4 ms·

As you can easily check, Mr. Breyer's website has been at the top of HN multiple times in the past year or so, and invariably the comment section becomes an ant

As you can easily check, Mr. Breyer's website has been at the top of HN multiple times in the past year or so, and invariably the comment section becomes an anti-EU pitchfork party based on nothing more than the linked text and various unhelpful stereotypes. Comments like yours, which justifiably ask for a primary source, have never been getting the attention they deserve. So let me explicitly go against the grain here: I believe the linked text to be fear-mongering and I also believe that the EU will not "break secure encryption" (or make it illegal) in the foreseeable future. And if Mr. Breyer or anyone else would like to convince me of the alternative then please show me some concrete evidence first.

belter 4y ago
>"... I also believe that the EU will not "break secure encryption" (or make it illegal) in the foreseeable future. And if Mr. Breyer or anyone else would like to convince me of the alternative then please show me some concrete evidence first..." "EU’s resolution on encryption foreshadows likely anti-encryption push": https://protonmail.com/blog/eu-attack-on-encryption/ https://protonmail.com/blog/eu-attack-on-encryption/ "EFF Tells E.U. Commission: Don't Break Encryption": https://www.eff.org/deeplinks/2022/03/eff-tells-eu-commission-dont-break-encryption https://www.eff.org/deeplinks/2022/03/eff-tells-eu-commissio... "Encryption: Council adopts resolution on security through encryption and security despite encryption": https://www.consilium.europa.eu/en/press/press-releases/2020/12/14/encryption-council-adopts-resolution-on-security-through-encryption-and-security-despite-encryption/ https://www.consilium.europa.eu/en/press/press-releases/2020... Particularly in the last reference you can hear it directly from the wolf's mouth: "...resolution on security through encryption and security despite encryption..." In other words, encryption they can access...
- SiempreViernes 4y ago
  > In other words, encryption they can access... Access under the conditions that the > Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality including protection of personal data by design and by default. Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths.
  - native_samples 4y ago
    Yes but so what? EU regulation is always like this, it contradicts itself and is impossible to interpret. Governments must be able to access encryption (unstated but obvious: without the target knowing they're being spied on), but the solution must also protect personal data and be "transparent". "Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths." You don't actually know that, you're just hoping that it means something like that. In reality, they will keep the rules vague and then attach massive fines to non-compliance so they get to do the following trick: make everyone involved in implementation super scared so they use a maximalist interpretation, then when people complain to the Commission they say "no we didn't intend that, our rules are actually super reasonable, go complain to the companies". Or one day the ECJ will 'discover' an interpretation that nobody knew about and everyone suddenly has to change the way they do things overnight, then the usual EU water carriers will post here on HN claiming everyone should always have known it from the start. Same thing that was seen with GDPR, EU competition law and other cases. It's become a standard trick. Good law doesn't have this problem; the meanings and consequences are always clear.
- prof-dr-ir 4y ago
  Thank you for your efforts but I am sorry to say that I am still not convinced. The Protonmail link is not a primary source but let me dignify it with a response anyway. The authors of that blog post themselves admit that the resolution they link to "is non-binding and does not provide any specifics for new laws or regulations and, on the surface, seems fairly innocuous." They then go on to say how actually it is really dangerous, and the tone is very threatening, but their reasoning is simply not substantial enough to convince me. I was sad to see that the EFF's very first link to a 'proposal' from the EU commission simply links back to Mr. Breyer's website. (But I am very happy with the letter co-signed by the EFF, which I think is well-written and a lot less alarmist.) And once you do get to a primary source, in your third link, you can only make your case by rephrasing "security despite encryption", which I can happily interpret as being entirely in line with the direction suggested by the aforementioned letter, as "encryption they can access". So I remain unconvinced, mainly because your "in other words" really do a lot of heavy lifting in your comment.
  - belter 4y ago
    And there you have the press release of today: "Questions and Answers –New rules to fight child sexual abuse" https://ec.europa.eu/commission/presscorner/detail/en/qanda_22_2977 https://ec.europa.eu/commission/presscorner/detail/en/qanda_... Exactly as predicted in this thread it's a "think of the children" and at the same time also as mentioned by others in this thread, mandated obligations but preparing for the excuse of "we never actually asked for this way of doing it" "Does the proposal cover encrypted material?" "The proposed obligations on service providers as regards the detection of child sexual abuse material are technologically neutral, meaning they do not prescribe which technology should be used for detection. It is an obligation of result not of means, leaving to the provider the choice of technology to be operated, subject to its compliance with strict safeguards." "This includes the use of encryption technology. Encryption is an important tool for the protection of cybersecurity and confidentiality of communications. At the same time, its use as a secure channel could be abused of by criminals to hide their actions, thereby impeding efforts to bring perpetrators of child sexual abuse to justice." "A large portion of reports of child sexual abuse, which are instrumental to starting investigations and rescuing children, come from services that are already encrypted or may become encrypted in the future. If such services were to be exempt from requirements to protect children and to take action against the circulation of child sexual abuse images and videos via their services, the consequences would be severe for children" It will be probably 6 to 12 months before this is extended to "Terrorism" and another 6 months to be extended to subversive talk on "Vaccine Risk".

belter 4y ago

>"... I also believe that the EU will not "break secure encryption" (or make it illegal) in the foreseeable future. And if Mr. Breyer or anyone else would like to convince me of the alternative then please show me some concrete evidence first..." "EU’s resolution on encryption foreshadows likely anti-encryption push": https://protonmail.com/blog/eu-attack-on-encryption/ https://protonmail.com/blog/eu-attack-on-encryption/ "EFF Tells E.U. Commission: Don't Break Encryption": https://www.eff.org/deeplinks/2022/03/eff-tells-eu-commission-dont-break-encryption https://www.eff.org/deeplinks/2022/03/eff-tells-eu-commissio... "Encryption: Council adopts resolution on security through encryption and security despite encryption": https://www.consilium.europa.eu/en/press/press-releases/2020/12/14/encryption-council-adopts-resolution-on-security-through-encryption-and-security-despite-encryption/ https://www.consilium.europa.eu/en/press/press-releases/2020... Particularly in the last reference you can hear it directly from the wolf's mouth: "...resolution on security through encryption and security despite encryption..." In other words, encryption they can access...

SiempreViernes 4y ago
> In other words, encryption they can access... Access under the conditions that the > Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality including protection of personal data by design and by default. Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths.
- native_samples 4y ago
  Yes but so what? EU regulation is always like this, it contradicts itself and is impossible to interpret. Governments must be able to access encryption (unstated but obvious: without the target knowing they're being spied on), but the solution must also protect personal data and be "transparent". "Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths." You don't actually know that, you're just hoping that it means something like that. In reality, they will keep the rules vague and then attach massive fines to non-compliance so they get to do the following trick: make everyone involved in implementation super scared so they use a maximalist interpretation, then when people complain to the Commission they say "no we didn't intend that, our rules are actually super reasonable, go complain to the companies". Or one day the ECJ will 'discover' an interpretation that nobody knew about and everyone suddenly has to change the way they do things overnight, then the usual EU water carriers will post here on HN claiming everyone should always have known it from the start. Same thing that was seen with GDPR, EU competition law and other cases. It's become a standard trick. Good law doesn't have this problem; the meanings and consequences are always clear.
prof-dr-ir 4y ago
Thank you for your efforts but I am sorry to say that I am still not convinced. The Protonmail link is not a primary source but let me dignify it with a response anyway. The authors of that blog post themselves admit that the resolution they link to "is non-binding and does not provide any specifics for new laws or regulations and, on the surface, seems fairly innocuous." They then go on to say how actually it is really dangerous, and the tone is very threatening, but their reasoning is simply not substantial enough to convince me. I was sad to see that the EFF's very first link to a 'proposal' from the EU commission simply links back to Mr. Breyer's website. (But I am very happy with the letter co-signed by the EFF, which I think is well-written and a lot less alarmist.) And once you do get to a primary source, in your third link, you can only make your case by rephrasing "security despite encryption", which I can happily interpret as being entirely in line with the direction suggested by the aforementioned letter, as "encryption they can access". So I remain unconvinced, mainly because your "in other words" really do a lot of heavy lifting in your comment.
- belter 4y ago
  And there you have the press release of today: "Questions and Answers –New rules to fight child sexual abuse" https://ec.europa.eu/commission/presscorner/detail/en/qanda_22_2977 https://ec.europa.eu/commission/presscorner/detail/en/qanda_... Exactly as predicted in this thread it's a "think of the children" and at the same time also as mentioned by others in this thread, mandated obligations but preparing for the excuse of "we never actually asked for this way of doing it" "Does the proposal cover encrypted material?" "The proposed obligations on service providers as regards the detection of child sexual abuse material are technologically neutral, meaning they do not prescribe which technology should be used for detection. It is an obligation of result not of means, leaving to the provider the choice of technology to be operated, subject to its compliance with strict safeguards." "This includes the use of encryption technology. Encryption is an important tool for the protection of cybersecurity and confidentiality of communications. At the same time, its use as a secure channel could be abused of by criminals to hide their actions, thereby impeding efforts to bring perpetrators of child sexual abuse to justice." "A large portion of reports of child sexual abuse, which are instrumental to starting investigations and rescuing children, come from services that are already encrypted or may become encrypted in the future. If such services were to be exempt from requirements to protect children and to take action against the circulation of child sexual abuse images and videos via their services, the consequences would be severe for children" It will be probably 6 to 12 months before this is extended to "Terrorism" and another 6 months to be extended to subversive talk on "Vaccine Risk".