10 ms·

European Parliament Draft to Enforce End-To-End Encryption for Citizens' Privacy

218 points by dpflan 9y ago

newzzy 9y ago
tldr?
- dpflan 9y ago
  Perhaps this article? http://www.tomshardware.com/news/european-parliament-end-to-end-encryption-communications,34809.html http://www.tomshardware.com/news/european-parliament-end-to-...
onestone 9y ago
Apparently the EU Parliament is trolling Theresa May.
- toyg 9y ago
  Not just EP, but the Council and Commission as well, since they initiated the legislative process. That means the 27 governments are also behind it, at the moment. This is very surprising to me - no government is free of authoritarian elements, especially in centralistic States like France, Hungary, Italy or Spain. Their unilateral disarmament would be peculiar. I don't see this proposal going all the way, to be honest, it seems too idealistic. I expect it will be perverted into its opposite, e.g. justification for "review methods" that states could apply to "check if your encryption is secure", which would result in compromising that very security. Remember that EU law is adapted at individual state level; for generic stuff like this, there is plenty of space for interpretation by national legislators. As a supporter of the EU concept, I think this is dangerous territory for the Union, at a time when its popularity is pretty low. I hope I'll be proven wrong.
  - TomMarius 9y ago
    "27 governments" aren't behind this. Members of the EP from 27 states are behind this, but in many cases, they have nothing in common with the actual government of the country. So little voters care about and participate in the election (often less than 25%) it's easy to win - and the parties that participate in the government don't care at all, thus making EP election the ideal target for otherwise irrelevant parties.
    - Muromec 9y ago
      EP doesn't introduce legislation, only amend and vote on it, so there is commission behind proposal.
    - fauigerzigerk 9y ago
      The turnout in the most recent European elections was 43%. The makeup of the EP doesn't support your claim either. It is dominated by essentially the same parties that rule on a national level.
      - TomMarius 9y ago
        That's true for the western part of the union, but it's very different in the eastern part. In the Czech Republic, it's been 31%, 28% and 28% (since 2004), and our voters are participating the most compared to other eastern states.
        onestone 9y ago
        It's also true for other countries in the eastern part of the union.
        fauigerzigerk 9y ago
        43% is the average across the EU. It's not surprising that it takes a while for new members to fully participate. You are mistaken about Czech turnout though. It's the second lowest of all members: http://www.europarl.europa.eu/elections2014-results/en/turnout.html http://www.europarl.europa.eu/elections2014-results/en/turno... [Edit] For comparison: Turnout in the 2014 US mid-term elections was 36%. In the most recent presidential elections it was 55%.
SimonPStevens 9y ago
Contrast this to the 'soon to be former member of the EU' UK where Theresa May is trying to force companies to add backdoors and ban end to end encryption. :-(
- Xoros 9y ago
  Hand in hand with new French president. :-( https://www.buzzfeed.com/amphtml/patricksmith/france-and-the-uk-are-calling-for-tougher-action-against https://www.buzzfeed.com/amphtml/patricksmith/france-and-the...
  - winstonhades 9y ago
    That article does not say anything about Macron being against end to end encryption or that tech companies should include backdoors. It only states that he might be interested in social communities to remove pro terrorism content.
  - fauigerzigerk 9y ago
    The article doesn't say that.
    - Silhouette 9y ago
      That particular article might not, but the joint press conference after those talks made it about as clear as politicians ever are that they agree on this point.
    - Xoros 9y ago
      Oups sorry. I started with articles in French I read and searched Google for an equivalent in English. I found a wikileak tweet [0] and put the article they linked. My mistake. [0] https://mobile.twitter.com/wikileaks/status/874531651010916352 https://mobile.twitter.com/wikileaks/status/8745316510109163...
- sarnowski 9y ago
  Somehow the actual EU states aren't really behind this. Germany's interior minister just recently proposed a new attempt at legalizing spying citizens devices. http://uk.mobile.reuters.com/article/idUKKBN1951VG http://uk.mobile.reuters.com/article/idUKKBN1951VG
caiob 9y ago
Trying to make sense of these drafts still being written in English, given that with Brexit, none of the countries in EU zone have English as their first language (with exception of Ireland). Convention?
- TkTech 9y ago
  It is still the current lingua franca for most of Earth. Most of their populations learn English as a 2nd (or 3rd) language. It's no different then past legislation and politics being done in Latin.
  - caiob 9y ago
    Hmm... if we're picking a lingua franca for the Earth, that would have to be Mandarin (~14% of the world's population speak it)
    - Arcten 9y ago
      For such a "lingua franca" the pure number of speakers is not quite as relevant as the distribution of those speakers. According to the numbers (https://en.wikipedia.org/wiki/List_of_languages_by_total_number_of_speakers https://en.wikipedia.org/wiki/List_of_languages_by_total_num...), approximately 14% of the world speaks English as a first or second language as well. More importantly, English has 400 million more speakers who speak it as a second language when compared to Mandarin, which suggests that its speakers are more widely distributed on Earth.
      - 3pt14159 9y ago
        While I agree with your viewpoint and it stands up on it's own, I also think it's important to remember the number of people that know at least 20 or 100 words of English. Simple statements can help at a lot of places, whereas I only know a single Chinese word. The number of people that can say basic numbers in English or very simple statements is much higher.
    - adrianN 9y ago
mbroncano 9y ago
It certainly seems the EU is becoming an actual land of the free
- aneutron 9y ago
  As was mentioned earlier, we should probably wait to see the individual states interpretations of such laws. It sounds too good to be true IMO.
- aneutron 9y ago
  As was mentioned earlier, we should probably wait to see the individual states interpretations of such laws. It sounds too good to be true IMO.
- Buge 9y ago
  Are they requiring all communication to use e2e encryption? That seems like a restriction on freedom. What if I want to use some other protocol?
  - drdaeman 9y ago
    This comment has a point. I'm all for a secure E2E for all private communications, but not through prohibitions encoded into laws. Unless it's wartime or similar kind of emergency, it's best to never let the government of any kind to be in control of what[1] you can create (and share with others) and what you can't. No matter how benevolent current one looks like, such capability will be abused by the next one. Better have a constitution-level protection that no government can dictate what technology you must or must not use. Not to say that it's not uncommon for legislatures to be quite awkward when trying to describe technology. And stay up-to-date with possible future breakthroughs. In my opinion, if someone has an idea (and implementation) of something amazing that won't be E2E, it doesn't make any sense to ban that. Label as "doesn't provide end-to-end security"? Okay, I'm not fan of this stuff, but knowledge gap is significant, so that may be well-justified. Prohibit advertising as "100% secure"? Sure, as long as that's not one-time pads stuff, that's most likely misleading advertising claims worth investigation. But banning the software or the service? That's nuts. And it impedes on freedom to create things. ___ [1] Okay, as long as that's not a nuke. Obvious exceptions apply. (Cryptography is not munitions or a hazardous material, right?)
glasz 9y ago
don't let yourselves be fooled, fools. if this takes any real form, it'll be gutted and ripped apart until there's nothing of essence left because it would mean the following ingenius legislation be repealed. and. that. will. never. happen. https://en.m.wikipedia.org/wiki/Telecommunications_data_retention#European_Union https://en.m.wikipedia.org/wiki/Telecommunications_data_rete... https://en.m.wikipedia.org/wiki/Passenger_name_record https://en.m.wikipedia.org/wiki/Passenger_name_record
- Tyrannosaur 9y ago
  I often take a pessimistic view to such good-looking things too. But taking a look at your first link, it appears to already not be in force anymore? For the same reasons that the new recommendation is being drafted- government surveillance violates fundamental rights to privacy. "On 8 April 2014, the Court of Justice of the European Union declared the Directive 2006/24/EC invalid for violating fundamental rights. The Council's Legal Services have been reported to have stated in closed session that paragraph 59 of the European Court of Justice's ruling "suggests that general and blanket data retention is no longer possible".[15] A legal opinion funded by the Greens/EFA Group in the European Parliament finds that the blanket retention data of unsuspicious persons generally violates the EU Charter of Fundamental Rights, both in regard to national telecommunications data retention laws and to similar EU data retention schemes (PNR, TFTP, TFTS, LEA access to EES, Eurodac, VIS)."
- yorwba 9y ago
  Page 30: > When the processing of electronic communications data by providers of electronic communications services falls within its scope, this Regulation is without prejudice to the possibility for the Union or Member States under specific conditions to restrict by law certain obligations and rights set out in this Regulation when such a restriction is targeted at persons suspected of having committed a criminal offence and constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests, including national security, defence, public security and the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Therefore, this Regulation should not affect the ability of Member States to carry out lawful interception of electronic communications or take other measures, if necessary and proportionate to safeguard the public interests mentioned above, in accordance with the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of the European Union and of the European Court of Human Rights. This is not about preventing state surveillance, this is about regulating non-state actors' ability e.g. to track users without their consent. Edit: However, on page 74 > The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services. It seems to me that this requires end-to-end encryption, but the regulation is scoped in such a way that the requirement may be lifted when it inconveniences law enforcement.
skrebbel 9y ago
Any tldr? I have a very hard time getting through this, but as the founder of a Europe-based messaging company (https://talkjs.com https://talkjs.com), I wonder whether this is trouble. En-to-end encryption is great but it also kills quite a number of use cases. For example, our group conversations couldn't be e2e encrypted because then users can't see the message history from before they joined it. In whatsapp this is indeed the case, but for our platform it is a core feature. Same for Slack, I suppose. Similarly, Slack search would be totally out of the door. (unless, again, you make it only search the stuff sent to you)
- HappyTypist 9y ago
  "The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services" I interpret this as the following clauses: * "sufficient protection in place against unauthorised access or alterations" [through] * "guaranteed by the nature of the means of transmission used " * "OR" * "state-of-the-art end-to-end encryption of the electronic communications data" aka: - HTTPS, non-ETE: fine - HTTP, non-ETE: not fine - HTTP, ETE: fine
- c22 9y ago
  Couldn't group chats be encrypted with a shared key that is provided to the new user by whoever invites them to the chat? The messages would still be encrypted and decrypted only at the ends.
  - doctorless 9y ago
    What about removing a user from chat? What if the shared key is leaked? How do you deliver the key to the new user? Who provisions new keys if a shared key is leaked? There are a variety of problems (all solvable/already solved, yes) with the shared secret strategy, and addressing them costs money and time.
infodroid 9y ago
Please append [pdf] to the title.

218 points by dpflan 9y ago

newzzy 9y ago

tldr?

dpflan 9y ago
Perhaps this article? http://www.tomshardware.com/news/european-parliament-end-to-end-encryption-communications,34809.html http://www.tomshardware.com/news/european-parliament-end-to-...

onestone 9y ago

Apparently the EU Parliament is trolling Theresa May.

toyg 9y ago
Not just EP, but the Council and Commission as well, since they initiated the legislative process. That means the 27 governments are also behind it, at the moment. This is very surprising to me - no government is free of authoritarian elements, especially in centralistic States like France, Hungary, Italy or Spain. Their unilateral disarmament would be peculiar. I don't see this proposal going all the way, to be honest, it seems too idealistic. I expect it will be perverted into its opposite, e.g. justification for "review methods" that states could apply to "check if your encryption is secure", which would result in compromising that very security. Remember that EU law is adapted at individual state level; for generic stuff like this, there is plenty of space for interpretation by national legislators. As a supporter of the EU concept, I think this is dangerous territory for the Union, at a time when its popularity is pretty low. I hope I'll be proven wrong.
- TomMarius 9y ago
  "27 governments" aren't behind this. Members of the EP from 27 states are behind this, but in many cases, they have nothing in common with the actual government of the country. So little voters care about and participate in the election (often less than 25%) it's easy to win - and the parties that participate in the government don't care at all, thus making EP election the ideal target for otherwise irrelevant parties.
  - Muromec 9y ago
    EP doesn't introduce legislation, only amend and vote on it, so there is commission behind proposal.
  - fauigerzigerk 9y ago
    The turnout in the most recent European elections was 43%. The makeup of the EP doesn't support your claim either. It is dominated by essentially the same parties that rule on a national level.
    - TomMarius 9y ago
      That's true for the western part of the union, but it's very different in the eastern part. In the Czech Republic, it's been 31%, 28% and 28% (since 2004), and our voters are participating the most compared to other eastern states.
      - onestone 9y ago
        It's also true for other countries in the eastern part of the union.
      - fauigerzigerk 9y ago
        43% is the average across the EU. It's not surprising that it takes a while for new members to fully participate. You are mistaken about Czech turnout though. It's the second lowest of all members: http://www.europarl.europa.eu/elections2014-results/en/turnout.html http://www.europarl.europa.eu/elections2014-results/en/turno... [Edit] For comparison: Turnout in the 2014 US mid-term elections was 36%. In the most recent presidential elections it was 55%.

SimonPStevens 9y ago

Contrast this to the 'soon to be former member of the EU' UK where Theresa May is trying to force companies to add backdoors and ban end to end encryption. :-(

Xoros 9y ago
Hand in hand with new French president. :-( https://www.buzzfeed.com/amphtml/patricksmith/france-and-the-uk-are-calling-for-tougher-action-against https://www.buzzfeed.com/amphtml/patricksmith/france-and-the...
- winstonhades 9y ago
  That article does not say anything about Macron being against end to end encryption or that tech companies should include backdoors. It only states that he might be interested in social communities to remove pro terrorism content.
- fauigerzigerk 9y ago
  The article doesn't say that.
  - Silhouette 9y ago
    That particular article might not, but the joint press conference after those talks made it about as clear as politicians ever are that they agree on this point.
  - Xoros 9y ago
    Oups sorry. I started with articles in French I read and searched Google for an equivalent in English. I found a wikileak tweet [0] and put the article they linked. My mistake. [0] https://mobile.twitter.com/wikileaks/status/874531651010916352 https://mobile.twitter.com/wikileaks/status/8745316510109163...
sarnowski 9y ago
Somehow the actual EU states aren't really behind this. Germany's interior minister just recently proposed a new attempt at legalizing spying citizens devices. http://uk.mobile.reuters.com/article/idUKKBN1951VG http://uk.mobile.reuters.com/article/idUKKBN1951VG

caiob 9y ago

Trying to make sense of these drafts still being written in English, given that with Brexit, none of the countries in EU zone have English as their first language (with exception of Ireland). Convention?

TkTech 9y ago
It is still the current lingua franca for most of Earth. Most of their populations learn English as a 2nd (or 3rd) language. It's no different then past legislation and politics being done in Latin.
- caiob 9y ago
  Hmm... if we're picking a lingua franca for the Earth, that would have to be Mandarin (~14% of the world's population speak it)
  - Arcten 9y ago
    For such a "lingua franca" the pure number of speakers is not quite as relevant as the distribution of those speakers. According to the numbers (https://en.wikipedia.org/wiki/List_of_languages_by_total_number_of_speakers https://en.wikipedia.org/wiki/List_of_languages_by_total_num...), approximately 14% of the world speaks English as a first or second language as well. More importantly, English has 400 million more speakers who speak it as a second language when compared to Mandarin, which suggests that its speakers are more widely distributed on Earth.
    - 3pt14159 9y ago
      While I agree with your viewpoint and it stands up on it's own, I also think it's important to remember the number of people that know at least 20 or 100 words of English. Simple statements can help at a lot of places, whereas I only know a single Chinese word. The number of people that can say basic numbers in English or very simple statements is much higher.
  - adrianN 9y ago

mbroncano 9y ago

It certainly seems the EU is becoming an actual land of the free

aneutron 9y ago
As was mentioned earlier, we should probably wait to see the individual states interpretations of such laws. It sounds too good to be true IMO.
aneutron 9y ago
As was mentioned earlier, we should probably wait to see the individual states interpretations of such laws. It sounds too good to be true IMO.
Buge 9y ago
Are they requiring all communication to use e2e encryption? That seems like a restriction on freedom. What if I want to use some other protocol?
- drdaeman 9y ago
  This comment has a point. I'm all for a secure E2E for all private communications, but not through prohibitions encoded into laws. Unless it's wartime or similar kind of emergency, it's best to never let the government of any kind to be in control of what[1] you can create (and share with others) and what you can't. No matter how benevolent current one looks like, such capability will be abused by the next one. Better have a constitution-level protection that no government can dictate what technology you must or must not use. Not to say that it's not uncommon for legislatures to be quite awkward when trying to describe technology. And stay up-to-date with possible future breakthroughs. In my opinion, if someone has an idea (and implementation) of something amazing that won't be E2E, it doesn't make any sense to ban that. Label as "doesn't provide end-to-end security"? Okay, I'm not fan of this stuff, but knowledge gap is significant, so that may be well-justified. Prohibit advertising as "100% secure"? Sure, as long as that's not one-time pads stuff, that's most likely misleading advertising claims worth investigation. But banning the software or the service? That's nuts. And it impedes on freedom to create things. ___ [1] Okay, as long as that's not a nuke. Obvious exceptions apply. (Cryptography is not munitions or a hazardous material, right?)

glasz 9y ago

don't let yourselves be fooled, fools. if this takes any real form, it'll be gutted and ripped apart until there's nothing of essence left because it would mean the following ingenius legislation be repealed. and. that. will. never. happen. https://en.m.wikipedia.org/wiki/Telecommunications_data_retention#European_Union https://en.m.wikipedia.org/wiki/Telecommunications_data_rete... https://en.m.wikipedia.org/wiki/Passenger_name_record https://en.m.wikipedia.org/wiki/Passenger_name_record

Tyrannosaur 9y ago
I often take a pessimistic view to such good-looking things too. But taking a look at your first link, it appears to already not be in force anymore? For the same reasons that the new recommendation is being drafted- government surveillance violates fundamental rights to privacy. "On 8 April 2014, the Court of Justice of the European Union declared the Directive 2006/24/EC invalid for violating fundamental rights. The Council's Legal Services have been reported to have stated in closed session that paragraph 59 of the European Court of Justice's ruling "suggests that general and blanket data retention is no longer possible".[15] A legal opinion funded by the Greens/EFA Group in the European Parliament finds that the blanket retention data of unsuspicious persons generally violates the EU Charter of Fundamental Rights, both in regard to national telecommunications data retention laws and to similar EU data retention schemes (PNR, TFTP, TFTS, LEA access to EES, Eurodac, VIS)."
yorwba 9y ago
Page 30: > When the processing of electronic communications data by providers of electronic communications services falls within its scope, this Regulation is without prejudice to the possibility for the Union or Member States under specific conditions to restrict by law certain obligations and rights set out in this Regulation when such a restriction is targeted at persons suspected of having committed a criminal offence and constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests, including national security, defence, public security and the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Therefore, this Regulation should not affect the ability of Member States to carry out lawful interception of electronic communications or take other measures, if necessary and proportionate to safeguard the public interests mentioned above, in accordance with the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of the European Union and of the European Court of Human Rights. This is not about preventing state surveillance, this is about regulating non-state actors' ability e.g. to track users without their consent. Edit: However, on page 74 > The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services. It seems to me that this requires end-to-end encryption, but the regulation is scoped in such a way that the requirement may be lifted when it inconveniences law enforcement.

skrebbel 9y ago

Any tldr? I have a very hard time getting through this, but as the founder of a Europe-based messaging company (https://talkjs.com https://talkjs.com), I wonder whether this is trouble. En-to-end encryption is great but it also kills quite a number of use cases. For example, our group conversations couldn't be e2e encrypted because then users can't see the message history from before they joined it. In whatsapp this is indeed the case, but for our platform it is a core feature. Same for Slack, I suppose. Similarly, Slack search would be totally out of the door. (unless, again, you make it only search the stuff sent to you)

HappyTypist 9y ago
"The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services" I interpret this as the following clauses: * "sufficient protection in place against unauthorised access or alterations" [through] * "guaranteed by the nature of the means of transmission used " * "OR" * "state-of-the-art end-to-end encryption of the electronic communications data" aka: - HTTPS, non-ETE: fine - HTTP, non-ETE: not fine - HTTP, ETE: fine
c22 9y ago
Couldn't group chats be encrypted with a shared key that is provided to the new user by whoever invites them to the chat? The messages would still be encrypted and decrypted only at the ends.
- doctorless 9y ago
  What about removing a user from chat? What if the shared key is leaked? How do you deliver the key to the new user? Who provisions new keys if a shared key is leaked? There are a variety of problems (all solvable/already solved, yes) with the shared secret strategy, and addressing them costs money and time.

infodroid 9y ago

Please append [pdf] to the title.