3 ms·

I have a question: what does it mean for the _users_ of messaging applications? If the OSB passes am I still within my rights to PGP encrypt my messages before

by cnity 4y ago

I have a question: what does it mean for the _users_ of messaging applications? If the OSB passes am I still within my rights to PGP encrypt my messages before sending them?

walterbell 4y ago
That may depend on whether operating systems (including app stores and package managers) are also regulated, e.g. via the EU Cyber-Resilience Act, https://news.ycombinator.com/item?id=34760173 https://news.ycombinator.com/item?id=34760173
- hellojesus 4y ago
  Worst case you could always roll your own based on proven open source libraries, down to the metal.
Arathorn 4y ago
In the current wording: yes, you can go encrypt your messages with PGP before sending them. However, the worst-case scenario is that Ofcom would then say to Apple and Google: "Hey, you are communication service providers (thanks to iMessage and Google Messages/Chat/etc). We believe you are failing to adequately block illegal content. Therefore we legally require you to perform content moderation. And given you also provide the operating system for your services, and given you've already demonstrated you are willing to do client-side scanning at the OS layer (https://www.siliconrepublic.com/enterprise/apple-csam-child-safety-sexual-abuse-material-uk-privacy https://www.siliconrepublic.com/enterprise/apple-csam-child-...) clearly we expect you to scan for illegal content in the OS. Therefore, please scan all content for illegal content, otherwise we'll send your UK-based staff to jail. By the way, have you considered putting scanning in the graphics pipeline? Then we can make sure that you do OCR and image-classification on all pixels that users see, to make sure that after users PGP-decrypt their messages we can spot words like 'bomb' or worse, and send evidence through Apple/Google's moderation teams, so they can be able to block the illegal content and uphold their obligations to report CSAM etc to the authorities." To be clear, this is a worst-case scenario, but it's the logical extrapolation of what the OSB allows. (That said, IANAL).
- rakoo 4y ago
  Also if I understand correctly it would be illegal to build and distribute gpg without the scanning bit

by cnity 4y ago

I have a question: what does it mean for the _users_ of messaging applications? If the OSB passes am I still within my rights to PGP encrypt my messages before sending them?

walterbell 4y ago

That may depend on whether operating systems (including app stores and package managers) are also regulated, e.g. via the EU Cyber-Resilience Act, https://news.ycombinator.com/item?id=34760173 https://news.ycombinator.com/item?id=34760173

hellojesus 4y ago
Worst case you could always roll your own based on proven open source libraries, down to the metal.

Arathorn 4y ago

In the current wording: yes, you can go encrypt your messages with PGP before sending them. However, the worst-case scenario is that Ofcom would then say to Apple and Google: "Hey, you are communication service providers (thanks to iMessage and Google Messages/Chat/etc). We believe you are failing to adequately block illegal content. Therefore we legally require you to perform content moderation. And given you also provide the operating system for your services, and given you've already demonstrated you are willing to do client-side scanning at the OS layer (https://www.siliconrepublic.com/enterprise/apple-csam-child-safety-sexual-abuse-material-uk-privacy https://www.siliconrepublic.com/enterprise/apple-csam-child-...) clearly we expect you to scan for illegal content in the OS. Therefore, please scan all content for illegal content, otherwise we'll send your UK-based staff to jail. By the way, have you considered putting scanning in the graphics pipeline? Then we can make sure that you do OCR and image-classification on all pixels that users see, to make sure that after users PGP-decrypt their messages we can spot words like 'bomb' or worse, and send evidence through Apple/Google's moderation teams, so they can be able to block the illegal content and uphold their obligations to report CSAM etc to the authorities." To be clear, this is a worst-case scenario, but it's the logical extrapolation of what the OSB allows. (That said, IANAL).

rakoo 4y ago
Also if I understand correctly it would be illegal to build and distribute gpg without the scanning bit