4 ms·

European court favors strong encryption, calling it key to privacy rights

266 points by miles 3y ago

dantastic 3y ago
https://archive.is/TOCOO https://archive.is/TOCOO
- smartbit 3y ago
  EFF press announcement https://news.ycombinator.com/item?id=39609256 https://news.ycombinator.com/item?id=39609256
ChrisArchitect 3y ago
[dupe] More over here on EFF post: European Court Confirms: Weakening Encryption Violates Fundamental Rights https://news.ycombinator.com/item?id=39609256 https://news.ycombinator.com/item?id=39609256
- deleted 3y ago
  [deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]
pvg 3y ago
Does anyone have a good sense of how ECHR rulings affect legislative practice? I know the rulings are considered binding to signatories but the article is fairly vague/wishcasty on the practical implications: Although digital rights advocates said they don’t expect Russia, one of the signatories to the human rights convention, to change its laws, they said the United Kingdom, also a signatory, is likely to modify pending legislation that had sought to bring similar pressure on companies there. “This will have to be taken into account,” said Ioannis Kouvakas, an assistant general counsel at the U.K.-based rights group Privacy International, which intervened in the Telegram case. “It would be the U.K. setting itself up for failure if they think this doesn’t apply.” That's a 'likely' followed by a quote by an advocate who also sounds a bit circumspect - not, say, 'this would be a violation of UK's obligations and subject to legal challenge' but just 'setting itself up for failure', whatever that means.
- theodric 3y ago
  As of a few months ago, the UK was still discussing separating from the ECHR [1], so they may yet snatch their success from the jaws of failure either way. Reading between the lines of their Q&A [2], it seems largely de facto and functionally voluntary for the participating nations to comply, perhaps straying into strongly-worded letter of disappointment territory in the case of a failure to comply. And they can apparently just leave. How do you push around a sovereign entity with a military? Sanctions, I guess. [1] https://www.ibanet.org/UK-ministers-continue-to-discuss-drastic-step-of-leaving-ECHR https://www.ibanet.org/UK-ministers-continue-to-discuss-dras... [2] https://www.echr.coe.int/documents/d/echr/50questions_eng https://www.echr.coe.int/documents/d/echr/50questions_eng
  - intunderflow 3y ago
    The level of protection you get from the ECHR is very dependent on what country you are in and how they interpret the convention. In some countries such as Denmark the ECHR and its rulings are considered to be absolutely binding and self executing by the national courts: > The European Convention on Human Rights is implemented in Danish law. This means that the convention is directly applicable in Denmark. Danish law must therefore be interpreted in accordance with the convention. In other countries rulings are routinely fully or partially ignored (for example the UK entirely ignored an ECHR ruling on prisoners voting).
  - tonfa 3y ago
    > voluntary for the participating nations to comply Most of those nations judiciary systems will enforce the ruling (eventually triggering legislative changes to reconcile things).
    - lazide 3y ago
      Is there any precedent of that actually happening, in say the UK?
  - ClumsyPilot 3y ago
    [flagged]
Havoc 3y ago
About f time. Europe was leaning heavily into the we need watch everything to keep you safe there for a bit
- deleted 3y ago
  [deleted]
- wkat4242 3y ago
  This won't stop them and the respite from "ChatControl" is only temporary. This isn't over, they will try again and again. It'll come back under a different name, just like Google keeps coming up with tracking initiatives when they're shut down. They just perk it up, add some 'privacy safeguards' and a cool new branding, perhaps find some way to tie it in to the latest scandal in the news, and try again and hope the next one sticks. It's not even a conspiracy, there's just a huge lobby profiting from this and they will keep pushing. It's business. And this was far from a decisive victory. It came very close to being implemented, unlike previous attempts. This was already attempt 2 and that's in this particular push only https://european-pirateparty.eu/chatcontrol-the-sequel-nobody-asked-for/ https://european-pirateparty.eu/chatcontrol-the-sequel-nobod... We have to stay vigilant. Don't forget this is the organisation that tried to push software patents through during a meeting of farming ministers. The European court is on our side here but the commission is not. Ps I don't really understand the downvotes. I don't think I'm saying anything untoward. And in EU privacy circles (which I follow strongly) the feeling is very much "we won this battle but not the war". I'm not complaining, just wondering. Don't forget here in Europe freedom isn't as huge a selling point as it is in the US. And even that has made several attempts over the years including the infamous clipper chip.
  - xvector 3y ago
    The fundamental problem is that the EU's regulatory bodies do not understand technology. Regulation in the EU has turned into a bona-fide industry, and it's a massive train of the blind leading the blind. Whether it's with Article 45 trying to break PKI [1], or with the AI Act trying to regulate the transformer model itself [2], or with ChatControl trying to surveil everyone, EU regulation is clearly a clownshow at this point where you get cheered on as long as you propose some regulation, any regulation! [1]:https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years https://www.eff.org/deeplinks/2023/11/article-45-will-roll-b... [2]: https://twitter.com/arthurmensch/status/1725076260827566562?s=20 https://twitter.com/arthurmensch/status/1725076260827566562?...
osigurdson 3y ago
[flagged]
- deleted 3y ago
  [deleted]
nhggfu 3y ago
meanwhile most European countries are surveilling their own people.
GoblinSlayer 3y ago
>it would have to install a back door that would work against everyone Right, what's the point in e2ee if you can just receive a backdoor in the official client and you can't have an independent client, because hello it's a walled garden?
alphazard 3y ago
This isn't a good thing. It's a step towards regulating the kinds of encryption required to market software in the EU. Once there are rules on the kinds of encryption that must be used, then a backdoored algorithm can be required by law. We want companies to choose the cryptographic algorithms based on what is recommended by experts in the field. The experts in cryptography inform software engineers, who implement the algorithms where they work. They pass on good software recommendations to family members and friends who ask. That leads to a world where everyone is using Signal, or a competent competitor. The chain of trust is organic and legitimate all the way from the user to the person that told them to use signal, to the domain expert that said signal uses solid cryptography to the cryptographers designing the algorithms. If you want privacy you have to create demand for it. Markets can satisfy demand, legislating supply creates excess unwanted things (like backdoored algorithms).
- braiamp 3y ago
  What in the article motivates you to write such comment? The only thing that this court rules does is to reaffirm the right of privacy, and that non-broken encryption is one of the guarantees that citizens have to obtain the right. > The court praised end-to-end encryption generally, noting that it “appears to help citizens and businesses to defend themselves against abuses of information technologies, such as hacking, identity and personal data theft, fraud and the improper disclosure of confidential information.”
- pas 3y ago
  We regret to inform you but we have run out of pure good things. (Also pure bad things too, so yeey?) It's a step, but precedent is (was) already established (US export controls on crypto), and regulations can take two steps at once. (It's not a nice discrete process.) And yes, of course, it's a trade off. Mandating strong encryption and sane security (no preset password in IoT/other devices), and the usual nice things (security updates) for things sold in the EU definitely puts these things in the regulated sphere. (Also, a hypothetical "right of the people to keep and bear Cryptography" law is also regulation, it's just a trivial one. And then folks start talking about what is and what is not Cryptography. And we're back to square whatever.)

266 points by miles 3y ago

dantastic 3y ago

https://archive.is/TOCOO https://archive.is/TOCOO

smartbit 3y ago
EFF press announcement https://news.ycombinator.com/item?id=39609256 https://news.ycombinator.com/item?id=39609256

ChrisArchitect 3y ago

[dupe] More over here on EFF post: European Court Confirms: Weakening Encryption Violates Fundamental Rights https://news.ycombinator.com/item?id=39609256 https://news.ycombinator.com/item?id=39609256

deleted 3y ago
[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago
[deleted]

pvg 3y ago

Does anyone have a good sense of how ECHR rulings affect legislative practice? I know the rulings are considered binding to signatories but the article is fairly vague/wishcasty on the practical implications: Although digital rights advocates said they don’t expect Russia, one of the signatories to the human rights convention, to change its laws, they said the United Kingdom, also a signatory, is likely to modify pending legislation that had sought to bring similar pressure on companies there. “This will have to be taken into account,” said Ioannis Kouvakas, an assistant general counsel at the U.K.-based rights group Privacy International, which intervened in the Telegram case. “It would be the U.K. setting itself up for failure if they think this doesn’t apply.” That's a 'likely' followed by a quote by an advocate who also sounds a bit circumspect - not, say, 'this would be a violation of UK's obligations and subject to legal challenge' but just 'setting itself up for failure', whatever that means.

theodric 3y ago
As of a few months ago, the UK was still discussing separating from the ECHR [1], so they may yet snatch their success from the jaws of failure either way. Reading between the lines of their Q&A [2], it seems largely de facto and functionally voluntary for the participating nations to comply, perhaps straying into strongly-worded letter of disappointment territory in the case of a failure to comply. And they can apparently just leave. How do you push around a sovereign entity with a military? Sanctions, I guess. [1] https://www.ibanet.org/UK-ministers-continue-to-discuss-drastic-step-of-leaving-ECHR https://www.ibanet.org/UK-ministers-continue-to-discuss-dras... [2] https://www.echr.coe.int/documents/d/echr/50questions_eng https://www.echr.coe.int/documents/d/echr/50questions_eng
- intunderflow 3y ago
  The level of protection you get from the ECHR is very dependent on what country you are in and how they interpret the convention. In some countries such as Denmark the ECHR and its rulings are considered to be absolutely binding and self executing by the national courts: > The European Convention on Human Rights is implemented in Danish law. This means that the convention is directly applicable in Denmark. Danish law must therefore be interpreted in accordance with the convention. In other countries rulings are routinely fully or partially ignored (for example the UK entirely ignored an ECHR ruling on prisoners voting).
- tonfa 3y ago
  > voluntary for the participating nations to comply Most of those nations judiciary systems will enforce the ruling (eventually triggering legislative changes to reconcile things).
  - lazide 3y ago
    Is there any precedent of that actually happening, in say the UK?
- ClumsyPilot 3y ago
  [flagged]

Havoc 3y ago

About f time. Europe was leaning heavily into the we need watch everything to keep you safe there for a bit

deleted 3y ago
[deleted]
wkat4242 3y ago
This won't stop them and the respite from "ChatControl" is only temporary. This isn't over, they will try again and again. It'll come back under a different name, just like Google keeps coming up with tracking initiatives when they're shut down. They just perk it up, add some 'privacy safeguards' and a cool new branding, perhaps find some way to tie it in to the latest scandal in the news, and try again and hope the next one sticks. It's not even a conspiracy, there's just a huge lobby profiting from this and they will keep pushing. It's business. And this was far from a decisive victory. It came very close to being implemented, unlike previous attempts. This was already attempt 2 and that's in this particular push only https://european-pirateparty.eu/chatcontrol-the-sequel-nobody-asked-for/ https://european-pirateparty.eu/chatcontrol-the-sequel-nobod... We have to stay vigilant. Don't forget this is the organisation that tried to push software patents through during a meeting of farming ministers. The European court is on our side here but the commission is not. Ps I don't really understand the downvotes. I don't think I'm saying anything untoward. And in EU privacy circles (which I follow strongly) the feeling is very much "we won this battle but not the war". I'm not complaining, just wondering. Don't forget here in Europe freedom isn't as huge a selling point as it is in the US. And even that has made several attempts over the years including the infamous clipper chip.
- xvector 3y ago
  The fundamental problem is that the EU's regulatory bodies do not understand technology. Regulation in the EU has turned into a bona-fide industry, and it's a massive train of the blind leading the blind. Whether it's with Article 45 trying to break PKI [1], or with the AI Act trying to regulate the transformer model itself [2], or with ChatControl trying to surveil everyone, EU regulation is clearly a clownshow at this point where you get cheered on as long as you propose some regulation, any regulation! [1]:https://www.eff.org/deeplinks/2023/11/article-45-will-roll-back-web-security-12-years https://www.eff.org/deeplinks/2023/11/article-45-will-roll-b... [2]: https://twitter.com/arthurmensch/status/1725076260827566562?s=20 https://twitter.com/arthurmensch/status/1725076260827566562?...

osigurdson 3y ago

[flagged]

deleted 3y ago
[deleted]

nhggfu 3y ago

meanwhile most European countries are surveilling their own people.

GoblinSlayer 3y ago

>it would have to install a back door that would work against everyone Right, what's the point in e2ee if you can just receive a backdoor in the official client and you can't have an independent client, because hello it's a walled garden?

alphazard 3y ago

This isn't a good thing. It's a step towards regulating the kinds of encryption required to market software in the EU. Once there are rules on the kinds of encryption that must be used, then a backdoored algorithm can be required by law. We want companies to choose the cryptographic algorithms based on what is recommended by experts in the field. The experts in cryptography inform software engineers, who implement the algorithms where they work. They pass on good software recommendations to family members and friends who ask. That leads to a world where everyone is using Signal, or a competent competitor. The chain of trust is organic and legitimate all the way from the user to the person that told them to use signal, to the domain expert that said signal uses solid cryptography to the cryptographers designing the algorithms. If you want privacy you have to create demand for it. Markets can satisfy demand, legislating supply creates excess unwanted things (like backdoored algorithms).

braiamp 3y ago
What in the article motivates you to write such comment? The only thing that this court rules does is to reaffirm the right of privacy, and that non-broken encryption is one of the guarantees that citizens have to obtain the right. > The court praised end-to-end encryption generally, noting that it “appears to help citizens and businesses to defend themselves against abuses of information technologies, such as hacking, identity and personal data theft, fraud and the improper disclosure of confidential information.”
pas 3y ago
We regret to inform you but we have run out of pure good things. (Also pure bad things too, so yeey?) It's a step, but precedent is (was) already established (US export controls on crypto), and regulations can take two steps at once. (It's not a nice discrete process.) And yes, of course, it's a trade off. Mandating strong encryption and sane security (no preset password in IoT/other devices), and the usual nice things (security updates) for things sold in the EU definitely puts these things in the regulated sphere. (Also, a hypothetical "right of the people to keep and bear Cryptography" law is also regulation, it's just a trivial one. And then folks start talking about what is and what is not Cryptography. And we're back to square whatever.)