12 ms·

Indiscriminate messaging and chatcontrol: Last chance to protest

237 points by ColinWright 5y ago

skocznymroczny 5y ago
It's hard to organize protests for free speech. If you ask people if people should be free to express their opinions, most people would agree. But then, if you ask people if it should be possible to block content doubting the scale of pandemic or efficiency of the vaccines, most people would also agree.
- hvis 5y ago
  This article is about private communication, however. And that one does not necessarily contradict current pandemic measures. Most of the harm of content with anti-vaccination stuff or whatever comes when it becomes publicly available. We could still have private communications but block (or annotate with "see COVID Center with actual science") those conspiracy videos when they get posted on public feeds, such as youtube, instagram or whatever. Until the pandemic subsides, that is.
mvdwoord 5y ago
How worrisome is this? And what can a normal person do while maintaining normal communications (to a degree) with people they love but who do not (seem to) care about this stuff?
- ramtatatam 5y ago
  My observation is that, sadly, "Normal person" probably does not care... For a long time I try to self-host communication channels that matter to me, that is at least email and communicators. That means support burden, since my family is not technical. Not easy but worth it..
- merlinscholz 5y ago
  Switch to email providers outside the EU like Protonmail, but I fear you are right. The main problem of this is that both sides of a given communication have to be outside the EU for this to work.
  - natch 5y ago
    >The main problem of this What is “this” — the EU parliament proposal? Or your workaround? Why would both have to be outside the EU?
    - avh02 5y ago
      > Why would both have to be outside the EU? Because email/chat is rarely a monologue
      - natch 5y ago
        Obviously, but that misses the essence of the question.
        tekknik 5y ago
        > What is “this” — the EU parliament proposal? Or your workaround? The workaround. > Why would both have to be outside the EU? Because if one party is within the EU then the contents of the message will be scanned even if one party is outside of the EU.
        natch 5y ago
        You should read up on Google’s “associated country.” I think these politicians will take any excuse they can get, and not limit themselves to people who are physically within the borders of EU countries.
        natch 5y ago
        Isn’t Protonmail based in Russia? Good luck getting them to comply.
- vaylian 5y ago
  > And what can a normal person do Prevent this law from passing. Call your MEP.
hyperdunc 5y ago
> Through a second piece of legislation to be proposed soon, the EU Commission intends to oblige all providers of chat, messaging and e-mail services to deploy this mass surveillance technology. So they're going to require Signal to break their E2E encryption if the app is to remain legal and readily available? Wow. Regardless of what intentions the EU bureaucrats have, there's no way these requirements won't be abused. Imagine what insights could be gained from applying a little ML to the real-time chat of an entire continent. Who would you trust to have access to data like that?
woudsma 5y ago
> Securely encrypted communication is at risk. Up to now, encrypted messages cannot be searched by the algorithms. To change that back doors would need to be built in to messaging software. As soon as that happens, this security loophole can be exploited by anyone with the technical means needed, for example by foreign intelligence services and criminals. Private communications, business secrets and sensitive government information would be exposed. Secure encryption is needed to protect minorities, LGBTQI people, democratic activists, journalists, etc. So if I understand correctly, this will be the end of E2E encryption? That would probably be the stupidest decision of the century. Governments are always lagging behind in terms of 'cyber' security, so my guess is that it will only be a matter of time before we can expect data leaks from widely used private chat services.
- Tepix 5y ago
  No. It will mean that criminals can protect their communications better than law-abiding citizens.
  - woudsma 5y ago
    That's the weakest of arguments. I don't trust that governments _can_ protect my data better than us nerds. If there is a backdoor, it will only be a matter of time before the criminals get access to it. It would be the holy grail of data. If I were a foreign regime with bad intentions, I would put a lot of resources into getting access to those chats. You could probably ruin anybody's life with access to their personal chats by extorting them, etc. It's going to create a whole new criminal sector. People sifting through other people's personal lives. I'm not implying that these people may have committed an offence, there are many things I don't want anyone else to see other than the person I'm sending the message to. The "law-abiding citizen" / "Only criminals have something to hide" argument is complete bullshit. With access to personal chats you can ruin careers, families, relationships, etc, etc. And what can happen, will -most likely- happen. E2EE prevents that. Edit: Sorry, I misread the parent comment!
    - tortasaur 5y ago
mpfundstein 5y ago
another great thing the EU is doing for us... wonderful! The bureacracy appartus works perfectly well, far away from any accountability. Its the perfect system actually. Let everyone fight their local nationwide politics and in the meanwhile implement those life changing things from an appartus far away.
- 411111111111111 5y ago
  Dumb legislature is not unique to the EU, blaming them specifically is misguided. Please use arguments that arent fundamentally based on biases. There is definitely value in a European government, even if the way it's currently setup is very questionable, as the citizens have no realistic way to influence decisions on that level.
  - nickpp 5y ago
    The EU is special when it comes to high-tech though. Just try to browse the web normally from inside any EU country to see how much they managed to f-up the Internet.
    - Kbelicius 5y ago
      I browse the web all day, every day from within the EU and I don't know what you are talking about.
      - nickpp 5y ago
        Never noticed that huge cookie popup smack in the middle of every single damn new website you visit huh?! Lucky you...
        Kbelicius 5y ago
        Yea, I see those but only the first time I visit a website. Lucky you... thinking that a notice that a web page is storing data on your computer is fuckig up the internet.
donkarma 5y ago
What the fuck is wrong with governments?
- okamiueru 5y ago
  Things like these tends to be backed by pressure from the US. It would surprise me if it wasn't the case here.
- dijit 5y ago
  If you really want to converse with governments then it helps to steelman their position before arguing it. Bear in mind I am against weakening cryptography when reading this: I am a government. 20% of my population are tech savvy, a different very minorly overlapping 20% are criminals. Given the law of distributions this is probably pretty close to true. Now, those 20% of criminals are very varied in their delights, violent, sexual or theft. Serious crime such as pedophilia or terrorism is very low probability overall. However, as a government, I can't be seen to be weak on those extreme positions because they are highly visible; the 80% population simply will not allow me to argue in good faith for protections which _might_ help such extreme criminals operate easier. The technical feasibility of good opsec for criminals is usually very low, and the FBI has a decent track record of targeted surveillance. But I, the politician, cannot communicate effectively with 80% of people, when the populist says that I am weak on terrorists and pedophiles. I only weaken my own position and allow the populist access to power, because 80% > 20%. -- The biggest benefit and the biggest problem with democracy is that everyone has a voice, even the uninformed. If you listen to all politicans by numbers there will be liars and opportunists among them; then you're not uninformed, you're misinformed, and that's arguably worse.
  - WillDaSilva 5y ago
    What you've described often goes hand-in-hand with a two-party system. That way everyone finds themselves voting for what they believe to be the lesser of two evils. Alternative voting systems (e.g. ranked choice systems) aren't some sort of political panacea, but they could help a lot with this issue. A populist thrives in an environment that does not support nuance. It would be harder for them to be successful if they were running against, say, 6 viable opponents rather than 1. I hope we can address some of these major problems with democracy, because the alternatives generally aren't great.
upofadown 5y ago
In practice this will only affect services provided by large entities like Facebook. If you encrypt your email on your own device there is no way they can make entities like GnuPG add in some sort of mandatory pre-screening system. This question comes down to who or what controls the software on your device. The very existence of the proposal implies that the user of the device does not have this control. That is the real fight here.
- mercora 5y ago
  i fear a little that it might mean doing this is just not legal no matter if its still possible to do yourself.
- vaylian 5y ago
  > In practice this will only affect services provided by large entities like Facebook Which covers a huge percentage of the private communications on the planet. That should not be overlooked. It takes at least 2 people to communicate. What are you going to do, when you have to communicate with a non-technical user who has a gmail address?
  - LinuxBender 5y ago
    This may not work for everyone. If I must email documents that I do not wish Google to see, I call the person and say "The password to that 7-zip file is fartbubble, all one word, lower-case." I can put a text file in the .7z file that has additional context that would have been in the email body.
- fauigerzigerk 5y ago
  Encrypt an email with what key? It takes two to communicate.
raverbashing 5y ago
Here's the the original text https://www.patrick-breyer.de/wp-content/uploads/2021/05/202105_Chatcontrol_Trilogue_Agreement.pdf https://www.patrick-breyer.de/wp-content/uploads/2021/05/202... Might I suggest that people check that before jumping to conclusions. My reading is that the main issue is putting limits on the companies that were already doing this (as mentioned, Google, fb, etc) and that's already privacy violating. Protecting privacy and encryption is important, but I really think the Pirates cry wolf more often than not. I might be wrong, of course. > In the case of technology used for identifying solicitation, such concrete elements of suspicion should be based on objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication. > (17b) End-to-end encryption is an important tool to guarantee secure and confidential communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.
- Aerroon 5y ago
  The EU always says this. Then they point at that one sentence and say: "See, we're protecting end-to-end encryption!" If the EU were an oil company they'd write: "Our oil is not allowed to be used in activities that are harmful to the climate." Then they'd go on to sell oil as usual while constantly claiming to protect the environment.
okamiueru 5y ago
https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2020/0259(COD)&l=en https://oeil.secure.europarl.europa.eu/oeil/popups/ficheproc... > Use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting [SIC] child sexual abuse online (temporary derogation from certain provisions of Directive 2002/58/EC) Who believes the sincerity behind this? Children's rights? Child protection? Do they not see the violation of rights and the potential abuse this law would effectuate, or is it just intentionally designed for it? I cannot believe anyone would be so brazen to give up a core right that is already established as part of 2002/58/EC, aka "ePrivacy directive", https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive https://ec.europa.eu/digital-single-market/en/news/eprivacy-.... So, let's look into the proposal more closely, which is available in the top URL. > CONTENT: the proposal aims to introduce a temporary and strictly limited derogation from the applicability of certain obligations of the ePrivacy Directive to enable providers of number-independent interpersonal communications services to continue using specific technologies and continue their current activities to the extent necessary to detect and report child sexual abuse online and remove child sexual abuse material on their services from December 2020, pending the adoption of the announced long-term legislation. In case you are wondering, "number-independent interpersonal communications services", apparently covers communication technology and services that not explicitly rely on public identifiable numbers. So, any communication service that you can have separate from a personally identified user. > As a reminder, the proposal aims to introduce limited and temporary changes to the rules governing the privacy of electronic communications so that over the top (OTT) communication interpersonal services, such as web messaging, voice over Internet Protocol (VoIP), chat and web-based email services, can continue to detect, report and remove child sexual abuse online on a voluntary basis. The language here comes across as particularly dishonest. You cannot introduce "limited" ability to circumvent privacy. In order to monitor something, services will need to be able to monitor everything. It goes on to mention safeguards: > - a mandatory prior data protection impact assessment pursuant and a mandatory consultation procedure, prior to the use of the technology; > - human overview and intervention is ensured for any processing of personal data, and no positive result is sent to law enforcement authorities or organisations acting in the public interest without prior human review > - appropriate procedures and redress mechanisms are in place > - no interference with any communication protected by professional secrecy > - effective remedies provided by the Member States at national level. > When no online child sexual abuse has been detected, all data should be deleted immediately, according to Members. Only in confirmed cases can the strictly relevant data be stored for use by law enforcement for a maximum of three months --- It honestly strikes me as one of the worst proposals I've seen in a long time. I cannot imagine that child porn is regularly transmitted through chatting services on a p2p basis. Especially not to the extent that it vindicates an end of E2E encryption. Giving up such a core component of ePrivacy, you would think that a report that documents what the problem currently is, would be in order. The document attached to this proposal, and the article on HN documents the issues quite well. https://www.europarl.europa.eu/doceo/document/LIBE-AM-661791_EN.pdf https://www.europarl.europa.eu/doceo/document/LIBE-AM-661791... > The proposal does not protect children but exposes law-abiding citizens to major risks (such as AI algorithms falsely flagging legal intimate depictions and conversations of children and adults relating to their health and sexual life) and violates the fundamental rights of millions of children and adults according to relevant jurisprudence. Analysing the content of all private messages is as unacceptable as if the post office opened all letters to check for illegal content. According to EDPS, neither the necessity nor the proportionality of the instrument have been demonstrated --- A very important and separate issue to E2E discussion is the violation of privacy for whom this is intended to protect. > Teenagers have the right to discover their sexual identity in a safe and private environment. The rise in reported numbers of online child sexual abuse material is also partially due to the emerging practice of teenagers who, in the development of their sexual identity and experiences, take explicit pictures of videos of themselves and send them to peers, or share such material without a sexual motivation. In addition, the age of sexual consent differs across Member States. If users have reached the age of sexual consent under national law, no reporting on solicitation of children should not be reported to law enforcement authorities > Notwithstanding their legitimate objective, these activities constitute an interference with the fundamental rights to respect for private and family life and protection of personal data of the individuals concerned, namely all users, potential offenders and victims. Any limitation to the fundamental right to respect for private and family life, including the confidentiality of communications, cannot be justified merely on the ground that certain technologies were previously deployed when the services concerned did not, from a legal perspective, constitute electronic communications services. https://www.europarl.europa.eu/doceo/document/A-9-2020-0258_EN.html https://www.europarl.europa.eu/doceo/document/A-9-2020-0258_... --- I must say I am pleasantly surprised as to how transparent this process is, and it shows that the "common sense" objections are voiced and brought up.
Aerroon 5y ago
Why is it always the EU that comes up with these moronic laws and regulations?
- nickpp 5y ago
  Three reasons: 1) They don't get tech. They are luddites. IT came from the US and they regard it suspiciously because it causes disruption, while EU is all about preserving the status quo and old money. Europe does not appreciate new money, self-made businessmen and entrepreneurship. 2) The two-level government. It should work in theory (after all, EU representatives are directly elected) but in practice it just removes any responsibility from those bureaucrats. 3) West European countries are oriented to the past. They can't innovate and evolve. Their rules and regulations are simply meant to preserve that past and stave off the future bringing all these damn changes. In the end, it's about control. EU is obsessed about controlling its people and is horrified by those it can't control. Because they bring change, something unacceptable to the good old boys of Europe...
  - atq2119 5y ago
    That seems a bit too simplistic and extreme. More likely, it's because the EU feels too removed from the people. There are plenty of reasons for that, and we're stuck in the pessimum place where democratic reform of the EU which would help bring it more in line with what people want is prevented because too many people don't like the EU. This is basically what happened with the Treaty of Maastricht, and three decades later the situation has if anything gotten worse.
- the-dude 5y ago
  As opposed to the US, which just goes ahead and lets the NSA siphon all traffic?
- oytis 5y ago
  They want to lift some restrictions, not add them. Pretty sure indiscriminate e-mail/chat scanning is already legal in the U.S.
- Ragnarork 5y ago
LinuxBender 5y ago
Last chance to protest Perhaps I have a lot of stubborn blood in me, but I never see a date or a law as a last chance. Protesting can also take the form of people adding witty footers to their emails such as old propaganda slogans from WWII, periodic messages to chat or chat server status, links to simple how-to's for E2EE that maybe your non technical friends can follow. Put your E2EE solutions to the test. Have your child and a grand-parent follow the instructions. If a provider rejects your encrypted messages, switch providers. Money talks. This is just my opinion based on my limited anecdotal life experiences.
- vaylian 5y ago
  Last chance to protest against the passing of that law. Repealing laws is harder than stopping them from becoming passed.
  - LinuxBender 5y ago
    You're right. I know what they meant, I just refuse to accept or acknowledge a bad law. In my view, protesting also means going against something even if it means stepping outside the boundary of the law. Taking one for the team so to speak.
  - lanamo 5y ago
    "Principiis obsta" [Ovid]. -> To Nip things in the bud. Hard to change afterwards...
undfg 5y ago
Just another proof that the EU has run its course. It was good while it lasted, but they can't stop themselves from getting bigger and bigger and overreaching.
- fauigerzigerk 5y ago
  What this proposal does is to create an exemption from EU privacy regulation for the purpose of allowing mostly U.S based service providers to continue doing what they're already doing on a global basis. I'm sure you can find examples of EU overreach and a desire to get bigger, but this isn't that.
micropresident 5y ago
If this is a topic you (reader) care deeply about, I have been building an open source project to avoid having a centralized authority on messaging while also keeping out the endless spam you'd get on an unmoderated system: https://www.stampchat.io/whitepaper.pdf https://www.stampchat.io/whitepaper.pdf
FabHK 5y ago
The article claims: > your private communications can be searched by error-prone artificial intelligence technologies. Although these algorithms are meant to search for potential child pornography and grooming, up to 86% of the correspondence reported to the police is not criminally relevant and users are falsely being reported – including many minors. > This takes place in a fully automated process and using error-prone “artificial intelligence”. If an algorithm considers a message suspicious, its content and meta-data are disclosed automatically and without human verification to a private US-based organization and from there to national police authorities worldwide. The proposed legislation contains: > (ac) the provider of the number-independent interpersonal communications services ensures human oversight of, and, where necessary, intervention in the processing of personal data using technologies falling under this Regulation, and ensures that no report of material not previously identified as child sexual abuse or of solicitation is sent to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation > (b) the technology used is in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of content representing child sexual abuse, and where such occasional errors occur, their consequences are rectified without delay; My conclusion as a layman: This is problematic, but if you wanted to write "good" anti-child-pornography legislation, this might be close to it?
swiley 5y ago
Someone was telling me the other day that censoring communication in Germany is just fine. Hopefully he's right.

237 points by ColinWright 5y ago

It's hard to organize protests for free speech. If you ask people if people should be free to express their opinions, most people would agree. But then, if you ask people if it should be possible to block content doubting the scale of pandemic or efficiency of the vaccines, most people would also agree.

hvis 5y ago
This article is about private communication, however. And that one does not necessarily contradict current pandemic measures. Most of the harm of content with anti-vaccination stuff or whatever comes when it becomes publicly available. We could still have private communications but block (or annotate with "see COVID Center with actual science") those conspiracy videos when they get posted on public feeds, such as youtube, instagram or whatever. Until the pandemic subsides, that is.

mvdwoord 5y ago

How worrisome is this? And what can a normal person do while maintaining normal communications (to a degree) with people they love but who do not (seem to) care about this stuff?

ramtatatam 5y ago
My observation is that, sadly, "Normal person" probably does not care... For a long time I try to self-host communication channels that matter to me, that is at least email and communicators. That means support burden, since my family is not technical. Not easy but worth it..
merlinscholz 5y ago
Switch to email providers outside the EU like Protonmail, but I fear you are right. The main problem of this is that both sides of a given communication have to be outside the EU for this to work.
- natch 5y ago
  >The main problem of this What is “this” — the EU parliament proposal? Or your workaround? Why would both have to be outside the EU?
  - avh02 5y ago
    > Why would both have to be outside the EU? Because email/chat is rarely a monologue
    - natch 5y ago
      Obviously, but that misses the essence of the question.
      - tekknik 5y ago
        > What is “this” — the EU parliament proposal? Or your workaround? The workaround. > Why would both have to be outside the EU? Because if one party is within the EU then the contents of the message will be scanned even if one party is outside of the EU.
        natch 5y ago
        You should read up on Google’s “associated country.” I think these politicians will take any excuse they can get, and not limit themselves to people who are physically within the borders of EU countries.
        natch 5y ago
        Isn’t Protonmail based in Russia? Good luck getting them to comply.
vaylian 5y ago
> And what can a normal person do Prevent this law from passing. Call your MEP.

hyperdunc 5y ago

> Through a second piece of legislation to be proposed soon, the EU Commission intends to oblige all providers of chat, messaging and e-mail services to deploy this mass surveillance technology. So they're going to require Signal to break their E2E encryption if the app is to remain legal and readily available? Wow. Regardless of what intentions the EU bureaucrats have, there's no way these requirements won't be abused. Imagine what insights could be gained from applying a little ML to the real-time chat of an entire continent. Who would you trust to have access to data like that?

woudsma 5y ago

> Securely encrypted communication is at risk. Up to now, encrypted messages cannot be searched by the algorithms. To change that back doors would need to be built in to messaging software. As soon as that happens, this security loophole can be exploited by anyone with the technical means needed, for example by foreign intelligence services and criminals. Private communications, business secrets and sensitive government information would be exposed. Secure encryption is needed to protect minorities, LGBTQI people, democratic activists, journalists, etc. So if I understand correctly, this will be the end of E2E encryption? That would probably be the stupidest decision of the century. Governments are always lagging behind in terms of 'cyber' security, so my guess is that it will only be a matter of time before we can expect data leaks from widely used private chat services.

Tepix 5y ago
No. It will mean that criminals can protect their communications better than law-abiding citizens.
- woudsma 5y ago
  That's the weakest of arguments. I don't trust that governments _can_ protect my data better than us nerds. If there is a backdoor, it will only be a matter of time before the criminals get access to it. It would be the holy grail of data. If I were a foreign regime with bad intentions, I would put a lot of resources into getting access to those chats. You could probably ruin anybody's life with access to their personal chats by extorting them, etc. It's going to create a whole new criminal sector. People sifting through other people's personal lives. I'm not implying that these people may have committed an offence, there are many things I don't want anyone else to see other than the person I'm sending the message to. The "law-abiding citizen" / "Only criminals have something to hide" argument is complete bullshit. With access to personal chats you can ruin careers, families, relationships, etc, etc. And what can happen, will -most likely- happen. E2EE prevents that. Edit: Sorry, I misread the parent comment!
  - tortasaur 5y ago

mpfundstein 5y ago

another great thing the EU is doing for us... wonderful! The bureacracy appartus works perfectly well, far away from any accountability. Its the perfect system actually. Let everyone fight their local nationwide politics and in the meanwhile implement those life changing things from an appartus far away.

411111111111111 5y ago
Dumb legislature is not unique to the EU, blaming them specifically is misguided. Please use arguments that arent fundamentally based on biases. There is definitely value in a European government, even if the way it's currently setup is very questionable, as the citizens have no realistic way to influence decisions on that level.
- nickpp 5y ago
  The EU is special when it comes to high-tech though. Just try to browse the web normally from inside any EU country to see how much they managed to f-up the Internet.
  - Kbelicius 5y ago
    I browse the web all day, every day from within the EU and I don't know what you are talking about.
    - nickpp 5y ago
      Never noticed that huge cookie popup smack in the middle of every single damn new website you visit huh?! Lucky you...
      - Kbelicius 5y ago
        Yea, I see those but only the first time I visit a website. Lucky you... thinking that a notice that a web page is storing data on your computer is fuckig up the internet.

donkarma 5y ago

What the fuck is wrong with governments?

okamiueru 5y ago
Things like these tends to be backed by pressure from the US. It would surprise me if it wasn't the case here.
dijit 5y ago
If you really want to converse with governments then it helps to steelman their position before arguing it. Bear in mind I am against weakening cryptography when reading this: I am a government. 20% of my population are tech savvy, a different very minorly overlapping 20% are criminals. Given the law of distributions this is probably pretty close to true. Now, those 20% of criminals are very varied in their delights, violent, sexual or theft. Serious crime such as pedophilia or terrorism is very low probability overall. However, as a government, I can't be seen to be weak on those extreme positions because they are highly visible; the 80% population simply will not allow me to argue in good faith for protections which _might_ help such extreme criminals operate easier. The technical feasibility of good opsec for criminals is usually very low, and the FBI has a decent track record of targeted surveillance. But I, the politician, cannot communicate effectively with 80% of people, when the populist says that I am weak on terrorists and pedophiles. I only weaken my own position and allow the populist access to power, because 80% > 20%. -- The biggest benefit and the biggest problem with democracy is that everyone has a voice, even the uninformed. If you listen to all politicans by numbers there will be liars and opportunists among them; then you're not uninformed, you're misinformed, and that's arguably worse.
- WillDaSilva 5y ago
  What you've described often goes hand-in-hand with a two-party system. That way everyone finds themselves voting for what they believe to be the lesser of two evils. Alternative voting systems (e.g. ranked choice systems) aren't some sort of political panacea, but they could help a lot with this issue. A populist thrives in an environment that does not support nuance. It would be harder for them to be successful if they were running against, say, 6 viable opponents rather than 1. I hope we can address some of these major problems with democracy, because the alternatives generally aren't great.

upofadown 5y ago

In practice this will only affect services provided by large entities like Facebook. If you encrypt your email on your own device there is no way they can make entities like GnuPG add in some sort of mandatory pre-screening system. This question comes down to who or what controls the software on your device. The very existence of the proposal implies that the user of the device does not have this control. That is the real fight here.

mercora 5y ago
i fear a little that it might mean doing this is just not legal no matter if its still possible to do yourself.
vaylian 5y ago
> In practice this will only affect services provided by large entities like Facebook Which covers a huge percentage of the private communications on the planet. That should not be overlooked. It takes at least 2 people to communicate. What are you going to do, when you have to communicate with a non-technical user who has a gmail address?
- LinuxBender 5y ago
  This may not work for everyone. If I must email documents that I do not wish Google to see, I call the person and say "The password to that 7-zip file is fartbubble, all one word, lower-case." I can put a text file in the .7z file that has additional context that would have been in the email body.
fauigerzigerk 5y ago
Encrypt an email with what key? It takes two to communicate.

raverbashing 5y ago

Here's the the original text https://www.patrick-breyer.de/wp-content/uploads/2021/05/202105_Chatcontrol_Trilogue_Agreement.pdf https://www.patrick-breyer.de/wp-content/uploads/2021/05/202... Might I suggest that people check that before jumping to conclusions. My reading is that the main issue is putting limits on the companies that were already doing this (as mentioned, Google, fb, etc) and that's already privacy violating. Protecting privacy and encryption is important, but I really think the Pirates cry wolf more often than not. I might be wrong, of course. > In the case of technology used for identifying solicitation, such concrete elements of suspicion should be based on objectively identified risk factors such as age difference and the likely involvement of a child in the scanned communication. > (17b) End-to-end encryption is an important tool to guarantee secure and confidential communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption.

Aerroon 5y ago
The EU always says this. Then they point at that one sentence and say: "See, we're protecting end-to-end encryption!" If the EU were an oil company they'd write: "Our oil is not allowed to be used in activities that are harmful to the climate." Then they'd go on to sell oil as usual while constantly claiming to protect the environment.

okamiueru 5y ago

https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2020/0259(COD)&l=en https://oeil.secure.europarl.europa.eu/oeil/popups/ficheproc... > Use of technologies by number-independent interpersonal communications service providers for the processing of personal and other data for the purpose of combatting [SIC] child sexual abuse online (temporary derogation from certain provisions of Directive 2002/58/EC) Who believes the sincerity behind this? Children's rights? Child protection? Do they not see the violation of rights and the potential abuse this law would effectuate, or is it just intentionally designed for it? I cannot believe anyone would be so brazen to give up a core right that is already established as part of 2002/58/EC, aka "ePrivacy directive", https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive https://ec.europa.eu/digital-single-market/en/news/eprivacy-.... So, let's look into the proposal more closely, which is available in the top URL. > CONTENT: the proposal aims to introduce a temporary and strictly limited derogation from the applicability of certain obligations of the ePrivacy Directive to enable providers of number-independent interpersonal communications services to continue using specific technologies and continue their current activities to the extent necessary to detect and report child sexual abuse online and remove child sexual abuse material on their services from December 2020, pending the adoption of the announced long-term legislation. In case you are wondering, "number-independent interpersonal communications services", apparently covers communication technology and services that not explicitly rely on public identifiable numbers. So, any communication service that you can have separate from a personally identified user. > As a reminder, the proposal aims to introduce limited and temporary changes to the rules governing the privacy of electronic communications so that over the top (OTT) communication interpersonal services, such as web messaging, voice over Internet Protocol (VoIP), chat and web-based email services, can continue to detect, report and remove child sexual abuse online on a voluntary basis. The language here comes across as particularly dishonest. You cannot introduce "limited" ability to circumvent privacy. In order to monitor something, services will need to be able to monitor everything. It goes on to mention safeguards: > - a mandatory prior data protection impact assessment pursuant and a mandatory consultation procedure, prior to the use of the technology; > - human overview and intervention is ensured for any processing of personal data, and no positive result is sent to law enforcement authorities or organisations acting in the public interest without prior human review > - appropriate procedures and redress mechanisms are in place > - no interference with any communication protected by professional secrecy > - effective remedies provided by the Member States at national level. > When no online child sexual abuse has been detected, all data should be deleted immediately, according to Members. Only in confirmed cases can the strictly relevant data be stored for use by law enforcement for a maximum of three months --- It honestly strikes me as one of the worst proposals I've seen in a long time. I cannot imagine that child porn is regularly transmitted through chatting services on a p2p basis. Especially not to the extent that it vindicates an end of E2E encryption. Giving up such a core component of ePrivacy, you would think that a report that documents what the problem currently is, would be in order. The document attached to this proposal, and the article on HN documents the issues quite well. https://www.europarl.europa.eu/doceo/document/LIBE-AM-661791_EN.pdf https://www.europarl.europa.eu/doceo/document/LIBE-AM-661791... > The proposal does not protect children but exposes law-abiding citizens to major risks (such as AI algorithms falsely flagging legal intimate depictions and conversations of children and adults relating to their health and sexual life) and violates the fundamental rights of millions of children and adults according to relevant jurisprudence. Analysing the content of all private messages is as unacceptable as if the post office opened all letters to check for illegal content. According to EDPS, neither the necessity nor the proportionality of the instrument have been demonstrated --- A very important and separate issue to E2E discussion is the violation of privacy for whom this is intended to protect. > Teenagers have the right to discover their sexual identity in a safe and private environment. The rise in reported numbers of online child sexual abuse material is also partially due to the emerging practice of teenagers who, in the development of their sexual identity and experiences, take explicit pictures of videos of themselves and send them to peers, or share such material without a sexual motivation. In addition, the age of sexual consent differs across Member States. If users have reached the age of sexual consent under national law, no reporting on solicitation of children should not be reported to law enforcement authorities > Notwithstanding their legitimate objective, these activities constitute an interference with the fundamental rights to respect for private and family life and protection of personal data of the individuals concerned, namely all users, potential offenders and victims. Any limitation to the fundamental right to respect for private and family life, including the confidentiality of communications, cannot be justified merely on the ground that certain technologies were previously deployed when the services concerned did not, from a legal perspective, constitute electronic communications services. https://www.europarl.europa.eu/doceo/document/A-9-2020-0258_EN.html https://www.europarl.europa.eu/doceo/document/A-9-2020-0258_... --- I must say I am pleasantly surprised as to how transparent this process is, and it shows that the "common sense" objections are voiced and brought up.

Aerroon 5y ago

Why is it always the EU that comes up with these moronic laws and regulations?

nickpp 5y ago
Three reasons: 1) They don't get tech. They are luddites. IT came from the US and they regard it suspiciously because it causes disruption, while EU is all about preserving the status quo and old money. Europe does not appreciate new money, self-made businessmen and entrepreneurship. 2) The two-level government. It should work in theory (after all, EU representatives are directly elected) but in practice it just removes any responsibility from those bureaucrats. 3) West European countries are oriented to the past. They can't innovate and evolve. Their rules and regulations are simply meant to preserve that past and stave off the future bringing all these damn changes. In the end, it's about control. EU is obsessed about controlling its people and is horrified by those it can't control. Because they bring change, something unacceptable to the good old boys of Europe...
- atq2119 5y ago
  That seems a bit too simplistic and extreme. More likely, it's because the EU feels too removed from the people. There are plenty of reasons for that, and we're stuck in the pessimum place where democratic reform of the EU which would help bring it more in line with what people want is prevented because too many people don't like the EU. This is basically what happened with the Treaty of Maastricht, and three decades later the situation has if anything gotten worse.
the-dude 5y ago
As opposed to the US, which just goes ahead and lets the NSA siphon all traffic?
oytis 5y ago
They want to lift some restrictions, not add them. Pretty sure indiscriminate e-mail/chat scanning is already legal in the U.S.
Ragnarork 5y ago

LinuxBender 5y ago

Last chance to protest Perhaps I have a lot of stubborn blood in me, but I never see a date or a law as a last chance. Protesting can also take the form of people adding witty footers to their emails such as old propaganda slogans from WWII, periodic messages to chat or chat server status, links to simple how-to's for E2EE that maybe your non technical friends can follow. Put your E2EE solutions to the test. Have your child and a grand-parent follow the instructions. If a provider rejects your encrypted messages, switch providers. Money talks. This is just my opinion based on my limited anecdotal life experiences.

vaylian 5y ago
Last chance to protest against the passing of that law. Repealing laws is harder than stopping them from becoming passed.
- LinuxBender 5y ago
  You're right. I know what they meant, I just refuse to accept or acknowledge a bad law. In my view, protesting also means going against something even if it means stepping outside the boundary of the law. Taking one for the team so to speak.
- lanamo 5y ago
  "Principiis obsta" [Ovid]. -> To Nip things in the bud. Hard to change afterwards...

undfg 5y ago

Just another proof that the EU has run its course. It was good while it lasted, but they can't stop themselves from getting bigger and bigger and overreaching.

fauigerzigerk 5y ago
What this proposal does is to create an exemption from EU privacy regulation for the purpose of allowing mostly U.S based service providers to continue doing what they're already doing on a global basis. I'm sure you can find examples of EU overreach and a desire to get bigger, but this isn't that.

micropresident 5y ago

If this is a topic you (reader) care deeply about, I have been building an open source project to avoid having a centralized authority on messaging while also keeping out the endless spam you'd get on an unmoderated system: https://www.stampchat.io/whitepaper.pdf https://www.stampchat.io/whitepaper.pdf

FabHK 5y ago

The article claims: > your private communications can be searched by error-prone artificial intelligence technologies. Although these algorithms are meant to search for potential child pornography and grooming, up to 86% of the correspondence reported to the police is not criminally relevant and users are falsely being reported – including many minors. > This takes place in a fully automated process and using error-prone “artificial intelligence”. If an algorithm considers a message suspicious, its content and meta-data are disclosed automatically and without human verification to a private US-based organization and from there to national police authorities worldwide. The proposed legislation contains: > (ac) the provider of the number-independent interpersonal communications services ensures human oversight of, and, where necessary, intervention in the processing of personal data using technologies falling under this Regulation, and ensures that no report of material not previously identified as child sexual abuse or of solicitation is sent to law enforcement authorities or organisations acting in the public interest against child sexual abuse without prior human confirmation > (b) the technology used is in itself sufficiently reliable in that it limits to the maximum extent possible the rate of errors regarding the detection of content representing child sexual abuse, and where such occasional errors occur, their consequences are rectified without delay; My conclusion as a layman: This is problematic, but if you wanted to write "good" anti-child-pornography legislation, this might be close to it?

swiley 5y ago

Someone was telling me the other day that censoring communication in Germany is just fine. Hopefully he's right.