Terrorists will have no problem writing their own encryption program, and more ordinary citizens will install malicious apps from unofficial app stores.
Ah… terrorist, the magic word. That’s why you can’t have a SIM card which is not tied to your ID or passport in EU since 2015. Terrorists actions allowing an state entity throwing 4000t of explosive on civils in a weekend… yep yep…
more seriously (though I wasn’t totally kidding), your non-tech relatives and friends are all on whatsapp/insta/messenger, good luck to move them.
People in Reddit and sometimes here always praise the EU as some bastion of privacy, and I always got downvoted when I said that this isn’t always true. And now here we are. I hope people don’t forget this after a month, like they always do.
They will, and you’re screaming into the wind sadly.
What you can do is never forget and base your voting decisions to include this as a priority going forward. Endorse and support companies that protect privacy.
It’s a long uphill battle and every little thing can help no matter how small.
I like how patrick breyer makes a warning with all the logical points. Especially this: “Fourthly, scanning for known, thus old material does not help identify and rescue victims, or prevent child sexual abuse. It will actually make safeguarding victims more difficult by pushing criminals to secure, decentralised communication channels which are impossible to intercept even with a warrant.”
I am not sure what the people over there think, but the criminals will not just continue using these services.
So for, here is what I can tell from specific countries:
On board with privacy destroying law:
Spain, Hungary, Cyprus
Mostly on board: (support on device scanning but not weakening E2EE)
Ireland, Denmark
Against:
Finland, Germany
Feel free to update this if you know more.
Source: https://www.wired.com/story/europe-break-encryption-leaked-document-csa-law/
If they can scan it, they can edit it.
Correct. Though signatures can help.
What is wrong with the eu? Why do they need to always ban end to end encryption?
As I remember at the moment partly Von Der Leyen, the current Commission president. She is a German Christian democrat and apparently bit with capital C. Meaning she has bit of a moral panic streak on her of the “won’t you think of the children” variety. As I understand this current proposal is very much driven by her.
However her driving it doesn’t mean it sail through to pass as legislation. Some whole memberstate governments are against the encryption busting idea.
Von Der Leyen is a swinger clubber
I have helped a little with some ongoing research on the subject of client-side-scanning in a European research center. Only some low level stuff, but I possess a solid background in IT security and I can explain a little what the proposition made to the EU is. I am by no means condemning what is proposed here.I myself based on what experts have explained am against the whole idea because of the slippery slope it creates for authoritarian government and how easily it can be abused.
The idea is to use perceptual hashing to create a local or remote database of known abuse material (Basically creating an approximation of already known CP content and hashing it) and then comparing all images accessible to the messaging app against this database by using the same perceptual hashing process on them.
It’s called Client-Side-Scanning because of the fact that it’s simply circumventing the encryption process. Circumvention in this case means that the process happens outside of the communication protocol, either before or after the images, media, etc, are sent. It does not matter that you use end-to-end encryption if the scanning is happening on you data at rest on your device and not in transit. In this sense it wouldn’t directly have an adverse effect on end-to-end encryption.
Some of the most obvious issues with this idea, outside of the blatant privacy violation are:
- Performance: how big is the database going to get? Do we ever stop including stuff?
- Ethical: Who is responsible for including hashes in the database? Once a hash is in there it’s probably impossible to tell what it represent, this can obviously be abused by unscrupulous governments.
- Personal: There is heavy social stigma associated with CP and child abuse. Because of how they work, perceptual hashes are going to create false positives. How are these false positives going to be addressed by the authorities? Because when the police come knocking on your door looking for CP, your neighbors might not care or understand that it was a false positive.
- False positives: the false positive rate for single hashes is going to stay roughly the same but the bigger the database gets the more false positive there is going to be. This will quickly lead to problems managing false positive.
- Authorities: Local Authorities are generally stretcht thin and have limited resources. Who is going to deal with the influx of reports coming from this system?
Making it illegal only hampers those that follow the law.
Criminals, by definition, already don’t follow the law.
Exactly. When privacy is criminal, only criminals will have privacy.
just in time.
connect the dots.
This could actually be a good thing, it might end up pushing people to serverless and more decentralized FOSS solutions
Just imagine the headline we’d see in the west if this was happening in China.
