She swallowed the dog to catch the cat/She swallowed the cat to catch the bird/She swallowed the bird to catch the spider/She swallowed the spider to catch the fly/I don’t know why she swallowed the fly/Perhaps she’ll die

It’s happened: David Cameron is prime minister, and he’s following through on his promise to ban effective cryptography.

The Snooper’s Charter (AKA the “Investigatory Powers Act”) will require internet giants like Facebook and Google to make some provision to decrypt and deliver to the police the messages their users exchange. Defenders of this bill, including MI5 (who should know better), make this out to be a simple and effective measure to protect the nation.

The reality is that this cannot possibly make us any safer, cannot possibly catch any serious criminals, and will, as a matter of iron-clad inevitability, lead to a cascade of more intrusive measures.

Let’s start with the spider that David Cameron is asking us to swallow, and move on to everything else we’ll have to swallow to catch it.

Apple, Google, Facebook and all the other big internet companies are now taking steps to enable end-to-end encryption. That means that each of their users will have software on their own devices that scramble their messages so thoroughly that if all the hydrogen atoms in the universe were made into computers that tried to guess the key until the stars grew cold, they’d run out of universe before they ran out of possible codes.

The big internet companies can’t know what’s in those messages unless they put deliberate flaws in this encryption/decryption software they distributed. They could break the software they distributed to everyone, but the more people there are in possession of your shameful secret, the faster it will be discovered and your code discredited, your business hurt and your management team punished by brutal lawsuits and market action.

So they could try to sneakily force devices owned by “bad guys” to update their software with nonfunctional crypto. This is a little more plausible, but the result is the same – eventually they will be caught. After all, one of the threats information security has to guard against is that someone will sneakily change the software you use – infect your computer with a virus that allows criminals or industrial spies from rival nations to get inside your most precious secrets. Companies want their customers to be able to independently verify that they are running byte-identical versions of the software that does the encryption and decryption, and the only way to sneak broken software on to targeted systems is by making all computers more vulnerable.

You can see why companies hate this. Finance startups like Eris Industries have already announced that they will shutter their UK offices and do their work elsewhere, because you can’t seriously propose to handle millions in other peoples’ money if you’re not allowed to use the best locks we know how to create – especially when your offshore competitors are not bound by the same stricture.

But that’s just for beginners, because, having swallowed a spider, the UK security establishment is going to have to swallow a bird to go in and get it. That’s because smart terrorists will seek out software that can be independently verified. Instead of using Facebook’s in-built crypto (or Android’s, or Apple’s, etc), they’ll run a free, open, best-of-breed program like the Gnu Privacy Guard (GPG) to scramble their messages. They don’t even have to give up Facebook! Just encrypt the messages before sending them – job done.

So the state has to control your use of software. They have to stop you from gaining access to working crypto, which is some of the most widespread, widely used software extant today. Every time you see a little padlock in your browser bar, you’re using crypto. There’s really only one kind of crypto that anyone uses: crypto with no known defects. There’s really no such thing as “strong” and “weak” crypto. In the very early days when computation was literally billions of times more expensive than it is today, programmers sometimes used shorter keys to accommodate underpowered computers – but today, the best technical practice is to use keys of sufficient length as to make it impractical for anyone to break them through brute force. “Weak crypto” is like “slightly fatal.”

It’s a safe assumption that any criminal who represents such an existential threat to the UK as to warrant these measures would be sufficiently motivated to seek out and install working software. Otherwise, the Snooper’s Charter is only proof against lazy and haphazard terrorists. Installing software isn’t rocket science.

There are millions of packages, sites, products and services that have good crypto. Blocking all these sinister dens of iniquity – like Github and Ubuntu and Openssl and Cyanogenmod – makes China’s Great Firewall look trivial by comparison. The Great British Firewall: the bird that catches the spider.

But that’s not enough, either. A thumbdrive, passed from hand to hand, could carry all the crypto that anyone would ever need to communicate in perfect security; a VPN would let Britons tunnel outside of the Great British Firewall to get at working code. To stop this, computers need to be redesigned to run like Iphones or PS4s, locked so that they’ll only run software that’s (cryptographically!) signed by the manufacturer, who, presumably, would get permission from Ofcomp for each package in their stores, ensuring that everything is designed to fulfill the mandate of allowing the state to listen in on anyone’s communication, at any time. Computers that only run state-approved software: the cat that catches the bird.

And even then, the terrorists are still in business. Cheap, Raspberry Pi computers, the size of a pack of gum, wide open to any code of your choosing, can easily traverse the borders of a modern nation – even if you wanted to institute border checks like the old Soviet searches for “unauthorised radios” that could tune in unapproved stations, modern computers are so small that no border service could hope to catch them. Invasive material border-searches: the dog that you have to swallow to catch the cat.



David Cameron says that the state has always been able to get a court to order a business to turn over customer information, and all he’s doing is keeping this principle intact. But Whatsapp isn’t like a insurance agency with our applications in its file-drawers – it’s like a cafe where we pop in for a chat. Cafes have never been required install hidden microphones in the salt-cellars that could be activated with a court order. The state has never had the power to listen in on all our conversations.

It’s not only impractical to attempt to seize this power – it’s genuinely totalitarian. It’s more than we can – or should – swallow.