31 ms·
European Court of Human Rights bans weakening of secure end-to-end encryption
- lacoolj 3y agothis is a HUGE win and could very much help set precedent across the globe (looking at our congress specifically, USA). Still more hurdles to jump over but a great step in the right direction
- eastbound 3y agoIs there an exception for emergency purposes?
- mratsim 3y agoWhen there is an emergency to break into a house, the police needs to get a mandate from a judge.
- gjsman-1000 3y agoWell, there is actually an exception to that too - the Police can break into any home, without a warrant, in the US, if they can prove they had reasonable cause to believe that there was imminent and immediate threat of bodily harm or death. If you are a police officer and see a guy clearly pointing a gun at someone else through the window, yes, you can break in if the circumstances warrant that.
- 05 3y agoOr if you receive an anonymous call from a swatter..
- JoshTriplett 3y agoThe flip side of that is that if the police enter on that basis, any evidence they come across in the course of that action is going to be tainted and potentially thrown out of court, especially if that evidence wasn't in plain sight.
- _cenw 3y agoNo, they don't. Many countries have the concept of "imminent danger", which allows police to skip the warrants. It's called "Gefahr im Verzug" in Germany, for instance.
- rtkwe 3y agoDepends on where you are. In the US there's the Exigent Circumstances exception to the warrant requirement. Not sure if the same theory has been included in EU countries but I would be surprised if it hadn't, a quick search didn't turn up much english language about it. https://www.ce9.uscourts.gov/jury-instructions/node/155 https://www.ce9.uscourts.gov/jury-instructions/node/155
- vdaea 3y agoThat's not true at least in Spain. There's "In flagrante delicto" which means if the police suspects something going on they can kick your door down. It was used many times during the pandemic: when they suspected you were having too many people over at home, they acted. Unconstitutionally, mind you. The EU is not the utopia many think it is.
- martimarkov 3y agoYou’d need to define “unconstitutionally” as it seems if they have the right then it is constitutional
- vdaea 3y agoThe constitutional court of Spain ruled the state of alarm (a kind of state of emergency) that was used to prohibit gatherings during the pandemic was unconstitutional. But by then the damage was made of course.
- denton-scratch 3y agoThe constitutional court of Spain is an ultra-rightwing joke. Imprisoning Catalan nationalist politicians for calling for independence brought that court into disrepute. I'm not keen on written constitutions, or constitutional courts <cough US Supremes>.
- vdaea 3y agoErrr, that's not exactly what they did, as well as you know :-) In any case I hope we can agree that it's good that they said that restricting our constitutional right to free movement was illegal, even if it had no consequences for those who violated our basic rights so blatantly.
- denton-scratch 3y agoIf I'm wrong about the constitutional court sentencing Catalan nationalist politicians to prison, that's not something I know; feel free to correct me. I don't know what that has to do with free movement, nor how that's related to the imprisoned politicians. FWIW, I don't accept the notion of "human rights" - there are in reality only those privileges that are actually granted. I would like it if there were some kind of universally-accepted set of rights; but only if they are congruent with my own views about what "rights" should look like.
- nottorp 3y agoIf it's done right, it can't be subverted in case of "emergency" can it? If it's full of bugs, it simply doesn't matter.
- AJ007 3y agoThe "e2e" concept that most are familiar with is basically fake: the provider is responsible for the client that does the encryption and decryption. Of course they can break it if forced. Software exploits are a separate matter and also easier to deal with when the end user isn't truly in control of the encryption (or easier if they don't know what they are doing.)
- deleted 3y ago[deleted]
- gjsman-1000 3y agoIf the client is properly developed and secured, they cannot break it without shipping an update to that client to change its behavior - which then affects everyone.
- guappa 3y agoI'm quite sure they can use the app store to push a targeted update just to some.
- px43 3y agoYes, an operating system that uses a compromised software supply chain is at risk of compromise, but that really has nothing to do with e2ee.
- shortsunblack 3y agoE2EE itself as a concept is ridiculous. The word was stolen from networking, end to end, and repurposed for an entirely different and non-sensical context to describe sth completely else. It has to do with "E2EE" because the biggest provided of it, Signal, pushes you to use 'compromised software supply chains' that are iOS and Play Store, evensofar as to spreading FUD about alternative distribution mechanisms, like APKs. That's why you have to go over yourself to find the APK of the App on Signal's website.
- priprimer 3y agothere’s only and opposing secret court mandating the opposite: publicly available encryption must be weakened on release
- Quanttek 3y agoI think that depends on what you mean: a general state of emergency or a specific situation where the police deem there to be an emergency (e.g. classic hidden bomb scenario) Regarding (2), the Court found that a statutory obligation to decrypt E2E-encrypted data upon (judicial) request to be disproportionate, but it could still be imagined that – if more narrowly construed – a law could be considered to be proportionate. But the Court does seem quite unwilling to entertain the idea of backdoors for E2E encryption. Regarding (1), the European Convention on Human Rights (ECHR) allows so-called derogations from certain rights in "time of war or other public emergency threatening the life of the nation" (Art 15 ECHR), insofar as they are necessary and the state of emergency has been properly declared. The right to privacy is such a right, so a State that faces an insurgency may declare a state of emergency and, as part of its emergency measures, could probably demand the decryption of E2E communications if it's necessary to fight the insurgency (e.g. it's a guerilla group using an E2E messenger) - but hard to judge in the abstract.
- layer8 3y agoExceptional circumstances can warrant exceptional measures, but also require exceptional justification, for example by means of a juridical decision for the individual case (i.e., a judge issuing a warrant allowing the police to install and use a backdoor on a concrete individual).
- eastbound 3y agoLet’s just remind that “exceptional justifications” in Canada were “Truckers are protesting with honks in the middle of cities”, so not exactly a matter of national security and in the USA, NSA took it to mean “Any US or non-US citizen on US or non-US soil” (for national security letters).
- steelframe 3y ago> Is there an exception for emergency purposes? The problem is when the "emergency" is "the citizen may be engaged in political activities that are against the interests of the ruling party."
- meindnoch 3y agoYes, in case of an emergency you can ask God to give you the prime factorization of 4096bit numbers.
- Macha 3y agoHonestly, after so many things turning into "they'll just come back and try again in two years", it's a little reassuring to see some longer term roadblocks being put in place against these anti-E2EE proposals.
- p0w3n3d 3y agoyeah, preferably through the Agricultural and Fisheries Commission or a similar body
- Aachen 3y agoI am a bit confused. The article seems fairly political, quoting some promotional text by the pirate party and not describing what case was brought in front of a judge and what the ruling bans specifically, so I clicked through to the actual court case linked at the bottom. It has nothing to do with the pirate party or chatcontrol or any such thing. The court case was one person against the Russian government for fining Telegram when they didn't hand over plain text chat messages, if I'm skimming the initial facts section correctly. The whole article doesn't even contain the word russia. What is the article reporting on and why does it portray it as being related to the recent chatcontrol legislation?! Edit: found the decision > 80. The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored without adequate safeguards against abuse and the requirement to decrypt encrypted communications, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society. > 81. There has accordingly been a violation of Article 8 [privacy] of the Convention [of human rights] Sounds like you can indeed extend that to any other encryption-circumventing law, like chatcontrol, but without considering the specific circumstances that were present in this Russian law, I'm not sure that it will be accurate. Note, for example, the wording in paragraph 80 "without adequate safeguards against abuse". Maybe chatcontrol had those, if that had been brought in front of the same judges
- tokai 3y agoIts a judgement that will provide precedence. A Pirate Party member of the European Parliament comments because its a core issue to the party. Why would there be anything about the Pirate Party in the ruling?
- Aachen 3y agoWhy would you include "We Pirates will now fight even harder for our digital privacy of correspondence!" (and then continuing to link their website as a source of truth on the matter) in a non-promotional piece? This is an advertisement, not a news article One which I agree with, to be clear. I'm not opposed to the pirate party's views on digital matters. This party's goals/narrative just has no place in a piece about a court case
- gjsman-1000 3y agoReminder that the European Court of Human Rights, although very powerful and influential, does not have the authority to force anyone to abide by their rulings. Also, here's a better article: https://fortune.com/2024/02/13/end-to-end-encryption-russia-telegram-european-court-of-human-rights/ https://fortune.com/2024/02/13/end-to-end-encryption-russia-...
- Georgelemental 3y agoFor example, Azerbaijan (a brutal and militarily aggressive dictatorship) is a member
- sampo 3y agoAlso, despite its name and despite its location in Strasbourg, European Court of Human Rights is not an EU institution. https://en.wikipedia.org/wiki/European_Court_of_Human_Rights#Relationship_with_other_courts https://en.wikipedia.org/wiki/European_Court_of_Human_Rights...
- deleted 3y ago[deleted]
- Quanttek 3y agoSlightly misleading: The Court's judgments are legally binding upon the State members of the Council of Europe. However, it is true that there is no armed enforcement mechanism – something that most domestic courts lack too – and instead decisions are enforced and monitored by the Council of Ministers (the equivalent of the UN General Assembly). However, most of its decisions are complied with most of the time by most nations (safe for Russia and Turkey), frequently because domestic courts will abide by the Court's rulings to overturn laws through its own decisions.
- hkt 3y agoNot so. The UK, for instance, appears to treat these rulings as binding. This is why the UK conservatives want to scrap the Human Rights Act and replace it with a supposedly identical Bill of Rights, the key difference being a presumption that the UK's supreme court would cease to defer to the convention court. A couple of examples relating to this that come to mind: * Deporting refugees to Rwanda was stopped by an injunction from the ECHR * Depriving prisoners of votes was ruled illegal in 2005 or so There are a few others but these two come to mind. My understanding is that although the treaties (plural?) of the CoE and ECHR don't assume judgements are binding, a number of countries made them binding in their legal systems via domestic legal instruments.
- HenryBemis 3y agoThe article is semi-garbage (politics aside it is a badly written/biased article). Better read the decision. https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854%22] https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854...} CASE OF PODCHASOV v. RUSSIA (Application no. 33696/19)
- roenxi 3y agoIn defence of the article - it linked the decision. That means it is automatically in something close to the top 20% of articles about political topics. And the actual decision is quite readable; on a quick skim it seemed to agree with what the article said.
- dns_snek 3y agoHN markup seems to be breaking the link, here's an alternative one: https://hudoc.echr.coe.int/eng/?i=001-230854 https://hudoc.echr.coe.int/eng/?i=001-230854
- ryukoposting 3y agoRelevant English text from the Court's press release: > The applicant, Anton Valeryevich Podchasov, is a Russian national who was born in 1981 and lives in Barnaul (Russia). > Mr Podchasov was a user of Telegram, a messaging application which was listed as an “Internet communications organiser” (организатор распространения информации в сети Интернет) by the Russian State. It was therefore obliged by law to store all communications data for a duration of one year and the contents of all communications for a duration of six months and to submit those data to law-enforcement authorities or security services in circumstances specified by law, together with information necessary to decrypt electronic messages if they were encrypted. > Relying on Article 8 (right to respect for correspondence) and Article 13 (right to an effective remedy) of the Convention, Mr Podchasov complains of the legal requirements to store, pass on and decrypt data, and that he did not have an effective remedy for this complaint. > Violation of Article 8 > Just satisfaction: The finding of a violation constitutes in itself sufficient just satisfaction for any non-pecuniary damage sustained by the applicant Source: (this is broken) https://hudoc.echr.coe.int/eng-press/#{%22fulltext%22:[%2233696/19%22] https://hudoc.echr.coe.int/eng-press/#{%22fulltext%22:[%2233...} Edit: Yuck, this website makes it impossible to permalink anything. What a horrible idea for an organization that's supposed to make very important decisions that people need to reference.
- duxup 3y agoThis article doesn’t actually contain any information that backs up the title, or if the title is true at all. There’s a quote from some party member who doesn’t seem directly involved, and almost no information about the actual case / ruling.
- Quanttek 3y agoFor a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted". To come to that conclusion, it referred to the wide-scale impact such a weakening of E2E through backdoors would have and referred to "calls for alternative 'solutions to decryption without weakening the protective mechanisms, both in legislation and through continuous technical evolution.'" Looking at the cited material, these include traditional policing, undercover operations, metadata analysis, international police cooperation, live forensics on seized devices, guessing or obtaining private keys held by parties to the communication, using vulnerabilities in the target’s software or sending an implant to targeted devices. While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. (It should be noted that, although the backdooring of E2E was considered to go beyond how the right to privacy may legitimately be restricted, the right to privacy is a so-called derogable right, i.e. a government can, upon declaration of a state of emergency, derogate from the right insofar that is necessary to address an emergency "threatening the life of the nation" (Art 15 ECHR)) Relevant paragraphs are paras 76-80 here: https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854%22] https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854...}
- Aachen 3y ago> The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. *when no adequate safeguards against abuse are in place Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neither is very specific about what it means)
- Quanttek 3y ago
- yxhuvud 3y agoNice. I can imagine certain ISPs (that I will not shame by name) won't be very happy right now. This really throws a wrench in some proxy models. Good riddance.
- KoolKat23 3y agoPlease do name and shame. This would benefit everyone.
- kypro 3y agoI realise the article contains the same typo, but the title is bugging me – it needs a space between "end" and "encryption". "Endencryption" is not a word. @dang ?
- yusml 3y agoYeah, it's bugging me as well. haha.
- robtherobber 3y agoAh, apologies about that, I didn't even notice it. Happy to see it corrected.
- max_ 3y agoEurope has done something that I actually love. I was worried the "let's think of the children" narrative would take over. The value of encryption has a future in Europe at least.
- guappa 3y agoDespite the name, it's not the eu :D
- max_ 3y agoI was assuming it had jurisdiction over the EU? What is the actual real world impact of this?
- yreg 3y agoThe European Court of Human Rights enforces the European Convention on Human Rights. Its jurisdiction is recognised by the 46 member states of Council of Europe (which includes all of the 27 EU members) + Kosovo.
- Deukhoofd 3y agoIt's a part of the Council of Europe, which includes all European countries besides Russia and Belarus (who got kicked out last year). It has no real enforcement powers for its judgements, though most countries do adopt most its judgements, and it has pushed human rights in Europe forward a lot. While the EU could potentially just ignore the statement, there's a good chance they won't, especially as the European Parliament already tends to be against weakening encryption.
- LightBug1 3y agoExcellent news. The European Court of Human Rights ... the court our idiotic UK gvoernment are trying to paint with the same brush they painted the EU.
- sackfield 3y agoIt's nice to know this also applies to the UK even after Brexit (still a member of the ECHR).
- jacobp100 3y ago[flagged]
- infamouscow 3y agoI'm not sure why this is being downvoted. Governments aren't accountable to their citizens, and there aren't any repercussions nor punishment for violating rights. Sure, the court might have ruled on this, but that's irrelevant when the government decides "national security" takes precedent and uses the media to manufacture the consent of the population into thinking extraordinary times require extraordinary measures. If most of the people with guns want to ignore the court, they will.
- tempestn 3y agoI expect it's being downvoted because it's patronizing and lacking in any useful information beyond an implied disagreement.
- x-complexity 3y agoIt's being downvoted because it's like saying "lol" or "L". Nothing substantive was added to the conversation.
- Georgelemental 3y agoAzerbaijan is in the ECHR too; doesn't stop them from imprisoning political dissidents, employing slave labor, committing war crimes, attacking other ECHR members, or performing ethnic cleansing.
- gpderetta 3y agoWell yes, generally the ECHR has no powers to compel compliance. But ECHR rulings are binding to EU members (and the the various organs of the EU including the ECJ have way to enforce them). ECHR are also still binding in the UK because legislation that says otherwise hasn't been passed yet.
- bulkseo84 3y ago[dead]
- rrrrrrrrrrrryan 3y agoMan, Europe is really setting an example lately for how it's possible to roll out sensible technology regulations.
- miohtama 3y agoThis decision was needed because the EU was about to ban end-to-end encryption. It’s not the EU commission, but a judge that ruled. AFAIK Commission can still ignore this.
- gpderetta 3y agoThey in fact cannot.
- moffkalast 3y agoUrsula on suicide watch.
- ko27 3y agoYou have it the other way around. Majority of EU member countries wanted to to ban E2E, but the EU institutions prevented that.
- dmichulke 3y agoNo, the ECHR is not a EU institution, it's just European. The bad guys here are the commission and some EU member states.
- 0dayz 3y agoHere's the actual position accord to the commission: https://www.europarl.europa.eu/doceo/document/E-9-2023-001661-ASW_EN.html https://www.europarl.europa.eu/doceo/document/E-9-2023-00166...
- 3y ago
- deleted 3y ago[deleted]
- denton-scratch 3y ago> The judgement cites using vulnerabilities in the target’s software or sending an implant to targeted devices as examples [of legitimate ways to defeat E2E encryption]. That looks like a bad judgement, to me; exploiting vulnerabilities, or using implants, is generally some kind of criminal hacking. So the court seems to be saying that's not OK, unless you're a government. I.e., governments don't have to obey the law. There are quite a few EU governments that would prefer not to have to comply with the law. Every EU government gets to plant a judge on the ECHR bench.
- denton-scratch 3y ago> Every EU government gets to plant a judge on the ECHR bench. Every EU Council member? Not sure why I was downvoted, because the downvoters didn't care to comment.
- deleted 3y ago[deleted]
- Georgelemental 3y agoA "Court of Human Rights" that counts Azerbaijan as a member is not a court that should be taken seriously.
- LuciBb 3y ago[dead]
- nadermx 3y agoThey also ruled a while ago on site blocking, which has at least been tested in the Mexican supreme court[0] translated via google "As the United Nations Human Rights Council has stated, blocking an Internet page implies any measure taken to prevent certain online content from reaching an end user. In this regard, it must be taken into account that restrictions on the human right of freedom of expression should not be excessively broad, on the contrary, they should refer to specific content; Hence, generic prohibitions on the operation of certain websites and web systems, such as blocking, are incompatible with the human right of freedom of expression, except in truly exceptional situations, which could arise when the contents of an Internet page are translate into prohibited expressions, that is, classified as crimes in accordance with international criminal law, among which the following stand out: (I) incitement to terrorism; (II) the advocacy of national, racial or religious hatred that constitutes incitement to discrimination, hostility or violence - dissemination of "hate speech" on the Internet; (III) direct and public incitement to commit genocide; and (IV) child pornography. Likewise, the exceptional situation regarding the prohibition of generic restrictions on the right of expression could also be generated when the entire contents of a web page are illegal, which logically could lead to its blocking, as it is limited only to hosting expressions that are not permissible by law. the legal framework." [0] https://vlex.com.mx/vid/tesis-aisladas-683012725 https://vlex.com.mx/vid/tesis-aisladas-683012725
- Williams77 3y ago[dead]
- dkwsupermanga 3y ago[dead]
- holoduke 3y agoWhat the hell is wrong with our democratic values to begin with? Why do we need high court decisions for these insane ideas of making a better world. Are these people infected by some corporate lobby or what is it why they cannot think in favour of human kind. I cannot phantom this.
- WalterBright 3y agoWeakening of secure end-to-end encryption means the encryption is worthless.
- germandiago 3y agoGood news
- Nostromos 3y agoThere's a degree of push/pull on government and industry as far as encryption is concerned. Government shouldn't be injecting vulnerabilities into algos but they also need a way to read messages from criminals and terrorists. Industry wants some way for customers to feel safe using their product to message or whatever their (legal) use case. Without some local pressure, this cedes encryption commercialization to the US. Sure academics will still love their novel algos but until someone can make money from them, they'll sit in papers, ready for the enterprising american dev to turn into the next big encrypted chat app that is more secure than Signal or something like that.