Mullvad's campaign against EU chat control | Hacker News Reader

Mullvad's campaign against EU chat control

mullvad.net

374 pointscristiioan89 comments

There are an unusual number of comments from new accounts making disingenuous arguments on this post. I wonder who is behind the astroturfing.

The answer to "what else should we do about bad people doing bad things?" is, of course how we usually catch people doing bad things: old-fashioned detective work. It involves taking reports of suspicious or illegal acts, interviewing witnesses and associates, requesting court orders to search or surveil specific people and places when there's evidence to do so, etc.... It doesn't scale. It's not supposed to.

> I wonder who is behind the astroturfing

I noticed the same thing, but this really is a strange one since there isn't an obvious single party which would desire this legislation (from my limited view).

External state-actors (e.g. China for proxy-policing), or non-democratic internal politicians/leaders (EU/EEA neo-facists?), is the only thing I can imagine.

More likely, TBH, in this case: Just one random person with a strong conviction and sub-par execution.

There is a meta-effect going on here: Your complaining about the now vastly downvoted comments is now filling the top of this topic.

You're probably right, seems like there hasn't been any new ones since the original influx.

EDIT: never mind since posting this there have been a few more.

It's a tired tale by now but stirring shit (whatever shit wherever it happens) is literally part of the Russian playbook [1]

[1] https://en.wikipedia.org/wiki/Foundations_of_Geopolitics

Really? Just the Russian playbook? No other country stirs shit up? No other country meddles in another country's affairs? No other country starts color revolutions to get someone they like to lead the country? No other country bombs another countries pipeline that serves "Allies"?

Yes, russia. And they don't even hide the threats: https://twitter.com/PMSimferopol/status/1634111915596173312

Neither does the US.

https://www.bloomberg.com/news/articles/2022-02-07/biden-sai...

Turns out he did not even have to do anything. Russians did it themselves.

> Russians did it themselves.

Do you have a source? Seems like the US IC is claiming a pro Ukrainian group did it.

https://www.reuters.com/world/europe/us-intelligence-suggest...

Sounds like German media claims that US IC claims something.

Foreign Malign Influence Center? They seem so hostile to free speech, I’d be surprised if they weren’t astroturfing stuff like this.

https://mobile.twitter.com/NameRedacted247/status/1628847554...

That's a US entity, not EU. I have my skeptic goggles on too because the accounts and comments on that whole thread are a rat's nest of typical Twitter right wing garbage. There's even people tagging Elon Musk who seem to think he protects anything more than speech he agrees with.

The parties that want this are government agencies that want more power. Perhaps the companies that plan to support the government agencies in this work.

There is a lot of money and political power that wants these laws. But they don't seem likely to be running any campaigns as obvious as astroturfing. Isn't it more likely that the new commenters are people who want to remain anonymous?

> there isn't an obvious single party which would desire this legislation

Holy cow. Its amazing how the general public is so unaware of how the mechanism for lobbying for laws work:

This 'pedophilia! think of the children!' thing along with its accompanying laws came to the public agenda at the same time in both sides of the Atlantic. In the US, in the Eu at the same time. And separately, in the UK. With various celebrities pushing it and certain segments in the respective parliaments introducting it all at the same time. In the same fashion that laws like ACTA, PIPA etc were pushed.

Who wants it is pretty simple - the establishments want to spy on the citizens but they dont want the public stampede and ensuing fallout that laws like the Patriot act involves.

If you would have any doubts about it, just look at what the UK establishment and its politicians say - having gotten used to get whatever they want regardless of what they say, they are directly saying "Just give us backdoors" to encryption software producers without bothering with the hassle of pedophilia.

Which brings us to the below problem:

> China for proxy-policing

These people are able to commit all these evils, from patriot act to jailing whistleblowers, because the public rationalizes and justifies what they do and throws the blame and all the evils to outside just like you did.

It wasnt China who pushed the patriot act. It wasnt China who spied on everyone on the planet as revealed by Snowden. It was our own establishments. And as long as people like you keep diverting the blame to outside like you have done, those who perpetrated such acts will keep getting bolder.

...

Aside from all of these, there IS an actual party with a very specific interest that is pushing these laws, and the reason why it is doing this is so much sh*ttier than the above establishment reasons that you will want to gouge your eyes out:

https://www.theregister.com/2022/10/13/clientside_scanning_c...

https://www.thorn.org/about-our-fight-against-sexual-exploit...

Ashton Kutcher is a founder of something called Thorn that sells spying software to chat services. He and his partner Demi Moore are pushing this pedophilia law on the Eu in order to be able to sell spying software to chat services. At the same time they are lobbying for client side spying, ie, spying on people from their browser.

Washed up Hollywood actors trying to make money by destroying democracy...

I do understand how lobbying works as you described, however the question remains with who specifically are "the establishments" and why are they so gung ho on it when the public backlash is visible from miles away.

> throws the blame and all the evils to outside just like you did.

I realise that China is unlikely the originator for the lobbying but the discussion is on who would likely support the movement, still I considered the internal actors as well as a potential driver.

> It was our own establishments.

So would you expect it to be like an aggregate of different government agencies that would post fallacious comments?

EDIT: posted before the '...' edit, that part actually does make sense and is very shitty indeed

> who specifically are "the establishments"

What you could call 'the establishment' in the modern Angloamerican-centric West is a collection of old money aristocrats, long-time ultra rich billionaires and their holdings in defense, heavy industry, and media sectors. This is a rather broad definition and it does not elaborate some of the factions among it, however it more or less accurate. As an example, Eisenhower called a part of it as the 'military-industry' complex. And that is what most of the people know 'the establishment' as. But of course, anything that is involved in this complex web of monetary and power interest is a part of it.

They are gung ho about it because especially in the Angloamerican West, at least half of the public justifies and rationalizes whatever they do. In some way or the other. So they get away with it. From mass spying to Iraq War lies, from the scam that led to the 2008 crash to anything you could pick from the latter half of the 20th century and early 21st. And because there are no repercussions for anything and they can get away with anything, they really dont care what anyone thinks. All that is required for them to push their stuff is a small percentage of public buying into their agenda and making enough noise. The most clear example of this can be seen in the UK - the establishment got used to getting whatever they want regardless of anything that they recently started just being honest with what they want.

> who would likely support the movement

That's just more of the 'blaming others for what the domestic psychos are doing'. Its a really nasty habit that is not easy to throw off.

Look. In terms of spying, you can bet that every single major actor has all the information that matters regarding the other major actors. From latest weapons' details to critical complexes and installations. For, if the satellite technology was not enough, there is the long-standing institution of double spies that leak info to both sides for many reasons, one being the need to tell about what you are doing to your rival so that the rival wont act on suspicion, ending up creating major conflict and even nuclear war.

So this kind of thing - mass spying on people - has absolutely NO value for things that actually matter. What every superpower needs to know about each other, they already know. And if they dont know something and they need to really know it or confirm it, its not the random public that they would spy on - it would be the rival intelligence agencies and the target would be their actual IT infrastructure. Actually even that is not needed - just pay enough to someone and you will get the info you want.

So, nobody has any interest in whatever the random Joe in another country is doing. Except that country's own establishment. China has no interest about some random schmuck going home somewhere in New York is doing. And the US has absolutely no interest in what the street seller somewhere in Beijing does.

But ALL of them have an immense interest to know what their OWN people are doing.

So, dont seek the blame outside.

> So would you expect it to be like an aggregate of different government agencies that would post fallacious comments?

No. It will just institute and normalize mass spying like how the patriot act was intended to, but failed to do.

Scrolling down... You weren't lying. I've recently been pondering more and more in how far governments use social media to manipulate our perception. The astroturfing has been pretty shamelessly obvious recently (in particular on sites like Reddit.)

On the other hand, since there seems to be so much going on, why aren't there any whistleblowers?

Please remember the HN Guidelines:

> Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.

https://news.ycombinator.com/newsguidelines.html

I mean yeah, but when there's a bunch of green accounts whose only comments are horrible corpo-speak takes on one single submission they're basically holding a sign that says "I am not a real HN commenter".

This might be the one guideline that makes me uneasy. I get why it's in place - some people will call anybody that disagrees with them a shill or whatever - but to pretend it isn't happening while it so obviously is feels a bit immoral. At the very least, it's certainly complacent.

His name is Sir Humphrey Appleby, aka the Deep State, aka the bureaucrats. Seriously watch the show Yes Minister, there has never been a show that does a better job at showing the ridiculousness that leads to these apparently horrible ideas that no one seems to like but seem to continue marching forward.

It’s likely just one person fwiw, HN is alarmingly bereft of anti-one-person-who-is-upset measures.

Hmm, idk, I had two accounts in the past and I wasn’t even using them for anything nefarious, but I got a reply from dang asking me to not use multiple accounts, so I went back to using just one account.

Seems from my experience that at least to some degree dang is on top of making sure each person has only one account.

But again, the situation may be different when people intentionally try to do sketchy things. If someone uses separate browser sessions and separate VPN connections then there would not be much HN could do to discover that multiple accounts belong to the same person, except if the person with the accounts made the mistake of displaying voting ring behaviour, i.e. a number of accounts upvoting each other, and that sort of thing

I promise you dang is in absolutely no way on top of any of this.

Then again, the most obvious way to combat this problem is to require a bunch of verifications, like providing your phone number and a scan of your passport/drivers license and a selfie and so on.

And I am happy and thankful that HN does not require all ‘at.

HN's best defense against that is probably that it doesn't take many flags from older accounts to kill a comment from a new account.

Whether these accounts were one person with an axe to grind, trolling by someone who doesn't really believe the arguments they were making, or coordinated activity by an organization, none of the comments stayed up longer than 15 minutes.

> There are an unusual number of comments from new accounts making disingenuous arguments on this post. I wonder who is behind the astroturfing.

The comments are so obviously going to elicit a negative response that a reasonable explanation would be that they're intentionally terrible. It might just be someone having a laugh - someone who is actually against this proposal.

Either that or they're not sending their best and brightest...

I only see two fresh accounts in this thread which were deleted/flagged. Come back when a pro-Tor topic is posted and see then how many new accounts pop up :)

> I wonder who is behind the astroturfing.

First rule of propaganda: look who will profit from this: The companies who sell personal data, politicians in power, maybe some 3 letter agencies, although they already have this data.

Anyway, this is a good sign that humanity is too stupid to learn from history.

Ha!

I probably should get a mullvad account just to support them (even if I use my own VPN).

Something that is not discussed much in Sweden is surveillance via the bank system. Banks have access to customers' transaction information and use it for two purposes: the "useful" feature of telling their customer how many of their purchases were e.g. food vs entertainment or house rent, and--of course--for advertising their products and services to their customers.

And then the government has legislation to demand that banks mass-report certain information from private citizens, like revenue/expenses for financial services (i.e. interest paid on loans and capital earnings from financial assets) plus any international transactions. One small stumble down the slippery slope of surveillance, and the Swedish government will be able to build profiles of each citizen using the information collected by banks.

Make Monero popular (doomer wojack)

Can't they already build profiles using info from their IRS?

I don't remember the details but Swedish law takes a fairly strong stance on preventing government agencies from sharing information with each other, for better and worse.

The problem is there are no reports on what counter terrorism units achieved, how many potential attacks they thwarted because it would jepoardize their work, at least that's the mantra. So it's a you have to believe us that these measures is a must situation.

The problem is, that the silicon we use in everyday hardware is a black box. Same applies to online services. We do not even know how Youtube's and other big services' and hardware units' lawful intercept/secretservice interface looks like and what options do they offer to surveil and manipulate (!) average people. So there is deffo zero insight into this matter.

Who do you believe? It's like religion if you don't know what to look for. So... choose a god and believe.

If we look at the number of terrorism incidents in Sweden Vs say the number of times a public official got in trouble for abusing state power as well, then the two conclusions is that either the existing mechanisms are sufficient for thwarting terrorism or the threat of terrorism is overplayed to begin with

> The problem is there are no reports on what counter terrorism units achieved, how many potential attacks they thwarted because it would jepoardize their work,

I used to subscribe to this but then there was the governor's kidnapping plot in Minnesota that the FBI started blowing their own horn about and making such a big deal right up until it turned out that 6 of the 13 individuals involved were in fact members of the FBI. That kinda shook my trust in the whole "we can't talk about our success because it is top secret." Excuse

Yeah I agree. I'm starting to wonder about that mantra. If disclosing your successes endangers the work so much then maybe it's not such great work. The whole "there will always be bad actors" who want to "destroy our democracy" starts to wear thin when such high levels of secrecy are also eroding democracy.

If governments opened up more about what they're doing they might lose a few more of their secret battles (and people will die) but maybe it would be worth it when you look at the overall preservation of democratic thought. That's the ramblings of a wannabe patriot though, and not a lawyer, and lawyers are deciding all this.

I am currently reading through all of the legislation to try to figure out what the latest version of this actually requires from providers. Early versions talked about scanning for "grooming behavior" in textual conversations, but then also required that there would be no mass-scanning of communications: this seems obviously contradictory. What's frustrating about these laws is how vague everything is: I wish there were more high-quality summaries of the current legislation's terms. (If they exist, please post them here.)

The ambiguity is by design.

It puts the onus on the implementer to be overzealous under fear of being criminally liable. This has the added benefit (to the slimy legislators pushing this garbage) of allowing them to scapegoat any perceived excesses onto corporations and developers.

The legislation [1] is amazingly vague about the impact on end-to-end encrypted systems. In fact the string "encryption" appears twice, and only once in the body of the text (in Paragraph 26 on page 27.) This paragraph basically says "it's ok to use end-to-end encryption" but does not actually stipulate an exemption for scanning technologies. Presumably this means you would need to somehow implement an effective scanner into your end-to-end encryption. The legislation gives no other guidance about how to do this, how secure it will be, or even a mild discussion of the tradeoffs.

This is alarming because the bill also makes clear that the goal is to detect not only known and unknown CSAM using some technological measure, but also to detect textual content that represents "grooming behavior." Only the "known" CSAM detection approach has ever even been attempted in a production system (with significant limitations) and that system was not ultimately deployed due to technical and customer concerns. But as much as CSAM media scanning worries me, the idea of automated ML-based text analysis for something as vague as "grooming behavior" is frankly terrifying. And I haven't even considered the slippery slope that becomes visible the second you build text-analysis and reporting systems into encrypted communications.

What is much more concerning than the legislation is the Impact Assessment [2], which is cited in the legislation to justify its reasoning. Specifically, the Impact Assessment recommends Option E, which is "mandatory scanning of all known and unknown CSAM, as well as textual detection of 'grooming behavior'" even in systems that deploy E2E encryption.

Where the legislation is vague about E2E encryption, the impact assessment [2] leaves no scrap of unambiguity: it makes clear that the need for these mandatory scanning mechanisms is almost entirely a response to the increasing deployment of E2EE, and specifically cites Facebook's (still un-deployed) 2019 encryption announcement to support its argument for a mandatory scanning requirement. It uncritically cites Apple's (since withdrawn) CSAM scanner (p. 39) as an example of a balanced privacy solution. It cites vaguely to the existence of scanners capable of detecting unknown CSAM, barely acknowledging that such techniques are entirely at the hypothetical/research stage and may not be safe at all. Finally it provides a privacy analysis that somehow concludes that the privacy benefits "in protecting victims" naturally outweigh all other concerns that might pop up around the deployment of what will be the world's most powerful ML-based text and media mass-surveillance system for encrypted and unencrypted private messages.

Because take note: while the authors don't use that terminology, readers should have no doubt: that is what the EU is proposing to build with this legislation.

[1] https://eur-lex.europa.eu/resource.html?uri=cellar:13e33abf-...

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

Translations:

First ad:

Kid: Haha!! Did you send the photo to mom, dad?

Dad's phone: Your photo has triggered our criminal activities filter. Your online services have been suspended and the police has been alerted.

Caption: Create safe spaces online for children instead of making the internet unsafe for everyone.

...

Second ad:

First worker: Weren't we just supposed to look for sexual crimes and terrorism?

Second worker: That was during the previous government.

Third worker: adds a 'race' label

Caption: The governments of today say they will monitor serious crimes. What will the governments of tomorrow say?

This is what Microsoft and Google are doing already. This is why I don't backup my photos to a cloud any more.

And if you are worried, don't upload to a some smaller provider either because some of them might have fun looking at the backups of the things that people find to to sensitive to upload to Google.

There's nothing sensitive - I just don't like being treated as a potential criminal.

Then you should be fine.

I'd still recommend resisting chat control since once that is in place they'll soon go after independent hosters.

I am really worried about this. I feel completely helpless though, I am almost a 100% convinced this legislation will make it through. It will be the worst day in the history of the EU. Great to see this campaign though.

We will then go and use GPG and Tor, where's the problem

If you can convince your family and friends to use GPG and Tor or just a niche FOSS app that won't follow this legislation, more power to you.

Wow, kudos. I don't see any way on Mullvad's site to donate to the cause... I might just have to buy a second Mullvad account for a few months to support them.

This seems like an appropriate campaign to reach people who probably don't think about this kind of stuff. I think there's more than enough HN articles that show the tech circle's opposition to these kinds of measures already. Energy is better spent explaining the issue to others and advocating for the right thing.

Great work! that Ad targeting EU politicians is savage!

Think of the children - their privacy is going to be violated if whatever they post online triggers the scanner. Then some random stranger will read your kid's private messages.

That chat control really looks like a creep magnet. What could possibly go wrong...

I mean, who is going to stop me? Think about it: Who and how are they going to stop me from applying some math to my messaging. I’d almost say: Good luck. But it’s just too horrible to think what would be needed to prevent me from privately chatting with my partner. The threat of jail time? Total control of my devices? Wtf is this savage thing they are proposing? Do we envy China all of a sudden?

Does anybody understand the ad that is just a long string of numbers? They give a translation but it still doesn't make sense to me.

>9781529035698

>12*

>*We placed this ad here for you to start practicing private communication in a public setting. This could be good to know if the European Commission's chat control law becomes reality.

What's even weirder is the numbers in the translation are different from the original.

It's the ISBN of Edward Snowden's book "Permanent Record: A Memoir of a Reluctant Whistleblower". The numbers in the poster differ because it's the ISBN of the Swedish translated copy of the book.

Nice. I guess I should have tried googling it but I was convinced it was some kind of code.

Unrelated to his book, but anyone else find Ed's last name mildly amusing?

English is not my first language so when we say "Snowden", unless we really try to do an American English accent, it can sometimes sound like "Snowedii-n".

His last name means:

> English: habitational name from any of the many minor places called from hills where the snow lay long (Old English snāw ‘snow’ + dūn ‘hill’). [0]

"To be snowed in": when you can't exit the property/house because of fallen snow. Keep that same thought but remove the snow element (still "stuck") and replace property with country.

Now take "Snowden", but make the E longer and make it sound more like an I.

Edward Snowed-in. One could say that he is snowed in, in another country.

Similary, another NSA leakers name: Reality Winner.

Not poking fun at their names, just pointing out the irony because of the situation they are/was in.

[0]: https://www.familysearch.org/en/surname?surname=snowden

Great to see a campaign like this being rolled out to the public. Wish there were orgs in the US that could spend this kind of money.

To be honest I'm not very hopeful. The average Joe really is gullible - just drop some terrorism, children and nowadays some "preventing misinformation" bs (which of course has never and will never be twisted to fit government's needs at the time) to the mix and people will accept it.

Nevertheless I support these campaigns since I'm more than happy to be proven wrong.

I'm not either. But it's always a fight worth fighting. If nobody is vocally against this stuff, governments can just go "see, nobody even wants full privacy anyways."

This is often where creative memes help.

This wouldn't be the first issue where some public education is needed.

Are they gullible or pragmatic? I appreciate the concern here but at the end of the day these laws hardly affect the average Joe so why should he care? There is some wisdom in not worring about future hypotheticals until they actually happen.

>Are they gullible or pragmatic?

Gullible. Pragmatic would be a person who doesn't worry about completely made up things - not the case.

>these laws hardly affect the average Joe so why should he care

That's where I completely disagree and I encourage you to read more about how this is an overreach. I won't link anything specific to prevent nitpicking but googling "chat control summary" should bring some ideas at least.

>There is some wisdom in not worring about future hypotheticals until they actually happen

Well this isn't a hypothetical, it's another step towards overreach and should be at least exposed. It's literally the boiling frog apologue [1]. When it actually happens we may already be burned alive - metaphorically speaking, hopefully - and there won't be much else left to do.

[1] https://en.wikipedia.org/wiki/Boiling_frog

> Pragmatic would be a person who doesn't worry about completely made up things - not the case.

They are completely made up things though. As an example: Climate change is not made up since it is affecting us now. Assuming what a future government might do is purely hypothetical though. I could draw a hypothetical that these laws will create world peace and stop nuclear war with the same amount of authority. Both are possible.

It is also just not caring. In the US the largest voter bloc is non-voter most of the time, even in presidential elections, with primaries and midterms skewing even worse. It is better in Germany though, but not vastly so.

I've never seen bottom up support for those type of measures. They are also universally unpopular: https://european-pirateparty.eu/wp-content/uploads/2021/11/c...

No amount of terrorist or pedophile arguments have changed it.

People don't accept it - at worst they are apathetic. This type of campaigns - and getting some media on our side will help.

Don't forget "fighting hate speech". If one doesn't support "fighting hate speech", that person is obviously an alt-right neo-Nazi.

I'm not hopeful either. For the first time in literally millennia, we've enjoyed a few golden decades of almost entirely uncontrolled communication. And now a lot of us are (unknowingly) begging for that to be taken away.

I agree, we need to stop the EU overreach immediately.

Typical EU behaviour. Same ones constantly whining about how Swiss banks won’t adopt their financial surveillance policies. Governments love to call it transparency when trying to justifying violating other people’s privacy.

This is in no way comparable.

There is a case to be made against rich people trying to hide their wealth in Switzerland, while they live in an EU country. They are also the majority doing it, as no average Joe can.

Weakening cryptography with the excuse of going after a minuscule percentage of the population, is about effectively considering any citizen a potential criminal.

They’re comparable if your support of a policy doesn’t depend on who it’s targeted against. That’s what makes us different.

Hiding money from tax agencies has one, and only one, reason to be, and it causes a net deficit for the majority of the population, as in taxes not being collected. The only people who loses when we target tax havens, are those evading taxes.

Strong encryption benefits the majority of the population, as it strengthens security and privacy, for everything. Weak encryption would actually make it easier for certain criminals to operate, and it would punish regular people indiscriminately.

> That’s what makes us different

Then I would have to say that your take is superficial and naive.

No you’re just inconsistent. Force is only justified in response to force. Even when it would benefit you to access someone else’s money.

I'm sorry I don't subscribe to that kind of libertarian fantasy.

Articles about the new proposal do a really poor job at reporting what the specific regulation in question is. So here it is:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM:2022...

https://en.wikipedia.org/wiki/Regulation_to_Prevent_and_Comb...

If the law were to go through, would this imply that Swedish VPN traffic would likely be monitored? It seems impossible that the government could separate the traffic of its citizens for spying out of that of foreign nationals.

Well done!

Reply on news.ycombinator.com