8 ms·

I'm going to slightly modify and repeat comment of mine I wrote here on another post for the same topic: According to the DKSB (Deutscher Kinderschutzbund) [1]

I'm going to slightly modify and repeat comment of mine I wrote here on another post for the same topic: According to the DKSB (Deutscher Kinderschutzbund) [1], encryption barely plays a role when it comes to the distribution of CSAM [2]. In short: DKSB is not in favour of this. You know, the people that probably know what they are talking about when it comes to the protection of children, unlike the politicians who are trying to force this through. The politicians which only really talked to salesmen of surveillance software [3] about this and never really consulted any independent people with expertise in tech, privacy or the protection of children [4]. Because this was never, at any moment, about protecting children. [1]: https://www.dksb.de/en/home/ https://www.dksb.de/en/home/ [2]: https://www.eu-info.de/dpa-europaticker/316232.html https://www.eu-info.de/dpa-europaticker/316232.html [3]: https://netzpolitik.org/2022/dude-wheres-my-privacy-how-a-hollywood-star-lobbies-the-eu-for-more-surveillance/ https://netzpolitik.org/2022/dude-wheres-my-privacy-how-a-ho... [4]: https://edri.org/our-work/private-and-secure-communications-put-at-risk-by-european-commissions-latest-proposal/ https://edri.org/our-work/private-and-secure-communications-...

spupe 4y ago
I'm usually on the fence between gross incompetence and straight out deception as the cause for these proposals, but in this case I'm convinced of the latter.
- nelox 4y ago
  History is replete with those who preach morality and act otherwise.
  - actionfromafar 4y ago
    With the mandate from Heaven out of fashion in most (ahem, one glaring example) democracies, there is always think of the Children.
numerik_meister 4y ago
You got it right. Lots of people here think this is some sort of big conspiracy by lizards to build a surveillance state. In truth, it is simply software companies that have surveillance products to sell lobbying the government. Source: at my German uni there are many recruitment drives from these entities
- bayindirh 4y ago
  Also, governments are used to being able listen into whatever they wanted to in the past, and now their capability is eroding, and they don't want to lose their apparatus. e.g.: Crypto AG incident, old phone taps, etc.
- emteycz 4y ago
  So you think Zensursula is pushing surveillance state only so she can then buy surveillance products of US tech companies because ... what? Money going to her pocket? I think that's much more of a conspiracy theory than the notion that politicians want control.
  - sam_lowry_ 4y ago
    She is riding the lobbying wave without giving much critical thinking to what happens. After all, she is just a humble public servant, she thinks. What harm can this possibly make?
  - tut-urut-utut 4y ago
    Why that surprises you? As a German minister of defence, she is known as a person who paid half a billion euros to PwC consultants. Also, she renovated a sailing wooden training ship for more than 200 million euros. And she is accused of removing proofs by deleting data from her phone and “not remembering” anything. I would trust that person every evil and corrupt thing one can imagine.
    - emteycz 4y ago
      Why is it so hard to believe she simply wants [Chat] Control, then?
_fat_santa 4y ago
Thinking about this from a more technical perspective. CSAM scanning will only catch the dumbest of abusers. One with even a remote level of sophistication will just spin up their own servers, there is plenty of OSS software out there to do such a thing, and thus would completely bypass any measures that are being proposed. With services like Digital Ocean, you can spin up a chat server with pretty much only the most basic of technical knowledge, hell you likely won't even have to touch a command line. Sure the EU could move to require OSS software developers operating in the EU to backdoor their software but that will be moot too as it will get caught on to in a heartbeat and a fork (sans backdoor) will be made available.
- rvanlaar 4y ago
  It will catch random webmasters. In short, Dutch hoster TransIP had to pause their scanning service. They got hashes that included default images from WordPress. "Waar het misging, is volgens TransIP-woordvoerder Marco Edelman dat per ongeluk hashes van standaardafbeeldingen van WordPress-installaties en plug-ins zijn toegevoegd." [1] https://tweakers.net/nieuws/182766/transip-pauzeert-hashcheckservice-na-onterecht-verwijderen-van-afbeeldingen.html https://tweakers.net/nieuws/182766/transip-pauzeert-hashchec...
  - rolandog 4y ago
    With the high-likelihood of false positives, this is just another Child Benefits scandal waiting to happen if the system were to be completely unsupervised.
  - withinboredom 4y ago
    It uses the MD5 of the image, no surprise there that there were collisions with ordinary files. I've run into MD5 hash collisions causing mayhem several times in my life (usually between unrelated email addresses, IIRC).
    - readams 4y ago
      You found 2 actual emails with the same md5? That sounds very unlikely. MD5 is weak against attack, but you're not going to be hitting collisions with "normal" data and especially not short strings.
raverbashing 4y ago
Really makes me wonder how many millions Ashton Kutcher would make pushing for this, he seems to have found the best regulatory capture since SawStop to push for this But I agree with the parent comment, the vast, vast majority of distributors doesn't know how to work with encryption. The audience here knows, but compared to the average user, the audience here has much more technical knowledge.
fsociety 4y ago
Generally I agree with everything you said. There is a subtle and important distinction here though. Encryption rarely plays a role in the distribution of CSAM, yes, but a more concerning part in my mind is the role encryption plays in the active abuse of children. To be very clear, I think there are ways to design applications around encryption to prevent the active abuse on platforms. For example, disabling encryption on minors accounts, limiting messages from people outside of your social circle, allowing opt-in so parents can read messages from their kids, AI models to display a prompt to the child that something may be harmful and they should seek their parents etc. The biggest disappointment I had with Apple about this CSAM scanning business, is that they were not talking about or taking steps in preventing the active abuse of children. I would love to see regulation put in for the design of apps when a minor uses them. A small part of me is worried about poor regulations, but then we have things like Kik.
- vorpalhex 4y ago
  You don't understand how CSAM scanning works. This requires well known hashes of pedophiliac content - meaning it will do nothing for a novel exploitation of a child. You can also just have your kid not use encrypted apps or not allow them to message internet strangers. That is probably the wrong thing to do - blanket bans are a bad way to teach life skills - bit you as a parent can do so. You don't need government help.
- Tagbert 4y ago
  Some of what you are suggesting is exactly what Apple has said that they are implementing in iMessage for child accounts. In particular, the AI notifications to children that the message that they are receiving or sending may contain csam and that they should reconsider.

spupe 4y ago

I'm usually on the fence between gross incompetence and straight out deception as the cause for these proposals, but in this case I'm convinced of the latter.

nelox 4y ago
History is replete with those who preach morality and act otherwise.
- actionfromafar 4y ago
  With the mandate from Heaven out of fashion in most (ahem, one glaring example) democracies, there is always think of the Children.

numerik_meister 4y ago

You got it right. Lots of people here think this is some sort of big conspiracy by lizards to build a surveillance state. In truth, it is simply software companies that have surveillance products to sell lobbying the government. Source: at my German uni there are many recruitment drives from these entities

bayindirh 4y ago
Also, governments are used to being able listen into whatever they wanted to in the past, and now their capability is eroding, and they don't want to lose their apparatus. e.g.: Crypto AG incident, old phone taps, etc.
emteycz 4y ago
So you think Zensursula is pushing surveillance state only so she can then buy surveillance products of US tech companies because ... what? Money going to her pocket? I think that's much more of a conspiracy theory than the notion that politicians want control.
- sam_lowry_ 4y ago
  She is riding the lobbying wave without giving much critical thinking to what happens. After all, she is just a humble public servant, she thinks. What harm can this possibly make?
- tut-urut-utut 4y ago
  Why that surprises you? As a German minister of defence, she is known as a person who paid half a billion euros to PwC consultants. Also, she renovated a sailing wooden training ship for more than 200 million euros. And she is accused of removing proofs by deleting data from her phone and “not remembering” anything. I would trust that person every evil and corrupt thing one can imagine.
  - emteycz 4y ago
    Why is it so hard to believe she simply wants [Chat] Control, then?

_fat_santa 4y ago

Thinking about this from a more technical perspective. CSAM scanning will only catch the dumbest of abusers. One with even a remote level of sophistication will just spin up their own servers, there is plenty of OSS software out there to do such a thing, and thus would completely bypass any measures that are being proposed. With services like Digital Ocean, you can spin up a chat server with pretty much only the most basic of technical knowledge, hell you likely won't even have to touch a command line. Sure the EU could move to require OSS software developers operating in the EU to backdoor their software but that will be moot too as it will get caught on to in a heartbeat and a fork (sans backdoor) will be made available.

rvanlaar 4y ago
It will catch random webmasters. In short, Dutch hoster TransIP had to pause their scanning service. They got hashes that included default images from WordPress. "Waar het misging, is volgens TransIP-woordvoerder Marco Edelman dat per ongeluk hashes van standaardafbeeldingen van WordPress-installaties en plug-ins zijn toegevoegd." [1] https://tweakers.net/nieuws/182766/transip-pauzeert-hashcheckservice-na-onterecht-verwijderen-van-afbeeldingen.html https://tweakers.net/nieuws/182766/transip-pauzeert-hashchec...
- rolandog 4y ago
  With the high-likelihood of false positives, this is just another Child Benefits scandal waiting to happen if the system were to be completely unsupervised.
- withinboredom 4y ago
  It uses the MD5 of the image, no surprise there that there were collisions with ordinary files. I've run into MD5 hash collisions causing mayhem several times in my life (usually between unrelated email addresses, IIRC).
  - readams 4y ago
    You found 2 actual emails with the same md5? That sounds very unlikely. MD5 is weak against attack, but you're not going to be hitting collisions with "normal" data and especially not short strings.

raverbashing 4y ago

Really makes me wonder how many millions Ashton Kutcher would make pushing for this, he seems to have found the best regulatory capture since SawStop to push for this But I agree with the parent comment, the vast, vast majority of distributors doesn't know how to work with encryption. The audience here knows, but compared to the average user, the audience here has much more technical knowledge.

fsociety 4y ago

Generally I agree with everything you said. There is a subtle and important distinction here though. Encryption rarely plays a role in the distribution of CSAM, yes, but a more concerning part in my mind is the role encryption plays in the active abuse of children. To be very clear, I think there are ways to design applications around encryption to prevent the active abuse on platforms. For example, disabling encryption on minors accounts, limiting messages from people outside of your social circle, allowing opt-in so parents can read messages from their kids, AI models to display a prompt to the child that something may be harmful and they should seek their parents etc. The biggest disappointment I had with Apple about this CSAM scanning business, is that they were not talking about or taking steps in preventing the active abuse of children. I would love to see regulation put in for the design of apps when a minor uses them. A small part of me is worried about poor regulations, but then we have things like Kik.

vorpalhex 4y ago
You don't understand how CSAM scanning works. This requires well known hashes of pedophiliac content - meaning it will do nothing for a novel exploitation of a child. You can also just have your kid not use encrypted apps or not allow them to message internet strangers. That is probably the wrong thing to do - blanket bans are a bad way to teach life skills - bit you as a parent can do so. You don't need government help.
Tagbert 4y ago
Some of what you are suggesting is exactly what Apple has said that they are implementing in iMessage for child accounts. In particular, the AI notifications to children that the message that they are receiving or sending may contain csam and that they should reconsider.