17 ms·
Euro MPs back end-to-end encryption for all citizens
- pulse7 9y agoMaybe they are just testing the ground... It sounds "too good to be true"... although I would like to live in such legislation...
- iDemonix 9y agoIs it too late to vote remain?
- petre 9y agoYou can always move and apply for residence in an EU country of your choice.
- setq 9y agoThis is actually my exit plan at the moment.
- jagermo 9y agoDon't you mean your Brexit plan? I'll show myself out...
- ue_ 9y agoIt's unfortunate that various European countries have similar limitations on our freedom of expression and their attitude toward privacy isn't that much better.
- setq 9y agoI have a spreadsheet going - there are a few serious options available still. I will publish it on here at some point.
- wohlergehen 9y agoWould you mind sharing that? That would be super useful to me as well.
- setq 9y agoI will share it in a couple of weeks if I get some time to finish it. It aggregates a lot of info from climate, financial market status, things of cultural interest, native languages, recruitment etc.
- mcintyre1994 9y agoI'd be interested to see this too! :)
- secfirstmd 9y agoYou voted Leave in the first place?
- gmac 9y agoIf so, please write to your MP saying you've changed your mind! https://www.theyworkforyou.com/ https://www.theyworkforyou.com/
- headmelted 9y agoThanks for posting this, it's my first time seeing it. What a flipping brilliant idea.
- iDemonix 9y agoWhat a nifty site, bookmarked!
- amelius 9y agoBut how are companies like Google and Facebook going to mine the data then? Or are they mostly interested in the metadata anyway?
- Piskvorrr 9y agoNo worries. If you're one of the endpoints and people shovel their data to you willingly, this does not concern you. (BTW your comms with the abovementioned are already end-to-end encrypted)
- ENGNR 9y agoI think this is for private communication only. When you're asking Google for things they're then party to that communication, and presumably web pages colluding to build profiles of you would be under different legislation again The fuzzy area is probably semi-private things like Facebook, or private forums vs group chats
- return0 9y ago"Download facebook for your PC . Gives you 100 new emojis and better advertising for your unique personality"
- r3bl 9y agoTo be honest, Facebook is the owner of WhatsApp (Signal's end-to-end encryption) and they've incorporated end-to-end encryption in their core product too (Messenger's "secret conversations"), albeit not by default. If I didn't know any better, I would say that Facebook did make a line between private and mining data, but there are countless examples beating that theory: their experiments with crashing the apps, showing only sad news, mining data from messages, WhatsApp and Messenger making web requests as you're typing the URL...
- amelius 9y agoFacebook has not finished integrating WhatsApp yet. Right now they have both Messenger and WhatsApp, which is confusing. I guess we'll see what happens to privacy once Facebook has made up their mind about the exact business model.
- stanislavb 9y agoYeah, and now many UK citizens will regret leaving the EU even more...
- fredley 9y agoMost UK HN readers yes, most UK citizens wouldn't have a clue though, sadly. I imagine the prevailing attitude is that encryption (i.e. messages that the police cannot read) allow terrorists to plot things in secret. In a month with three terrorist attacks, it's easy political capital to clamp down on such things.
- hasenj 9y agoI won't be surprised if many (in the leave camp) will construe this as the EU sabotaging the security of its member countries.
- doc_holliday 9y agoAs much as I wish they did, I am not sure they will. A large portion of the UK has no idea how encryption helps them and believe that criminals and terrorists should "have nowehere to hide".
- fredley 9y agoIf there's one thing that stops criminals and terrorists, it's making the things they do illegal!
- forgottenacc57 9y agoSame as drugs. Making them illegal really sorted things out and now no-one takes drugs and there's no more criminal activity because people fear the outcomes of breaking the law.
- nailer 9y agoAgreed, smart criminals will just use private channels. But what about dumb criminals? From what I read both the London Bridge attackers and Manchester bomber are dumb as dogs__t. They'd probably use whatsapp even if it wasn't private simply because it's popular. (I support private communication, and think not being able to catch some criminals is a reasonable price, but many others do not)
- forgottenacc57 9y agoWhy is it that European governments seem to act in the interests of their citizens and just about all other governments default policy positions is to act against the interests of the citizens?
- secfirstmd 9y agoParliamentary systems in general are more responsive than Presidential ones. Also, most of us EU nationals don't see EU structures as very democratically responsive. Fairly sure most of us only send the B Team to the EU parliament. E.g retired national politicians, or people who couldn't get elected for national parliaments. Also, it gets a lot less coverage than national parliaments, so members are free to vote on random things without the same amount of scrutiny.
- forgottenacc57 9y agoOther countries primary concern is to give big business and the rich anything they want.
- jopsen 9y agoYeah, the EU works surprisingly well... I mean given how little attention it gets the EU institutions makes a lot of good calls. Granted, it would likely change it more controversial topics was handled by EU.
- krylon 9y agoOTOH, sometimes national governments will try establish policies at the EU level that they know will be unpopular at home, so can face their voters and claim they don't really want this, but look, that evil EU makes us. That was how the data retention laws were established before the European Court of Justice decided that it was illegal/unconstitutional (unsure what term to use here).
- NetStrikeForce 9y ago> most of us EU nationals don't see EU structures as very democratically responsive. Whilst I got the same feeling, this really needs to be backed up by data. Do you know any reliable polls about it?
- hacksonx 9y agoWhat do laws like these for partner but not member states to the EU like Turkey mean?
- jacquesm 9y agoTurkey will never be part of the EU proper. 'Never' as in: not in a couple of life times. Turkey has been given the runaround for the last 30 years or so not because there ever was a serious push to integrate them into the EU but because of the fear that Turkey would align with Russia. So Turkey is as much out of the EU as they ever were and the EU laws will not influence Turkey, especially not laws that would make it harder for Erdogan and his cabal to repress the intelligentsia of Turkey.
- mercurial 9y ago> Turkey will never be part of the EU proper. 'Never' as in: not in a couple of life times. Turkey has been given the runaround for the last 30 years or so not because there ever was a serious push to integrate them into the EU but because of the fear that Turkey would align with Russia. Yeah, even with a secular democratic party in power they would not have a chance (a 80 million people country, mostly Muslim, at the time where there is an islamist terrorist attack every month in Europe? Never mind the number of terrorists with a Turkish background, nobody would agree to that, and that's not even talking about its own stability problem and the neighbours Europe would acquire). With a proto-islamic dictator like Erdogan, forget about it.
- devuo 9y agoNothing, these would only apply as law to member states. Since December 13 2016, accession talks have been stopped and from the last interview to Erdogan that I've heard on an European TV, it was clear he no longer believes Turkey will ever be a part of EU, given the way that most member states populations and leadership look at Turkey (notwithstanding his presidency) and the difficulties that have been raised constantly throughout the whole accession process that started in 1987. Recent EU wide survey: https://www.theguardian.com/world/2017/jun/20/two-thirds-europeans-believe-eu-hard-line-brexit-poll https://www.theguardian.com/world/2017/jun/20/two-thirds-eur... > The survey found there was strong opposition to Turkey joining the EU, with 61% of people saying they opposed it. This was most strongly expressed in Austria (82%), Germany, France and Belgium (all 73%).
- r3bl 9y agoHere's a quote from the draft that I particularly like: > The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services.
- josteink 9y ago> Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services. If I'm going to play devil's advocate, this sounds like a European DMCA in the sense that it will prohibit removal of DRM, and tools which assist such removal.
- dannyobrien 9y agoThere's already a European DMCA -- the Copyright Directive, which was introduced in 2001. See https://en.wikipedia.org/wiki/Copyright_Directive#Technological_protection_measures https://en.wikipedia.org/wiki/Copyright_Directive#Technologi...
- shubb 9y agoI worry how that wording will work for security researchers exposing badly implemented roll your own encryption systems. Or opensource client applications for proprietary messaging systems, though those get rarer these days.
- marcus_holmes 9y ago
- another-dave 9y agoThis is welcome, but moves like this will only make a difference if the legislation has teeth — will there be some ombudsman that I can appeal to, who will investigate that a firm is using encryption (correctly), and issue a hefty fine for breaches? Or will it turn out like the cookie legislation: potentially good in theory — that you should have an opt out to non-essential tracking cookies — but because of vague hand-waving around implicit opt-ins and not forcing firms to distinguish between essential & non-essential cookies, means the only outcome is an annoying banner on every website and no real effect on end-user privacy.
- EwanToo 9y agoThis is just a proposal, from the European Parliament's Committee on Civil Liberties, Justice, and Home Affairs. It's not a law, and (unfortunately) I can't imagine the proposal will get passed in it's current form.
- uhnuhnuhn 9y agoAgreed. As the article states, this would have to be approved by the European Council, i.e. all EU heads of state. They may not have such a positive view of encryption and privacy.
- mpeg 9y agoThe UK will never approve that, so that's at least 2 years before it can even pass let alone be implemented.
- mike-cardwell 9y agoSo end to end encryption of email within the EU is going to become common? Facebook messages? Sure. Is there anybody here who actually believes that 1, this will happen, and 2, will be effective?
- devuo 9y ago1. I'm not so sure. Due to the threat of terrorism and tax fraud Governments would most probably not want, National Parliaments — if not controlled by a governmental majority — however most probably would, as this would help paint the acting government in a negative '1984' like light. 2. Massive fines would hopefully act as a deterrent.
- thrillgore 9y agoIt must be nice to live in a country where the politicians care about the public.
- fivestar 9y agoI bave a hard time squaring that statement with the absolute mayhem being caused to the European public via the immigration policies.
- IsaacL 9y ago"End-to-end encryption means the company providing the service does not have access to the key, meaning it cannot "listen in" to what is being shared - giving the sender and recipient added confidence in the privacy of their conversation. "The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, email, internet phone calls and personal messaging provided through social media," said a draft proposal from the European Parliament's Committee on Civil Liberties, Justice, and Home Affairs." How would this work in practice? Would any web service that includes a private messaging feature need to ensure it is end-to-end encrypted? Would there be fines or penalties for startups that included an unencrypted messaging feature in their product?
- nvarsj 9y agoThe same as any other similar legislation, like requiring cookies notification on every website, or the data protection requirements.
- kuschku 9y agoEvery site with the cookie notification violates the original cookie regulation. The original regulation is clear, you only need to ask the user if you want to track them, no matter how, but they have to be able to opt out of tracking. - Login cookies? No notification required. - Tracking via fingerprinting? You need to ask. - User says no to the tracking? You have to allow them to continue using your service. It’s pure bullshit what most sites do, based on the UK interpretation of the cookie law. Luckily, that’s gone soon (both due to the EU GDPR, and due to Brexit)
- IsaacL 9y agoBut implementing end-to-end encryption is much harder than adding a cookie notification. https://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ https://www.howtogeek.com/166507/why-most-web-services-dont-... There's a few startups working on platforms to make adding E2E encryption easier, but I doubt the EU is planning to mandate everyone use their services. The plan sounds nice from a distance (who in tech is anti-encryption?) but closer inspection reveals problems. All legislation can do is ban certain activities. You want to release a new dating app, or add a basic messaging feature to your Q&A site, and you're not a crypto expert with 3 months to spend adding E2E encryption? Should it be illegal for you to release your app without encryption?
- narrator 9y agoHere's some irony for you: a significant result of Brexit is that the U.K will have a censored, tightly monitored Internet without encryption and Europe will have data privacy and end-to-end encryption. The pro-freedom crowd will benefit, but in the opposite way of what they were expecting: the control freak British government is removed from EU politics. Nigel Farage is going to be really confused.
- Markoff 9y agodon't forget roaming fees
- rsynnott 9y agoOh, Nigel Farage never cared about any of that freedom stuff. He's fairly transparently using it as respectable cover for ethno-nationalism.
- fivestar 9y agoI disagree with that statement--it is abundantly clear that the desire was for self-determination and not meddling by some unelected body which is not what the Brits signed up for with the EU, or at least not how it was sold to the public. Get your MI5&6 under control, the way the US needs to get its IC back under control, and the crypto problem solves itself.
- pbhjpbhj 9y agoHow does that fit with having a family with an Irish wife, and later a German wife. That would appear to limit the ethnicity to "European", which doesn't fit well with his anti-European actions. He comes across in the press, to me, as an English imperialist.
- bjelkeman-again 9y agoTo me there is no logic to it. Just someone who wants to be breaking down rather than building up. Building is a lot harder.
- 9y ago
- moontear 9y agoSerious question: If we had perfect encryption on all devices and no government would be able to listen in on anything (spoken conversation, mails, whatever) we would be pretty much back to where we were a couple of decades ago. I suppose the government would need to employee more real people to monitor other real people. Is there any way we could have encryption / security with a state actor still being able to decrypt the data if needed? I'm not saying that I personally am for the state actor, but I'm just imagining a scenario where all communications of bad actors would be via encrypted channels. No possibility to gather chatter, no possibility for rumors, everything encrypted and hidden. I mean this is the scenario state actors are afraid of, and frankly I would be too. How would we live in a world with perfect encryption? More anonymous, sure. But safer? I'm really trying to see "the other side" (state) right now. Help me out and tell me how we can have perfect encryption, but don't undermine security / possibility of investigation.
- Cthulhu_ 9y ago> Is there any way we could have encryption / security with a state actor still being able to decrypt the data if needed? There are, and there have been, they're called back doors and they are a bad idea, because you cannot guarantee a state actor having sole access - if there is any way to get to data besides the main gateway (e.g. having a private key), it's insecure and potentially hackable by people that are not said state actor. Even if it's fully secure, there's still the risk of human failure - leaks, espionage, accidents. Then all your data would be up for grabs.
- rsynnott 9y agoThere's also a question of how much you trust the government, and trust all future possible governments.
- hackpert 9y agoSure, it is actually quite easy to design systems that allow only the state or the government (or any given trusted organizayion for that matter) to decrypt secure communications. However, the problem is, can we trust the governments to not use this for malicious purposes, or to not somehow leak their credentials to others? What if some bad actor infiltrates the government and gets all access, or some rogue terrorist organization invades a country? As the Latin poet Juvenal said, "Quis custodiet ipsos custodes?" (Who will guard the guards?)
- conradk 9y agoEver since Brexit, I feel like the EU suddenly has plenty of good news for EU citizens (myself included, which makes me happy). No backdoors, free roaming and privacy law in 2018 most notably. Anything else I might have missed that EU is doing to improve itself for citizens lately ?
- CM30 9y agoPart of me wonders whether that's deliberate. They realised there was a growing discontent with the union, Brexit brought about the realisation that countries would want to leave and now the MEPs and EU government officials and what not have realised that making the EU a positive thing to be part of is crucial to its future success.
- pbhjpbhj 9y agoOr cynically these, or similar, things were already tabled and the UK elite felt that would give the demos too much power/freedom and so decided to nip it in the bud, retaining a greater share of the local (to the UK) power structure. It must be much easier for the plutocrats to procur the political positions they want in the UK when [liberal] European politicians can't intefere.
- k-mcgrady 9y agoWith the exception of this news the other things OP mentioned have been being worked on for several years. It's just that anytime this stuff is passed member states are given a couple of years to implement it. Completely unrelated to Brexit.
- fivestar 9y agoI hope you're right because it flies in the face of what every other government institution wants to do about crypto these days. What is it with the UK and their Orweillan nonsense? They need to get over the idea of backdoors that weaken crypto and just accept the fact that bad people do bad things--they seem to accept all the ISIS attacks in their country, so why not? As far as the US goes, we have strong crypto because the system by which citizens come to be dominated is broken, and not for any other reason.
- vectorEQ 9y agothis only apply to citizens.. they will just revoke this status from you and call you a criminal if it comes to it..
- Strom 9y agoUnlikely. For example the Estonian constitution explicitly forbids revoking citizenship obtained via birth. There may be ways to revoke some other rights like encryption, but my citizenship can't be lawfully removed, unless the constitution is changed, which is extremely unlikely.
- andreasgonewild 9y agoGuarantee this, prohibit that. Meanwhile, no one gives a crap since the state/EU/CIA, whatever you want to call them; have already proven beyond doubt where they stand on these issues. You either encrypt everything yourself or you're potentially in trouble. https://github.com/andreas-gone-wild/snackis https://github.com/andreas-gone-wild/snackis
- CyberThijs 9y agoAnother big recent achievement of the European Parliament is the "General Data Protection Regulation" (GDPR) [1], which comes into effect in May 2018 and stipulates that companies can be fined up to 4% of their worldwide turnover when they fail to protect/process the data of EU-based customers in a proper manner. For example: say that LinkedIn was to experience a new data breach, and they fail to inform the authorities or their customers in time, then they can be fined for up to 120 million USD (based on a revenue of 5 billion USD)! I'm surprised that it's so little known here, as the impact will be massive. [1] https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
- halflings 9y agoYep, and it does much more than that: it forces companies to actually wipeout your data when you ask them to (not just flip some bit and still keep that data, like facebook infamously does), and also set strict TTLs (Time To Live) for any derivative data that the user cannot explicitly delete.
- 3pt14159 9y agoHow do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?
- kough 9y agoYou ask your team of lawyers who can make a good decision for your company based on your business goals and the relative values of complying with each of the competing laws, along with the relative risks associated with failing to do so.
- harperlee 9y agoI would guess that one solution is to keep EU citizens' data in the EU to avoid it being subject to other laws. And possibly having separate companies by country. As an analogy, if I recall correctly banks have very stringent laws to follow regarding data export and money export to other countries. The solution they choose is to have a bank per country, not a global bank.
- Allower 9y agoWait, but they wont rule out back-doors... so that's NOT true end-to-end encryption..
- microcolonel 9y agoWhy enforced? Why can't they just let it be? Next they're going to tell you that you have to use their ciphers and protocols to be in compliance.
- hellbanner 9y agoContrast this to the UK (now out of the EU)'s approach to internet encryption: http://www.independent.co.uk/life-style/gadgets-and-tech/news/theresa-may-regulating-internet-anti-terror-measures-extremism-snoopers-charter-a7775566.html http://www.independent.co.uk/life-style/gadgets-and-tech/new...
- rf15 9y ago>now out of the EU You still have a little less than two years left! Until then you can step back any time you want from this silly idea.
- 0x0 9y agoI wish this forced Apple to move EU developer apps to an EU App Store and EU iTunesConnect, so that those won't have to deal with the US export classification nonsense anymore just for using the built-in HTTPS support in NSURLSession.
- iuguy 9y agoI for one will be glad when we free ourselves of the yoke of EU tyranny and can move Britain forward by banning crypto.</sarcasm> Seriously, my country's going backwards. Is there a way to reboot it and see if that fixes it?
- rf15 9y ago"I'm not saying that we need a revolution driven by the left, but..." :D
- iuguy 9y agoThe problem is that the left seem to be just as supportive of a hard brexit as the right. Labour have pledged to end free movement in their manifesto, which is one of the EU's fundamental four freedoms. le sigh
- bjelkeman-again 9y agoIt is sad to see. I get the impression that a lot of Brits have just resigned themselves to Brexit and kind of thinking "Just get it over with quick". I personally don't believe much good will come out of it.
- drdaeman 9y agoCareful with this stuff. It looks nice, but it may bite. The "states shall not impose any obligations" is a great thing, but "shall ensure that ... guaranteed ..." isn't so much. Your Parliament basically tells you how to write your software, and while this particular cause may be good[1] - the general concept isn't healthy. Granting governing bodies this level of control... that must require exceptional levels of trust in those bodies and all future ones that could be their successors. I'd argue that it's better to have the very contrary thing - a ruling that no governing body may ever dictate how one can secure their communications and how they can't (or, in more general terms - how one can write their software). Oh, and keep the "states shall not impose" clause, of course. Yes, that leaves data-miners with their messengers still vulnerable, but I think it's less important than a general non-interference principle. And I'm for having fines for calling non-E2E messengers "secure" if the wording may confuse user into thinking it's E2E - that's basically misadvertising. The issue is information gap and "clever" marketing - fix that and things will be good. _____ [1] It may be a problem for early prototypes, if they had started with UI/UX and a simple insecure "TCP socket server"-level stub for the messaging layer. Mandatory implementations are always a barrier.
- splintercell 9y agoBut isn't this the same issue with Net Neutrality regulations? We're asking the state to enforce net neutrality, but it opens a can of worms. Tomorrow it would be "all data should be treated equally, except for govt data which should be prioritized above all." "All data should be treated equally, except for terrorist data, which should be prioritized/blocked".
- burkaman 9y agoThis is true of any government at all. "We're asking them to arrest murderers, but what's next, arresting suspected communists?" Well, maybe, depends who you elect. Every government power can potentially be abused.
- drdaeman 9y agoIt is. And this is controversial statement but I'm really not sure how I feel about Net Neutrality. Where I'm from (Russia), we had (and still have, to a some extent) a lot of competition in ISP space. This had happened just because government weren't particularly looking at that direction at the time (90s and early 2000s). If one ISP did some weird stuff that upset customers, the market had actually worked and they lost profits, making them reconsider. This may sound weird, but that really was like that - "power" users were vocal, and word of mouth did spread fast. And absence of NN allowed ISPs to do things that were actually beneficial to the customers, like routing specific traffic differently so e.g. gaming would be smoother and files would download faster. Just because content customers meant good reputation - a stable userbase with steady growth. So I don't believe NN is a good idea if the market's right. It only makes sense if it's bad, with a few giant telcos and no competition. [Edit: ignore this paragraph, please. I'm keeping it, but indeed it's a long stretch.] When the government decided they're going to get a grip on the tubes, things immediately got worse. No NN here, though, just censorship - a great pile of unsound kludges with mandatory monitoring and automatic fines if something goes through. But NN here would've killed tiniest ISPs just as well. That's just how I see things. It very well could be that I'm mistaken here.
- megous 9y ago> Data subjects have a right to receive a copy of their personal data in a commonly used machine-readable format. Hopefully, this will work out better than the shit Facebook produces in its data export. While their HTML is technically machine-readable, the intention clearly was "here's your data, and fuck you for thinking of leaving, btw". Little to no metadata for the wall posts, for example, makes it almost useless.
- sctb 9y agoPrevious discussion: https://news.ycombinator.com/item?id=14577828 https://news.ycombinator.com/item?id=14577828.
- adam-fn 9y agoDo we need to have a discussion on so many of the media outlets, including ones which host pro-encryption / pro-user-privacy articles, either failing to provide SSL, providing SSL but the certificate is from their hosting provider or other affiliated company, or having it setup just to redirect users to their http endpoint with prejudice, as is the case here? $ curl -I https://www.bbc.com/news/technology-40326544 HTTP/1.1 301 Moved Permanently Content-Type: text/html Location: http://www.bbc.com/news/technology-40326544
- medalist 9y agoAnd once again, Britain is going a different, worse, direction on its own.