up TPP in a discussion like this, but please hear me out: It's important to block broad international agreements like TPP because it creates competition among nations that would protect us from the dystopia you describe.

Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. Which would cause larger nations to think twice before their valued tech talent packs up and moves to escape their surveillance state.

I know not everyone can pack up and go, but the competition and fear of just how many might leave would be enough to keep even rich nations in check. But if something like TPP goes though, they can point to all its provisions and say "boo hoo, you're shitting on trade deals by allowing encryption, now we're going to bully your whole nation with economic sanctions"

It could, but it probably won't, because hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing...and I say that as someone who has moved internationally 6 times.

Look, your argument is fundamentally weak - we can generalize and say big countries are bad because it eliminates competition between smaller jurisdictions, therefore federalism is bad. And indeed, the notion that federalism is bad (or at least damn risky) is partly why the USA has ~3000 county governments despite the manifest inefficiency involved.

Your error is in assuming that competition is always beneficial. As we can see in the US, counties and states frequently pass laws that reduce rather than enhance freedom. So while I wouldn't want you to construe this as an endorsement of the TPP in particular, I reject your claim that any kind of trade agreement is necessarily destructive of freedom.

Besides, your notion of comeptition as unalloyed good is easy enough to subvert. Uruguay sets up the world's freest internet? Denounce Uruguay as a haven for cyber-criminals and impose penalties on unverified connections from there. Despite the fact that it makes the digiterati uncomfortable, things like child porn and terrorism are genuine problems that impact the lives of real people when allowed to operate unchecked. This isn't a 'think of the children' argument; I personally know people who were trafficked for sex and child porn as small children and who suffer from serious dysfunction as adults because of this. Their liberty and safety shouldn't be considered acceptable sacrifices on the altar of your liberty and safety; there are valid reasons to delegitimize some kinds of commercial traffic.

If Uruguay becomes a criminal sanctuary--then sure maybe it will be ostracized internationally--but as long as law abiding, upright business people have legitimate business there its more enlightened policy will make others think twice about enacting less enlightened ones and give companies some options. Moreover, it gives companies tied to Britain a strong incentive to advocate for a reasonable policy so they are not placed at a competitive disadvantage.

This doesn't mean that lawmaking has to be a false choice between anarchy and totalitarian surveillance, just that the OP's point that more variance in jurisdictions, the higher the pressure on the least permissive to mitigate the worst excesses is a real phenomenon.

Good thing there are laws against rape and mass murder.

> hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing

You can't know that, not until we live in an age where the mere act of communicating is a crime. Thats taking surveillance state to a new level. I'm sure some people wont even care, just like how many Britons dont apparently care about their new big brother laws, but there will always be people who care about their natural rights.

As for people moving, I certainly can know that if we're talking about existing and imminently foreseeable conditions. That you need to posit a completely alternative reality where the act of communicating is a crime suggests your argument is fundamentally weak. I'm pointing out the demonstrable lack of interest under current and historical conditions. Available evidence suggests that people are pretty attached to places and prefer to undertake clandestine activity rather than just up and go somewhere else short of a stark existential risk.

Do I know this to be true in the epistemological sense, of course not. Am I pretty damn sure about it in an empirical sense, yes I am. I've moved repeatedly and feel little or no emotional attachment to my birth family - in fact the farther away from them the better I like it. But this is really really unusual. the vast majority of people are intensely concerned with maintaining their family ties even at significant economic/political cost. Just because I don't share that mindset doesn't mean I can blind myself to it.

I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.

It took great effort to get crypto even recognized under the first amendment -- the USGov kept insisting that source code was not speech. In the 1990s it was against the law to let foreign nationals have access to the source code to DES. If you had folks from overseas in your organization, technically you couldn't let them see the source for crypto in your product (e.g., you had to wall off pieces of your repositories, and many companies did).

We could see a return to this. Don't take it for granted.

https://www.wired.com/2000/08/court-to-address-decss-t-shirt...

That said, up to the mid 90s it was theoretically against the law to show a foreign national a printed-out copy of DES. Crazy. I think it was published in magazines . . .

I'm expecting something like, "Yeah, sure you can have your 1st amendment, you just have to give us the keys if we ask or you get charged with destroying evidence/obstruction of justice which together carry more time than almost whatever possible illegal activity your encrypted traffic could have been concealing.

I've been wondering about the interaction of technologies like this with DRM technologies; what if I send HDCP-over-TCP? What if ISIS start using Macrovision on their jihadi videos?

I agree with you, but I am a bit afraid you are giving them ideas.

>.>

"(About Netscape) The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0). Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version, whose weak 40-bit encryption could be broken in a matter of days using a single personal computer." (Wikipedia - https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...)

In fact, strong crypto was only allowed in 2000. Only 16 years ago!

Edit: this is probably a good opportunity to remind people to donate to the Open Rights Group, who are the UK counterpart to the EFF and already actively opposing this and other bad laws.

I think what will prevent the above from happening is inability of government to enforce laws on the books, people disregard for those laws and the fact that technology experiments are often positive sums games where Google, Microsoft and Oracle stand to lose more by blocking entry to small players through regulatory mechanisms.

If we look at the majority of tech law suites we can easily observe that there is no clear winner and either parties seem to have achieved only small term gains.

But I most certainly see that government will successfully kill innovation when it comes to heavily regulated industries such as education, drugs, medicine and biotech.

It turns out, though, that we leave fingerprints on everything we touch. And many of the conveniences and indeed basic user experience we've come to expect leave plenty of markers of who we are for anyone who might be listening. This makes it easy for hacker news to remember who I am, and easy for advertisers to target ads, and governments to track individuals.

So yeah, tools exist, sort of, but require a lot of inconvenience. We've seen instances of ISPs inserting their own cookies on headers of outgoing customer traffic, meaning there are still times when your precautions don't matter at all. When I've thought about totally anonymous internet usage, my guess is that you need to go buy a fresh laptop with cash, and then only use it on large public networks, with good encryption...

The software which is currently closest to this is ricochet [0] which communicates directly between Tor hidden services. Since there is no central server, there is no one to record metadata (at least in a trivial fashion). However there is still a lot of work left to do before ricochet is something that could be mainstream. Also, some metadata can be leaked, such as when one is online, and (until proposal 224 is out) how much people are communicating based on the number of lookups on the hidden service directories corresponding to the service (since there is no randomness in the system yet, afaik, you can brute force values to get into the right place in the ring. I haven't read the Tor specifications in a while tho, so I may be wrong)

You could also use some sort of mixnet system, although you would probably end up leaking who is sending messages to their ISP. To stop the ISP from determining when, you could send o constant stream of encrypted traffic, although that would be inefficient. (I need to read more research on this)

However, weather people will actually use these systems is in entirely different problem.

[0] https://ricochet.im

Then, it depends where you sent it. Email goes to one person, so receipt of the message is seen on their ISP's side.

Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files. In order for the receiver to find what they wanted, they would have to browse the public folder to find what they needed, and this act of browsing strips the anonymity away.

The other problem is that you have to exchange the decryption keys with the person you intend to communicate with. You either need to physically give/mail them to the recipient (loss of anonymity in the case of mail), or else you need to exchange them electronically, which usually requires an A<->B exchange, or you can post your public key and let the recipient find it.

Basically, if you are a government watching all the communication from above, you can usually tell what path information takes, even if its posted publicly.

I think USENET and nntp came really close to fulfilling most of "single public folder for the whole world", but unfortunately has fallen out of popular use (and it needs to be popular enough to increase the anonymity) because it wasn't walled-garden enough to make money from.

Sure you could steal signals or go to starbucks (which has cameras of course ) a few times and maybe get away with it, but to do it reliably, on demand, is very difficult.

For metadata things are the opposite of your logic. It is always accessible. Whatever protocol you create to hide it, will have holes; Math dictates it.