8 ms·

So in short: * EARN IT creates a committee that is set out to define "best practices" for preventing child sex abuse. * Companies that don't adhere to these b

So in short: * EARN IT creates a committee that is set out to define "best practices" for preventing child sex abuse. * Companies that don't adhere to these best practices lose liability protections for user-generated content. * The attorney general can unilaterally edit these best practices as he sees fit. * The current attorney general has repeatedly made statements that he wishes to eliminate the ability for companies to offer end-to-end encryption - he wants all communications to be vulnerable to wiretapping. This effectively gives the attorney general the power to compel tech companies to do whatever he wants (so long as he can argue that it's preventing sex abuse) by threatening to revoke section 230 protections, and it's likely that this would be used to revoke protections from companies that offer end to end encryption.

diroussel 7y ago
So what will happen? Facebook will lose ability to deploy encryption and move servers overseas? Unlikely to affect non US internet users, unless my phone suddenly looses ability to use encryption.
- diroussel 7y ago
  Sorry if this seemed flippant. Of course there will be massive impact. But I was asking people if they though they knew what the impact will be? Will it only affect social platforms that need moderation?
henryfjordan 7y ago
The article does mention that companies could argue they took "reasonable steps" if they refuse to follow the best practices. If they choose that route and win whatever court battle that follows, it'd essentially neuter this law. So there would at least a way out but it's risky.
- londons_explore 7y ago
  Lets think of what "reasonable steps" a service provider of encrypted messaging could take to prevent child porn on their service... * They could put up a big message saying 'no child porn'. I don't think that would be considered sufficient by a court. * They could put a 'report' button. Again - insufficient. * They could make client-side automated content scanners. Might be accepted by a court, but if you provide the scanner to the user, the government could argue it is easy to make images which bypass the scanner, which it would be. * They could break encryption on some percentage of chats. A court would likely be looking at a particular case, and would consider the service provider not to have done their duty if the particular case at hand hadn't been checked. I don't really see any reasonable steps which would stand up, other than breaking e2e and doing server-side scanning.
  - henryfjordan 7y ago
    The proposed law (according to the article) requires the committee coming up with the rules to consider user privacy (not that they have to actually do that), but that gives a platform some cover to argue that breaking end-to-end encryption is not reasonable and that the report button will have to suffice.
    - tenpaiyomi 7y ago
      That would be fine, if not for the fact that the committees rules can be completely overridden as desired, essentially making the committee nothing more than a public appeasement piece.
- cft 7y ago
  Do you know how much such an "argument" would cost? Forget all the small forums, 4chan, Mastodon instances after this law. Maybe forget even Tor then, because by running a node at home or in your small business you are not adhering to the "best practices"
  - henryfjordan 7y ago
    It would only take 1 platform with deep pockets to set a precedent for everyone
    - jachee 7y ago
      Say iMessage, for example?
  - deleted 7y ago
    [deleted]
JeremyNT 7y ago
Would such a thing have a positive side effect of effectively encouraging decentralized end-to-end encrypted technologies?
- eugeniub 7y ago
  People almost never deliberately use end-to-end encryption. They use it by accident when centralized services they already use like WhatsApp and iMessage implement it.
  - hnuser123456 7y ago
    For the layperson (not trying to be insulting, just honest), sure. For hn readers, it's probably more appealing. I find the parent comment more insulting than stating there is in fact a group of good people out there who value and seek privacy. Interesting that people are taking issue with my comment instead.
    - outworlder 7y ago
      Elitist connotations aside, the fact that you want to use encryption is irrelevant if noone else is using. Are you going to talk to yourself, or only with a close-knit group?
      - hnuser123456 7y ago
        I'm a member of several group chats on keybase which I use daily... Who is elitist here exactly? Sure I also have several friends who I talk to not on keybase. As soon as there's a service that's easier to setup, more reliable, and supports voice, I'll push it on all my friends. Also, the keybase app on desktop runs 8+ processes, chewing more than 1gb of ram and several gb of storage, and the phone app is using about 1gb of storage too. I very begrudgingly endure this because it's the only service I trust so far, along with my friends who also value e2ee. Really not sure what makes you adopt your attitude, can you explain? Do you think e2ee is not a worthy pursuit, or are you just being cynical? I didn't intend "commoner" to be as insulting as people here seem to be reading it. Not everyone understands e2ee yet. I'd like to change that but it's the current reality.
hanniabu 7y ago
The continued subversion of our democracy
- Greg_Adams 7y ago
  Perhaps you wish to do something about it ? https://tails.boum.org/donate/?r=sidebar https://tails.boum.org/donate/?r=sidebar https://supporters.eff.org/donate/join-eff-4 https://supporters.eff.org/donate/join-eff-4 https://donate.torproject.org/ https://donate.torproject.org/ https://riseuplabs.org/ https://riseuplabs.org/ https://donate.mozilla.org https://donate.mozilla.org
panny 7y ago
>Companies that don't adhere to these best practices lose liability protections for user-generated content. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ >we’d be unlikely to ever federate with clients and servers we don’t control This didn't age well.
nine_k 7y ago
This is a perfect case against centralized messaging: no company = no liability. Sorry, moxie; there's going to be no way to have a beautiful e2e encrypted IM еxperience under wise oversight of a single company; only ugly p2p hodgepodge without a legal SPOF has a chance to pull it off.
- api 7y ago
  If it has poor UX nobody will use it and people will use unencrypted centralized messaging instead.
  - deleted 7y ago
    [deleted]
- elchupanebre 7y ago
  It doesn't have to be p2p. It just needs to be sufficiently decentralized, like email. If a company provides software but not a service then it's not liable under the new ruling. You can also run it outside of US jurisdiction. For example, use something like https://github.com/tinode/chat https://github.com/tinode/chat to set your own chat service. Sure, they may try to go after a myriad of individual operators but it's a completely different story that forcing half a dozen US companies to drop e2e encryption.
- matheusmoreira 7y ago
  We still need to replace the ultimate centralized industry: internet service providers. The telecommunications industry has always cooperated with the government and they can be ordered to block the "dangerous" messaging services. We need to somehow replace ISPs with a world-wide mesh network that can't be censored no matter how much governments want to.
  - codegrappler 7y ago
    How do you loop in the rural areas?
  - clarry 7y ago
LeftHandPath 7y ago
Reminds me of a lot of the ire that I had for GDPR when I first read it (vague wording, general legislative over-reach, potential for arbitrary enforcement, and shoving it all through due to popular consumer sentiments that aren't necessarily directly related). And like GDPR, it will hurt innovation, although that detriment is difficult to measure.
- Mirioron 7y ago
  At least GDPR is trying to improve privacy and the rules aren't arbitrarily made up by unelected officials.
  - strken 7y ago
    I don't think the European Parliament or the European Commission are elected by the general public, I'm pretty sure the EP is selected by governments and the EC is voted on by the EP.
    - nl 7y ago
      The European Parliament has been directly elected since 1979. https://en.wikipedia.org/wiki/European_Parliament#Elected_Parliament https://en.wikipedia.org/wiki/European_Parliament#Elected_Pa...
jejei992o 7y ago
Waiting for this forum to get to its norm of ignoring politics, as if remaining ignorant of the scheming of the social class with a monopoly on violence is ever a bright idea.

diroussel 7y ago

So what will happen? Facebook will lose ability to deploy encryption and move servers overseas? Unlikely to affect non US internet users, unless my phone suddenly looses ability to use encryption.

diroussel 7y ago
Sorry if this seemed flippant. Of course there will be massive impact. But I was asking people if they though they knew what the impact will be? Will it only affect social platforms that need moderation?

henryfjordan 7y ago

The article does mention that companies could argue they took "reasonable steps" if they refuse to follow the best practices. If they choose that route and win whatever court battle that follows, it'd essentially neuter this law. So there would at least a way out but it's risky.

londons_explore 7y ago
Lets think of what "reasonable steps" a service provider of encrypted messaging could take to prevent child porn on their service... * They could put up a big message saying 'no child porn'. I don't think that would be considered sufficient by a court. * They could put a 'report' button. Again - insufficient. * They could make client-side automated content scanners. Might be accepted by a court, but if you provide the scanner to the user, the government could argue it is easy to make images which bypass the scanner, which it would be. * They could break encryption on some percentage of chats. A court would likely be looking at a particular case, and would consider the service provider not to have done their duty if the particular case at hand hadn't been checked. I don't really see any reasonable steps which would stand up, other than breaking e2e and doing server-side scanning.
- henryfjordan 7y ago
  The proposed law (according to the article) requires the committee coming up with the rules to consider user privacy (not that they have to actually do that), but that gives a platform some cover to argue that breaking end-to-end encryption is not reasonable and that the report button will have to suffice.
  - tenpaiyomi 7y ago
    That would be fine, if not for the fact that the committees rules can be completely overridden as desired, essentially making the committee nothing more than a public appeasement piece.
cft 7y ago
Do you know how much such an "argument" would cost? Forget all the small forums, 4chan, Mastodon instances after this law. Maybe forget even Tor then, because by running a node at home or in your small business you are not adhering to the "best practices"
- henryfjordan 7y ago
  It would only take 1 platform with deep pockets to set a precedent for everyone
  - jachee 7y ago
    Say iMessage, for example?
- deleted 7y ago
  [deleted]

JeremyNT 7y ago

Would such a thing have a positive side effect of effectively encouraging decentralized end-to-end encrypted technologies?

eugeniub 7y ago
People almost never deliberately use end-to-end encryption. They use it by accident when centralized services they already use like WhatsApp and iMessage implement it.
- hnuser123456 7y ago
  For the layperson (not trying to be insulting, just honest), sure. For hn readers, it's probably more appealing. I find the parent comment more insulting than stating there is in fact a group of good people out there who value and seek privacy. Interesting that people are taking issue with my comment instead.
  - outworlder 7y ago
    Elitist connotations aside, the fact that you want to use encryption is irrelevant if noone else is using. Are you going to talk to yourself, or only with a close-knit group?
    - hnuser123456 7y ago
      I'm a member of several group chats on keybase which I use daily... Who is elitist here exactly? Sure I also have several friends who I talk to not on keybase. As soon as there's a service that's easier to setup, more reliable, and supports voice, I'll push it on all my friends. Also, the keybase app on desktop runs 8+ processes, chewing more than 1gb of ram and several gb of storage, and the phone app is using about 1gb of storage too. I very begrudgingly endure this because it's the only service I trust so far, along with my friends who also value e2ee. Really not sure what makes you adopt your attitude, can you explain? Do you think e2ee is not a worthy pursuit, or are you just being cynical? I didn't intend "commoner" to be as insulting as people here seem to be reading it. Not everyone understands e2ee yet. I'd like to change that but it's the current reality.

hanniabu 7y ago

The continued subversion of our democracy

Greg_Adams 7y ago
Perhaps you wish to do something about it ? https://tails.boum.org/donate/?r=sidebar https://tails.boum.org/donate/?r=sidebar https://supporters.eff.org/donate/join-eff-4 https://supporters.eff.org/donate/join-eff-4 https://donate.torproject.org/ https://donate.torproject.org/ https://riseuplabs.org/ https://riseuplabs.org/ https://donate.mozilla.org https://donate.mozilla.org

panny 7y ago

>Companies that don't adhere to these best practices lose liability protections for user-generated content. https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/ >we’d be unlikely to ever federate with clients and servers we don’t control This didn't age well.

nine_k 7y ago

This is a perfect case against centralized messaging: no company = no liability. Sorry, moxie; there's going to be no way to have a beautiful e2e encrypted IM еxperience under wise oversight of a single company; only ugly p2p hodgepodge without a legal SPOF has a chance to pull it off.

api 7y ago
If it has poor UX nobody will use it and people will use unencrypted centralized messaging instead.
- deleted 7y ago
  [deleted]
elchupanebre 7y ago
It doesn't have to be p2p. It just needs to be sufficiently decentralized, like email. If a company provides software but not a service then it's not liable under the new ruling. You can also run it outside of US jurisdiction. For example, use something like https://github.com/tinode/chat https://github.com/tinode/chat to set your own chat service. Sure, they may try to go after a myriad of individual operators but it's a completely different story that forcing half a dozen US companies to drop e2e encryption.
matheusmoreira 7y ago
We still need to replace the ultimate centralized industry: internet service providers. The telecommunications industry has always cooperated with the government and they can be ordered to block the "dangerous" messaging services. We need to somehow replace ISPs with a world-wide mesh network that can't be censored no matter how much governments want to.
- codegrappler 7y ago
  How do you loop in the rural areas?
- clarry 7y ago

LeftHandPath 7y ago

Reminds me of a lot of the ire that I had for GDPR when I first read it (vague wording, general legislative over-reach, potential for arbitrary enforcement, and shoving it all through due to popular consumer sentiments that aren't necessarily directly related). And like GDPR, it will hurt innovation, although that detriment is difficult to measure.

Mirioron 7y ago
At least GDPR is trying to improve privacy and the rules aren't arbitrarily made up by unelected officials.
- strken 7y ago
  I don't think the European Parliament or the European Commission are elected by the general public, I'm pretty sure the EP is selected by governments and the EC is voted on by the EP.
  - nl 7y ago
    The European Parliament has been directly elected since 1979. https://en.wikipedia.org/wiki/European_Parliament#Elected_Parliament https://en.wikipedia.org/wiki/European_Parliament#Elected_Pa...

jejei992o 7y ago

Waiting for this forum to get to its norm of ignoring politics, as if remaining ignorant of the scheming of the social class with a monopoly on violence is ever a bright idea.