Why can't we collect all the signals all the time?
This is incredibly dangerous for our society, no-one should have that much power. That power isn't about terrorism (or even very useful against terrorism), but about subverting governments, judiciary and businesses.
Don't forget that while they were talking to the IRA politicians were saying in public "we don't talk to terrorists".
(There was a great documentary about this on TV, but I cannot remember the name of it)
Links to any credible sources?
It's basically impossible. One can also use steganography to hide messages in lolcat pictures, or music files. The only way to prevent this, I think, is to start a totalitarian surveillance state where using Free or custom software or hardware is punishable by death. Even then, I'm not sure this will be enough.
What they really need is to invent time travel, and murder Ada Lovelace.
They can't. The US tried it in the 90's when SSL sites could not use strong encryption outside the US and you'd need a license to "export" PGP... That went well! :-/
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
Install a device on one's head?
I expect it's quite likely this one was using WhatsApp because that's what he used; not because he read about its end-to-end encryption.
Don't think we can "tech" our way out of this.
It's actually easier than ever to ban encryption for messaging.
Would that stop determined people? No, but it's never been about that anyway. Just make the pool small enough and it becomes too difficult to use. (See PGP / email).
Also, if you genuinely legislate against encrypted messaging then it's easy to pick up on the relative handful of people who go outside the app stores to get encrypted messaging applications.
And it shouldn't come to technical solutions, we should have people challenge the notion that two people should never be allowed to share a private message, because that's why Rudd and the government is suggesting.
+1. This is the crux of the matter, although unfortunately I don't think the average person realises it.
Just because something is illegal doesn't mean it is enforceable.
Now, the UK isn't at that point obviously, but if they really wanted to use draconian measures against encryption, it probably would be somewhat effective.
Then there's how you use it. They could mandate all of X businesses could only use encryption that could be inspected by the state, so either weak encryption, or PKI where you send the government your site's private key or use the state's CA or something. They can also mandate backdoors in encryption used in certain ways. And they can mandate that weak encryption be used outside their country's borders.
All of these are real parts of US laws on cryptography from WWII to 2000 to prevent "export" of "strong encryption", because of course evildoers around the world might make use of these "munitions". US law still regulates how we can use or distribute cryptography around the world. It is illegal in the US to release open source crypto on the internet without notifying the Bureau of Industry and Security. And 41 other countries (including the UK) have similar laws.
The one thing the US has going for it is the 1st Amendment, which makes it illegal for the US to prevent its citizens from making or using crypto within the US.
That's not an issue. Writing solid encryption software is very difficult on its own. You will hear "do not roll your own crypto" all the time from security experts. We don't live in a James Bond universe and it's beyond the reach of terrorist organisations.
Beyound the reach of the terrorist organisations? We have already seen pretty sophisticated operations by relatively small crime organizations (like exploiting pseudorandom generators in casino slot machines). There's an established black market for exploits. I think writing an end-to-end encryption app is not much more difficult compared to this. What's more, it will even be perfectly legal in many countries, meaning you could legally hire professionals to do the job. Terrorist organisations won't need to esablish a development office in SV to write the app, they will only need to know how to use Tor and wire money to the app producer. Which isn't such a huge competence to ask for.
Plus, they don't have to write it. They could just 'pivot' from an existing open source messenger.
If all you do is pushing the buttons of the slot machine in the right order with the right timing, that's hardly a crime —and I don't care about court judgements to the contrary. If a slot machine has a crappy pseudo random number generator, they're just asking for it. I'd rather sue the slot machine's maker for providing a machine that's not fit for its intended purpose.
You provided it as an example of "organized crime", and doing so heavily suggests that it is wrong.
We tend to conflate "wrong" and "unlawful", and for good reason: the law is supposed to prevent wrong things from being committed. There are exceptions however, and this is one of them. I'd rather use another example if possible.
Speaking of moral issues, cheating on casino is pretty much off limits on my personal moral compass. That the attack was possible within the normal mode of operation does not make it less of a fraud. Imagine if the casino would reverse-engineer a slot machine and find a way to abuse it within the normal mode of operation, making odds (even more) in their favor. That would be fraud, plain and simple, and I don't see why a player should be held to a different standard.
You are absolutely right, not everything unlawful is wrong. But I fail to see which benefit we as a society would have by allowing exploitation of technical deficiencies in slot machines for profit. It is a crime and it is wrong in my book.
The rules for slot machines are ostensibly very simple. As long as you're only pushing the buttons that are supposed to be pushed without deteriorating them, you are acting within the rules of the slot machine, and as such cannot cheat.
The presence of hidden rules such as "don't push the buttons in this particular order and timing", or "don't push the buttons in a way that reliably causes you to win", are just silly and unfair. Especially considering casinos are exploiting gamblers' minds in the first place. Don't like slot machine exploiters? Fix your slot machines.
Likewise for counting cards: the player is merely acting upon information naturally gathered buy observation and play. Asking players not to act upon such information is intrusive —and unheard of in competitive play. Don't like card counters? Invest in a continuous shuffling machine.
"you're only pushing the buttons" except they were not only pushing a button, they were also recording sequences and sending them abroad for analysis.
But as you directly say that exploiting the flaws of a slot machine is not cheating and that it's fair, I guess I won't be able to persuade you otherwise.
Either you meant something along the lines of "that shouldn't be a crime" or you're essentially saying "it's not crime even though it is a crime" - which doesn't make terribly much sense.
Anyone have a link about this story? I'm curious to read about it.
Sure that can go wrong as anything can, but it's far from rolling your own crypto and makes things a lot easier.
It's not. You can use existing software, reuse existing protocols, and stick to safe languages as much as possible. Even implementing your own crypto isn't all that difficult¹. I have written my own crypto library², and I can almost recommend it for production use.
[1]: http://loup-vaillant.fr/articles/rolling-your-own-crypto
Are you suggesting gpg has been backdoored? A simple wrapper around gpg is not-beyond terrorist organisations.
Of course it's utterly trivial to make a one-time-pad cryptosystem, and more practical in 2017 than ever. So what if the keylength must match the message length, my phone has a 32gb uSD. That's a lot of text messages.
If we outlaw encryption, then only outlaws will have encryption.
For me it seems to be more in a direction of so called "Big Brother" than real counter-terrorism.