{"id":55670,"date":"2023-04-18T12:05:33","date_gmt":"2023-04-18T12:05:33","guid":{"rendered":"https:\/\/alecmuffett.com\/?p=55670"},"modified":"2023-04-18T18:28:47","modified_gmt":"2023-04-18T18:28:47","slug":"the-impending-crisis-of-messenger-communications-in-the-westminster-bubble","status":"publish","type":"post","link":"https:\/\/alecmuffett.com\/article\/55670","title":{"rendered":"The Impending Crisis of Messenger Communications in the Westminster Bubble"},"content":{"rendered":"\n

So I keep tabs on Westminster discussion of internet technology via a selection of RSS feeds<\/a>, and this gem<\/a> directed my attention to this report from the ICO<\/a>, dated from mid-2022, titled:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\n

Behind the screens \u2013 maintaining government transparency and data security in the age of messaging apps<\/strong>
Report of the Information Commissioner to Parliament, July 2022<\/p>\nhttps:\/\/ico.org.uk\/media\/about-the-ico\/documents\/4020886\/behind-the-screens.pdf<\/a><\/cite><\/blockquote>\n\n\n\n

\n\n\n\n

I’ll be blunt: I read the PDF as essentially the Information Commissioner’s Office saying:<\/p>\n\n\n\n

    \n
  1. Everyone in government already knows that official records are meant to be retained<\/li>\n\n\n\n
  2. Everyone in government is already trusted to act where they deem necessary in order to satisfy this retention<\/li>\n\n\n\n
  3. Everybody in government already knows that official records need to be kept to a high standard of privacy and integrity<\/li>\n\n\n\n
  4. Regardless of what everyone knows and is trusted to do, this is all really complicated because it turns out that everyone working in government will at the drop of a hat use any messenger account on any messenger service in order to communicate with each other, especially if they are secretly shagging and\/or plotting to overthrow the Prime Minister<\/li>\n\n\n\n
  5. \u2026but everything is already okay, because <see points 1 to 3 all over again><\/li>\n\n\n\n
  6. Maybe we could consider doing the American thing<\/a> if we really want? Maybe? Pretty please?<\/li>\n\n\n\n
  7. But only if we really <\/em>want.<\/li>\n<\/ol>\n\n\n\n

    Of course the ICO wrote-up point (4.) more elegantly:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    However…<\/h2>\n\n\n\n

    What I found more telling was the utter lack of discussion regards the “platform” risks of security; there is mention of “encryption” a total of three times:<\/p>\n\n\n\n

    \n
    \"\"<\/figure>\n\n\n\n
    \"\"<\/figure>\n<\/figure>\n\n\n\n
    \n\n\n\n

    They haven’t exactly gone out of their way to talk about “all this shagging and plotting which ministers are getting up to, wouldn’t it be a good idea if such communications were not available to any Spy or News International journalist who gets a job at the Messenger platform<\/a> which is being used?”<\/em> \u2014 but such ought to be of increasing concern to ministers, and it’s astonishing that the matter remains undiscussed. At best there’s reference to (fairly bland and meaningless) “certification”<\/a> of communications platforms, plus a wishlist for what the Department of Health should <\/em>have sought to know \u2014 but again without reference to how the provider stores the data in order to make it secure against third-party tampering:<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Everything is basically done on trust and left to the assumptions that “privacy is all sorted out by contract.”<\/p>\n\n\n\n

    That’s lovely, but it’s not actually how the world works any more.<\/p>\n\n\n\n

    Mercury Shrugged<\/h2>\n\n\n\n

    We know that the Westminster Bubble uses WhatsApp and Signal<\/a>; we know that they use those two apps because the apps guarantee privacy integrity at a very fundamental level which goes beyond what can be achieved by “contract” and by “vetting platform employees”.<\/p>\n\n\n\n

    We also know that those apps are going to walk out of the United Kingdom<\/a> if it presses ahead with illiberal and misconceived proposals to permit Ofcom (hello again!<\/em>) to obligate client-side content filtering (i.e. spying) upon messages, a matter reinforced this morning by a group tweet which may signal broadening of this shunning of the supply of Messenger services to Britain:<\/p>\n\n\n\n

    \n

    Our position remains clear. We will not back down on providing private, safe communications. Today, we join with other encrypted messengers pushing back on the UK's flawed Online Safety Bill. pic.twitter.com\/MwGBgcvgjk<\/a><\/p>— Signal (@signalapp) April 18, 2023<\/a><\/blockquote>