6 ms·
National Crime Agency response to Meta's rollout of end-to-end-encryption
- bezbac 3y agoIf only there were other measures to combat terrorism or child exploitation than mass surveillance...
- zaphar 3y agoI am sympathetic to your position. However this sort of low value statement is I think part of the problem. You ask a question that you imply you know the answer to and then you don't give the answers. What other measures do you actually propose?
- logicchains 3y ago>What other measures do you actually propose? If the US really wanted to stop terrorism it could achieve that just by pulling all its troops out of the middle east. Islamists aren't just coming to the US to blow themselves up for the fun of it, they're attacking the US because it has soldiers and military bases occupying most of the middle east.
- trash_cat 3y agoYou left the combatting child exploitation part out. How does pulling troops from ME will achieve that?
- zaphar 3y agoI'm sure that's part of it. But a clear eyed reading of their own religious beliefs and proclamations shows that they are also quite intent on converting the entire world over to their religion or else slaughtering. I'm not sure your suggestion is enough. How would you encourage the hard line believers (also most likely to become terrorists) to abandon that belief system? I'll note that part of their complaint is also that we export our culture via economic methods. Would you also withdraw from all interaction with areas they currently control including humanitarian and immmigration? This would prevent people of that cultural heritage who live here from sending aid to those societies legally. And this only barely touches on just how complicated this all is. The discourse around much of all of this is full of motivated thinking on both sides and a massive amount of oversimplification of the problem.
- trash_cat 3y agoI assume they mean "...more targeted surveillance based on reasonable suspicion".
- deleted 3y ago[deleted]
- bezbac 3y agoYou're right; I didn't offer a solution. The point of my comment was how one-sided and predictable the framing around these measures has become. As you can see by some of the other comments, I seem to not be the only one thinking that. Let me ask you the apparent counter question: do you not see the value of private communication? If you use Facebook Messenger personally, don't you feel that you have gained something by your messages being encrypted? If not, is your reply simply "I ain't got anything to hide"?
- zaphar 3y agoAs I said I'm sympathetic. My question was more about effective strategy in countering the push against encryption than it was challenging the utility and value of private communication.
- bezbac 3y agoNow I got you. I guess "keep children safe" here means two things. 1. Protecting them from grooming 2. Stopping CSAM from being spread via Facebook Messanger It's evident that E2E encryption likely doesn't make much of a difference regarding the second point, given that many messengers have already implemented E2E encryption. So, assuming the communication of the NCA was perfectly sincere, the loss here would be mostly the inability to prevent grooming properly. In this case, I think the question we should be asking ourselves is whether children need to be on these platforms at all. We're seeing so many issues linked to the phone use of children that regardless of protecting them from sexual abuse and exploitation, they should probably just be using phones less.
- zaphar 3y agoThis is I think a much more effective line of communication. I would also suggest that investing in creating communities where parents are much more involved in their children's activities is also a really effective mitigation. Much of our current communities seem to be trending in a direction where children are isolated and alienated making them much richer targets. Creating communities where the environment is much less target rich for those who would prey on them would I think be a good step. Also making it a community where children are more likely to report the predator would go a long way toward identifying and removing the predator from those communities.
- colesantiago 3y agoI see no issue with this, how is the NCA going to try and ban maths? The cat is already out of the bag with E2EE, there is no point trying to stop this. NCA should focus on getting platforms to raise the age limit of their platforms and (dare I say) have some form of ID and consent system for children to use social parts of the internet / web.
- hnlmorg 3y agoPlease not ID. I was with you right up until that point.
- mr_mitm 3y agoThere is a huge difference between blanket use of e2ee in one of the most popular messenger on earth and a couple of nerds using "maths" on top of whatever protocol to send PGP encrypted messages around. Many, if not most criminals are neither smart nor tech savvy. They're clearly pissed because Meta's step is actually impactful. I appreciate Meta's decision but let's not pretend that there isn't a trade-off.
- germandiago 3y agoThese things must go through a judge. Full stop. Indiscriminate spying is not the way to go.
- zug_zug 3y agoA friend of mine worked at meta and said they already had a fullscale set of systems to mass export data to governments based on certain indicators (eg keywords) in response to subpoenas. Perhaps that’s obvious, but the mechanism for proper channels is there, I doubt end-to-end encryption blocks that.
- rascul 3y ago> I doubt end-to-end encryption blocks that. Isn't it supposed to?
- ben_w 3y agoA keyword search is simple enough it can be done client side, before any encryption (and/or after decryption).
- rascul 3y agoOh, good point.
- stonepresto 3y agoWhat's to stop them from having hooks in their app that can bundle up all the decrypted messages, re-encrypt, and phone home? Certainly it wouldn't be default behavior, but its possible and would allow them to answer warrants.
- beej71 3y agoIt's a good point. But someone would eventually see it in the dev tools and Meta's credibility would be shot forever. It's an open question if that impacts their bottom line at all.
- DannyBee 3y agoI don't for a second believe the part about search warrants. Judges often rubber stamp search warrants on the flimsiest of circumstances. There is no reason that won't happen here, especially since judges are humans and thus when you tell them you suspect someone of having child porn, most (but not all) will give you more leeway.
- InCityDreams 3y agoPerhaps the reasoning for obtaining any warrants should be admissable in court (if not already) on behalf of the defendent?
- multjoy 3y agoThat reasoning is usually subject to PII - Public Interest Immunity - exemptions, especially where it involves evidence obtained from sensitive techniques (wiretap, CHIS, other technical measures).
- driverdan 3y ago> Judges often rubber stamp search warrants on the flimsiest of circumstances. I have personal experience with this. A warrant to search my apt was approved by a judge because I was suspected of credit card fraud. Their evidence? Packaging for a new external hard drive found in a recycle bin shared by 4 apts, that's it. No evidence of who put it there or how it was acquired, just a hard drive package.
- rich_sasha 3y agoI'm curious - if the memory isn't too painful - did the search leave much of a mess, and was there any "apology process" when, I assume, it turned out you weren't a criminal? Also, what's the locale? I sometimes worry about being a "victim" of a legitimate legal process, in which I did nothing wrong, and yet have to endure legally-mandated procedures.
- driverdan 3y ago
- ur-whale 3y agoI can't believe I'd ever say this one day, but: assuming they've actually done this properly (which remains to be seen) : very well done facebook.
- ur-whale 3y agoTurns out they have a FB page and just posted something on the topic. https://www.facebook.com/NCA/ https://www.facebook.com/NCA/
- hnlmorg 3y agoI don’t have a Facebook account. Are you able to share what they responded with?
- bertil 3y agoIt’s a summary of the public statement: > Today, Meta has chosen to rollout end-to-end-encryption on Facebook Messenger, which means they will no longer be able to keep children safe on their platform. > Today, our role in protecting children from sexual abuse just got harder. > For years, Meta has supported law enforcement by reporting instances of abuse to National Center for Missing & Exploited Children. The content in these reports enable us to progress investigations. > Currently, the NCA and UK policing are arresting around 800 offenders and safeguarding 1,200 children every month. > Unfortunately, This important work is now at risk. Meta’s design choices mean they will no longer be able to see offending on their platform. > As the rollout continues, we estimate that UK law enforcement will lose 92% of the reports we currently get from Facebook. > The onus should not be entirely on children to report abuse. > Along with our partners in the UK and overseas, we will continue to do everything in our power to safeguard children and identify offenders. > Read our full statement https://ow.ly/6fFt50Qgra3 https://ow.ly/6fFt50Qgra3
- soared 3y ago> As outlined in our 2023 National Strategic Assessment, we estimate that here are between 680,000-830,000 adults in the UK that pose some degree of sexual risk to children. This is equivalent to 1.3%-1.6% of the UK adult population This can’t be accurate, can it? The article says they arrest 800 people a month, whereas the US only convicts 1,600 people a year. What causes these discrepancies? https://www.ussc.gov/sites/default/files/pdf/research-and-publications/quick-facts/Child_Pornography_FY20.pdf https://www.ussc.gov/sites/default/files/pdf/research-and-pu...
- hnlmorg 3y agoArrests don’t always lead to a conviction (eg not enough evidence or the suspect might genuinely be innocent).
- multjoy 3y agoIt's likely to be a massive under-estimate. >whereas the US only convicts 1,600 people a year. What causes these discrepancies? Difficulties detecting the offending and the enthusiasm for prosecution.
- fer 3y agoIt's a hot topic and I rarely want the Internet drama associated, but the UK LE already failed numerous times at keeping children safe, and they're probably trying to pick up the slack[0]. Searching "uk grooming gang scandal" will add some context. Hell, even "Prince Andrew scandal" would add a lot of context. [0]https://www.statista.com/statistics/303514/child-cruelty-abuse-in-england-and-wales-uk-y-on-y/ https://www.statista.com/statistics/303514/child-cruelty-abu... (can't find a graph like that on sexual abuse cases but there's been constant growth too)
- ben_w 3y agoIt's close to what I'd have guessed: • It's a bit higher than the percentage indicating they have that interest in responses to sexual desire surveys, but such surveys are often underestimates. • It's much lower than the percentage of women who report being victimised when they were minors, but one criminal can have many victims. • It's really difficult to prove the offence in a court. • A common argument for harsh punishments is that the legal system is supposed to have punishments severe enough to act as a deterrent (as in not just rehabilitation, compensating victims, or keeping dangerous people out of society). Quite a lot of other crimes, say possession of heroin which IIRC carries a 7 year prison sentence even without intent to supply, also have far more offenders than the entire UK prison population (3x in the case of heroin).
- RcouF1uZ4gsC 3y agoThis is the government that ignored reports of child sexual abuse for decades resulting in the sexual abuse of 1400-2000 children. https://en.m.wikipedia.org/wiki/Rotherham_child_sexual_exploitation_scandal https://en.m.wikipedia.org/wiki/Rotherham_child_sexual_explo... End to end encryption doesn’t actually harm children and may in fact help them by allowing whistleblowers and others to safely report government misdeeds.
- HenryBemis 3y ago> This is equivalent to 1.3%-1.6% of the UK adult population. Did the not to editors just labelled 1.3-1.6% of the population as "perverts"? I will go ahead and assume that this tilts disproportionately to male over female, so... 3% of adult male population in the UK is allegedly perverts? How about addressing THAT instead of carpet bombing personal freedoms?
- lostdev 3y ago> “It is hugely disappointing that Meta is choosing to roll out end-to-end encryption on Facebook Messenger. They have an important responsibility to keep children safe on their platform and sadly, this will no longer be possible." I think you mean... “It is hugely disappointing that Meta is stopping us from spying on their users."
- ben_w 3y agoI don't trust Meta or the UK government and its agencies, so it's quite possible for both sides to be technically correct while also utterly misleading.
- sgift 3y agoNot even a day until "THINK OF THE CHILDREN" .. probably not even a second. One could just write an auto answer script by now. Parse news headlines and the moment something with end-to-end encryption pops up. "Agency foo is very sad that <whoever> chose this step. <whoever> has an important responsibility to keep children safe and sadly, this will no longer be possible. We are so disappointed. So, so disappointed." .. and so on.
- mytailorisrich 3y agoNothing is black and white. E2E encryption is a big headache for legitimate law enforcement. We've seen it with Encrochat.
- driverdan 3y agoGood.
- multjoy 3y agoEncrochat wasn't E2E, which is why the Dutch were able to get all up in their servers.
- mytailorisrich 3y agoExactly. It was a big issue but they still manage to get in, with difficulties. Now, E2E encryption is much harder to crack if possible at all. You probably need to compromise each specific phone/computer/app you're interested in.
- spir 3y agoI can't believe these folks can say "we need to prevent everyone in society from communicating privately to protect children" with a straight face. What must their employees think to themselves? Seems Stalinist.
- multjoy 3y agoThe employees who think this are the ones who have to watch videos of babies and toddlers being raped, so that tends to influence their opinions. My partner was one of those employees and she is, consequently, very much against anything that makes it easier for this to go undetected.
- _factor 3y agoOpinions based on trauma are rarely logical.
- multjoy 3y agoThat doesn't make the employees stalinist, does it. The issue is that CSAM is not some sort of nebulous, vague idea. It is pervasive and endemic in online communities and if you have any tool that can facilitate the sharing of images and communication with children by adults then it will, inevitably, be used by paedophiles. This isn't a vague conjecture, it is the truth of the matter. FB Messenger is specifically a problem because of the ready access it provides adults to children.
- Turing_Machine 3y ago> That doesn't make the employees stalinist, does it. Yeah, it kinda does.
- multjoy 3y agoNo, it kinda doesn't.
- saladdays 3y agoIt is always about the children when it comes to surveillance of online comms.
- cactusplant7374 3y agoWhat about choosing not to encrypt chats involving children? Good compromise?
- bertil 3y agoProbably the most reasonable take, but it’s unclear how you would tell who is a child and who is not. I read your comment as a provocation to get the NCA to reveal that it’s not children they care about, which… I think some of them genuinely do, but encryption isn’t making a material difference. Nota: detecting who was underage on Facebook used to be my job, so I'm happy to explain functional, scalable solutions and their limits, but not in public. Edit: I think encryption isn’t material because you can have a bad-thing detector on the device if you suspect a problem. Naturally, there are debates about how to implement that, too.
- Frost1x 3y agoBut, how will we protect the children's need for privacy if just anyone can read their communication?! Think of the children! The children argument has no bounds.
- fidotron 3y agoIt is quite amazing to see the UK gov PR focus so exclusively on child protection and not one mention of terrorism remains. Given their failures to protect children when the evidence was right in front of them (the Jimmy Savile situation) they clearly cannot expect this messaging to be taken remotely seriously, especially given the way we are all supposed to forget about Epstein. These people really have not internalized what it means to have all your communication able to be intercepted by AI and they won’t until someone uses AI to fake a whole load of crime being committed by them for which they are then punished.
- bertil 3y ago> if Meta continues to roll out end-to-end encryption as planned, it would result in the loss of the vast majority of reports (92% from Facebook …) Wait: how does that prevent reports? The recipient presumably can see the message and share it. Are reports coming from messages that are read by a third party? I’m assuming Meta itself, as that’s the only party who can and would do it at scale. That’s not the NCA telling what Meta should do; that sounds more like an internal Meta team that deals with that and has close contact with the NCA, unhappy they can’t use keyword search to flag bad things.
- egberts1 3y agoFrom Facebook Engineering on about secured storages of messaging server, my take is there is no need for convoluted protocol on server-side in a true encrypted end-to-end (EE2E). https://engineering.fb.com/wp-content/uploads/2023/12/TheLabyrinthEncryptedMessageStorageProtocol_12-6-2023.pdf https://engineering.fb.com/wp-content/uploads/2023/12/TheLab...
- rabbitlin9 3y agoThe NCA are so out of touch. Anyone technical briefing these people should be ashamed.