Hacker News Reader

Comment by SiempreViernes | Hacker News Reader

I went three indirections down and I still can't find any actual quotes or even summaries of concrete proposals, so I'm surprised how many people can confidently judge that these unexplained proposals are a dumpster fire solely on the basis that they aim to precent child sexual abuse material...

The most specific thing I found was a linked document that laid out three possible legislation options, all in very loose language, of which one was an entirely voluntary system.

Found from here https://ec.europa.eu/info/law/better-regulation/have-your-sa...

View on HN

Anytime something starts out with "think of the children" (paraphrased), hold on to your wallet, your pocket-size Constitution, and pocket-size "rights of man". They are coming for your freedom.

I've heard there is a need to improve primary education, but you'd have me believe this is a ploy to steal my copy of the constitution?

As you can easily check, Mr. Breyer's website has been at the top of HN multiple times in the past year or so, and invariably the comment section becomes an anti-EU pitchfork party based on nothing more than the linked text and various unhelpful stereotypes. Comments like yours, which justifiably ask for a primary source, have never been getting the attention they deserve.

So let me explicitly go against the grain here: I believe the linked text to be fear-mongering and I also believe that the EU will not "break secure encryption" (or make it illegal) in the foreseeable future. And if Mr. Breyer or anyone else would like to convince me of the alternative then please show me some concrete evidence first.

>"... I also believe that the EU will not "break secure encryption" (or make it illegal) in the foreseeable future. And if Mr. Breyer or anyone else would like to convince me of the alternative then please show me some concrete evidence first..."

"EU’s resolution on encryption foreshadows likely anti-encryption push": https://protonmail.com/blog/eu-attack-on-encryption/

"EFF Tells E.U. Commission: Don't Break Encryption": https://www.eff.org/deeplinks/2022/03/eff-tells-eu-commissio...

"Encryption: Council adopts resolution on security through encryption and security despite encryption": https://www.consilium.europa.eu/en/press/press-releases/2020...

Particularly in the last reference you can hear it directly from the wolf's mouth: "...resolution on security through encryption and security despite encryption..."

In other words, encryption they can access...

Thank you for your efforts but I am sorry to say that I am still not convinced.

The Protonmail link is not a primary source but let me dignify it with a response anyway. The authors of that blog post themselves admit that the resolution they link to "is non-binding and does not provide any specifics for new laws or regulations and, on the surface, seems fairly innocuous." They then go on to say how actually it is really dangerous, and the tone is very threatening, but their reasoning is simply not substantial enough to convince me.

I was sad to see that the EFF's very first link to a 'proposal' from the EU commission simply links back to Mr. Breyer's website. (But I am very happy with the letter co-signed by the EFF, which I think is well-written and a lot less alarmist.)

And once you do get to a primary source, in your third link, you can only make your case by rephrasing "security despite encryption", which I can happily interpret as being entirely in line with the direction suggested by the aforementioned letter, as "encryption they can access".

So I remain unconvinced, mainly because your "in other words" really do a lot of heavy lifting in your comment.

And there you have the press release of today:

"Questions and Answers –New rules to fight child sexual abuse" https://ec.europa.eu/commission/presscorner/detail/en/qanda_...

Exactly as predicted in this thread it's a "think of the children" and at the same time also as mentioned by others in this thread, mandated obligations but preparing for the excuse of "we never actually asked for this way of doing it"

"Does the proposal cover encrypted material?"

"The proposed obligations on service providers as regards the detection of child sexual abuse material are technologically neutral, meaning they do not prescribe which technology should be used for detection. It is an obligation of result not of means, leaving to the provider the choice of technology to be operated, subject to its compliance with strict safeguards."

"This includes the use of encryption technology. Encryption is an important tool for the protection of cybersecurity and confidentiality of communications. At the same time, its use as a secure channel could be abused of by criminals to hide their actions, thereby impeding efforts to bring perpetrators of child sexual abuse to justice."

"A large portion of reports of child sexual abuse, which are instrumental to starting investigations and rescuing children, come from services that are already encrypted or may become encrypted in the future. If such services were to be exempt from requirements to protect children and to take action against the circulation of child sexual abuse images and videos via their services, the consequences would be severe for children"

It will be probably 6 to 12 months before this is extended to "Terrorism" and another 6 months to be extended to subversive talk on "Vaccine Risk".

> It will be probably 6 to 12 months before this is extended to "Terrorism"

Alright, I'll take that bet if you got actually got the conviction to stake your HN-account.

If this proposal is ever approved, I am willing to bet you a dinner at any restaurant of your choice, that within two years it will be extended to track terrorism and other subversive activities. After all the principle of mandating all providers, to monitor all communications for specific behaviors will be set by law...

Immediately moving the goalposts and not putting up the stake requested, can I take this as you declining to stand by the quote and thus the bet overall?

I moved the goal posts that YOU sat on the ground? :-)

> In other words, encryption they can access...

Access under the conditions that the

> Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality including protection of personal data by design and by default.

Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths.

Yes but so what? EU regulation is always like this, it contradicts itself and is impossible to interpret. Governments must be able to access encryption (unstated but obvious: without the target knowing they're being spied on), but the solution must also protect personal data and be "transparent".

"Which means that the right to put something that clones the authentication session on a targeted device would do the job, no need to ban maths."

You don't actually know that, you're just hoping that it means something like that. In reality, they will keep the rules vague and then attach massive fines to non-compliance so they get to do the following trick: make everyone involved in implementation super scared so they use a maximalist interpretation, then when people complain to the Commission they say "no we didn't intend that, our rules are actually super reasonable, go complain to the companies". Or one day the ECJ will 'discover' an interpretation that nobody knew about and everyone suddenly has to change the way they do things overnight, then the usual EU water carriers will post here on HN claiming everyone should always have known it from the start.

Same thing that was seen with GDPR, EU competition law and other cases. It's become a standard trick. Good law doesn't have this problem; the meanings and consequences are always clear.

> solely on the basis that they aim to precent child sexual abuse material...

Solely on the basis of having to undermine end-to-end encryption in order to even begin working. Always use the most charitable interpretation of other people's arguments.

Here's one regulatory measure that's enforced already and seems to fit within the criteria being described: https://eur-lex.europa.eu/eli/reg/2021/1232/oj

(agreed, it would be nice to have direct links to the enacted and proposed regulations to compare and understand the language used)

'Enforced' isn't the right word for that legislation - it's a derogation, meaning it's removing rules, not creating them.

Specifically, that regulation gives service providers a temporary legal mechanism to continue to scan their own traffic for CSAM, if and only if they want to do so, without breaking the law due to GDPR etc (which otherwise made doing so arguably illegal). It just re-legalized the scanning that service providers were doing voluntarily before GDPR, and which they're doing regardless outside the EU anyway.

Thanks for the explainer, that makes sense.

I tried to find the proposal as well, without success.

Reply on news.ycombinator.com