If a country like the UK decided to ban end-to-end encryption, how would they even enforce it? I understand that they could demand big companies like Apple stop providing such services to their customers and withdraw certain apps from the UK App Store. But what’s stopping someone from simply going online and downloading an app like Session? I mean, piracy is banned too, yet you can still download a torrent client and start pirating. What would a ban like this actually prohibit in the end?
Rules and enforcement are different.
If you make the behavior illegal, you can use that behavior to prosecute people you don’t like. Even if you can’t really control every instance of that behavior. Like speeding laws
If encryption is illegal, then every company operating legally in your country will not offer encryption. Making it very unavailable to the majority of people. That’s 80% of your problem right there. The other 20% will persist, but if they become a problem you can target them with the above law about using illegal math.
It’s not about perfection, it’s about layered defense to weaken your enemies. And when you see the people in your country as the enemies of the government, then you’re going to see a lot of threats.
So this would yet again only affect the people who are not the problem while the people they intend to target with said ban would remain more or less unaffected.
Maybe not entirely, governments probably aren’t thrilled that something that was once an obstacle to authorities when dealing with a small group of dedicated individuals now extends to huge portions of the population for any and every investigation where their communications might have helped authorities build their case so you can see why they might try and remove that obstacle for themselves.
people they intend to target
They absolutely intend to Target the people who will be affected. The stated use case is an excuse, but once a government gets a capability it never gives it up.
Partly correct.
It’s true that anyone with nefarious intent would still be able to encrypt things.
However, it means law enforcement doesn’t need to bother decrypting things to make arrests.
People here are generally going to be distrustful towards the government, and for good reason, this feels like gross overreach imho, but at the same time, I think it’s a little naiive to view all potential terrorists as tech savvy enough to know to use the right open source encryption package. I’m sure this would help them catch some percentage more of attackers.
Again, to be clear, I don’t think that’s remotely worth the damage that unencrypted messaging can do, but there’s enough examples of incompetence and bad opsec amongst criminals to think that someone would just continue to use whatever is most convenient or what their friend told them is good.
I’m sure this would help them catch some percentage more of attackers.
Like the TSA?
Easy. They would block traffic they can’t decrypt.
They would force a root cert to be accepted that they use to decrypt-inspect all encrypted traffic.
Couldn’t be done something like a reversed book encryption? Something that is plain text and perfectly readable but that you can use to decrypt a message?
Wouldn’t binary transfer in base64 be undescifrable as they could be files in a proprietary format?
You’d be surprised at how much an off-the-shelf firewall can see and categorize. A purpose built application that regulates/controls the physical network would have no issue with that type of traffic.
Then I will have my encryption program make the encrypted data look like text/images/whatever…
The network can see who you’re communicating with and either kill that session or pressure either side to allow them access.
Additionally, as a method scales up in usage it becomes more likely a target.
If you ban encryption, only criminals will have it. It’s a revolver…
They can’t but also by banning it having the banned software makes it a crime. So if they stop you and see you have the banned software installed they can add charges. It’s like a seat belt law most are not going to catch you wearing a seat belt or not but if they pull you over they will add that charge to your ticket. Also making something illegal that everyone will keep doing. Allows the government to charge people it doesn’t like. Speak out in ways powerful people don’t like jail. Help the homeless jail. Be homeless jail. Try and run against me in an election jail.
If encryption would be banned then how any information in internet can be trusted? I am not computer expert but…
https is encrypted between client and server, so how are banking going to work if there are no encryption betveen client and server? Or anything that matter, no secure way to communicate with banks, stores, coverment (taxes, etc.) . That would bring internet as whole back to 80-90’s. Whole idea seems to me 100% bullshit. And since bad actors have learnes thing or two since 80’s it would be all you can eat buffet for them.
Or i have missunderstood something…
surely they would retain the encryption capability for themselves so this is not a problem for them.
It wouldn’t.
USA tried to keep the encryption all to itself in the past by classifying it as munitions, it didn’t work out.
And criminals don’t care if encryption is banned anyway.
No-one thinks that the US citizens will actually use the second amendment for the allowed purpose. It’s kind of laughable that people think that they will. It’s used for your kids to shoot their fellow students.
Wasn’t there an official building invasion recently? Turns out they forgot all about it at the time.
You can download a torrent client and start pirating because it’s encrypted. Nobody knows you’re doing that besides the people you’re directly connected to on the other end. If they wanted to crack down on it, the first thing they need to do is crack down on encryption. If they can see exactly what you’re doing, it’s now possible to easily catch you, with encryption it isn’t.
Note that this also applies to encryption itself. Once it’s banned, it gets much more difficult to hide the fact that you’re encrypting something. Encrypted data itself has to go into hiding. You have to resort to something like some pretty hardcore steganography which means you need to hide secret encrypted messages in normal-seeming non-encrypted traffic. The problem is that to do this you need to have a sufficient quantity of non-encrypted traffic to hide your secret encryption in without it starting to look suspicious, either due to the unusually massive volume of meaningless “normal” traffic needed to subtly encode the hidden data, or the fact that large amounts of hidden data in small amounts of “normal” data become increasingly obvious as the large number of supposedly “normal” mistakes and errors and artifacts that form the encoded data will suggest some of those variations are not in fact “normal” at all and will indicate that encrypted data is being concealed.
Governments banning encryption will of course never stop everybody. But it makes it much harder for the people still using encryption anyway and much easier for the people who want to see what they’re doing or at least see who they are. It’s classic “black or white” thinking to assume that because it hasn’t simply stopped encryption it hasn’t worked. This would be a big step that makes things much harder, and even taking small steps to make things slightly harder is an extremely effective tool and it’s become extremely common to try to convince people that these small regressions and erosions are inconsequential and normal even when they are in fact targeted, repeated, relentless and consistently add up to dramatic change over time. The only saving grace we have is that at least some people are simultaneously making the same kind of targeted, repeated, relentless changes for the common good and those can have just as drastic an effect.
Would detecting that encrypted traffic be obvious or can you only see it after you start looking? So in other words, could the ISP just rat out on everyone who they detect using encryption or is that something that could only be proven by looking at the logs after you’re already under investigation?
It’s not only obvious, it’s already done worldwide. Deep packet inspection evolved into HTTPS inspection and corporate/enterprise firewalls can detect and hijack attempts to establish encrypted connections already, as a “feature”. So do government firewalls in totalitarian countries. Of course they (probably) can’t do this secretly and transparently, because of the man-in-the-middle protections built into SSL, so they simply make the actual encrypted connection themselves on the client’s behalf, and give the client a different encrypted connection signed by their own certificate authority, which they force you to accept.
In this situation, you have two choices: You accept the certificate, and you accept that the owner of the intermediate certificate will be inspecting your “encrypted” connection. If you don’t accept the certificate, then your connection is blocked and you have to find some other way to encrypt and hide your traffic without it being intercepted, because it won’t let you go direct end-to-end. Usually, at the moment, this is not that hard for the tech-savvy to avoid, it doesn’t even require something as secretive as steganography, it’s usually simply a matter of tunneling through a different protocol or port. Although those approaches are still obvious, and can easily be detected and either blocked in real-time or flagged for investigation after-the-fact if they have any interest in doing something about it. Corporations or countries that want to lock down their networks further can simply block any ports or protocols that would allow such tunneling or inspection-evasion in the first place.
Deep packet inspection already allows any non-encrypted traffic to be clearly identified. If you don’t want any encrypted traffic to sneak through, you can safely assume anything that can’t be clearly identified is encrypted and block it. Depending on how strict you want to be about it, you start essentially whitelisting the internet to known, plaintext protocols. If it’s not known and plaintext, just block it. Problem solved. Encryption gone, until people start building (possibly hidden) encryption on top of those plaintext protocols, which is inevitable, and then you update your deep packet inspection to detect the encrypted fields inside the plaintext protocol and block them, and the back-and-forth battle continues.
Encryption is probably a false panacea against a major state-level adversary anyway, especially if they have plausible access to network infrastructure, but that’s a whole different can of worms and unless you’re a serious revolutionary/terrorist probably beyond the useful scope of most people’s realistic concerns.
Man, deep packet inspection is some crazy stuff.
Good implementation can identify the type of traffic within seconds with scarily good accuracy.
Quite a few countries actually implement this in their national ISP’s infrastructure to block VPNs, so the citizens can’t access non-approved websites.
