Hacker News Reader

Comment by r3bl | Hacker News Reader

Here's a quote from the draft that I particularly like:

> The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services.

View on HN

> Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services.

If I'm going to play devil's advocate, this sounds like a European DMCA in the sense that it will prohibit removal of DRM, and tools which assist such removal.

I worry how that wording will work for security researchers exposing badly implemented roll your own encryption systems.

Or opensource client applications for proprietary messaging systems, though those get rarer these days.

Unless they're Member States, they should be OK

Why wouldn't it apply to private entities ?

Given that the next sentence is about "Member States", I think the sentence before it is as well—it's the member state['s government, or any contractor acting on its behalf] who is "prohibited" here from "reverse engineering or monitoring" encrypted communications.

In other words, this would constitute a ban on domestic SIGINT operations ala PRISM.

Also, "when encryption of electronic communications data" would have to be interpreted in a very twisted way to apply to DRM of IP content (be it software or art)

It would need to be twisted indeed to apply to DRMed games, sure. On the other hand, I could see streaming video from Netflix being "encrypted communication", where the "recipient" is your HDCP television, and breaking the trusted media path between the two would count as "reverse engineering or monitoring" the signal. If, of course, these lines were meant to apply to something other than the Member States themselves. :)

It would depend on the legal definition of recipient used. If I — as a natural person — am the recipient, than decrypting that stream would not be unlawful. Even if my TV is the 'recipient', I, as its legal owner, am probably still in the clear.

Considering the level of mental gymnastics necessary to produce the current model of "intellectual property", there is definitely room for concern that you may end up with software which you do not own that is considered the recipient.

Think a proprietary streaming service client which you pay to have a license to use. Combine it with enough layers of HDCP and shitty illegal-to-break crypto and they'll have managed to plug your analog holes.

Actually, yeah, given that TVs are clearly private property. How about the set-top box you're renting from your cable company, though?

My guess is value. A set top box being the recipient is of no value to me, it, or anyone else. If I (a person in meatspace) cannot see whatever was encrypted, what's the point, even? Why would I pay money for it?

these kind of assumptions and having openings to these kind of interpretations is what creates loopholes in the law. if anything this will be crappy worded and probarb ly exploitable by lawyers...

This is still a draft. It will likely be tightened up before the final version is approved (if it ever comes to that).

Reporters are picking up on it because it's unusually conciliatory - Commission (i.e. lobbyists), Council (i.e. governments) and Parliament (i.e. people) all seem happy to let it go through, in an area where nation-states have recently been quite belligerent versus their own citizenry. This could be a watershed victory for civil rights on par with FOIA laws, and it might happen after little or no unrest, which would be remarkable.

So what is stopping telecommunication providers, or tech companies, from "voluntarily" breaking the encryption and providing the results to the governments (in expectation of deregulation, or bandwidth allocation, or tax advantages, or as a result of secret coercion)?

That's where the famous "colored bits" come into play; "but we didn't do it personally ourselves and we didn't hold a literal gun to the telcos' heads" is ... not a great defense. http://ansuz.sooke.bc.ca/entry/23

In other words, intent matters; we only pretend it doesn't (and let the legal system sort it out) because it's too hard to express into computer systems.

By the time the lobbyists and policy launderers have got to it, it'll be "you shall not remove DRM, and everything else must have a back door".

The context seems to be communications between citizens, not media playback.

DMCA applies to first parties and to anything which could be defined as "encryption".

This should apply to state-of-the-art encryption and only to third parties.

There's already a European DMCA -- the Copyright Directive, which was introduced in 2001. See https://en.wikipedia.org/wiki/Copyright_Directive#Technologi...

Reply on news.ycombinator.com