While not officially known, Google might have been served a notice from the British government similar to what Apple received last month.
Google has refused to deny receiving a secret legal order from the British government, according to a bipartisan group of members of Congress who are concerned Westminster may have demanded that several U.S. technology companies provide its security services with a mechanism to access encrypted messages.
It follows the British government reportedly issuing such a secret legal demand, officially known as a Technical Capability Notice (TCN), to Apple. Apple is believed to be contesting the demand at a closed court hearing on Friday.
Google is not legally allowed to disclose whether they received this order under the Investigatory Powers Act. If this is true, almost every tech company has been forced to comply without the broader public being aware.
âGoogle also recently told Senator [Ron] Wydenâs office that, if it had received a technical capabilities notice, it would be prohibited from disclosing that fact,â wrote the group.
If I recall correctly, the only reason we heard about Apple was through a leak.
Right now, the U.S. government is more willing to challenge these orders since it impacts American tech companies. We donât really know the behind the scenes, but like you said, I would not be surprised if Google did not fight back
Unfortunately it seems only reasonable to assume that most well known encryption software available in the UK will also have received such orders. I think itâs crucial we have a discussion about if/how this should influence our recommendations.
Not inconceivable but Google does have lawyers too and would be in big legal trouble if they gave info from places other than US.
Now comes the speculation: I think Google would definitely give data from UK users only and probably would avoid giving data from countries with strong enough privacy laws such as the EU via GDPR and US by extension from whatever strict California law it has. The rest of the world is probably fair game, except maybe China because of their Great Firewall.
What E2EE data does Google hold where itâs their clients that have encrypted the data? AFAIK RCS itâs the carriers who hold the encrypted data, and thereâs not just Google Messages which can send/receive encrypted RCS. Then thereâs encrypted data that Google holds like WhatsAppâs encrypted backups, but thatâs WhatsApp who encrypts and decrypts the backup, so not much that Google could disclose there.
Swedish 2020:62 allows for both hardware and software backdoors for breaking encryption, no?
Yeah, seems like some govts have boldly ventured there, but the specifics & safeguards vary from one to another.
offtopic
[quote="phnx, post:4, topic:25803"]
. I think itâs crucial we have a discussion about if/how this should influence our recommendations
[/quote]
Recent enough to remember you censored me and another user over this, including reacting with a ââ emoji. Oh wellâŚ
Never in my life have I used the clown emoji lol. If you have an issue with me or my actions you can take it up privately with Jonah or another team member.
It does not require companies to collude with the government to secretly backdoor encryption, no.
âThose providing electronic communication services are obliged by law to cooperate with the police/security police (section 24).â
OK, but:
âUnder section 12 of the Act, an authorization can provide for secret entry to premises to plant spyware physically on an information system (e.g. a stationary computer).â
Compromising websites seem to be fair game, too?
âWhere the identity of the suspect is not known, but his contacts are known, or a third party (such as a website which the suspects visits) is known, one can permit secret data reading of these contacts, or the third party, but only in order to identify the suspect.â
Breaking encryption is where their focus seems to be at:
âThe figures, published since 2020, when the Act was introduced, show that the overwhelming purpose for which secret data reading is granted in Sweden is to break a deviceâs encryption.â
This has been so glossed over in all the discussions Iâve seen on the topic.
Another point that seemingly hasnât come up at all is are we even sure that the UK isnât just asking for the same access the US might already have? It seems very much a sort of British approach to âfairâ intelligence sharing because otherwise, the request just doesnât seem at all a reasonable by itself.
Imagine in the pre-snowden era, this kind of data wasnât even encrypted at rest and was basically a legal warrant away to all governments of countries where apple did business. With secret courts and untrustworthy institutions, why should we believe that ADP or other tools created since then arenât already back-doored for the US authorities? Do you believe that the US would allow exports of commercial user-friendly e2e tools without any meddling? I think some healthy doubt is reasonable here.
It would be trivial to force apple to copy all encryption keys to US authorities when ADP is activated, allowing full access without any warning to the users. The features may have even been designed with legal interception in mind and could even be a paid service that apple offers. The apple TOS even states not even apple can read your info⌠but legal orders can force the sharing of the encryption keys before anything is even made E2E anyway and this would not contradict their TOS.
And what about the new US administration? The violent change and new pay-to-play approach of the current government could easily have shaken up some international intelligence sharing agreements, causing the UK to demand this overreach.
The fact that it was leaked is super interesting because you have to wonder who is leaking this and what is the motivation behind it.
Having never not been privacy conscious⌠my senses are tingling. There is too much that doesnât add up here. If you are a criminal or a pedo or whatever, you can just use fully private and independent tools like gpg - no need for signal messenger or appleâs ADP. Technically ADP still shows hash info on files to Apple I believe, so especially if youâre a pedo it seems like a terrible plan to hide your crimes anyway. The people that a functional ADP would protect more likely includes engineers, business people, scientists and business owners with access to material that is valuable for economic espionage or for kompromat purposes.
â emoji. Oh wellâŚ