8 ms·

EU Plans Major Expansion of Mass Surveillance

70 points by NewbornGlow 2y ago

izacus 2y ago
The link to the document because this post is a pretty undetailed blogspam: https://cdn.netzpolitik.org/wp-upload/2024/06/2024-05-22-Recommendation-HLG-Going-Dark-c.pdf https://cdn.netzpolitik.org/wp-upload/2024/06/2024-05-22-Rec... In general, most of the document is set as a "information collection" proposal from different "expert working groups" (expert names redacted). It's mostly proposing standardizing who collects data, what data is collected, jointly buying surveillance software/technology and in general harmonizing EU-state laws when it comes to that. However, AGAIN there's the outright demand to collect and expose data: 22. Implementing lawful access by design in all relevant technologies in line with the needs expressed by law enforcement, ensuring at the same time strong security and cybersecurity and providing for the full respect of legal obligations on lawful access. According to the HLG, law enforcement authorities should contribute to the definition of requirements, but it should not be their role to impose specific solutions on companies so that they can provide lawful access to data for criminal investigative purposes without compromising security. To that end, experts recommend developing a technology roadmap that brings together technology, cybersecurity, privacy, standardisation and security experts and ensures adequate coordination e.g. potentially through a permanent structure. also two new fun things: 33. Developing a mechanism to ensure that Member States can enforce sanctions against noncooperative Electronic Communications Services54, and that such measures act as a deterrent against those entities. Both administrative and criminal law measures should be available and should be applied depending on whether a provider is merely non-cooperative or is deliberately hosting activities of a criminal nature. 34. Harmonising at EU level criminal law measures to enforce cooperation, including imprisonment. The same should apply to non-cooperative hosting providers (in addition to Electronic Communications Services) to ensure that such companies, when hosting communication services of a criminal nature, adequately comply with the judicial orders they receive. [The coherence of this recommendation with the rules established by the Digital Services Act Regulation should be further assessed] They seem to be seeking to make sure that every EU member state enshrines data collection in their law (even ones that are more privacy obeying) and punish companies which refuse to implement backdoors into communication systems.
- Hizonner 2y ago
  Collect, expose, do it in a convenient format so law enforcement doesn't have to do any work, do 99 percent of the technical standards work to determine what that format is, make sure that it works for any every kind of system or service (including ones not yet invented)... and somehow magically put in all these back doors without reducing security.
jmakov 2y ago
Finally sth to monitor our politicians and every director/leads at state agencies or state owned companies. I always wanted to have that for my emoloyees that I pay +50% of my sallary to.
throw46365 2y ago
This is better understood for Americans in terms like "Grouping of State governors submits plan". The European Commission doesn't pass laws. It represents the heads of state of the EU nations, and it can propose legislation, but not pass it. Only the Parliament can pass legislation, and the parliament is made up of (720, as of this year) MEPs from various national parties in EU states representing somewhat-large constituencies in their home states, in weird and wobbly international groupings. So it's a much tougher sell. ETA: Governors isn't an ideal comparison -- commissioners are appointed representatives of the heads of state/heads of government, a bit like ambassadors, and they are supposed to think collectively like ministers of a European government. But it's sort of closer to the idea. Essentially in my analogy, it's a bit like if all the state governments gathered some delegates who asked the Senate or House to write legislation, and provided them with an outline. But my point is, the Commission planning something doesn't at all mean it's going to happen.
- surfingdino 2y ago
  And sometimes member states do it anyway https://notesfrompoland.com/2024/05/29/polish-surveillance-law-violates-human-rights-rules-european-court/ https://notesfrompoland.com/2024/05/29/polish-surveillance-l...
  - throw46365 2y ago
    Right -- states are very often ahead of the EU on all sorts of legislation, though. It was always amusing to see Brits complain that the EU imposed GDPR on us, when it was pretty much our own existing legislation (the Data Protection Act of 1998) that gave the GDPR most of the structure it has.
- Hizonner 2y ago
  Governors in the US aren't formally the main source of federal legislative proposals, nor do they represent their states at the federal level in any formal way. They can propose legislation in the same sense that any citizen can, but a petition signed by all 50 of them would have zero legal force in terms of requiring Congress to take anything up. The Commission is a lot more integrated into the process. Governors of US states are also directly elected, and have to be careful about annoying the voters too much... and it would be noticed if each of them individually signed onto something like you suggest. It'd be even more noticed if they did it over and over every year. Commissioners are at one or two levels of appointed remove, and are also somewhat sheltered by the Commision as a collective. They can more easily get away with repeatedly raising unpopular proposals until they manage to wear everybody down and move the Overton window.
rvz 2y ago
But the EU cares deeply about us though. It’s for our safety! /s Thank EU!
- rvnx 2y ago
  No :' Please take back the popups about cookies, and these silly plastic caps.
jonesjohnson 2y ago
I agree that what's going on in the EU council is a very big problem. But what is that website about? They want my money? for what? It doesn't look like it's a legit NGO, let alone a European one. > Reclaim The Net is supported by you, those who care about the future of the internet and are concerned about Big Tech, media, and governments controlling speech and eroding liberties. > Become a contributing member to keep fighting for individual liberty online. Not only does your donation support our work around free speech, alternative tech, privacy, and individual liberty online, members also get…[list of perks] You have to enter a made up email address to get to the "choose your membership" page [1] https://reclaimthenet.org/support https://reclaimthenet.org/support
- tzs 2y ago
  > But what is that website about? They want my money? for what? It doesn't look like it's a legit NGO, let alone a European one. People have wondered that for a while [1] [2], and so far no one has found out much about them. [1] https://news.ycombinator.com/item?id=23276430 https://news.ycombinator.com/item?id=23276430 [2] https://www.reddit.com/r/privacy/comments/gkq5s4/does_anyone_know_who_owns_reclaimthenetorg/ https://www.reddit.com/r/privacy/comments/gkq5s4/does_anyone...
Snowworm 2y ago
The question when governments are enforcing backdoors is, how can they be sure hackers won't abuse these new backdoors too? This is going to do a lot more harm than good. It's reassuring to know that these are the sorts of people running our society.
- quitit 2y ago
  We already know there is no way make a back door that only the "good guys" can access. However I see that discussion as moot because governments past and present already abuse the information technology they have access to. Below is just a small snippet of the seemingly countless number of examples I could find in minute of searching: USA: N.J. cop used police databases to stalk ex-girlfriend, investigators say https://www.nj.com/monmouth/2023/01/nj-cop-used-police-databases-to-stalk-ex-girlfriend-investigators-say.html https://www.nj.com/monmouth/2023/01/nj-cop-used-police-datab... Officer Fired for Allegedly Using Police Database to Stalk, Harass Women https://www.newsweek.com/officer-fired-allegedly-using-police-database-stalk-harass-women-1615920 https://www.newsweek.com/officer-fired-allegedly-using-polic... Australia: Former policeman accused of using force database to stalk ex-wife and girlfriend https://www.theage.com.au/national/victoria/former-policeman-accused-of-using-force-database-to-stalk-ex-wife-and-girlfriend-20230303-p5cp8g.html https://www.theage.com.au/national/victoria/former-policeman... Former federal police officer faces new charges over stalking of ex-girlfriend https://www.canberratimes.com.au/story/6138318/former-federal-police-officer-faces-new-charges-over-stalking-of-ex-girlfriend/ https://www.canberratimes.com.au/story/6138318/former-federa... (Note the two above articles are not the same person) UK: Met police officer 'used CCTV cameras to stalk his ex-girlfriend after telling her to take up sex work to pay her bills' https://www.dailymail.co.uk/news/article-11868575/Met-police-officer-used-CCTV-stalk-ex-girlfriend-telling-sex-work-pay-bills.html https://www.dailymail.co.uk/news/article-11868575/Met-police... Creepy cop saw attractive woman on the road and 'looked up her license plate number so he could stalk her on Facebook' https://www.dailymail.co.uk/news/article-2178556/Officer-Jeffrey-Tyther-used-license-plate-database-stalk-woman-Facebook.html https://www.dailymail.co.uk/news/article-2178556/Officer-Jef...
TheChaplain 2y ago
To attempt another perspective on this... These days we have organized crime, drug cartels, human trafficking, government corruption, terrorist activities but from that all the way to simple crime as three dudes sharing pictures of a girl they gangraped while she was unconscious.. All this, happening on encrypted platforms. Mass surveillance is probably not the silver bullet to deal with it. And yes, most hardened criminals will certainly find a way around.. But, then what are effective measures, in terms of time and cost?
- hiatus 2y ago
  > Mass surveillance is probably not the silver bullet to deal with it. And yes, most hardened criminals will certainly find a way around.. So should the government be reading every piece of mail too? And record your private conversations? Why not put a microphone and camera in your home to ensure you are not gangraping anyone? > But, then what are effective measures, in terms of time and cost? Effective measures need not be time or cost efficient. Maintaining a free society is expensive.
  - throw46365 2y ago
    > So should the government be reading every piece of mail too? Essentially all governments have some mechanism to make it legal and possible for them to read any post in transit. US postal inspectors need a warrant, which they can easily get. In the UK, once you post something in a post box, it becomes the temporary property of the crown (the state) until it is delivered, so they can read it when they want. They have to open it, of course, so you would know it happened. The simple problem with encryption is that it replaces communications that are exposed to this authority with communications that can evade it. Whether you are happy with it or not, it's absolutely true that inspecting post has thwarted serious crimes, so it's not surprising to see governments seeking to have the same powers. The fact that it's impossible to do safely doesn't necessarily make it an idiotic request. And the instantaneous nature of these communications means retention for some period of time is the only way inspection is even possible. I am not sure we should blame governments for wanting to retain powers in a social contract we've been broadly happy for them to have for 150 years. It's technologists' jobs to explain why easily-broken encryption is a bad idea. In the UK that's really easy. You just say "imagine if the Prime Minister could read their own party's whatsapp group whenever they liked". And then they get it.
deleted 2y ago
[deleted]
henriquenunez 2y ago
We need community run resiliency more than ever. Support TOR!
LelouBil 2y ago
Isn't the EU parliament completely against surveillance like this ? That's what happened to Chat Control right ?
- izacus 2y ago
  It was, but this weekend it's election time which can change that.
kkfx 2y ago
That's why we MUST impose FLOSS by popular acclaim and came back to desktop computing and home servers. That's why modern connected cars are designed to be a national security threat as well as many other macro-bugs.

70 points by NewbornGlow 2y ago

The link to the document because this post is a pretty undetailed blogspam: https://cdn.netzpolitik.org/wp-upload/2024/06/2024-05-22-Recommendation-HLG-Going-Dark-c.pdf https://cdn.netzpolitik.org/wp-upload/2024/06/2024-05-22-Rec... In general, most of the document is set as a "information collection" proposal from different "expert working groups" (expert names redacted). It's mostly proposing standardizing who collects data, what data is collected, jointly buying surveillance software/technology and in general harmonizing EU-state laws when it comes to that. However, AGAIN there's the outright demand to collect and expose data: 22. Implementing lawful access by design in all relevant technologies in line with the needs expressed by law enforcement, ensuring at the same time strong security and cybersecurity and providing for the full respect of legal obligations on lawful access. According to the HLG, law enforcement authorities should contribute to the definition of requirements, but it should not be their role to impose specific solutions on companies so that they can provide lawful access to data for criminal investigative purposes without compromising security. To that end, experts recommend developing a technology roadmap that brings together technology, cybersecurity, privacy, standardisation and security experts and ensures adequate coordination e.g. potentially through a permanent structure. also two new fun things: 33. Developing a mechanism to ensure that Member States can enforce sanctions against noncooperative Electronic Communications Services54, and that such measures act as a deterrent against those entities. Both administrative and criminal law measures should be available and should be applied depending on whether a provider is merely non-cooperative or is deliberately hosting activities of a criminal nature. 34. Harmonising at EU level criminal law measures to enforce cooperation, including imprisonment. The same should apply to non-cooperative hosting providers (in addition to Electronic Communications Services) to ensure that such companies, when hosting communication services of a criminal nature, adequately comply with the judicial orders they receive. [The coherence of this recommendation with the rules established by the Digital Services Act Regulation should be further assessed] They seem to be seeking to make sure that every EU member state enshrines data collection in their law (even ones that are more privacy obeying) and punish companies which refuse to implement backdoors into communication systems.

Hizonner 2y ago
Collect, expose, do it in a convenient format so law enforcement doesn't have to do any work, do 99 percent of the technical standards work to determine what that format is, make sure that it works for any every kind of system or service (including ones not yet invented)... and somehow magically put in all these back doors without reducing security.

jmakov 2y ago

Finally sth to monitor our politicians and every director/leads at state agencies or state owned companies. I always wanted to have that for my emoloyees that I pay +50% of my sallary to.

throw46365 2y ago

This is better understood for Americans in terms like "Grouping of State governors submits plan". The European Commission doesn't pass laws. It represents the heads of state of the EU nations, and it can propose legislation, but not pass it. Only the Parliament can pass legislation, and the parliament is made up of (720, as of this year) MEPs from various national parties in EU states representing somewhat-large constituencies in their home states, in weird and wobbly international groupings. So it's a much tougher sell. ETA: Governors isn't an ideal comparison -- commissioners are appointed representatives of the heads of state/heads of government, a bit like ambassadors, and they are supposed to think collectively like ministers of a European government. But it's sort of closer to the idea. Essentially in my analogy, it's a bit like if all the state governments gathered some delegates who asked the Senate or House to write legislation, and provided them with an outline. But my point is, the Commission planning something doesn't at all mean it's going to happen.

surfingdino 2y ago
And sometimes member states do it anyway https://notesfrompoland.com/2024/05/29/polish-surveillance-law-violates-human-rights-rules-european-court/ https://notesfrompoland.com/2024/05/29/polish-surveillance-l...
- throw46365 2y ago
  Right -- states are very often ahead of the EU on all sorts of legislation, though. It was always amusing to see Brits complain that the EU imposed GDPR on us, when it was pretty much our own existing legislation (the Data Protection Act of 1998) that gave the GDPR most of the structure it has.
Hizonner 2y ago
Governors in the US aren't formally the main source of federal legislative proposals, nor do they represent their states at the federal level in any formal way. They can propose legislation in the same sense that any citizen can, but a petition signed by all 50 of them would have zero legal force in terms of requiring Congress to take anything up. The Commission is a lot more integrated into the process. Governors of US states are also directly elected, and have to be careful about annoying the voters too much... and it would be noticed if each of them individually signed onto something like you suggest. It'd be even more noticed if they did it over and over every year. Commissioners are at one or two levels of appointed remove, and are also somewhat sheltered by the Commision as a collective. They can more easily get away with repeatedly raising unpopular proposals until they manage to wear everybody down and move the Overton window.

rvz 2y ago

But the EU cares deeply about us though. It’s for our safety! /s Thank EU!

rvnx 2y ago
No :' Please take back the popups about cookies, and these silly plastic caps.

jonesjohnson 2y ago

I agree that what's going on in the EU council is a very big problem. But what is that website about? They want my money? for what? It doesn't look like it's a legit NGO, let alone a European one. > Reclaim The Net is supported by you, those who care about the future of the internet and are concerned about Big Tech, media, and governments controlling speech and eroding liberties. > Become a contributing member to keep fighting for individual liberty online. Not only does your donation support our work around free speech, alternative tech, privacy, and individual liberty online, members also get…[list of perks] You have to enter a made up email address to get to the "choose your membership" page [1] https://reclaimthenet.org/support https://reclaimthenet.org/support

tzs 2y ago
> But what is that website about? They want my money? for what? It doesn't look like it's a legit NGO, let alone a European one. People have wondered that for a while [1] [2], and so far no one has found out much about them. [1] https://news.ycombinator.com/item?id=23276430 https://news.ycombinator.com/item?id=23276430 [2] https://www.reddit.com/r/privacy/comments/gkq5s4/does_anyone_know_who_owns_reclaimthenetorg/ https://www.reddit.com/r/privacy/comments/gkq5s4/does_anyone...

Snowworm 2y ago

The question when governments are enforcing backdoors is, how can they be sure hackers won't abuse these new backdoors too? This is going to do a lot more harm than good. It's reassuring to know that these are the sorts of people running our society.

quitit 2y ago
We already know there is no way make a back door that only the "good guys" can access. However I see that discussion as moot because governments past and present already abuse the information technology they have access to. Below is just a small snippet of the seemingly countless number of examples I could find in minute of searching: USA: N.J. cop used police databases to stalk ex-girlfriend, investigators say https://www.nj.com/monmouth/2023/01/nj-cop-used-police-databases-to-stalk-ex-girlfriend-investigators-say.html https://www.nj.com/monmouth/2023/01/nj-cop-used-police-datab... Officer Fired for Allegedly Using Police Database to Stalk, Harass Women https://www.newsweek.com/officer-fired-allegedly-using-police-database-stalk-harass-women-1615920 https://www.newsweek.com/officer-fired-allegedly-using-polic... Australia: Former policeman accused of using force database to stalk ex-wife and girlfriend https://www.theage.com.au/national/victoria/former-policeman-accused-of-using-force-database-to-stalk-ex-wife-and-girlfriend-20230303-p5cp8g.html https://www.theage.com.au/national/victoria/former-policeman... Former federal police officer faces new charges over stalking of ex-girlfriend https://www.canberratimes.com.au/story/6138318/former-federal-police-officer-faces-new-charges-over-stalking-of-ex-girlfriend/ https://www.canberratimes.com.au/story/6138318/former-federa... (Note the two above articles are not the same person) UK: Met police officer 'used CCTV cameras to stalk his ex-girlfriend after telling her to take up sex work to pay her bills' https://www.dailymail.co.uk/news/article-11868575/Met-police-officer-used-CCTV-stalk-ex-girlfriend-telling-sex-work-pay-bills.html https://www.dailymail.co.uk/news/article-11868575/Met-police... Creepy cop saw attractive woman on the road and 'looked up her license plate number so he could stalk her on Facebook' https://www.dailymail.co.uk/news/article-2178556/Officer-Jeffrey-Tyther-used-license-plate-database-stalk-woman-Facebook.html https://www.dailymail.co.uk/news/article-2178556/Officer-Jef...

TheChaplain 2y ago

To attempt another perspective on this... These days we have organized crime, drug cartels, human trafficking, government corruption, terrorist activities but from that all the way to simple crime as three dudes sharing pictures of a girl they gangraped while she was unconscious.. All this, happening on encrypted platforms. Mass surveillance is probably not the silver bullet to deal with it. And yes, most hardened criminals will certainly find a way around.. But, then what are effective measures, in terms of time and cost?

hiatus 2y ago
> Mass surveillance is probably not the silver bullet to deal with it. And yes, most hardened criminals will certainly find a way around.. So should the government be reading every piece of mail too? And record your private conversations? Why not put a microphone and camera in your home to ensure you are not gangraping anyone? > But, then what are effective measures, in terms of time and cost? Effective measures need not be time or cost efficient. Maintaining a free society is expensive.
- throw46365 2y ago
  > So should the government be reading every piece of mail too? Essentially all governments have some mechanism to make it legal and possible for them to read any post in transit. US postal inspectors need a warrant, which they can easily get. In the UK, once you post something in a post box, it becomes the temporary property of the crown (the state) until it is delivered, so they can read it when they want. They have to open it, of course, so you would know it happened. The simple problem with encryption is that it replaces communications that are exposed to this authority with communications that can evade it. Whether you are happy with it or not, it's absolutely true that inspecting post has thwarted serious crimes, so it's not surprising to see governments seeking to have the same powers. The fact that it's impossible to do safely doesn't necessarily make it an idiotic request. And the instantaneous nature of these communications means retention for some period of time is the only way inspection is even possible. I am not sure we should blame governments for wanting to retain powers in a social contract we've been broadly happy for them to have for 150 years. It's technologists' jobs to explain why easily-broken encryption is a bad idea. In the UK that's really easy. You just say "imagine if the Prime Minister could read their own party's whatsapp group whenever they liked". And then they get it.

deleted 2y ago

[deleted]

henriquenunez 2y ago

We need community run resiliency more than ever. Support TOR!

LelouBil 2y ago

Isn't the EU parliament completely against surveillance like this ? That's what happened to Chat Control right ?

izacus 2y ago
It was, but this weekend it's election time which can change that.

kkfx 2y ago

That's why we MUST impose FLOSS by popular acclaim and came back to desktop computing and home servers. That's why modern connected cars are designed to be a national security threat as well as many other macro-bugs.