If we want to protect the right to encryption and (pseudo)anonimity to the degree we have it now, we have to appeal to emotion. Just like how "child advocacy" groups tried to make you into a monster if you think blanket scanning of all data on our computing devices is a bit too far gone.
[1] actually I don't think that is true, but let suppose so
[1] Let me guess, the "good solution" you claimed as existing has been described by you already.
Educate them, absolutely. Monitor their every move online because they might do something stupid? That's an option I would like to limit to their parents/guardians, if it all, not any state or bigtech corporation, and certainly not any automated flagging system.
1: Not CSAM; let's limit this line of thought to consensually made porn.
Of course, possessing or distributing images of underage naked people can get you on a sex offender list, even if that naked person is you. That's a different issue.
With a false flag sufficing to ruin your life, I'd rather take no chances for a nebulously defined benefit. In the end all this does is mark those apps participating as unsafe for people who do, incredibly, feel safe now to post such images through a service like WhatsApp or IMessage (do these people even exist?). They'll use something else, and the people you do catch are just idiots and teenagers.
And that false flag event is hardly far-fetched with the extremely broad definition CSAM has. I'm pretty sure that if a parent photographs their 13 year old daughter proudly posing in her new bikini on the beach, and sends it to grandma who naively posts it on Facebook, where someone downloads it for their personal sexual gratification, then posts it on some image hosting site for bragging rights, where it gets hoovered up for the great CSAM database because that site was filled with photos of scantily clad children, and now when the partner of the above parent asks them to send those photos they took of their daughter on the beach for the holiday photo-album they're making, and boom, they are on a list.
Unlikely? With unaccountable processes and black-box databases things like this will happen, and that is excluding the likelihood of bugs happening (which is inevitable).
I have a very hard time with this. These laws which are ostensibly there to protect the children are actually used to persecute these same children.
Any proposal "to protect the children" that doesn't address this is full of shit.
The real problem they want to solve is most likely organized crime and terrorism, plus on son countries political dissent.
The issue at hand can be described very, very easily: law enforcement agencies' mission is going to get harder to fulfil if they lose the possibility to wiretap suspects. The solution is, unfortunately, not that easy!
Now, HNers can cry their lungs out that mathematics forbid a perfectly safe backdoor and what not, but they are missing the point: they are simply ignoring the question and lacking any respect for the people posing it in the first place.
The issue exist; and it makes sense. Furthermore, wire-tapping has always been accepted, at least as a necessary evil, by democracies all over the world. At the same time, absolute remote privacy has never existed, much less been guaranteed. E2EE is a big game changer, and you expect people with governing responsibility to just ignore it?
Is it actually getting harder for law enforcement? Do we have evidence of E2EE harming cases, hurting conviction rates, or similar? At this point in time law enforcement has been routinely dealing with and lawfully overcoming encryption for several decades. Encryption is no longer a novelty law enforcement has no idea how to deal with.
I understand that law enforcement officers may sincerely believe that encryption makes their jobs more difficult and thus the public less secure. Since they are public officials, I am happy to accept their claims as truth. I just need to see supporting evidence. At that point we can begin to weight public safety against privacy. Until then, I can only consider a demonstrable loss of privacy against a purely hypothetical impairment of law enforcement functionality.
Speaking only and solely for myself, I in no way expect people with governing responsibility to ignore end to end encryption. I do expect them to ask questions when people with a demonstrated capacity to function in the presence of E2EE claim it is making their jobs too difficult.
Please, be! Discussion is welcome.
What I despise is only immature people ignoring important societal issues with a sweep of their hands, while crying a void "because privacy".
Until then, I think we should give their claims all the weight of all the evidence they have provided. Or failed to provide.
Whatever the law says law enforcement within your own country can or can't do has no bearing at all on what foreign intelligence agencies can do.
All of which is to say, if you're thinking of things like MK Ultra, nobody ever publicly argued we should give that kind of capability to the CIA and it was already illegal at the time they did it and they did it anyway. Trying to make telecom service providers legally obligated to provide an encryption workaround for law enforcement is a completely different thing.
With this in mind, I think making the tools resistant to abuse is a highly desirable design goal, up there with making the detection of abuse very easy.
The wiretapping of yesterday is not the mass surveillance of today. John from the police taskforce snooping on your landline and taking notes is not even in the same ballpark as mass data collection and categorization of everything, everywhere all the time.
I also accept the former as a necessary evil, but it's a completely different beast from my latter example.
That being said, you raise good points. I don't know what would be the ideal solution to these relatively new worries of governments. I feel like this bump in internet privacy is counteracted by the surveillance network that has been built in the real world, so we could call it even in some ways.
You're going to say that in democracy, the state uses warrants issued by a judge for wiretapping and there's due process. How's that working out in the US, given Snowden's revelations and the Patriot Act?
Leftists wrongly think that the state represents the will of the people. It doesn't. Democracy is preserved primarily by (1) a culture of liberalism and (2) the state having limited powers. But as could be seen in WW2, democracy is fleeting, actually.
Being from Eastern Europe I've got to say that seeing privileged Westerners willingly give up freedoms, that other people died for, has been such a huge disappointment.
---
As for crime prevention and investigation, you can still follow individuals around, install bugs in their home, compromise their personal devices. But it's never enough, is it?
Actually, I don't have a strong opinion because I recognize the issue to be very complex.
So far we've seen a lot of assertions that encryption is a major hazard to public safety, mostly from groups with a long history of abusing access to wiretaps. We've seen precious little evidence to support this. The other group claims that encryption enhances privacy and pushed back against abuse. There's plenty of evidence to support this.
More than once in my life, I've seen people attempt to advance an unsupported position by claiming it's very complex. Sometimes this is true and they just need time to support their points. Sometimes it's completely untrue, and the idea is to leave uninformed onlookers with the impression of complexity that needs to be negotiated.
How sure are we that this issue is genuinely very complex, versus the real possibility of false complexity in an effort to confuse you and me?
How do you compromise someone's device that's running iOS 17 and using an encrypted messaging app?
> But it's never enough, is it?
The reality is that people are using E2E en masse, and it's not possible to compromise modern devices the same way it possible to compromise a phone line in 90's. I can open telegram and buy any number of substances/devices/items, paying with Cash App. This just wasn't feasible even 10-15 years ago in the way it is now. So what do we do? (I don't have an answer, fwiw).
As for iOS, there are always vulnerabilities that state-level actors can exploit. Not long ago simply sending a message to someone via iMessage could have compromised an iPhone. Which is why iPhones now have a "lockdown mode". Criminals are either dumb enough to expose themselves via insecure devices, or competent enough to use an extra layer of encryption, which can't be prevented. Even if you outlaw general-purpose computing, people can just send encoded messages with custom algorithms, WW2-style.
If you target someone specifically, and have access to their location, there's no way they can protect themselves while also keeping a communication channel open. Let's be honest, this isn't about targeting someone specifically, but about fishing for wrongthink.
> So what do we do?
As a citizen, not my problem. Law enforcement should do their jobs without encroaching on my privacy. Or my child's privacy for that matter.
If scientists invent a way to read people's thoughts, what next? Mass surveillance for people's brains directly because there's no other way?
If the question is mass surveillance, NO is always the answer as far as I'm concerned.
Sure we do! Use parental controls to prevent your children from using any e2e messaging services.
It protects children. Removing protection doesn't protect children.
Bad actors will use the this to find children to harm.
In a more globally appealing version, you can spin that into various forms of "This is what the Communists did to prevent people from rising against them" (replace Communists with Nazis, if desired). Or reference V for Vendetta or 1984 or other cult classics.
Our governments wield extreme power and we have a moral imperative to keep checks and balances in place so that power is not abused.
A pedophile with a laptop and a camera is terrible. A Senator without the 4th amendment is worse.
A racist with a social media account is terrible. A President without the 1st amendment is worse.
They keep saying it because to most people they absolutely do weigh heavier. Very, very few average people are going to agree with what you just said.
Every conversation I’ve had IRL on these points, after the initial negative reaction to what I just said, progresses into mutual understanding that an organized government is the ultimate threat when left unchecked - and that these rights are core to the system that protects us from that power structure.
It protects us from the very same people who are telling us to “think of the children.” When Feinstein and co. proposed “child abuse” legislation to “protect the children” - my point is that children need to be protected from her and the power structure she represents first and foremost.
Endlessly repeating that you are “thinking of the children” when you trade their future safety away digs this toxic thought deeper into the cultural zeitgeist.
When I opposed the president’s surveillance program, I was thinking of the children and how it was going to shape their lives in the US.
Anecdotally, my close friends struggle reading the single short paragraphs I send them about important events. Bad enough that they skip over a couple numbers, and then say "I'm not doing all the math for that", when it literally says the answer directly. The mere sight of a couple numbers immediately puts them into "gloss-over" mode.
I really have no faith in Gen Z at large. I largely blame Tik Tok, but at the same time, something like it was inevitable. Capitalizing off of a feedback loop of shortening attention spans is going to spell doom for our society.
Rubber hose cryptanalysis is pretty effective.
E2EE protects the children from being spied on by pedophiles.
E2EE protects children from being arrested by the government for being dumb children.
[Edit: Added "pictures of"]
This is a power grab and should be treated as such. E2EE makes police work more inconvenient but it should be inconvenient. If you want to optimize for police work convenience, you get a police state.
A key part of this issue is learning about the frequency with which this type of legislation is brought up over and over again and how it might be new to some not not everyone.
Perhaps bureaucracies are counting on people relatively new to encryption erosion not having context that they are far from alone.
I do think there's some merit to your second point, however.
It also, of course, contains the kind of implicit contempt for the public that has led to widespread disdain of politicians in the first place, because while many people may be easily swept along by appeals to emotion, they still usually have a good feeling for when the speaker doesn’t respect them.
I don’t know if anyone’s really trying to figure out what it would take to make these tactics not work on a large scale, rather than how to use or work around them.
See also: “Guided by the beauty of our weapons”[1] by Scott Alexander. Compare: Paul Graham’s statement[2] that “Java's designers were consciously designing a product for people not as smart as them.”
[1] https://slatestarcodex.com/2017/03/24/guided-by-the-beauty-o...
Lt. Commander Data: Were you prepared, sir?
Commander William T. Riker: I don't think anybody ever is.
Lt. Commander Data: Hm... Then it is better not to trust?
Commander William T. Riker: Without trust, there's no friendship, no closeness. None of the emotional bonds that make us who we are.
Lt. Commander Data: And yet you put yourself at risk.
Commander William T. Riker: Every single time.
Lt. Commander Data: Perhaps I am fortunate, sir, to be spared the emotional consequences.
Commander William T. Riker: Perhaps.
I know that scifi is being used to reflect on the present. That doesnt mean it is always helpful.
The individual people involved often have good intentions.
But the political machine is a different beast. Seeing like a state, and all that.