EU interior ministers welcome mandatory chat control for all smartphones
european-pirateparty.eu
european-pirateparty.eu
EU Chatcontrol 2.0 [video] - https://news.ycombinator.com/item?id=29066894 - Nov 2021 (197 comments)
Previously:
Messaging and chat control - https://news.ycombinator.com/item?id=28115343 - Aug 2021 (317 comments)
EU Parliament approves mass surveillance of private communications - https://news.ycombinator.com/item?id=27759814 - July 2021 (11 comments)
European Parliament approves mass surveillance of private communication - https://news.ycombinator.com/item?id=27753727 - July 2021 (415 comments)
Indiscriminate messaging and chatcontrol: Last chance to protest - https://news.ycombinator.com/item?id=27736435 - July 2021 (104 comments)
IT companies warn in open letter: EU wants to ban encryption - https://news.ycombinator.com/item?id=26825653 - April 2021 (217 comments)
Others?
https://netzpolitik.org/2021/eu-commission-why-chat-control-...
Including for example:
"According to a legal opinion by Prof. Dr. Ninon Colneric automated scanning could indeed be illegal. Surveillance without a specific reason or reasonable suspicion is prohibited in the EU due to the fact of its violation of fundamental rights. The European Court of Justice has repeatedly confirmed this view and, for example, reproved the retention of data on a number of occasions.
Nevertheless, attempts to revive the data retention zombie with legal tricks have not died down. The demand can be found regularly in council papers of various EU countries. Thus, this type of mass surveillance is still part of the German Telecommunications Act („Telekommunikationsgesetz“), although being currently suspended."
The open letter, linked in the article, is also a good read:
https://www.patrick-breyer.de/wp-content/uploads/2021/11/202...
Notably:
"Individuals, businesses and government rely on end-to-end encryption to safeguard their personal, commercial and state secrets. The safety of individuals (e.g. witnesses, officials) depends on secure encryption protecting their confidential communications. Backdoors can and will be abused by criminals, foreign intelligence services and forces that seek to destabilise our society. The Commission keeps reiterating its commitment to not generally weaken encryption, but “client-side scanning” would do exactly this."
A question I have about this topic: Banks and other organizations, including governments themselves, mandate that specific kinds of information be kept secret. An example of this is the information I need to log in to my bank account.
How am I supposed to comply with these requirements if every device I use is compromised?
Source?
"Thus, in the judgment of 8 April 2014, Digital Rights Ireland and Others (C-293/12 and C-594/12) (see Press Release No 54/14), the Court declared Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ 2006 L 105, p. 54), invalid on the ground that the interference with the rights to respect for private life and to the protection of personal data, recognised by the Charter of Fundamental Rights of the European Union (‘the Charter'), which resulted from the general obligation to retain traffic data and location data laid down by that directive was not limited to what was strictly necessary. In the judgment of 21 December 2016, Tele2 Sverige and Watson and Others (C-203/15 and C-698/15) (see Press Release No 145/16), the Court then interpreted Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ 2002 L 201, p. 37), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 (OJ 2009 L 337, p. 11) ('the directive on privacy and electronic communications')."
apple:
- “Let us be clear, this technology is limited to detecting CSAM [child sexual abuse material] stored in iCloud and we will not accede to any government’s request to expand it,”
- “These decisions are not always easy, and we may not agree with the laws that shape them,” the company said. “But our priority remains creating the best user experience without violating the rules we are obligated to follow.”
Not sure why you expect Apple to fight your legal battles, since they are simply selling tools (iPhones) that have to comply with the local laws. Would you want random OEMs to skip the local laws they do not like?
If you do not agree with the laws in your country, you need to work to change them.
Also, many laws are routinely broken by convention. If you drive in the US for example you will see that the speed limit, by convention, is most often the minimum acceptable speed, with a 10-15 mph buffer; ie, a speed limit of 65 means the majority of cars will drive at 65-75 mph. Also, laws are routinely added but rarely removed.
They already cannot handle the reams of financial reporting data they began requiring a few years ago - burdens which have made good companies shut down because the increased overhead was so great that doing business was no longer feasible.
These politicians are so ignorant of technology and real life itself that it’s a wonder we keep electing them.
The data's use isn't just in real time on ingestion. It allows them to examine anyone they want under a microscope forever after.
Once the collection has been running for a while: If I'm in power today and I don't like something you said today, I can look over your entire life history, and that of your parents and all other associates, and find all kinds of things to make you disappear, even if you never actually did anything wrong.
But you don't have access to that same power to discredit me or to defend yourself.
Which will then get you charged with wasting police time, covering criminals or worse. Also, it will be pretty obvious that all those reports originate from you, unless you have a massive amount of burner phones - which are, by the way, also on their legislative way out.
Personally I still consider it unlikely that the actual proposal, whenever it comes, would include mandatory screening of encrypted communications of the kind depicted in the article. It would not pass parliament.
It will more likely aim to legalize the current practice of voluntary screening (which is temporarily allowed for 3 years, granted in July 2021) or something similar.
EU parliament can voice, but not block.
Actually the last I heard, the latest proposals had the chat monitoring removed, but I can't find the link now
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
Treating the public like the enemy is a good way to destroy trust in all its forms.
Nope. We'll never have truly free computing until we can make our own hardware at home. Just like we can make free software at home.
Governments will eventually decide that unrestricted computers that run arbitraty code are too subversive. They turn laws into a joke. They destroy entrenched business models. Stuff like copyright barely makes any sense now that networked computers exist. Encryption alone is a potent enough weapon to defeat militaries
They don't want the masses to have access to such a poweful thing. Industries and governments are completely aligned on this matter.
This just isn't enforceable. Yet more laws made by people that don't understand the technology.
It's possible, just really inconvenient. Except for the "few" people running their custom rom android phones.
Jailbreaking is also a thing. Modifying the OS enough to break through vendor imposed restrictions. Why is that implausible for this example?
I'm not saying it's easy. There are certainly limitations due to the secure boot process of Android devices. But what if there was a way to change the root keys? Then it's an open game. Black market for devices with modified keys, unique per device, sign the image loaded on them to ensure the same level of security, and then load whatever you want.
This idea that our corporate overlords define what we are able to do is the only thing stopping us from proving otherwise. If someone says something is impossible, you ask for proof, question them, check their work. You don't accept and move on. This is a foundation of security research - any business claiming their product is "hack proof" is just asking to be hacked. Same goes here - if the vendor says you're not allowed to do something, you find a way around it.
That's not how computers work.
The scanning would take place at the lowest possible layer (ie. keyboard input, or kernel-mode input driver, etc), such that the user-mode software itself wouldn't be able to bypass the scan. It could also happen at the hardware layer.
You'll need to bring your own hardware/software to ensure you're not being monitored.
If you had a look at EncroChat at all, you'd see that they were running a custom Android OS with a bunch of their own apps on it.
Yes, we can take it to hardware level, however, that's not what was being discussed. The idea of mandating app developers to use the scanning tech can be trivially circumvented. i.e. Law makers not understanding the technology.
Mandating a hardware implant to achieve the same goals is a better understanding of the technology involved, but that ends badly for everyone. At least with software, a vulnerability can be fixed. In hardware, you're stuck with buying a new device or living with the vulnerability. Not to mention it's an open statement that the law makers want to spy on you.
See “similar cases” section of https://en.m.wikipedia.org/wiki/EncroChat for links to anom and other infiltrated apps.
Globally destroying web experience by mandating super-useless, super-obnoxious Cookie prompts on all web pages is one thing, but setting things up for "Equilibrium" or "1984" type of society is a whole new level, and I'm not sure if sheer stupidity can be claimed on this one.
Nobody did that.
But funnily enough, the other 10 popups/banners/sliders etc to sign for their newsletters, promotions, etc are all voluntary then?
no? I mean, right now in most countries instead of "to protect the children" you could use the excuse of "to stop misinformation", "to prevent damage from antivaxxers" and the majority will cheer your censorship efforts.
This surveillance bingo is always two-squared.