Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp • Hacker News Board

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#51

Post by noodlesUK » Thu, Oct 22, 2020, 5:28 AM UTC

dane-pgp wrote: post #22

Barrin92 wrote: post #16

Earlier quoted context omitted.

isn't that already the status quo? Most governments I'm aware of have the right to engage in surveillance of individual homes, albeit with strong requirements. But all guarantees you have right now that no intelligence is bugging your home is the promise (and legal protection) that they don't do it arbitrarily.

While it is lawful for your government to bug your home, it is also legal to own a home that doesn't have a telescreen or to remove a bug if you find one. Laws against E2E encryption effectively mean that it is illegal to use a communications technology that is hard for the government to interfere with, even if you are not using it to break any (other) law, which seems like a change from the status quo.

You say that, but in at least one case [1], you can be charged with stealing government property if you remove a bug from your car.

[1] https://arstechnica.com/tech-policy/2019/11/man-charged-with...

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#52

Post by dane-pgp » Thu, Oct 22, 2020, 6:36 AM UTC

noodlesUK wrote: post #51

dane-pgp wrote: post #22

Earlier quoted context omitted.

While it is lawful for your government to bug your home, it is also legal to own a home that doesn't have a telescreen or to remove a bug if you find one. Laws against E2E encryption effectively mean that it is illegal to use a communications technology that is hard for the government to interfere with, even if you are not using it to break any (other) law, which seems like a change from the status quo.

You say that, but in at least one case [1], you can be charged with stealing government property if you remove a bug from your car. [1] https://arstechnica.com/tech-policy/2019/11/man-charged-with...

That case did come to mind when I wrote my previous comment.

> After waiting another 10 days to see if it would start working again, detectives applied for a warrant to search Heuring's home and a nearby property belonging to Heuring's parents. ... Police did find the tracking device.

It sounds like the suspect moved the bug from his car into a house. If you were to move a bug from your living room to your attic (and place a sign at the location of the original bug saying "The bug is now in the attic, feel free to collect it when you find this note") then it might be harder for the police to claim you had stolen it.

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#53

Post by tsjq » Thu, Oct 22, 2020, 8:26 AM UTC

nelaboras wrote: post #40

tsjq wrote: post #39

Genuinely curious. How is this different from China mandating visibility into all of their citizens' internet data ?

It's not about mass surveillance, it's about court-ordered surveillance of individual suspected criminals. As someone said in another thread, it's like a wiretap.

okay. looks like step-1 towards that.

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#54

Post by Cantbekhan » Thu, Oct 22, 2020, 9:01 AM UTC

dang wrote: post #49

A couple problems with this submission: (1) articles on HN need to be in English. We have deep respect for the German language and for other languages, but HN is an English-language site; (2) we've gotten complaints about this title being misleading and/or completely wrong. I've edited the title now in an attempt to be more accurate. (Submitted title was "Germany's Bundeskabinett approves draft law allowing WhatsApp/…

I'm sorry ... I could not find any English language article on any reliable/reputable media reporting on this matter after searching extensively. Therefore I decided it was best to submit this reputable AFP one in German that could be translated easily using Google translate or whatever.

I thought it was quite important to report on it despite the absence of English media coverage.

I apologize for the title being wrong in this case but some other German media press articles have used the word backdoor instead of Trojan. I should have used the word Trojan instead of Backdoor in relation to this particular article and apologize for the mistake. But I'm not really sure which is worse to be honest... and I also suppose they don't want the suspects aware of the Trojan being on their phone. Which leaves many wondering if they don't mean that they want the Trojans at tech companies instead (which then would become backdoors).

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#55

Post by MeinBlutIstBlau » Thu, Oct 22, 2020, 1:19 PM UTC

StavrosK wrote: post #27

MeinBlutIstBlau wrote: post #25

Earlier quoted context omitted.

Wiretaps are normally implemented for a singular specific purpose by specific entities. Not run of the mill average everyday programmers.

So exactly like the proposed law then.

I guess I should've reread that. I think it's fine for large companies because they can afford to do it. It's just the small ones that I'd find it egregious.

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#56

Post by majewsky » Thu, Oct 22, 2020, 2:57 PM UTC

abdullahkhalids wrote: post #47

s9w wrote: post #36

Earlier quoted context omitted.

The problem with similar laws has always been that there are no proper channels. There were cases those were just flat out ignored. And in other laws released numbers showed that less than 1% of requests were denied. These requirements are for optics only, they are never in place in practice. Another example is a police internal system to request information about citizens. That has been abused many times to spy on n…

> less than 1% of requests were denied The statistics of a rubber-stamp court are identical to a court, where the requirements for an approved request are so clear that no one ever submits requests that are likely to be denied. To prove what you are claiming, you have to actually show that a large number of accepted requests were "unethical".

The problem with these surveillance requests is that only rejections need to be argued. When the court says yes, it's mostly just a rubberstamp. When the court says no, they have to write about 4 pages of text. Given the overload of the court system, judges tend to say yes except in the most egregious cases because they need to move on to the next case.

(Disclosure: I'm occasionally involved in public relations for a local chapter of the CCC, a German NGO that deals among other things with surveillance policy.)

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#57

Post by dang » Thu, Oct 22, 2020, 4:19 PM UTC

Cantbekhan wrote: post #54

dang wrote: post #49

A couple problems with this submission: (1) articles on HN need to be in English. We have deep respect for the German language and for other languages, but HN is an English-language site; (2) we've gotten complaints about this title being misleading and/or completely wrong. I've edited the title now in an attempt to be more accurate. (Submitted title was "Germany's Bundeskabinett approves draft law allowing WhatsApp/…

I'm sorry ... I could not find any English language article on any reliable/reputable media reporting on this matter after searching extensively. Therefore I decided it was best to submit this reputable AFP one in German that could be translated easily using Google translate or whatever. I thought it was quite important to report on it despite the absence of English media coverage. I apologize for the title being wro…

It's quite ok - obviously your intentions were fine. I appreciate the explanation.

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#58

Post by MeinBlutIstBlau » Thu, Oct 22, 2020, 5:59 PM UTC

StavrosK wrote: post #26

MeinBlutIstBlau wrote: post #23

Earlier quoted context omitted.

Coming from the country that had the Stasi, no. It's very bad. The Stasi was so smart, they knew it wasn't threatening you with violence that made you complicit, it's blackmail and threats to your loved ones or ruining your career. Also absurd types of guilt trips that make you feel obligated to comply with the objective of the state for other people.

So you consider legal wiretapping and following people immoral as well?

The primary purpose for entities such as the FBI and CIA are to give autonomy to an entity that somewhat exerts the will of the ruling establishment by curtailing movements or organizations. Communism had no influence or money even remotely close to that of the mob. Yet who did they prioritize? Communists. They pick and choose whom the state wants to deem as enemies and exert their powers to silence them.

Re: Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp

#59

Post by reissbaker » Fri, Oct 23, 2020, 8:18 PM UTC

nelaboras wrote: post #42

Aerroon wrote: post #32

Earlier quoted context omitted.

> So much for the EU's vaunted privacy rights... Do people really have such an impression? In 2006 the EU passed a directive that obligated all ISPs to effectively save your browsing history.[0] They had to keep this for a minimum of 6 months. It took until 2014 for the directive to be found to be invalid. It worked until then though. And that's on the EU level. My expectations are even lower when it comes to individ…

But the data collection comes with safeguards to accesing the data. You need a court order to request it. This is not state ordered mass surveillance but rather gives police a right to monitor when they have a court order.

If e2e encryption is backdoored, there are no safeguards. If a court can read the data, then any "encryption" is privacy theater: either the key has been leaked and stored on government-controlled servers (which means an adversary who got access to the government-controlled servers could read your data without your knowledge too), or the e2e encryption is entirely fake and there's a plaintext copy stored somewhere that, similarly, adversaries could access. If the government can read all of your data, a hacker can too — which in today's age, also includes foreign (or even domestic!) government surveillance programs.

Backdoored encryption isn't real encryption. It's theater.