3 ms·

Parts of GDPR (cookie law++, 100 people organization expectations for random one man software operations in japan, etc) and the current efforts to effectively r

by novok 4y ago

Parts of GDPR (cookie law++, 100 people organization expectations for random one man software operations in japan, etc) and the current efforts to effectively remove end to end encryption from people's chat programs are two good examples. The EU is not the lone offender in this of course, many other countries have similar issues, such as the USA's FATCA.

3np 4y ago
> current efforts to effectively remove end to end encryption from people's chat programs May be out of the loop here but do you have some source where we can catch up on the state of this? In case you're referring specifically of the DSA/DMA (the recent interoperability bombshell), I don't see how that's currently an effort to remove E2EE. Also keep in mind that only "gatekeepers" (as defined) are under scope here. E.g. Signal is small enough to not be in scope. As long as your chat program is not controlled by a multi-billion-dollar corporation you should be good. Arathorn from New Vector has written a series of insightful blog posts about this[3]. References: 2022 EU parliament DSA amendment[0]: > Member States should not prevent providers of intermediary services from providing end-to-end encrypted services. Applying effective end-to-end encryption to data is essential for trust in and security on the Internet, and effectively prevents unauthorised third party access. Furthermore, to ensure effective digital privacy, Member States should not impose a general obligation on providers of intermediary services to limit the anonymous use of their services. In accordance with the principle of data minimisation and in order to prevent unauthorised disclosure, identity theft and other forms of abuse of personal data, recipients should have the right to use and pay for services anonymously wherever reasonable efforts can make this possible DSM FAQ[1]: > The final agreement on the interoperability obligation also ensures that the levels of service integrity, security and encryption offered by the gatekeeper shall and will not be reduced. ...However, I can't seem able to find the referred final agreement. The publicized document is (still?) the 2020 version[2] which contains no references to encryption AFAICT. I don't mean to imply that you are wrong here as contradictory (is there a better non-toxic way to say "schizophrenic"?) tech regulation initiatives seems to be a trend with the EU. But please provide more details as there has been a lot of confusion around this. [0]: https://www.europarl.europa.eu/doceo/document/TA-9-2022-0014_EN.html https://www.europarl.europa.eu/doceo/document/TA-9-2022-0014... [1]: https://ec.europa.eu/commission/presscorner/detail/en/QANDA_20_2349 https://ec.europa.eu/commission/presscorner/detail/en/QANDA_... [2]: https://eur-lex.europa.eu/legal-content/en/TXT/?qid=1608116887159&uri=COM%3A2020%3A842%3AFIN https://eur-lex.europa.eu/legal-content/en/TXT/?qid=16081168... [3]: https://matrix.org/blog/2022/03/30/technical-faq-on-the-digital-markets-act#does-this-undermine-the-gatekeepers-current-encryption https://matrix.org/blog/2022/03/30/technical-faq-on-the-digi...

by novok 4y ago

3np 4y ago

> current efforts to effectively remove end to end encryption from people's chat programs May be out of the loop here but do you have some source where we can catch up on the state of this? In case you're referring specifically of the DSA/DMA (the recent interoperability bombshell), I don't see how that's currently an effort to remove E2EE. Also keep in mind that only "gatekeepers" (as defined) are under scope here. E.g. Signal is small enough to not be in scope. As long as your chat program is not controlled by a multi-billion-dollar corporation you should be good. Arathorn from New Vector has written a series of insightful blog posts about this[3]. References: 2022 EU parliament DSA amendment[0]: > Member States should not prevent providers of intermediary services from providing end-to-end encrypted services. Applying effective end-to-end encryption to data is essential for trust in and security on the Internet, and effectively prevents unauthorised third party access. Furthermore, to ensure effective digital privacy, Member States should not impose a general obligation on providers of intermediary services to limit the anonymous use of their services. In accordance with the principle of data minimisation and in order to prevent unauthorised disclosure, identity theft and other forms of abuse of personal data, recipients should have the right to use and pay for services anonymously wherever reasonable efforts can make this possible DSM FAQ[1]: > The final agreement on the interoperability obligation also ensures that the levels of service integrity, security and encryption offered by the gatekeeper shall and will not be reduced. ...However, I can't seem able to find the referred final agreement. The publicized document is (still?) the 2020 version[2] which contains no references to encryption AFAICT. I don't mean to imply that you are wrong here as contradictory (is there a better non-toxic way to say "schizophrenic"?) tech regulation initiatives seems to be a trend with the EU. But please provide more details as there has been a lot of confusion around this. [0]: https://www.europarl.europa.eu/doceo/document/TA-9-2022-0014_EN.html https://www.europarl.europa.eu/doceo/document/TA-9-2022-0014... [1]: https://ec.europa.eu/commission/presscorner/detail/en/QANDA_20_2349 https://ec.europa.eu/commission/presscorner/detail/en/QANDA_... [2]: https://eur-lex.europa.eu/legal-content/en/TXT/?qid=1608116887159&uri=COM%3A2020%3A842%3AFIN https://eur-lex.europa.eu/legal-content/en/TXT/?qid=16081168... [3]: https://matrix.org/blog/2022/03/30/technical-faq-on-the-digital-markets-act#does-this-undermine-the-gatekeepers-current-encryption https://matrix.org/blog/2022/03/30/technical-faq-on-the-digi...