Leaked government document shows Spain wants to ban end-to-end encryption | Hacker News Reader

Leaked government document shows Spain wants to ban end-to-end encryption

wired.com

556 pointsarkadiyt299 comments

We (the citizens) need access to all the politicians communication, just in case if they do anything illegal... 24/7 microphones, digital communication tracker, etc. Let's start with that, and then move on to "normal people", if politicians still believe in no privacy.

Politicians are the most surveilled people, and sometimes vote for things like this for fear of or as the result of being targeted by their own or other countries' intelligence agencies.

If the CIA wants Spain to ban encryption, they're not going to be bothered by the resistance of some Spanish MPs, they're going to fix the problem.

We (the citizens) need to ban secret police and secret courts.

> Politicians are the most surveilled people, and sometimes vote for things like this for fear of or as the result of being targeted by their own or other countries' intelligence agencies.

Not here. Probably not anywhere outside US and some very few countries.

Politicians are mostly corrupt, though degrees vary. Most relevant child abuse was covered by famous politicians¹²³⁴⁵. Nevertheless, the same politicians cut budgets for police to do actual investigation work, because that could harm themselves, then want to cut the last line of defense the public has to do actual investigation and journalism (which requires free speech and privacy) by declaring that this is required to fight pedophilia.

We need to do something against this. We really do.

¹ https://en.wikipedia.org/wiki/Jeffrey_Epstein

² https://www.researchgate.net/publication/336831983_Understan...

³ https://time.com/2974381/england-land-of-royals-tea-and-horr...

⁴ https://en.wikipedia.org/wiki/Marc_Dutroux

⁵ https://www.spiegel.de/international/germany/past-pedophile-...

Politicians are just ambitious people, sharing full spectrum of other traits. Most people would become equally corrupt if presented the opportunity. Being ambitious just amplifies the temptation.

You underestimate the selection pressure. While I agree that many people would become corrupted, the profession (so to speak) attracts certain people. It is even to the point where you need some negative traits (explicitly: skeletons in the closet) to rise up, because it means you're easier to control.

> Most people would become equally corrupt if presented the opportunity

Bold claim, without anything to back it up.

If you downvote, please at least state a reason. All of the links are reputable and verified. And all of them were covered by famous, reputable politicians.

You state that "Most relevant child abuse was covered by famous politicians" and list 5 examples. This does by no means prove your claim. For all I know, the rate of child abusers could be much lower among politicians than in the general population.

I assume he meant covered up, right? Anyway there is a lot of gross stuff happening, but he hasn't substantiated that point.

Didn't downvote. But saying we need to do something about corrupt politicians isn't novel. I'm also not sure how pedophilia and Jeffrey Epstein is meaningfully related to the topic at hand.

Politicians usually go with the "think of the children" persuasion tactic when they want to do some nefarious stuff (and when they don't "fight terrorism" or recently "misinformation").

If “novel” comments were really what this site was about, it would have been dead years ago.

Two good reasons to downvote this would be 1) that it's a conspiracy theory and 2) that reading about pedophilia every time one turns on the internet is exhausting.

Not everything that's uncomfortable and swept under the rug is a conspiracy theory. Calling the revelations about Jeffrey Eppstein and his shady connections in 2023 conspiracy theory comes off as dismissive.

Relevant standup bit https://youtu.be/b6NmjK2pgiQ

But I sort of get your #2.

Unlikely the garbage dreamt up on 4chan is the truth. Sure the government lies. Doesn't mean your interpretation is correct.

Nobody said that on this thread, I hope you know that.

Critical thinking and scepticism are essential, both when you read things from traditionally reputable sources, like WaPo, NYT, state media, politicians, and alternative media, like Youtube opinion people, online forums, or your friends, family and colleagues.

My point is simply that "distrusting the government" doesn't mean you should believe the theories. The theories are probably less trustworthy. They can be less trustworthy than a untrustworthy government!

> Critical thinking and scepticism are essential, both when you read things from traditionally reputable sources, like WaPo, NYT, state media, politicians, and alternative media, like Youtube opinion people, online forums, or your friends, family and colleagues.

And I never said otherwise :)

It's not a conspiracy theory. It's a collection of links that describe actual conspiracies.

Not all of them - the Time one from 2014 (link number 3) actually links to the Wikipedia article that has a section about the VIP paedophile ring claims (that the article is mostly about) being discredited in 2015 [1]. (The page title was changed from 'Scandal' to 'Hoax' after the article was published and redirects)

1. https://en.wikipedia.org/wiki/Elm_Guest_House_hoax

"it's a conspiracy theory" Is not a fact a good reason.

Why do conspiracy theories get a bad rap? it's because there's people who think the moon landing isn't real and the earth is flat. These are what jumps to mind when anyone says "conspiracy theory". Here you are using that association to try to cover for corrupt politicians, which is not exactly a very far out there concept.

> Why do conspiracy theories get a bad rap?

Because it's usually speculation without evidence, and because no matter how much evidence contradicts a conspiracy theory people continue to cling to it like a religion.

I'm not sure what "Most relevant child abuse was covered by famous politicians" is supposed to mean, but most child abuse isn't committed by politicians, there is no evidence that most politicians are child abusers, and there have been several insane conspiracy theories about child abusing politicians in recent years so it's pretty natural to be skeptical when it looks like someone's starting down that path.

I expect there's already people who'd say "The crazy conspiracy theories about child abusing political figures were intentionally spread online by child abusing politicians so that anyone on social media talking about politicians abusing children would only be met with eye rolls"

>it's a conspiracy theory

Are you disagreeing with the information in GP's links? As far as I can tell this is all looks pretty legit and the onus is on people like you to prove that all this evidence is somehow fabricated.

He seems to be disagree with how they are characterizing the info in the links.

>"reading about pedophilia every time one turns on the internet is exhausting"

That's because politicians keep bringing this up.

This powerful "pedophile network" is likely politicians who shopped online at Tesco in the early 2000s and had their credit card numbers used by criminals for fraudulent purposes, and likely got caught up in Operation Ore and falsely accused of having purchased child pornography online. Thousands of people in the UK were raided by police and had their life destroyed over this, and the majority were entirely innocent.

At the time the News of the World, a Rupert Murdoch owned tabloid, was stoking the moral panic over pedophiles and creating an atmosphere of fervour over this issue. Maybe other News Corporation owned media worldwide might have started this whole panic around child pornography in the first place, in the early 2000s? With Murdoch seeing the Internet as a large threat to his dominance over the media?

https://en.wikipedia.org/wiki/Operation_Ore

https://www.theguardian.com/technology/2007/apr/26/comment.s...

https://www.duncancampbell.org/content/operation-ore

https://www.whatdotheyknow.com/request/the_home_office_cover...

And rooting out hidden enemies within is typical of what happens during a moral panic. Same with McCarthyism. In reality it's very unlikely that there are pedophile networks within the UK government.

My reason to downvote will be: Around half the girls I've met in my life were molested by adults as children, and it wasn't by famous people or politicians. It was by neighbors and family members in the suburbs where they grew up. It's fine to call out hypocrisy in the ruling class that covers up for their own while claiming to be trying to address the problem, but at the end of the day the vast majority of the millions of daily cases of child abuse are taking place right nextdoor or even in the same houses as the people who make a lot of noise about corrupt politicians. I'd even go as far as to say that an obsession with famous child abuse cases is a good indicator of someone who's either committed or thought about committing that sort of crime.

As a first step, I'd settle for 1 party consent for recording everywhere.

And no more unrecorded votes.

Spain is already a 1-party consent country, it is legal to record any conversation as long as you are part of it. However, it is not legal to publish them, but they can be used in a trial.

Thanks. Looking up “1-party” sent me down an interesting rabbit hole learning about the limited “0-party” rights of interception. For radio interception in NJ, it is legal (and only legal?) to intercept:

f. Any person to intercept any radio communication which is transmitted:

(1) by any station for the use of the general public, or that relates to ships, aircraft, vehicles, or persons in distress;

(2) by any governmental, law enforcement, civil defense, private land mobile, or public safety communication system, including police and fire, readily accessible to the general public;

(3) by a station operating on an authorized frequency within the bands allocated to the amateur, citizens band, or general mobile radio services; or

(4) by any marine or aeronautical communications system;

———

Which would imply that broadband RF recording using SDRs, even if it excludes the cell phone bands, is not OK!

For example, the MURS band seems to be illegal to intercept.

Absolutely ridiculous, this signal is coming into your private property, it should never be illegal to receive it. So they are criminalizing monitoring the voltage on a piece of wire (an antenna) in your own property, that is what an SDR does.

These signals are being sent into your property, whether you want it or not. I think you have a natural right to receive it. It doesn't matter if the government says it's illegal, or attempts to enforce it. Just as we can hear anything nearby with our ears, nobody tells us we can't overhear conversations in a restaurant, trying to do so would clearly be absurd. My opinion here is from natural law.

Can someone steelman the argument against one-party consent? I literally can't think of any reason anyone would want it, other than wanting to be able to lie about what they said later. It doesn't even help people who are saying things that might be dangerous if they leak, since illegal != impossible.

Having to be constantly on guard about what you say in case someone's recording you and can play it back for others, or in court, often out of context...

Basically, some expectation of privacy especially in a 1-on-1 conversation, even if it's via telecommunications tech rather than in-person.

Some people adopt a more filtered, cautious way of speaking anyway as a defense mechanism. For them it doesn't matter so much. Other people talk informally with less of a filter, and for them it matters quite a bit.

Given that recording is ubiquitous now anyway, and voice deepfakes are about to render even that irrelevant, there probably isn't a good argument against 1-party consent today.

(However, government officials, outside of a foreign policy context, deserve no privacy for anything related to their official duties. The argument that they need to be able to talk informally with their peers, without fear of public judgment, works against the public interest far more than it works for it. That helps build rapport, but no politician these days would fully trust someone they're just building rapport with; that kind of thing may be valuable for diplomatic relations and spies, but not for regular government officials. Privacy and secrecy among ordinary politicians is little more than a recipe for corruption and side-dealing that they know the public would be rightly upset about.)

To add some practical context to this insightful comment: in Belgium, 1-on-1 conversations are considered private and as such protected, meaning you need a judge order to listen in. However, If the conversation is professional, both parties are allowed to record it.

Now, any conversation with 3 or more parties is considered public. A closed group chat on whatsapp has the same legal protection as shouting it on a megaphone to a crowd, meaning none whatsoever and people have already been convicted for their speech in closed chats or forums.

> Can someone steelman the argument against one-party consent? I literally can't think of any reason anyone would want it, other than wanting to be able to lie about what they said later.

Are you actually asking hackernews, in a thread about banning encryption, why "if you have nothing to hide you have nothing to fear" is not a good justification for being monitored without your consent?

I don't consider it "being monitored" when the person you're talking to is the one doing the recording. Contrast "I'm legally allowed to keep emails sent to me after I first read them" with "other people are legally allowed to read emails sent to me". Wouldn't almost everyone agree that the former is a good thing but the latter would be a bad thing?

> don't consider it "being monitored" when the person you're talking to is the one doing the recording

Compromise is reached in quiet, safe places. Politicians make bombastic statements for their base and donors, and then go behind closed doors to negotiate. You can't negotiate in earnest if every offer for compromise you put forward immediately results in (a) the losers of that compromise creating a ruckus and (b) your opponent using (a) to weaken you.

Public negotiations reward playing to the audience. (You see this in small groups–letting leaders or the people in a friend group who disagree pull aside almost always solves the problem better than litigating it as a group.) If every conversation might be recorded for replaying to a third party, then every conversation will be treated as an open one. That destroys room for compromise.

> Compromise is reached in quiet, safe places. Politicians make bombastic statements for their base and donors, and then go behind closed doors to negotiate.

That may be. But corruption also festers in quiet safe places. It's not clear to me that the the tradeoff is worth it.

> corruption also festers in quiet safe places. It's not clear to me that the the tradeoff is worth it.

Public legislating, private bargaining [1]. This keeps substantive deliberation in the public domain while the horse trading, the job republics delegate to elected representatives, has a limited space within which it can efficiently engage.

[1] https://news.ycombinator.com/item?id=36037530

This seems like a weak argument since compromise may be more difficult, but it certainly isn't impossible when conversations are transparent. Eventually the "losers" of a compromise are going to learn about how their elected officials voted and what the impact of that vote will be for them, and they'll hold their elected officials accountable for it regardless.

It just isn't worth forcing every person to give up the ability to protect themselves by recording their everyday conversations just so that politicians can lie to the public and their donors while screwing over the people behind closed doors.

Legislative deliberation, i.e. hashing out details, should be open [1]. At the bargaining phase, when you're working out high-level frameworks, the theory says closed doors win [2]. (Put another way, in a transparent bargaining environment, the winning move is to ignore your opponent and beat your drums to your base.)

> Eventually the "losers" of a compromise are going to learn about how their elected officials voted

The point is to let both sides table ideas without having to face the downside. To propose what if scenarios to the other side.

[1] https://preprints.apsanet.org/engage/api-gateway/apsa/assets...

[2] https://eprints.lse.ac.uk/225/1/open-door8.pdf

That cuts two ways. If everything they said was on the record there would be no point in putting on a show since it will immediately turn out the show is all fake.

Imagine if politicians acted like normal people, negotiating things in nuance instead of being showmen.

Don't blame the politicians. Blame the people who have opinions. The public debate is so dominated by bad-faith arguments that it's not productive to treat it as a real debate. Until the social consequences of arguing in bad faith are severe enough, all meaningful political discussion must happen off the record.

Okay, fair enough. I was so focused on my own perception of privacy that it hadn't occurred to me that the person I'm talking to has every right to record the conversation just as much as they do to remember it.

Speaking as someone who often has to tell people "Email that to me or I won't remember it", I can see the utility without it being intrusive.

The main difference is that if they remember it and tell someone else, it's hearsay, but if they record it and play it for someone else, it's evidence. At least until deepfakes ruin that idea and make the two equivalently refutable.

You seem to be referring to zero-party consent, which yes HN would tend not to want. I think most of HN would be into one-party consent, meaning you can time shift that which you already had the ability to hear (and therefore let third parties hear it, without knowledge of the other original party).

The police already have the ability to monitor you without consent. One party consent lets people record their own conversations and push back against false allegations about what they did or did not say.

The sane version is one-party that is actually participating in the conversation needs to consent, 3rd parties to the conversation have to ask.

It probably felt right around the time when recording devices were first invented.

Some strong arguments against one-party consent:

1. Privacy. The cornerstone of personal conversation has always been an inherent right to privacy. Traditionally, conversations held in confidence were sacrosanct, and any disclosure of their content required mutual agreement. Otherwise, the second party can simply deny it and it will never be known with certainty what has been said.

2. Chilling effect on authenticity. In a climate where any conversation could be recorded without one's consent and later used against them, people would be compelled to adopt calculated diplomacy in all their interactions. This would sterilize authentic conversation, replacing genuine thoughts with measured communication, removing a lot of depth and meaning.

3. Weaponization of speech. Recordings under a one-party consent system could be misused in a myriad of damaging ways, from creating training data for voice (deepfake) AIs to insidious forms of blackmail. This extends beyond traditional notions of blackmail to include public shaming or character assassination. This is the "group chat has leaked" scenario, but potentially decades later. One could be a completely different (and potentially reformed) person, but their past will always haunt them and not let them get ahead in their public life, like hold an office or public trust.

4. Limited utility. In many places that allow first-party consent, these recordings are not recognized as valid evidence in court without consent from all parties involved. This significantly undermines their perceived utility as a defensive tool. Is it worth surrendering our privacy for this?

5. Accountability for human folly. People often vent and ramble, it's part of our emotional expression and a necessary component of our mental health. If every idle venting or thoughtless comment were recorded and held against us, it would make our lives much less peaceful. Sometimes it's good to let some thoughts die in a conversation. Reflect on your own past and the blunders of youth - good that they were not recorded, right? This also applies to intoxicated conversations, conversations while suffering from mental health illness, and similar.

6. Two-party consent already serves many purposes. For most business or evidence needs, two-party consent is enough. One can simply tell the other party that they will start recording the call if the other party does not hang up, and that will be implicit second-party consent in many countries. So one can record conversations, and one can choose to have only recorded conversations with some people. One-party consent has only marginal benefits over two-party, but it has significant downsides.

7. Little effect on harassment or threats. Threats and intimidation could be made in other ways, like face-to-face, or through coded language. "Your political campaign is going great, it sounds like a guaranteed win unless someone fabricates a scandal. You need to play it safe with the people that could."

8. Third-party recording. One-party consent doesn't mean a third party isn't recording. For example, smartphones could record audio of conversations for ad targeting and government purposes if there was one-party consent (one party turned on the call recorder).

9. Other contexts. If the laws for one-party consent are too permissive, this could lead to a lot of surveillance activities becoming permissible. For example, the definition of a conversation could be stretched to include all chatter on an office floor if just one person consents to the recording (perhaps a manager).

> Privacy, Limited utility

Where/when has the been true? Nowhere I know of.

> Chilling effect on authenticity, Accountability for human folly

There are lots of places with 1 party consent already. Not a problem

> Weaponization of speech

People who are going to commit crimes won't hesitate to commit other crimes. Irrelevant.

> Two-party consent already serves many purposes

For business 2 party consent is not enough. It would be enough if people didn't regularly commit crimes... but they do. Wage theft is probably the most common type of theft. Add on shenanigans with worker's comp, and other workplace nastiness and 1 party consent is very much needed.

> Little effect on harassment or threats

If one person can understand covert speech, other people can too. Irrelevant.

> Third-party recording

I'm a little sympathetic to accidental sharing of recordings, but there are plenty of ways to record that don't have this danger (dedicated recording devices and apps where the data doesn't leave the phone come to mind).

> Other contexts

Lots of things are possible. Your example isn't particularly compelling, though: not every instance of speech has an expectation of privacy.

42 states (in the US) have one party recording so I think that it is by far the normal situation.

https://www.justia.com/50-state-surveys/recording-phone-call...

Why is it big is that California have too much power for encouraging/removing technologies.

"Dutch PM Mark Rutte questioned after deleting text messages for years" - https://www.euronews.com/2022/05/19/dutch-pm-mark-rutte-ques...

In the uk politicians were allowed to opt out

https://www.digit.fyi/data-protection-political-parties/

While of course no government comes close to that level of radical transparency, Finland comes closer than most. I believe Finland requires all official government documents be made public by default, unless they are specifically exempted. Many other governments, like the US through FOIA, let citizens request documents with varying degrees of success, but proactive disclosure is much more rare. And of course, this is just about official documents and doesn't cover the contents of private meetings.

(I'm just an interested observer, so I'd love to hear from actual Finns on how they feel about their government's level of openness!)

It's the same here in Sweden. It just feels natural that _obviously_ we should have access to what goes on in the public sector, unless there's a very specific reason not to. There was a huge backlash when the current government decided to hide who received electricity subsidies this last winter, as it was seen as a way to hide corruption.

Way back when, Ukraine implemented video recording of all politicians' offices in order to combat corruption. I read an article where a citizen was trying to get something done at a local government office, tried to offer a customary bribe, but was rejected as the officer pointed to the recording camera in the corner of the room.

More responsibility demands more scrutiny.

If they got nothing to hide why wouldn't they do it?

Yep, and they're working and being paid for and by us. If they're working for the benefit of the people (or at least their voters), why would they keep secrets from us/them?

Not to defend politicians, but I don't want to be does on just because I think I'm doing nothing wrong

I believe your parent commenter is being sarcastic by quoting the "nothing to hide" meme. Politicians notoriously have many things to hide.

Yep, I realized that right as my post submitted! That's what I get for replying too fast before coffee

I have been advocating this for some time. If we want full transparency, let's start with the public servants. Oh, they won't be able to make backroom deals, fail at peace agreements because they walked out after 2 hours, and we'll know exactly how they failed? Yes, that's how it should be, because millions of plebs will have to fight and pay the price for their abject failure, negligence and incompetence later. Let it be on full display!

Look, maybe nuclear secrets, black ops and some kind of weird Blackwater (er excuse me Academi) stuff can be off the books, although that has historically resulted in a lot of misery, especially the CIA: https://www.npr.org/2017/01/23/511185078/america-in-laos-tra... and is probably a major reason behind war in Ukraine since 2014 ... but also in dozens of other countries, too. You'll find out when it's fully declassified 10 years later, but by then they'll just say "mistakes were made".

If we knew about how the covert operations that led to wars that killed MILLIONS of people, we'd hold them to account: https://www.outlookindia.com/website/story/how-jimmy-carter-...

Come to think of it, we'd all be richer, too. Want to get rid of wasteful spending? Start with the Pentagon. Somehow debt-ceiling Republicans aren't eager to do that but it can't account for $35,000,000,000,000 https://www.yahoo.com/video/pentagon-35-trillion-accounting-...

Thankfully we have C-SPAN at least.

that’s what I’m saying, quadruple or 10x their pay to increase the cost of them selling out for corruption but also make them wear 24/7 body cameras, maybe we can get the true patriots who are willing to sacrifice some privacy to do the good work and as a bonus shorter terms will just work themselves out naturally

Patriots ought to work for free.

This is about duty. Not about profit.

I think you have it flipped.

Have everyone in govt making in excess of 2x poverty line be subject to a tax of 99% for all income exceeding the avg of 5 years of income before joining govt

You can be rich and join govt. You can live ok post-govt. But you sure as hell should not get rich off govt

It's called public service for a reason. Its a service. Not a career.

Either you have a sense of duty and are willing to sacrifice, or else go work on the private sector.

We need statesmen. Not rent-seeking politicians

Doesn't this make it impossible for anybody not already rich to get into politics? You'd need a second job to support yourself. And second jobs are a problem not only for focus, but also as conduits for corruption

if you are not rich, what makes you so special to think you can be rich , after leaving the govt?

What has changed since the moment you joined, (nonrich), and now suddenly, you leave and you are hot stuff ?

You can still earn a living in govt, even nice money ( >$100k+ for senior jobs) the point is, that is your cap. Job security and duty come at a price. That price is not trading in insider govt connections.

You can live comfortably. You can have job security. But you cannot get rich off it. That is your "sacrifice" if you want to call it that.

And to be clear, because i realize my comment was not: You can have a really nice bump in earnings while in govt. - For example, if you have an avg salary of 50k, then join govt, at make 100k, that bump is yours to keep just like everyone playing by the same rules. However, once you leave govt, your cap goes back to 50k . So either retire in govt or just go back to what your situation was.

As you may imagine, the complaint is never that public service pays "well" therefore the hypotetical is very unlikely to happen in the first place.

Yeah but the rent seeking politician says everything I want to hear, so I’ll vote for them.

if you have to wear a 24/7 live stream body cam though

It is so ridiculous that the exact same discussion has to be repeated again and again. The arguments haven't changed. "Bad thing is happening and we need this to ensure it doesn't anymore". The bad thing changes to what's currently the most popular threat although protecting children is obviously an all-time favorite.

I think the next angle will be that it's needed to prevent hate speech. Any other ideas?

There needs to be an international human rights treaty that enshrines the right to end-to-end encryption. Law enforcement all over the world already has more than enough power to do their jobs. If they cared about protecting people, they should be embracing the wide availability of strong encryption with open arms.

It's time politicians spent time increasing accountability and preventing abuse before they even think about granting more power to law enforcement.

They never needed to go to a "next angle"; the "protect children" has almost always worked (with the occasional "prevent terrorism" thrown in for diversity) :)

You don't need to change the angle, you just need to keep trying until the people's views align enough to get it through. "Never let a crisis go to waste", and such.

Counter-terrorism, criminal investigations, national security, cybersecurity, anti-corruption, regulatory compliance, breaking up organized crime, stopping drug distribution and trafficking, stopping black market trades (weapons, human trafficking, and the aforementioned drugs), stopping production of illegal materials, preventing insider trading, detecting fraud, stopping money laundering, preventing corporate espionage, nationalistic thought-police stuff that some countries legitimately want, stopping identity theft, political back channel interference prevention, social stability (someone might incite unrest), economic stability (someone might share ideas bad for the economy), public health safety (someone might share anti-vax ideas), gang activity prevention, stopping cults and sectarian violence, scam/fraud call and message prevention, disrupting ransom schemes, preventing propaganda, stopping environmental crime, disrupting illegal immigration, military and government organization advantage against allies on whom they can spy if they pressure them into abandoning E2E... oops I mean... peacekeeping, preventing the undermining of democracy (or the fatherland/motherland for those of the authoritarian inclination). There are definitely a few bingo cards worth of possible excuses.

https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

In a world where encryption is banned:

- will it be illegal to transmit a blast of static?

- will it be a crime to transmit words that aren’t good, clear Spanish? If no, what if it’s a crazy complicated language?

- will it be a crime to transmit Spanish with bad grammar? What if I transmit a billion random Spanish words?

This is already tested somewhat in the UK, where you're required by law to provide a password to an encrypted file or volume when asked. If you're in possession of the encrypted volume, the courts assume you know the password, and throw you in jail if you don't. Obviously this can be easily abused by slipping an encrypted USB drive into someone's backpack.

The point is that they will look at intention and surrounding context - is there a crime leading to you in some way and could it have been facilitated in part by encrypted messaging? Did you also transit a billion random Spanish words during this time frame? If so, it seems to follow by their current laws and logic that they can assume this was encrypted information and therefore broke the law. And if you refuse to decrypt it for them, that's another broken law.

Perhaps we need to make a special decrypt program, one that accepts any password and just produces some log files. They can't prove it is not the data (except by claiming they planted it)..

This is done on projects like VeraCrypt with hidden containers to give you plausible deniability - one password opens the decoy container and another opens the real one. Of course this means a ton of wasted space on the disk, and as soon as you boot the decoy container it starts desytroying hidden container data. And also there's apparently ways to detect hidden containers if this is to be believed:

https://ro.uow.edu.au/cgi/viewcontent.cgi?referer=&httpsredi...

Wildly unrealistic but it exists.

> They can't prove it is not the data

Encryption is the one-to-one mapping of a set of bytes to a set of bytes. Software + key is the mapping function. When doing cryptographic forensics you don't use the user's software, you use your own.

So proving that the user's decryption program is fake is trivial and may not even come up as you wouldn't bother running it.

And you can't choose keys in a way that would alter the byte mapping in a way that you can control, the true key will map to the true data, and anything else will map to random bytes.

What if I use my own proprietary encryption algorithm? If I don't specify a file extension, then how could they tell what algorithm is used -- it's just a scramble of bytes.

In fact, what if encryption one day gets so good we cannot distinguish it from plain English? Kinda like trying to spot LLM generated content.

Sounds like steganography, it should be possible to encrypt and merge two files, with one key for each file.

I recommend filling up the empty space on hard drives and flash drives with random data from /dev/urandom. What is the government going to do, try and get you to decrypt that? On my computer I already have several terabytes of completely random data. Decrypt that, thought police.

Relevant xkcd: https://xkcd.com/538

If encryption is illegal, you are suspected of having to encrypted data and don't provide the keys, the police won't be puzzling about what's random or encrypted bytes: they'll interrogate you, abuse you and throw you into jail.

There is no law in the UK making it illegal to possess random data. And I strongly encourage other people to use the "dd" command and create some large random files on their own computer, themselves. It's a perfectly legal form of protest. The more people that do so, the less these key disclosure laws can be enforced?

In fact it would be really nice if Android smartphones, when encryption is enabled, fill up all the unused space with random data. I wonder if they do that already or not?

Even better would be have the operating systems fill up the unused space with random data upon partitioning the disk, by default. SSDs are very fast nowadays so it doesn't really take too much time to do so.

This random data filling could even be implemented by SSD controller firmware. Any SSD firmware developers here, please consider doing this by default, as it would severely impact the ability of the government to violate our rights. If AES crypto hardware is available, just use a random key, and let the hardware generate a stream of encrypted zeros.

Also if you run a Web site, you can generate chunks of random data dynamically each time and serve it up to the users. That way it will end up being stored in peoples' browser caches worldwide. Even a couple of kilobytes at a time would be fine. This can be embedded in HTML files, added as dummy data in video files, music files, JPEG, PNG, etc. Again, this is all perfectly legal to do. Transmission and possession of random data is not illegal.

So anywhere you can, if it's cheap to do, don't pad it with zeros, pad it with random numbers instead! You can even do it with RAM, because it will likely end up in the swap space at some point.

https://lemire.me/blog/2018/06/07/vectorizing-random-number-...

https://old.reddit.com/r/crypto/comments/jj4j47/arx_based_fa...

When nearly every computer or embedded device out there contains large quantities of random data on it's disk, these "key disclosure laws" will be rendered completely useless.

> There is no law in the UK making it illegal to possess random data

https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...

Not illegal to posses it explicitly, but illegal when accused of it being encrypted information and you can't magically make it not-random

But I strongly doubt it's illegal to cause thousands or even millions of computers to have random data in their browser caches, as long as no hacking takes place? Just by padding files with dynamically generated random data, as I described above?

We could write software to do this, and people can install it on their web servers, as a means of protest?

They’ll be interrogating and torturing suspected individuals, but the ability to perform dragnet surveillance or steal your data without a warrant would be curtailed. The comic mocks encryption advocates but portrays a return to old school police work necessarily limited in scope, which is what we want.

Yes, I don't like xkcd. Comes across as arrogant and condescending.

You're speaking as if this will help you. If you go to the prosecution/trial phase, you will be found guilty since you probably hadn't the best opsec and forensic analysis of your computer found the encryption/steganography software you used, or you left something in the system logs (e.g. timestamps of accessing files), or you left something in the thumbnail cache, or you did not rename the file before deleting it, or the timestamp analysis of e.g. you browser data and logs will show clear behavioral patterns pointing to you hiding data. If you use VMs, their ram is stored in a plaintext file unless you configure it otherwise, on your ssd it never goes away due to wear protection. Even if you had an encrypted drive you will be forced to give them the key, then they will rederive the master key and analyze parts of the disk free space to find something on you, again on ssd this is a certainty and on for example Bitlocker you can never change the master key, ensuring you going to jail.

Even if all of this did not incriminate you, you're in trouble for something in the first place, since you're on trial, right? So probably other people you communicated with lead them to you. And in this case, the judge applies common sense, there is this traffic cell of 6 people and on 5 computers we have clear evidence but on 6th nothing, therefore you're still probably 95+% guilty? Judges aren't stupid.

People making comments like yours annoy me since you seem to be calming people down that we could endure total strong encryption ban, while we absolutely could not.

The type of person you are replying to has most likely never lived in any sort of authoritarian regime. People like them play these games...almost like the equivalent of a child saying "I'm not touching you".

What happens in authoritarian regimes is that the law is used to justify the actions of the ruling body, not the other way around. So if you just so happen to blast random static and act suspicious, you'll be taken, beaten and either admit to a crime or a law will be made or amended to justify it. And then you'll admit to it.

The price of freedom is constant vigilance. You are correct in saying we could not endure a total strong encryption ban.

What are you smoking?

The parent comment has nothing to do with anything you just spouted.

It's about random transmissions being labeled as "encrypted" when that is not the intention.

Encryption is not limited to the more modern systems. They have existed for a long time.

These are politicians. We cannot trust them to have any knowledge or nuance.

So what's the point of sending random static over the network and looking for trouble like that then? Complying in a way that you find slightly less humiliating but still complying?

It's called being an amateur radio or ham radio operator.

"Oops, sent a funky signal with the wrong configuration, let's try again."

"I messed up the modulation so the message is illegible."

"I just found a funky NASA satellite that is no longer operational. Let me slap it with some messages and see if I get a return."

https://www.science.org/content/article/amateur-astronomer-d...

Or maybe you are an amateur radio astronomer. Built your own radio telescope.

Well yes, if you're not using encryption and it's a one off thing, the judge will probably find you not guilty.

The OP seemed to suggest that when you ban encryption, random people will randomly get in trouble, therefore banning encryption is a bad idea. But judges have common sense and law enforcement has limited resources (prioritization) therefore random people will probably not randomly get in trouble. Therefore strong encryption ban is very realistic and very easy to sell to the population, and not like the OP claimed something that will backfire. This is why his comment is naive. He likes encryption and doesn't want for it to be banned therefore he deludes himself with some alternative reality where doing something he doesn't like backfires and is reversed.

Strong encryption ban will not backfire.

Well no, judges do not have common sense. They are either extremely obtuse or corrupt. Worst case, they will make up their mind early on and refuse to budge.

Sometimes they are too old to even comprehend the technology.

Judges are always on the side of law enforcement, and whomever can purchase the more reputable legal firm. Judges have favorites, and biases.

Laws like this will immediately backfire. It won't hurt politicians initially. They get immunity. But it will allow the party in charge to cement their position through illicit use of encryption.

No encryption allowed for the opposing party! But us...

Extremely late edit : I would also point out that "random people" are easier to arrest than actual career criminals. Police here are extremely lazy and usually only go for the low hanging fruit. Some of these cases do get thrown out. But not all of them.

Did the other anti privacy laws and customs backfire? Did big tech which is in bed with the goverment censoring you while the goverment pretends you have your 1st ammendment rights backfire? Did mass metadata collection backfire? Did KYC backfire? Did banning open wifi networks backfire? Did banning face coverings in public backfire? Did indefinite contempt for refusing encryption keys backfire? Did Patriot Act backfire? Did judges signing every warrant without reading backfire? Did that FBI raid on anonymous vault storage for people, where they admitted to laying on the warrant backfire? Did civil asset forfeiture backfire? Will the soon introduced kybc (know your business customer) forcing hosting and cloud providers to identify their customers before allowing them a Vps backfire?

My country does not have a 1st amendment, but ok?

My country does not have free speech. It has some of the most stringent copy right laws in the world. It also has defamation laws that have been used to suppress truthful reports.

Police are allowed to hold you indefinitely with no justification. (Technically they are limited to 30days) They are allowed, and constantly refuse to allow you access to a legal representative.

They are allowed to force you to confess to a crime you never committed.

Politicians get away with corruption, and secure votes through the use of cults.

I know what it looks like when the current dominating party was created by a literal Class A Warcriminal from WW2.

These anti- encryption laws make life even worse. The last thing we have here is a semblance of privacy.

I do not want, or need 1st world countries such as Britain or Spain to give an example for my government to follow.

I am, of course, familiar with the wrench decryption method (https://xkcd.com/538/).

I am saying no ban on encryption can be logically consistent since you can’t absolutely prove that something is encrypted. Even if it is a file called encrypted_drive.imencrypted.

I’m not a lawyer but this kind of ban should be wide open to legal attack. Especially if the country also has freedom of speech. And if it doesn’t have that, it should.

And if all else fails and this insane law passes, the illiterates who pushed it through will cause a national economic and security disaster. Online crime will skyrocket. The KGB/FSB will have a feeding frenzy. Voters will quickly learn to love encryption again.

> - will it be a crime to transmit Spanish with bad grammar? What if I transmit a billion random Spanish words?

I'm open they ban anything related to Latinx. Or at least call it a different language.

I'd have more sympathy to the "we need to be able to read every one's message, and open up everyone's communication to criminals to stop crime" story if there was any evidence it would actually do anything.

There is no evidence that the reason terrorist attacks (the common go to) would be stopped by removing encryption from people, because we know that existing attacks have occurred even when law enforcement is already aware (take the Manchester bombing: multiple friends and family had reported him to the police on multiple occasions).

We do have a huge amount of evidence that any such attack on privacy will immediately be abused. In the UK those laws that were passed to "stop terrorism", etc are used to catch people not picking up dog poop, not paying TV licensing, etc. In the US we had wide spread warrantless surveillance of literally everyone, courtesy of AT&T.

My opinion is that any law that proponents proclaim will only be used to stop X should contain terms along the line of "any use of this legislation for any purpose other than X invalidates this law, any evidence acquired must be destroyed, and any convictions derived from such evidence are no longer valid". I would give good odds that any attempt to add such text would result in push back by the people saying the law is only needed to stop X.

We had a recent example in Canada of how any attempt at restricting such a law would go.

- The government proposes a law to regulate content on the internet, ostensibly targeted at Netflix and similar services.

- Critics point out that the law would apply to small-time content creators too, and could destroy their ability to compete.

- The government pinky-swears that they would never apply the law to individuals.

- A member of the opposition proposes an amendment to explicitly exclude individuals from the law.

- The government rejects the proposal and passes the bill as originally drafted.

Spain's politicians don't understand what this ban means. In their eyes, it's like allowing a policeman to open suspicious mail at the post office; and no, it's like getting your mail in transparent envelopes, or receiving all your online shopping in crystal boxes. However, nobody will convince them since someone has sold them the other idea: the same people who sell ultra-expensive software to government that causes nothing but problems.

Every country wants to ban end-to-end encryption. It's this one, common desire that gives me comfort that it actually works.

Yes. And continue thinking in the same vein, not once, not even single time there was a talk about banning https.

Oh... oh, shit.

Fair point. We always hear about the NSA has this or that. The calls to ban encryption are lower in the US, so I wonder if NSA has something they just won’t share with Europe?

It's a non-starter in the U.S. Legal battles were waged in the 90s over encryption and it was ruled that software is speech: https://archive.epic.org/crypto/export_controls/bernstein_de...

My view on banning encryption in any way is always the same: it will disadvantage the innocent masses, and the criminals they purport to be targeting will simply continue to use it. The black hats will rejoice because now their victims are less secure by law. Good luck stopping them.

I don't understand how this is proposed all over again when it has zero chance to be effective.

Criminals will not use apps that compromise security. They will still use apps that are end-to-end encrypted. These people are breaking the law already, why would they make an exception for one that would compromise their opsec?

It's a far-left government that believes the state has answers to everything. They also want to ban porn, prostitution, etc.

Oh sweet summer child. It's a government. This one may be "far-left". The UK wants to do the same and is "far-right". The far-right in the USA want to ban porn, prostitution and burn books. Governments are made of psychopaths. It doesn't matter what kind of politics the psychopaths are pretending to have in order to get into power. The reason that politicians even have parties is so that there is always someone else to blame, not them: you blame "the far-left" and not the psychopaths in power. The problem is always "woke people", "fascists", "lefties", "racists", you name it. No the problem is psychopaths.

Spoiler alert: They don't care about the criminals.

Crazy that we need big corporations to protect us from the government. It was supposed to be the other way around.

Gov't is just a special case of corporation. Every city within a state has a charter just like a corporation.

More the opposite. Corporations are granted charters (and limited-liability) by governments because they are extensions of governments. They're either meant to

1) take risks to accomplish goals that would be beneficial to government, but that government does not want to risk itself, [e.g. if there were no grocery stores, government would have to feed you, but government doesn't have the information to choose locations and stock stores effectively, which competition provides]

2) allow the government to do things that government isn't allowed to do directly [e.g. censor content, cut off undesirables from financial services, pay lower than their current government union contracts or legislation], or to

3) aid the transfer of wealth from government to insiders through either government overpayment for services it could more cheaply provide itself, or by having looser labor/materials sourcing/pollution regulation or monitoring than government does, providing self-dealers a margin built from externalities.

A city files a charter with the state to be recognized as a city. A business files a charter with the same state (not a city) to be recognized as a business. It's like instantiating the same base class, but extending each one with specific properties that identify them as different objects.

Whether it is A->B or B->A doesn't really matter. It's all a method of operating as a defined entity to the state with minor differences. It would not be hard to define something like Apple with it's corporate campus as a city. That would blur the lines pretty significantly. They could create an actual Apple Police. I'm guessing that would do some heads in.

Corporations serve at the pleasure of the government. Big corporations serve as single chokepoints for extortion or blackmail (via threats to business, legal via regulation or otherwise) to put in backdoors.

All power structures are your enemy.

https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

For the purposes of privacy and human rights, corporations and the state are integrated in almost all large industrialized nations. Businesses are too busy being businesses to fight city hall.

Not everything is a “power structure”. Some people actually like to get shit done and organizations are a means to that end.

If you get a million people together, you'll get a million different ways to "get shit done". Deciding which ways to do things and who does what is a power structure.

Add in billions of dollars in quarterly revenue, and you have a power structure that will willingly integrate itself with the state to preserve those cash flows.

This is why iMessage is backdoored and isn't really e2ee.

They don't really protect from the government. NGOs like https://eff.org, https://edri.org do.

The corporations just want to stake their claim of keeping our data to themselves away from other corporations. Crazy were in a situation where corporations and governments are at war over who gets the looting rights.

I just don't understand how they think they can do so.

It's not even the "why?". I get the "why?" even though I obviously don't agree.

It's the "how?".

How do you ban cocaine? How do you ban special parts in guns that make them automatic? How do you enforce any law that's not practical to enforce?

You just make it a felony with a penalty of decades of imprisonment. Then, all the businesses stop doing it and you selectively enforce the law in order to make an example out of people. The idea is never to enforce it fully.

If encryption is a felony, your average business will stop using it, which is pretty much the desired effect. They don't care so much about your personal website or data store using encryption. They'll just make it a fringe technique.

So are they banning VPN and SSL too? Those are not fringe techniques.

It's like staying so are you banning freight and air travel too to those politicians in order to stop cocaine. When do programmers get it that those analogies don't mean anything in real world.

Except it's not cocaine. It's banning bikes, when everyone uses bikes, no? VPNs and SSL explicitly are the target, in part. It's not a figure of speech, it's factually the thing. If your point is politicians don't get that then... fuck idk, I'm hoping for maliciousness over that level of incompetence.

Freight and air travel don’t involve cocaine as a standard. VPN and SSL do include encryption as standard.

It’s not an analogy, it’s pointing out that encryption is more common than some think.

If only more people understood that the police aren’t there to stop crime rather to document it, we would be further along with the enlightenment.

It’s all punitive because preventative is fantasy.

Controlling supply chains is a lot easier when you're dealing with physical things and not abstract concepts.

Ok but banning encryption seems akin to banning combustion.

Government can ban combustion too. So that next time it's revealed in a court of law that you caused combustion, you'll be locked up. It's not about preventing combustion, it's about if they find evidence that you combusted, you getting a criminal sentence.

The how probably isn't so hard if you are a state actor. You won't be 100% effective, but if you make it a felony to possess systems that can do it, to use systems that can do it, to possess any data that can be tied to such a system, etc., etc. it's quite likely that usage would drop to nearly nothing.

I think the how is pretty simple: If you're a company that runs a chat/communication app and you can't comply with a government request for the contents of private communication on your platform then you're in violating of the law.

If you have any presence in Spain then you'd be subject to fines or whatever cross-jurisdictional sanctions they can get away with. Or if you're untouchable legally they could require ISPs to block you and you can play whack-a-mole. The majors players where 95% of communications happens would either have to play ball or withdraw from the country. In practice this probably means that small apps get away without complying until the government has a request for you that you fail to meet.

It's a horrible and terrifying idea, but I think it's reasonable to enforce and get the vast majority of people to have unencrypted communications. (but not the vast majority of dedicated criminals)

It is not pretty simple. A govt can't win a whack-a-mole game. Consider attempts to block Telegram in Russia. They caused so much collateral damage while not even approaching the goal, that the whole effort had to be canceled and swept under the rug.

You force Google and Apple drop apps in the app store that support encrypted messages.

You sue and jail any website operator offering access to encrypted peer-to-peer chats.

Finland "warned that the proposal could conflict with the Finnish constitution" and Germany "has staunchly opposed the proposal", so I don't think there's going to be an EU law banning end-to-end encryption. So if Spain were to act alone, I can't imagine banning WhatsApp (which uses end-to-end encryption) would go over well with their constituents. It's on 98% of their smartphones and (at least in 2015) they used it more than any other EU country [1]. WhatsApp (like Signal) said it would leave the UK rather than weaken encryption if end-to-end encryption was banned there. [2] I'm sure the same would be true for Spain.

1. https://english.elpais.com/elpais/2015/02/16/inenglish/14240...

2. https://www.theverge.com/2023/3/10/23633601/uk-online-safety...

Maybe WhatsApp is lying, but it would put them in a predicament for the following situation: a user from outside of Spain chatting with someone inside of Spain. Assuming they comply with Spanish law, they could,

1. Say nothing and show no warning message. Would generate negative press and distrust in the platform.

2. Show a warning message when a user tries to message someone in Spain. Some would commend the transparency, but the press and public may still be upset that they acquiesced to the Spanish governments' demands.

3. Create an entirely different version of the app for Spanish users. This wouldn't generate much negative press outside of Spain, but Spanish users absolutely would be upset that they can't contact people outside Spain with the app.

This is not an edge case scenario: 15% of people in Spain are foreign-born (likely contacting family and friends from their home country) and 2.7 million Spaniards live abroad (likely contacting family and friends inside of Spain.)

Option 3 is likely out of the picture, but of options 1 and 2, while neither would result in the death of WhatsApp, some users may indeed leave the platform due to it. In order to be worse than losing the entire country of Spain, 2.35% of WhatsApp users would have to leave the app. That seems unlikely, but even still WhatsApp might not feel it's worth the risk, and in any case they'd probably prefer to not have to spend development hours building systems to comply with the law. Easier to just cut them off.

Good Android supports app sideloading. Apple users, too dumb to care :‑þ

Most likely it would enable them to go "well we can't decrypt your messages you exchanged with you conspirators which we think would prove you're a criminal, but since you used E2EE you are now a criminal by default."

It also enables them to stop petty criminals, but we both know they don't really care about that.

> but since you used E2EE you are now a criminal by default

Wouldn't simple mappings introduce sufficient plausible deniability in this case?

An example: Every two bits in the encrypted message are mapped to 0=A, 1=T, 2=G, 3=C and suddenly everyone is transmitting DNA sequences for research and evaluation.

Attach the encrypted message to a legitimate sequence and-- boom! --you have a "telomere".

Or even more in-your-face:

Encode bits as spanish words. Enumerate 2^8 words in the dictionary and just use them.

If they can get the apps removed from Google/Apple app stores in their country, and put blocks at the ISP level to prevent anyone actually communicating with Signal or WhatsApp servers, they'll get most of the way there.

LLMs make it possible to scan every message, every phone call, every communication and classify it for intent. Ba Without E2E we are screwed.

tbf communications are now classified by ridiculously broad criteria like degree-of-separation (my Doordash driver who called me donated money to "terrorists" so now my communications are fair game), keywords (I venmoed my friend for tickets to ISIS-the-band's last show) and geography (I live within 100 miles of the US border) so LLMs don't seem necessarily worse

Much like certain segments of American society prioritize gun regulation as the paramount factor influencing their electoral choices, I aspire that citizens might accord an equivalent level of importance to the prohibition of end-to-end encryption in shaping their voting decisions.

Off the wall idea - given that encryption was classified as a munition in the U.S. from an export control standpoint, does that mean it’s protected under the second amendment?

That's not an off the wall idea at all. https://duckduckgo.com/?q=encryption+2nd+amendment+protectio...

personally, i doubt this to be true. the voting masses are by and large not that smart on issues like this. granting access to personal data in order to receive promotional information has been accepted and liked by a large percentage of the masses. if not liked, then tolerated. if not tolerated, then willfully ignored.

if the argument is to get discounts on retail products/services, then of course the "think of the children" or "but terrorists" will work on them as well.

putting that much decision making in the hands of the voting public is always a scary idea, and never a sure thing.

Yeah - I’m constantly floored by the number of people that trust Clear at the airport, to save a couple of minutes in line…

Both are fantastical and naive. Billions are used on shaping voting decisions in plain sight/text.

Anyone with any insight as to why this topic is suddenly in the limelight in so many places at the same time?

I find it remarkable that, even though the UK government is desperate to demonstrate any form of tangible benefit to Brexit, and talks about independence and sovereignty etc, it is moving in exactly the same direction as EU nations on this, ignoring all advice to the contrary.

To be honest I’m kind of feeling left out. My messages are boring. Perhaps if this nonsense goes ahead I’ll start communicating dinner plans with my wife through our own custom key pairs, just to mess with them.

The dirty secret of the web is that the past 2 decades of VLOPs have led to a stunning increase in CSAM and sex trafficking. Governments know this from initial good-faith participation by VLOPs to escalate abuse to authorities. They were quickly overwhelmed. We know all this because of investigative journalism done by NYT in 2019.

VLOPs are interested in E2E encryption now because it lets them ignore their sexual abuse problem by making it untraceable and therefor unreportable. No normal user needs or benefits from E2E encryption on Facebook.

We don't need a blanket ban of E2E encryption but we do need regulation around who can use it and when. Preventing VLOPs from smoke-screening their platform abuse is a good middle ground.

Many idealistic technocrats on the web already believe E2E encryption is an absolute moral good, so it's hard to even get the conversation started. As evidenced by the extremely simplistic black & white takes in this thread. VLOPs are counting on this when they market E2E features as in their users' best interest.

I suppose that massive increase of cases is why the special "sex trafficking" courts the US government set up in 2018 shut down for lack of cases. This is just anothe scare like the red scare, terrorism, etc. Very little actual impact or events but huge response in terms of getting re-elected and showing eyes ads so it's blown way out of proportion in the public discourse.

Basing your laws off the needs of corporate persons instead of human persons is bad policy. Authoritarianism might look good in the short term but $godwin. Will you suggest going after the post office for people mailing illegal items too? It's misplaced. The person who commits the crime commits the crime.

Here is the investigation I referenced. Consider reading the report and grounding your argument in reality. This stuff is happening. What should we do about it?

https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...

The answer you don't want to hear and is bound to be extremely unpopular is: nothing. If the only way to effectively rein in online CSAM is to fatally compromise encryption, that's a price not worth paying. We have already sacrificed many a personal liberties at the altar of "think of the kids!!", and, as you mention, it's yet to prove effective at the task. A line has to be drawn somewhere.

You're conflating transport encryption and E2E encryption. The OP article is only about E2E encryption, which is not fully implemented on Facebook to date, so not allowing them (and other VLOPs in the same position) to implement it just maintains the status quo.

My claim is that these platforms have a proven history of elevating CSAM on the web and are turning to a currently unused technology, E2E encryption of messages and groups, to crystalize the problem instead of tackle it.

This has nothing to do with theoretical beliefs about encryption in general, the value of transport encryption used by Facebook and nearly every other website, or personal liberties. Nobody needed E2E encryption on Facebook in its first couple decades. Nothing is being sacrificed if they don't implement it now. The sacrifice happens when the _do_ implement it. We sacrifice the ability to do anything about the CSAM influencers profiting on the platform.

I'm not even arguing for a blanket ban of E2EE. What I'm arguing for is that we don't allow VLOPs to use it.

I am talking about what the original article mentioned, which is that certain Spanish legislators are pushing for what sounds like a blanket ban on E2EE by service providers, including the dominant communication platforms such as WhatsApp and Signal. This, in and of itself, is a massive overreach.

> Nobody needed E2E encryption on Facebook in its first couple decades [...]

The reality is that "transport encryption" does absolutely nothing to protect you from a malicious, authoritarian state actor, which is why the state's asking for it in the first place and why there have always been activists pushing for adoption of E2EE on these platforms. I should know, I was and still am one of them, so it's a bit absurd to say "nobody needed it for decades" when the only reason it's being adopted in the first place is because there's clear demand. And because the state has steadily gained the ability for technologically feasible mass surveillance for the first time in history, which is also a new phenomenon.

> We sacrifice the ability to do anything about the CSAM influencers profiting on the platform.

I'll spell it out bluntly: I acknowledge it could have such an effect, and it's a sacrifice I am willing to make, and deem to be a net gain for society as a whole. People have throughout history engaged in despicable behaviour, and will continue to do so in the online world because it's a reflection of who we are as a species, both good and bad.

> I'm not even arguing for a blanket ban of E2EE. What I'm arguing for is that we don't allow VLOPs to use it.

So we lose the ability to *maybe* do *something* on *some platforms* using only the online communications of the perpetrators, whom probably represent single digit percentages in the population. Meanwhile, traditional policing continues to exist, and the ban would, in practice, affect almost everyone else (or else what's the point?). Except, of course, the technologically literate criminals who will as always find ways around it.

I'm assuming you're aware of the far-reaching potential for misuse of your proposal, and presumably that's a sacrifice you're willing to make, so our differences can be easily summarised: you place higher value on punishing a relatively limited number of individuals for crimes deemed particularly damaging and offensive over sacrificing the whole of society's right to private communication, I do the opposite. In fact, if you grant that this issue will likely never fully be resolved (as history suggests is the case), we merely disagree about what the tolerable level for this crime is in exchange for safeguarding societal freedom. Same with all other forms of criminal activity throughout history...

As we've already sacrificed much in the name of this very issue, I hope people living in democratic nations understand what's at stake here, and that there will never be an end to these authoritarian arguments. Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.

I understand your position and if you're willing to say the quiet part out loud then that's enough to stop me hounding your position. I just don't want anyone having their cake and eating it too.

I disagree with how you frame my position. First the argument that criminals will always find a way around it is specifically why I think legislation should target VLOPs. Nobody can just build one of those, including criminals. If you want to firm up my position it's not that E2EE is the last battle against CSAM; rather it's that VLOPs proliferate CSAM in previously impossible ways, with a virality factor unachievable by older means. Criminals are of course free to return to Signal or whatever, but it won't give them the reach that Facebook gives them so it's still progress even if we didn't save every single child on the planet.

Moreover, I disagree (again) with your desire to pull my position into a theoretical debate about free speech absolutism. I just don't think two people on HN are going to get to the bottom of that one. But with a little nuance, which yes is messy, we can stop the proliferation of CSAM on VLOPs without constraining individual liberties. Just go do those liberties on anything except a VLOP.

I appreciate the candour, and understand you’d rather these measures be restricted to a very limited number of platforms.

Ultimately, you’re right, our debate here will have little effect on the outcome, given that members of the Spanish government stated in no uncertain terms they would indeed not restrict it to the large social media platforms. I was pointing to the specifics mentioned in the article instead of pulling it in a theoretical debate like you said.

Alas, whether their stated intentions are the true ones, I trust few legislators to nail some platonic ideal state of authoritarianism, even if they’re benevolent. Too much power stands to be concentrated in too few hands for this ever to go our (society at large) way. When we shift the debate to the problem of the integration, we’ve already lost.

This was a delightful read. Two contrasting points of view coming together without a flame war. For a second I had to double check that I was on the internet.

Me, I don’t know where I stand. I think if it eliminated CSAM, terrorism and other such things, it’s a price worth paying.

What I need to be convinced of is the scale of that elimination, because if erosion of privacy is the cost paid, people (as in Joe Public) will want to see returns on that.

What I think it’ll actually do is move offenders away from those platforms and onto ones that are even harder to monitor. I mean, I’d assume that Meta will be able to see who is talking to who even without the content, which puts some pieces of the puzzle together in the presence of other evidence. I’d also assume end to end encryption doesn’t mean much if the app itself has a CVE that leaks information once decrypted, and it certainly doesn’t mean much if authorities have possession of your device (in the UK, not unlocking a device and apps when asked to is itself a punishable crime).

So if all this will do is drive people to platforms that eliminate such things and make the job of law enforcement even harder, it isn’t worth it.

But if there’s more to it than that, it might be. Im guessing it’s feasible that WhatsApp push out an update that sends them your private keys, because I’m assuming the app itself has access to them. If Im right, then in theory the end of E2EE could open up a huge backlog of messages and solve “historic” crimes. If that’s the case, it might be worth it.

Too many variables for me, so Im placing myself firmly in the “I don’t know” camp.

Whatever we can do without restricting E2EE.

We don't need to ban E2E, especially not "to think of the children". I am thinking of my children when I say I don't want any ban on encryption at all. I want them to enjoy their lives and the internet as I have, without the government constantly sticking its nose in. That's what “thinking of the children” really means if you're being sincere about it.

> No normal user needs or benefits from E2E encryption on Facebook.

Not the encryption baked into facebook chat, but most certainly the encryption baked into the HTTPS they're accessing facebook through.

How would this even work? Sorry in advance, since I'm not well-versed in encryption, but wouldn't HTTPS also fall under end-to-end communication? What about for military purposes? How would enforcement of this work? Like would they just require that What's App and the like not use end-to-end, or fully just block all encrypted packets on the ISP side? If not, couldn't someone just program an app to do the same, or download APKs of Signal or a similar app? This strikes me as being completely bone-headed.

> wouldn't HTTPS also fall under end-to-end communication?

Not if you have to use a government-issued root certificate.

Wow, so would non-gov-signed certs be completely banned? Like if a website used Let's Encrypt, then would the government just ban people from accessing it? How would that even play out with VPNs? This seems so completely unenforceable, unless Spain decided to enact a China-style Great Firewall, and even then this would be an entirely different level.

They tried to do that in Kazakhstan in 2019. Mandate a root cert installed everywhere, then MITM everything.

Ofc the attempt failed.

They stopped?

Technically still end-to-end but in that case you can’t trust one end.

So spain would have to make a certificate for EVERY website? How would it work, when you would visit a canadian or brasilian website?

All I'm seeing is Spain wishes to disconnect from the rest of the world.

Without encryption, you do not have banks, you do not have email, you do not have 90+% of websites, you don't have any business software sales, and now as of Win11 and its Bitlocker-by-default strategy, you don't have consumer desktops.

If Spain wants to get on the fast track to a revolution by literally destroying their economy in the most efficient manner, I say let them. This is a self-solving problem.

They are fine with transport encryption. They want do ban E2E encryption. As long as the companies (and the authorities) can access your data at rest, they are fine.

Encryption does not work unless everything is encrypted, even at rest.

There are no secret keys that only the "correct" people can use, there are no impenetrable vaults where hard drives live and only the "correct" people have access to. It is either encrypted, 24/7/365, in all the forms it lives in, or it is not encrypted.

Banning E2E is the first step on banning encryption entirely. There is no other sane way to conceptualize this.

What is "E2E" is a bit ambiguous. Server-Client is a sort of end-to-end in network context. Maybe nowadays people say E2E for between personal device encryption?

Reminder that France actually did this in the 90s, because why wouldn't such an exceptional country with glorious leaders do that? Clearly they knew was was best.

https://www.theregister.com/1999/01/15/france_to_end_severe_...

> Until 1996 anyone wishing to encrypt any document had to first receive an official sanction or risk fines from F6000 to F500,000 ($1000 to $89,300) and a 2-6 month jail term.

This news item from 1999 is about France finally making it legal to use toy ciphers to encrypt documents in France. Let that sink in. Trivial toy ciphers were actually illegal to use in france for 3+ years.

This (I think '97) was when I realized that France is not your typical western democracy style country. Nothing about France is typical.

(And, yes, the it was that Dominique Strauss-Kahn.)

> imperative that we have access to the data

What makes electronic messages be different to other forms of private communication that they need to be provided to the government automatically? And in the case of Spain in particular, there are reports of Pegasus being used to spy on Catalan politicians [1][2].

[1] https://www.amnesty.org/en/latest/news/2022/05/spain-pegasus...

[2] https://www.amnesty.org/en/latest/news/2022/04/spain-pegasus...

Anytime you see articles like this just substitute the word "math" for "encryption" to understand how absurd and authoritarian it is.

They can shove this CSAM BS up their asses. We all know that this "save the children" is nothing but fig leaf used to cover total surveillance and control. Opening their communication to wide public instead as the other poster have proposed makes way more sense.

https://www.versobooks.com/en-gb/blogs/news/4421-the-authori...

"The psyche of a fascist is “authoritarian” in the sense that it attaches itself to figures of strength and disdains those it deems weak. It tends toward conventionalism, rigidity, and stereotypical thinking; it insists on a stark contrast between in-group and out-group, and it jealously patrols the boundaries between them. It is prone to obsession over rumors of immorality and conspiracy, and it represses with self-loathing the sexual licentiousness it projects onto others. In all of these ways, fascism appears as the political manifestation of a pre-political disposition. The authoritarian personality does not always turn explicitly fascist; its politics may remain dormant, only to emerge under certain social-historical conditions."

Fascism always uses an excuse, it stokes widespread fear and panic, so that it can subject the population to authoritarian rule.

I'm curious. Why are European Governments from the UK to Spain suddenly trying to ban end-to-end encryption.

I mean I would be extremely surprised if agencies such as the GCHQ were unable to crack or completely circumvent end-to-end encrypted messages (and any well-funded signals intelligence agency that claims it's unable to do so, should be required to give an accounting of what it spends it's budget on), so why the sudden desire to ban it?

Wouldn't it be better to give the bad guys a false sense of security to lull them into using seemingly secure end-to-end encrypted messaging apps, and then quietly gather evidence against them?

They are taking an authoritarian bent, this is what happens when you think government can solve all your problems.

The issue with governments is that they don't see the risk it creates for themselves.

Even if everybody _inside_ your country plays by the rules... Everyone _outside_ of it does not.

And let's face it, foreign intelligence services will have a feast over this.

I see those things as a big slap in the face for freedom. Can you imagine? We forbid locks in your homes. You have nothing to hide (but a lot to lose).

I hate the argument 'You have nothing to hide'. It is so untrue for every single person in the world. It is such a weak argument.

You have nothing to hide and we forbid to use any form of encryption.

Alright, lets AI call your grandmother with all the information hackers got on you. Lets see if you really had nothing to hide.

Would homomorphic encryption or any other privacy enhancing technologies allow for a middle ground here?

Would allow you to scan the encrypted messages for incriminating or illegal content when there is reason to believe a specific account is doing something illegal (could require court approval, then a further process for full decrypted messages as part of court proceedings)

In one-key scheme you, the encryptor, would also have to encrypt the naughty word list, allowing you to cheat, so it will not be allowed.

Ahh interesting. So you could not have one key encrypting the messages than a separate org-wide key encrypting the naughty word list. That makes sense. Thanks.

I think there are some multi-key schemes but they are much more expensive and very rarely used, I don't know much about them

This seems similar to the ridiculous questions members of the US Congress asked Google and Facebook employees a few years ago. Law makers (particularly the older, less technologically inclined) tend to view things through the worst possible lens because they lack the knowledge required to understand the inherent value of technologies such as encryption.

I think you misunderstand the display put on by most senior members. They have staff that can get details. However, playing dumb or obstinate is a negotiating tactic. The authority hierarchy at play is more important that the details of the tech, viewed a certain way. Let's be blunt, more than half of all representatives in both parties work on behalf of local, state, Federal and international security.

And many of them - on behalf of foreign nations.

It's not just lack of knowledge, but lack of willingness to learn and apply it.

Their priorities are set on the power plays that happen in government chambers, the government and corporate interests that ask them to change laws for some purpose, and performing actions that will keep them elected (in that order). Banning encryption is something that satisfy the second group, where government organizations would love to make their jobs easier by having a key to encrypted communications. The fact that the entire internet is built on encryption is only a barrier to these governmental powers telling lawmakers to "pull the trigger" on banning encryption, since the compromises will hit corporations the most (since corporations actually do need perfect encryption without the government spying on them).

Who is it specifically that pushes for this? It has to boil down to specific people/companies/organisations.

Who, and why do they want it?

The politicians saying they need to curb CSAM, mean exactly what they say they mean. The problem is exactly as big as they say it is. That doesn't make their desired angle of attack a good idea, but if you make predictions based on the assumption they mean something completely different and want to spy on people, or that they're being influenced by people who do, you're going to predict wrong. There's a reason many of them are fixated on trying to fingerprint CSAM content out of encrypted messages without decrypting them, something that would not enable the government spying everyone seems convinced it's really for.

Seems like everyone who wants to spy on and control you has a strong interest in outlawing encryption or anything else that stands in their way.

Almost all governments want this because they want more power and more control over people's lives.

https://archive.is/3rqpB

The problem is not that they want to ban encryption but that they can't. It's like banning poetry

Or randomness itself. What if I want to publish a sequence of meaningless blips?

The article says the majority of EU countries want to scan peoples' messages for illegal content. If this ends up being implemented, then it has crossed the line and we are now living in an authoritarian state. A watershed moment indeed.

How does one even look out for these things?

There are elections this year, yes.

But other than that, how does one even notice these proposals, and how can one help to prevent them from passing? Or even, how to help change the people representing the country in these things?

politics has patterns, it has some procedural and bureaucratic parts, those are very visible (legibility! see also "Seeing like a state")

but in general there's the separation of powers (branches of government), the opposition parties, the checks and balances, and the media.

to answer your question directly, the bigger the government the more separate agencies it has, the more people you need to watch them, the more people are needed to simply raise their voices, give their faces as the opposition, and then more people to keep track of what-the-hell are they doing.

that's how you got special interest groups. single issue parties. (and if such a party manages to raise the salience of their issue to the "national level" then this basically forces other parties and actors to reveal their preference regarding that issue.)

The global view to put it into context:

https://community.qbix.com/t/the-coming-war-on-end-to-end-en...

As a Spaniard, genuinely curious about why they are so worried. I mean, the real reason. My first bet is Catalonia, but wouldn't be surprised they are actually worried about their own security.

I don't use E2E encryption to evade my government. I use E2E encryption to protect myself from criminals and malicious actors. Oh, government == malicious actors ??

Maybe what we need is for a first world nation to finally do it, so the rest of the world can see what a catastrophe it turns out to be?

I would be surprised if all governments didn't want to ban e2e encryption except for their own usage.

Every government wants to ban E2E encryption, but most know that it isn't feasible to do so.

Am I the only one to wonder what will happen to DRM streaming in the EU if this passes?

Every single government on Earth does. This is why you limit their power.

Apparently Germany is an exception. From the story:

> Representatives from Germany—a country that has staunchly opposed the proposal—said the draft law needs to explicitly state that no technologies will be used that disrupt, circumvent, or modify encryption. “This means that the draft text must be revised before Germany can accept it,” the country said.

And if is a public document, why do they call it "leaked"?

Why don't we just ban alcohol too.

Afraid people votes conservative and the election is the next Sunday. The more confused and afraid get the voters, the more will search protection in the angry and vicious candidate that promises stability.

For the PP all is a flaming hell, for the Socialists all is unicorn glittering wonderful. All are wrong and they know it. The truth is in the middle.

I would just assume that everything said in this week is fake or incorrect. This is simply typical FUD to catch some late votes in minor groups of citizens.

Pack it up boys. Back to http

Reply on news.ycombinator.com