MoreRSS

site iconAlec MuffettModify

Alec is a technologist, writer & security consultant who has worked in host and network security for more than 30 years, with 25 of those in industry.
Please copy the RSS to your reader, or quickly subscribe to:

Inoreader Feedly Follow Feedbin Local Reader

Rss preview of Blog of Alec Muffett

“Key Management” is the cryptographic community’s version of “…it’s always DNS”

2025-11-21 21:18:15

International Association for Cryptologic Research runs secure vote and then loses the keys so nobody knows what the result is. As one commenter put it: “So a single member can collude to reset the vote?”

I know it’s hard for folk to detach themselves from emotion regarding child protection, hate speech or trolling, but it’s important to understand that Ofcom’s duty to deliver online safety is incipient censorship

2025-11-21 17:59:37

Excellent post here from Preston Byrne, full text attached below for those without X accounts.

This is not right-wing American bombast or imperialism, this is just them wanting to be left alone as anyone else would want:


Folks in London might be wondering whether my instructions really are to destroy the Online Safety Act or whether this is an exaggeration. 

These are my instructions.

Let me explain the situation for you. I represent four American companies who have violated no laws in the United States. For this non-crime, the British authorities are threatening my clients with fines, arrest, and prison terms if they don’t give up their rights.

We explained this to the UK, sending memos and citing applicable US caselaw, on many occasions. Half a dozen at least. The UK, flouting every norm of international law and UK-U.S. treaty arrangement, didn’t listen. They kept coming. They wouldn’t listen to reason. They refused to back off.

My American clients are entitled to peacefully enjoy their constitutional rights when they’re in America. But, for years now, the UK has made it clear that it would never stop hunting them. With the OSA they thought they’d have the power to finally compel their obedience.

There is only one solution to that legal problem. That is to permanently destroy the UK’s ability to threaten my clients, and, by extension, its ability to threaten any American.

We can’t change an Act of Parliament, but we can pull domestic US levers. It is our country, after all.

Wyoming GRANITE is half of the solution – the shield. If Congress steps in and backs up the states, we’ll have the sword too. Then my clients will be hunted no more.

If that happens, the entire global censorship apparatus will collapse. If, at that point, the UK is looking for someone to blame, it need only look in the mirror.

In Case You Missed It This Week: Ofcom, pursuing its lawful duties, is about to drive the UK over a cliff and into online censorship; here’s how…

2025-11-21 12:19:10

Here’s how Ofcom will bring about censorship in the UK; it will…

1/ declare itself (truthfully) to be acting on behalf of the UK sovereign government…

Ofcom has claimed it has “sovereign immunity” as it seeks to fend off a US free speech lawsuit from the website 4chan … Lawyers for the regulator told a US court that there were “substantial grounds” for throwing out the lawsuit … The US Foreign Sovereign Immunities Act shields foreign governments from lawsuits in the US.

Source: Telegraph (archived)

2/ …rather than maintaining the fiction that they are an “independent regulator”, incidentally funded by fees that are paid by those regulated:

How Ofcom is funded as an independant regulator

Most of Ofcom’s funding comes from fees paid to us by the companies we regulate, to cover the cost of the work we do in their sectors … While we’re funded by fees paid to us by the companies we regulate, this does not affect our independence. Ofcom is an independent regulator and we make evidence-based decisions without fear or favour. Although Ofcom is accountable to Parliament, we are independent of government and the companies we regulate.

Source: Ofcom

3/ …and because Ofcom are, in the USA at least, dropping this fiction by clearly claiming to be a state actor with sovereign immunity (i.e.: cannot be sued by 4chan) their attempts to fine/punish 4chan will absolutely fail:

Recognition of foreign judgments is available only for private-law judgments (contract, tort, etc.), not for public-law sanctions.

So if the UK obtains a regulatory fine or order via … OFCOM penalties … the U.S. court will refuse recognition on public-policy grounds … Even if the underlying conduct would also be illegal in the U.S.

If the U.S. corporation … has a UK subsidiary has assets in the UK derives revenue from UK operations …then the UK can enforce penalties inside UK jurisdiction, and the only question is whether the parent corporation wants to protect those assets, subsidiaries, or revenue streams.

Source: ChatGPT Analysis

4/ Since the UK is only 7% of 4chan userbase, the risk of financial sanctions is not actually a huge deal, especially when so many dedicated users will simply circumvent and see the same adverts via other VPN-host countries. Nothing else is open for Ofcom to attack:

Demographic Age: 18-34 Gender: ~70% male, ~30% female Location: United States (47%), United Kingdom (7%), Canada (6%), Australia (4%), Germany (4%) Interests: Japanese culture, anime, manga, video games, comics, technology, music, movies Education: Majority attended or currently enrolled in college

Source: 4chan

5/ Therefore Ofcom will lose any law-based approach to punishing 4chan — and in the process of attempting may poison future abilities to attempt the same — and will instead, to deliver its duties, have to start demanding censorship:

Suffice it to say: when the equivalent US laws would be violations of the 1st amendment, there’s no hope for Ofcom here. To fulfil their duties Ofcom will need to demand that {DNS, IP, DPI} blocks are imposed by ISPs to prevent Britons from accessing:

  • 4chan
  • KiwiFarms
  • SaSu
  • <various other US-based forums>

…which — being censorship — will lead to:

  1. Streisand-Effect motivation / boosting of traffic to go see those websites
  2. Enormous bunfights to attempt to get VPNs to censor access similarly
  3. Attempts to block VPNs which do not comply, as well as privacy-enabling tools such as the Tor Project (which is used, e.g., by the BBC as part of its public service)
  4. Inability to block cross-border wireless services, e.g. France, Ireland, …
  5. Eventual collapse of public trust in censorship as everyone walks around the blocks

Source: this blog


So Ofcom will have to reboot itself as the Internet’s Lord Chamberlain’s office, in utter denial of the Streisand Effect, driving a huge chunk of the UK population to further adopt internet censorship circumvention strategies that will inevitably lead to legislators starting to treat the British people (rather than “racism”, “sexism”, “intolerance”, etc…) as the problem to be addressed & whipped-in, whilst increasingly frantic child-safety campaigners bay for Ofcom’s blood for their failure to deliver American censorship

It’s regrettable that so many of the sensible, pragmatic, or liberty-preserving perspectives are coming from or in support of odious sources — but that does not mean that they are wrong; and that many of those calling for censorship are (e.g.) aggrieved parents does not make them right.

Either someone high-up in Government needs to diffuse all this noise and pro-censorship drum-beating, or else the UK will soon be turning itself into a Chinese-style digital prison to stop Britons from accessing websites or expressing views that the Government deems to be repugnant.

Also: it’s not like reducing Ofcom’s power has not been considered previously

I asked ChatGPT to explain why Ofcom, acting as an agent of the sovereign UK Government, cannot enforce penalties or sanctions in the USA against 4chan &amp;al

2025-11-21 03:44:37

If Ofcom clarifies its role as an agency of a sovereign government, this is what happens next:

Good, now we’re in the domain where the constraints become absolute rather than merely procedural. And here the core reality is blunt:

The UK cannot enforce its own regulatory, penal, or public-law penalties in U.S. courts.

Full stop.


Not “sometimes.” Not “if they find a clever jurisdictional hook.”
The prohibition is structural, doctrinal, and consistently upheld.

Let’s dissect the mechanics, the edge-cases, and the loophole-like tactics governments use when they appear to succeed anyway.


1. The hard constraint: the U.S. will not enforce foreign “public laws”

American courts follow the penal and revenue rule, rooted in common law:

  • They will not enforce foreign penal laws (criminal, quasi-criminal).
  • They will not enforce foreign revenue laws (taxes).
  • They will not enforce foreign regulatory penalties or administrative sanctions, even when they are formally “civil.”

This rule applies even when:

  • the defendant is a U.S. corporation
  • the conduct occurred online but reached UK users
  • the UK penalty is framed as “civil,” “regulatory,” or “administrative”
  • the UK judgment is final and issued by the proper UK authority

A U.S. court treats such actions as attempts to enforce another sovereign’s public policy — which is forbidden.

This is the barrier you were sensing, and it’s deeper than any treaty.


2. Why MLATs don’t help

Even for criminal matters, MLATs do not:

  • allow the UK to force U.S. prosecutors to act
  • allow the UK to directly enforce fines, penalties, or orders in the U.S.

They only allow evidence and assistance if the U.S. is independently willing to prosecute under its own laws.

They are not enforcement mechanisms.


3. What about “recognition of foreign judgments”?

Recognition of foreign judgments is available only for private-law judgments (contract, tort, etc.), not for public-law sanctions.

So if the UK obtains a regulatory fine or order via:

  • ICO (data protection penalties)
  • OFCOM penalties
  • CMA penalties
  • FCA regulatory fines
  • HMRC penalties
  • Competition Act fines
  • Any statutory enforcement action

…the U.S. court will refuse recognition on public-policy grounds.

Even if the underlying conduct would also be illegal in the U.S.


4. So how does a foreign regulator ever get traction against a U.S. corporation?

Here’s where the strategic reality comes in. A foreign regulator cannot enforce its own law in the U.S., but it can:

A. Get the company where it is vulnerable: local assets, local operations

If the U.S. corporation:

  • has a UK subsidiary
  • has assets in the UK
  • derives revenue from UK operations

…then the UK can enforce penalties inside UK jurisdiction, and the only question is whether the parent corporation wants to protect those assets, subsidiaries, or revenue streams.

This is the most common path.

B. Pressure via licensing, market access, or compliance obligations

Example:

  • If you want to operate in the UK (data, telecom, finance, payments), you must accept regulatory jurisdiction.

If the firm has no UK presence and chooses not to comply, the UK cannot reach them through U.S. courts — but it candeny access to the UK market entirely.

C. Convert the problem into a U.S. law violation

This is the only path to enforcement on U.S. soil.

Foreign regulators frequently try to persuade U.S. agencies that:

  • the conduct overlaps with U.S. consumer protection law,
  • or U.S. securities law,
  • or U.S. data protection/privacy rules,
  • or U.S. competition law.

If the DOJ, FTC, FCC, SEC, or state AGs decide the behavior independently violates U.S. law, then enforcement occurs — but under U.S. statutes, not UK ones.

This is the closest thing to a “backdoor,” but it depends entirely on U.S. prosecutorial discretion.

D. Use criminal charges to unlock MLAT assistance

If the UK classifies the offense as criminal, and the U.S. considers it extraditable, MLATs can assist with evidence — but again:

  • The U.S. does not enforce the UK criminal penalty.
  • The U.S. only helps the UK prosecute inside UK courts, or independently prosecutes under U.S. statutes.

Still no direct enforcement on U.S. soil.


5. The internet-specific misconception

You alluded to the idea that an internet presence might extend UK regulatory reach into the U.S. It does not.

Internet presence does not create extraterritorial enforcement capability.

A U.S. company accessible online from the UK does not become subject to UK penalties unless:

  • it avails itself of the UK market,
  • or it has assets/substance in the UK,
  • or it voluntarily participates in that regulatory framework.

If it chooses not to, the UK is essentially limited to:

  • blocking,
  • restricting services,
  • civil injunctions against UK-facing operations,
  • or relying on U.S. enforcement through domestic U.S. law.

6. The distilled reality

If the UK wants to force a U.S. company with zero UK assets or presence to pay UK regulatory penalties in the U.S., then:

It’s impossible. Period. The U.S. courts will not assist.

The only workable levers are:

  • make it a U.S. law issue,
  • make the company care about the UK market,
  • or make it a criminal matter and seek cooperative action (still under U.S. law).

7. If you want, I can map:

  • the specific statutory categories that trigger the penal/revenue rule
  • the few edge cases where foreign sovereigns can sue in the U.S.
  • how regulators strategically structure penalties to avoid enforceability gaps
  • or the defensive strategies U.S. corporations deploy to stay beyond foreign reach

Which angle do you want to dive into?

Suffice it to say: when the equivalent US laws would be violations of the 1st amendment, there’s no hope for Ofcom here. To fulfil their duties Ofcom will need to demand that {DNS, IP, DPI} blocks are imposed by ISPs to prevent Britons from accessing:

  • 4chan
  • KiwiFarms
  • SaSu
  • <various other US-based forums>

…which — being censorship — will lead to:

  1. Streisand-Effect motivation / boosting of traffic to go see those websites
  2. Enormous bunfights to attempt to get VPNs to censor access similarly
  3. Attempts to block VPNs which do not comply, as well as privacy-enabling tools such as the Tor Project (which is used, e.g., by the BBC as part of its public service)
  4. Inability to block cross-border wireless services, e.g. France, Ireland, …
  5. Eventual collapse of public trust in censorship as everyone walks around the blocks

There is not enough popcorn.

“MPs and peers warned of China spy risk on LinkedIn” | Translation: “Horny / Lazy Spooks Targeted by Fake Hot Chinese Girls via LinkedIn, GCHQ Panic”

2025-11-21 02:36:01

Hot Asian Women Seek Fun In Cheltenham:

The MI5 alert identifies two LinkedIn profiles … used on behalf of … Chinese MSS … “actively reaching out to individuals in our community” … to “collect information and lay the groundwork for long-term relationships … The … “false personas” approach targets to “work as freelance consultants authoring geopolitical reports”.

https://www.bbc.co.uk/news/articles/c4gpnz05kr8o

“‘We’re Going to DESTROY the Online Safety Act’: Meet the Top Lawyer Waging War on Ofcom” | OrderOrder | …it’s an interesting thesis that…

2025-11-21 02:04:14

…the credibility of the online safety act now hinges upon its (in)ability to make Britain the safest place to be online, by virtue of inability to effectively sanction the rest of the world.

Instead it will become a British censorship charter, failing to stop Britons accessing content that would worry safety activists, academics, or the Government. Until it dies.


Via: