Hacker News Reader

Comment by somenameforme | Hacker News Reader

That Tweet links to this [1] description which, in glancing at the text, seems to indeed be accurate:

----

According to the latest draft regulation dated 28 May (Council document 9093/24), which is presented as “upload moderation”, users of apps and services with chat functions are to be asked whether they accept the indiscriminate and error-prone scanning and possibly reporting of their privately shared images, photos and videos. Previously unknown images and videos are also to be scrutinised using “artificial intelligence” technology. If a user refuses the scanning, they would be blocked from sending or receiving images, photos, videos and links (Article 10). End-to-end encrypted services such as Whatsapp or Signal would have to implement the automated searches “prior to transmission” of a message (so-called client-side scanning, Article 10a). The initially proposed scanning of text messages for indications of grooming, which is hardly being used to date, is to be scrapped, as is the scanning of voice communication, which has never been done before. Probably as a concession to France, the chats of employees of security authorities and the military are also to be exempted from chat control.

----

Strange times we live in. Entertaining, but strange.

[1] - https://www.patrick-breyer.de/en/majority-for-chat-control-p...

View on HN

Article 12 of the declaration of Human Rights :

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

Bugging communications by investigators with special approval is already an exception to this principle. Government bodies that make sure that laws conform to the constitution should veto any exception broader than that, so this draft should basically be pointless.

It feels like there are social/political mechanisms at work that allow that to however happen. They pave the road to Hell little by little, one stone at a time, and this is neither strange nor entertaining. To me, the beginning of this century has similarities with the beginning of the previous, which is quite worrying.

agreed. i feel the real motivation is much more sinister and much more to do with the geopolitical situation than anything else.

the reality is, if anyone is seriously determined to commit what they know are crimes then there are many solutions, of admittedly varying quality, for having private communications outside of the mainstream apps available on the app store. even signal itself has an apk you can install on android from their website.

so, it's unlikely this will indeed help in the fight against CSAM or whatever else is purportedly motivating this legislation. the end result will be mass surveillance 24/7 on the vast majority of the population who aren't commiting any crimes at all. it seems to me like big brother's wet dream. ironic that this is exactly the thing the US/EU political leadership have been bashing the chinese for since forever.

governments having low level dirt on their populations feels like manufacturing excuses to send people to war and remove their autonomy

> ironic that this is exactly the thing the US/EU political leadership have been bashing the chinese for since forever.

there's a good reason for that. it's not controlled by and for the benefit of our oligarchs.

Any intelligent criminal will just meet face-to-face to discuss their criminal activities. None of these apps protect against someone taking a photo of the screen and snitching to the authorities about what was said in exchange for less jail time.

Or, to be honest, implement a fully E2EE chat application by themselves, right?

it's pretty easy to do these days. even in the browser you can use WebRTC for P2P and Web Crypto on top and knock together an e2e encrypted messenger in a few hours. assuming you can trust the browser crypto of course.

I haven't confirmed this, but I would expect that creating E2EE chat that doesn't follow this new law would itself be prosecutable? Now criminals can be picked up for merely using secure chat, if the government can't easily get them for human trafficking/drug trafficking/whatever. Reminds me of how the twentieth century US gangster Al Capone was prosecuted for tax evasion.

Anyone who is not explicitly privy to a fully bespoke, end to end encrypted data transmission and retrieval system has no way to determine the function or purpose of that system.

It could be text, audio, video, raw signal bitstream from an IoT sensor, or a full duplex async combination of anyone of those.

It wouldn't be a "chat service" to an outside observer, it would just be seemingly random, opaque bits between two endpoints.

If the traffic can't be identified and it isn't a known endpoint, then that's already suspicious.

well, for example, you could roll your own secure messaging over WebRTC data channels using Web Crypto. There won't be anything unusual looking about the traffic as it will all be wrapped up inside DTLS/SRTP which is the transport for WebRTC. so, it's encrypted twice and would look perfectly normal to any outside observer. there's no way to tell what is happening in the messaging layer WebRTC "encapsulates".

At end of day, if someone wants to do this, there is no way, afaik, it can be detected. so, all these laws won't really help combating serious criminals who have some savvy.

The way to do it would be to outlaw any protocol that can encapsulate to a point that off the shelf DPI can't read it.

I know you're being sarcastic, but you can implement perfect crypto and still get analog holed.

https://en.wikipedia.org/wiki/Analog_hole

If you're running a criminal organization, a bigger threat than a wiretap can be someone wearing a wire, so to speak. Talking about anything over text creates a ton of evidence about the criminal conspiracy that you are currently engaged in. That evidence can be screencapped or recorded or whatever else by the person at the other end of the conversation. Since you don't have physical control over that person, it's possible they could be compromised.

If you keep everything in-person, even if someone becomes a snitch, you can still check them for hidden recording devices. At best, this means the evidence against you is that person's recollection of your conversation.

This is the same reason why it's much harder to pirate a movie in theatres than one released on streaming. Physical control over the environment that information is disseminated in is the gold standard, just look at the US military:

https://en.wikipedia.org/wiki/Sensitive_compartmented_inform...

To be fair, criminals are (fortunately) not always intelligent, especially the rabble they are trying to catch; or at least, the "small fry" isn't, but that's precisely how - I suppose - they hope to catch the bigger fishes who may be more cautious.

> agreed. i feel the real motivation is much more sinister and much more to do with the geopolitical situation than anything else.

Of course. Your "privacy" is very important for Microsoft, Google and Apple because of the "geopolitical situation". /s

Yeah I truly don't see how this is all that ambiguous of a violation of privacy.

Here I entirely blame Apple for opening this Pandora’s box. Politicians never attempt what they don’t know to be possible.

Will my email client using SMIME have to implement this? Seems kind of ridiculous.

Seems to be targeting platforms. Will it be illegal to send encrypted texts, what is keeping anyone from using crypto on top of existing messaging?

While I do not want to dive into any details on adverse effects of such stupidities, the EU seems to be actually taking a strange road to tech dependent overengineered regulation. It seems that this mostly driven by lobbyists that want to sell compliance services. Also it seems that there is more value in creating regulation rather than making sure it is enforcible.

> Will my email client using SMIME have to implement this? Seems kind of ridiculous.

Seems about right for the EU.

If you are in the business of selling SMIME clients as a service to other people, then yes, you would need to implement this if the law passes.

Maybe there's an unintended upside to all this regressive business legislation. With all the focus on the "platforms", then maybe, just maybe, this will be yet another nail among the thousands of nails needed to finally kill them off.

Signal is not selling anything. So my guess is that distribution is enough. So my guess this would also apply to e.g. Thunderbird then.

Yes. There are people with problems. Instead of helping them fix their problems it's just easier to prevent nice things from everybody.

Strange times indeed.

This is the standard reaction humans have these days, ban things because a small minority screw it up. See guns.

Seriously, who are they expecting to pay for that? AI vision detection run against _every image every person sends to anyone_, among other things, will get ridiculously expensive.

Half of the reason Microsoft is pushing "AI PCs" with special hardware is so they can push their spying to on-device and reduce all the extra costs the data processing they're imagining for things like automatic-screenshot-analysis-every-x-seconds will need.

And they're pretty much experts on spying on users. They've been collecting so much data for so long that apparently they've found a way to utilize what they collect in a way that makes the costs balance out in the end. Whether thats with government access, preferential antitrust treatment, or some actual financial method that directly affects the bottom line, I don't know. Somehow it's worthwhile for them. BUT -- when even Microsoft is looking for more efficient ways to spy on people, and forcing new hardware to support that effort, you know the data collection and analysis technique is definitely not ready to be made a legal mandate.

It doesn't make sense at all for some EU decision makers to decide it's acceptable for their citizens to bear the cost of so much data processing.

....wait, how much do large players in AI contribute to these politicians campaigns? Or if not them, who is really pushing this? It seems like someone should really try following the money on this one.

vry good take

You answered yourself : remember Apple’s implementation of CSAM detection.

We don’t own our devices anymore and we now have very limited control of what is executed or not so there is nothing stopping developers to run those legal spywares on the device since our only option if we don’t like what an app does is to not use it.

A trusted app running on arm execution level 3 could make use of the NPU to offload some of the work?

Apple's proposed algorithm was probably the best so far.

The problem is not going away, we in tech are partly responsible and we should promote good ways to deal with it. If we don't then a solution will be found anyway, it'll just be a bad one.

I don't know how to help folks that didn't treat the apple csam fiasco as a massive wake up call to ditch the ecosystem.

We have linux phones these days, caly, and grapheneos. There really isn't reason to give up on general computing. (Ignoring the propriety baseband blobs.)

Apple's backing down on that very sound initiative was a failure and a red flag indeed. They had the chance and the weight to pull it off and set a standard, but instead basically gave in for regulators to implement whatever spying laws they want.

Sadly, nothing else comes even close to Apple in terms of security and privacy, especially for someone who is not an infosec specialist and doesn't have time to read CVEs all day.

While you make good points, I still wouldn't trust Apple to not scope creep over time. Client side scanning of hashes for csam presents the entry point they need to establish client side scanning as a norm. It's the preverbial inch. Give it a year, or months even, and watch that grow to include scanning of text for terroristic threats, or of teens' chats for grooming, or depression, etc. Then watch that data become a gold mine for both the gov and for advertisers.

The slope is so slippery that it's ot worth the risk, imo. It paves the way to reduce general computing even further, which is already quite restricted on apple devices to begin with.

> Sadly, nothing else comes even close to Apple in terms of security and privacy, especially for someone who is not an infosec specialist and doesn't have time to read CVEs all day.

Even for someone that is not an infosec specialist, they should be using something like Graphene for phones and something like Qubes for their OS.

Apple isn't great at all honestly, at least in terms of MacOS security - they mostly benefit from not being worth the time to target.

Let me take the other side here. The western world couldn't make it without sovereignty. I do realize that it sounds bad that few states would have such power. But make no mistake - if they won't do it, other actors would, I think that your interests reconcile with a democratic state much more than the other crooked actors.

It's just a matter of lesser evil in my humble opinion.

Implemented mass-surveilance is proof that democracy is dead.

What if the overwhelming majority of voters want surveillance?

Then put it to a referendum. It's certainly an important enough protection considering that correspondence is usually constitutionally protected.

I give you that if the voter opinion was not influenced by media reports. However, since that is pretty much impossible, no... There is actually no way the "overwhelming majority" will ever want that, without being influenced...

E2E encryption would prevent anyone from intercepting texts by mathematic certainty.

At least on a mass scale, if we worry about back doors.

This SaaS fad is the underlying technical enabler of the spying and need to go away.

I guess Google is the main culprit by making P2P coms hard.

Asking faceless corps to open their users' mailboxes willy nilly is way easier then asking the voters to.

Follow the money article: https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

I will quit using all these platforms then.

Finally, free from WhatsApp voice notes, stickers and images clogging my phone storage. Adieu.

If those are what's bothering you, nothing stops you from quitting right now.

For now I have a Tasker job routinely deleting WhatsApp's media directories. Unfortunately everyone is using it so I have to stick with it. Hate WhatsApp with passion.

If this law passes, bye bye.

"want to stick with it"..

dont misrepresent

"have to stick with it"..

dont misrepresent

you admitted yourself you dont have to, as you will leave it if the law passes. Why are you not willing to admit that it is a "WANT" ?

Everyone will be using it when the law passes so it’s no different.

Do you imagine that people will stop chatting if this law passes? If you hate it so much, why not just stop using it now?

As others have stated, just uninstall it now. Even at my work, my manager wanted us to use WhatsApp to communicate with our offshore teams. I let her know that I would be happy to do so with a company provided phone, but I don't install spyware on my devices, and furthermore don't have an app store so would need to be able to build it from source. But I'd be happy to use signal or email.

"The initially proposed scanning of text messages ... is to be scrapped, as is the scanning of voice communication, which has never been done before."

If true, then it seems unnecessary to "leave the EU market" with respect to text messages and voice calls.

It would be so funny if a security authority was caught in a CSAM case, and it wasn't detected simply because said person is an authority and shall not be scanned for unlawful content.

The problem is the design of the system and the programs. It should not handle by the apps/services but you can use your own programs for encryption, for display, etc, and can be used separately. If the data is really end-to-end encrypted then the service and apps should not care what they are; the user should care based on what programs they install to handle them.

Additionally, it says photos, videos, links, but you can make any data represented as other files e.g. text, slowscan, steganography, etc.

The law says "images, photos, videos and links". What about simple encrypted or password protected zip files?

As far as I know, most messaging platforms allow you to send regular files too. Wouldn't "the bad guys" simply use that as a loophole and continue with their day?

I know the real reason behind the law isn't to actually protect children, but, you know...

I assume this will apply to all bits. After all, a zip could contain an image, so it should be scanned. And someone might accidently change the file extension from .jpg to .py.

The point he's making is if they enact this law, it will be trivial for anyone that cares (eg, people who do distribute CP) to bypass if it is implemented as described. They don't even have to stop using Signal or whatever. They just need to plonk whatever they want hidden in a password protected .zip (or something else if that's not strong enough, or use stenography if they ban containers) and send it using Signal as normal.

So it won't stop CP, or any other criminal activity that's in the slightest bit cluefull.

They must know this, so I'm left scratching my head wondering what they are actually up to.

Yep, lol nothing to stop criminals from encrypting the file themselves and sending it across lol theirs hundreds of unhacked encryptions, all the end users need to do is share the passwords outside the spied upon platforms, like this doesn't solve any issues it just strips freedoms from the non-criminals.

Shit criminals will just meet and swap usb drives lol, like i don't get how this solves the crime issue. This is like banning monero or crypto because its used illegally.. meanwhile CP and other crimes have used Euro and USD paper money for long before crypto lol but yet "crypto seems shady" is enough reason to point at it as the reason crime exists lol.

> The point he's making is if they enact this law, it will be trivial for anyone that cares to bypass if it is implemented as described.

I took that as a given and therefore described what I would see as scan-creep of the gov implementation regardless of the exact verbiage of the law.

My point was that anyone expecting to use the file type as a loophole would likely ne compromised, and the only way to ensure bypass of the scan would be to locally encrypt before transmission, as any text or binary entered into an app affected by this law should be assumed to be fully mined, scanned, and reported to the gov regardless of its contents.

I hope this passes.

I want to see the riots when EU cell phone consumers have to pay for text messages again.

Some men just want to watch the world burn...

Does anyone have to pay for text messages?

People often forget just how much we get from the EU that's taken for granted. Everything from practicalities like no roaming costs and consumer protection, all the way to freedom of movement, peace and overall stability.

I don't think the EU says anything about how much texts should cost...

Edit: I am *obviously* not talking about surcharges for roaming but cost in plans, which I think is the point of the OP when he asks who pays for texts. Pricing is not regulated and has nothing to do with the EU.

It does, quite a lot. For example, it says you should pay the same regardless where you are in the EU (roaming), it also says you get a clear and transparent pricing for your mobile service, it also says all kinds of things about your rights to cancel, change providers, get refunds etc... you should look it up.

Why the snark? Especially since you're beside the point, so let me rephrase with the help of my lawyer: the EU does not say anything about how much consumers should be charged for text messages by their operator (i.e. "cost"). This was clear from my previous comment...

> If you continue to spend more time abroad than you do at home and your roaming consumption continues to exceed your domestic usage your operator may start charging you extra for your roaming use. The surcharges (excluding VAT) are capped at:

> €0.022 per minute of voice calls made

> €0.004 per text message

> €2 per GB of data (cap in 2022, decreasing over time to €1 / GB, which will be the maximum surcharge from 2027 onwards) https://www.google.com/amp/s/europa.eu/youreurope/citizens/c...

So where does it say how much operators can charge in their plans? Nowhere.

They are free to say texts are free (included in plan), or texts are charged at 10 euros each, whatever.

The EU only limits surcharges when roaming to other EU countries.

Jeez, guys.

Edit:

I am not backing away from anything, I was rephrasing to sustain your strange cross-examination. You guys are being unecessarily aggressive and argumentative over a simple point.

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

"don't cross-examine."

It's Sunday, guys. Do something positive with your time. Bye.

So you're backing away from your original stance of:

"I don't think the EU says anything about how much texts should cost."

Into a weaker form of "The EU only limits surcharges when roaming to other EU countries.". This was my only comment because your first position is factually incorrect, there are situations in which the EU defines how much texts can cost.

edit: not sure where you see the aggressiveness

The funny part of this is that I avoid such charges by pointlessly using lots of data in home country to account for usage in other EU countries.

Yes, but also the (1) push of PNR to keep a complete record of your travel and movements within the EU. Dutch train operator NS is operating in spirit of the future “PNR” already and makes it harder and harder to buy “anonymous” train ticket (even for local 15min journeys). The so called anonymous card, is linked to your bank account used to top it up. What if you prefer to use cash in your daily life (2), for envelope-style budgeting? Well, your bank will let inform the authorities of your anomaly. You will start receiving monthly questionnaires asking to backup your behavior and why you might want 2-3-4K eur in cash every month.

All that people have to do is vote for the Pirate Party. There are people holding the line in Europe, but the population is worried about war and immigration instead of net neutrality and encryption. These are understandable priorities but it'll not be good.

This is part of the trans Atlantic trade agreements. They have a certain responsibility, having negotiated them, but they clearly feel they are beneficial in some way.

Crediting the EU with peace while Israel and Ukraine are actively at war is a bit much.

Are Israel and Ukraine EU members? Are they fighting members of the EU?

Oh come on, France and Germany were basically in a perpetual war for hundreds of years before, and now there's not even a theoretical chance of any two EU states fighting each other.

Occasional war here and there not directly involving any of the member states is incomparably better than what came before.

In Germany at least, unless you opt for a super cheap package(e.g. sponsored free or less than EUR 6/-), calls and texts are unlimited in local(country level) networks, only data volume is limited. Not sure about other EU neighbors.

In Poland, 4.70€/mo will get you unlimited calls and texts. Can be purchased on pre-paid plans as a 30-day package, no need for post-paid plans.

If you have to run every image and text through some sort of "filter" you cant turn off... Yes.

Thats a LOT of compute.

Yes. The phone batteries across the EU are going to hate this.

That is already happening though, this just says it should also happen to e2e encryption by scanning on device. If it was that expensive costs would have appeared a long time ago.

I pay ~0.10€ for a text message - but I don't know anyone who uses text messages for communication so it's not a problem. I could buy a cheap plan for unlimited text messages, but I don't want a fixed monthly fee and prefer prepaid.

There won't be any riots. This is the scariest part, most people just don't care

France: Hold by beer. https://en.wikipedia.org/wiki/List_of_incidents_of_civil_unr...

While it's a fun meme, if you actually look at the list, the inciting incidents are usually (accusations of) police violence/overreach, reforms to cut labor protections, welfare or public education, and Israeli military operations in Palestine.

In fact, most of the protests seem to neatly fall into the "police violence" (usually against minorities) and "austerity" buckets.

I think the parent meant that France is a country that actively protects its rights via violent protest as opposed to other countries that merely sit and suffer.

And yet France is talking about turning off the internet during these protests so that protestors can't communicate.

That was my point. Austerity measures tangibly affect most people in easy to understand ways: cuts to healthcare, cuts to education, delayed retirement, etc. Police violence and overreach are a significant concern especially among certain minorities because they (allegedly) experience forms of it every day.

But the Internet is largely a magic box and at this point the common understanding seems to be that it is both private and also under massive corporate and state surveillance at the same time. And that's not even mostly wrong.

A lack of rioting doesn’t mean people don’t care.

When was the last time public outcry actually impacted policy?

Example from last year: https://en.wikipedia.org/wiki/Dutch_farmers%27_protests?uses...

Holy shit thats creepy AF

What do they do if I send: AFBC67CEDA7AD?

Ban all “non-intelligible” content?

Who can stop me from hiding information in very normal looking sentences?

If you want privacy, there will always be a way.

This is not about preventing you from doing that, it is about preventing services with many users from providing that service to you without a backdoor.

You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.

> they just can't provide an automated means to do that for you

What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data.

What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?

> The encryption app?

That might be the next step. Banning encryption. We live in a strange world right now.

The EU does not want to ban encryption, because it is the backbone of e-commerce and banking. There are plenty of public references that show the EU's explicit support of strong encryption.

What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.

Neutralizing encryption is real; it is not about forbidding websites and clients using TLS, it's about getting in the middle.

Step one would be determining if anyone actually uses those two apps together. A handful of people? No one cares. Is it now the default way you install Signal (or its two components) and do hundreds of thousands of users do this? Then the next question asked is who is facilitating it and how is that done? Does the backdoored Signal have a plug-in that allows this kind of use? Does Android facilitate that? Those people will likely find themselves in legal trouble.

Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.

> Does Android facilitate that?

Does Android facilitates IPC and services?

That's not what the law cares about. Being able to encrypt stuff end-to-end, is not what is being targetted — it is not realistically possible. What is being targetted is millions of people getting private, true end-to-end secure communication with no content scanning of any kind through some service. Are you providing that service to millions like Signal is? This law applies. Are you the size of Meta and are you implementing some 'clever' two-component solution to sidestep this law? Expect legal trouble.

You can already install a mail client with PGP-support. Will K-9 Mail get in to trouble if a million users in the EU started privately exchanging keys and using GPG with K-9 Mail? Who knows. These laws are not about such practical details. This is about unlocking massive amounts of signal intelligence to do… who knows what, and those large communication platforms are juicy targets. All it needs is a law to coerce them to cooperate.

Don't expect reasonable arguments from the proponents of such laws, and don't expect to be able to avoid them for millions of users with clever tricks; you'll still fall foul of the spirit of the law, if not the letter.

> A handful of people? No one cares.

Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.

I am using a special keyboard that outputs these sequences automatically. Must my keyboard driver send the keypresses to the EU? Fine, here are they: AFC628BCF627.

I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer?

Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.

You don't seem to understand the point of these laws. It is not about stopping anyone with enough technical know-how from encrypting their communications. This is possible today, and not something which can be easily legislated away without resorting to a much heavier class of draconian laws (at which point you won't be living in a democracy any longer in any case).

This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you.

You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law.

It's a dumb law, but you won't make it go away by playing silly semantic games.

> without resorting to a much heavier class of draconian laws

They may be coming down the pipe, after the soft version gets people macerated.

> at which point you won't be living in a democracy

But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships.

And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.

Criminals are using specialty phones or should I say, were using, because this was recently cracked and thus became useless. Catching Taghi in NL was a famous result of that.

Point is that dangerous people will use specialty devices/services and being legal is certainly not one of the requirements.

Again, not what this law is about. This is all about wanting to gather signal intelligence on millions of people automatically. About being flagged when someone uploads CSAM or uses certain keywords. They know it won't stop anyone with the skills and means to use some other encrypted solution.

So they explain it to people as being able to catch criminals, but they known it won’t work against that?

How can you maintain such a position? At some point you’ll have to explain your reasons for draconian measures like this.

That’s why I’m spamming people with “it won’t work” because so many seem fooled by this. You will catch exactly zero people with this. The only people you’ll catch will be the ones that you would have caught anyway, because of their nonchalance.

I don’t know anything about law but I know tech.

> So they explain it to people as being able to catch criminals, but they known it won’t work against that?

Why a law is enacted is more complex than just the here and now. Some of these law-and-order types dream of the day they can order Apple or Samsung to completely lock down their smartphones and forbid any user controlled cryptography. Some just want to be able to feel that they are doing everything in their power to prevent children from being harmed, even if the measures only cover naive users. Some just want people to know that they are being watched, and have these laws act as deterrent.

And as a bonus: some parents really like the idea that none of their children or any of their mates are sharing (their own) underage nudes and that this is enforced automatically.

The law will likely work for some of these points, to some extent. It's still a bad law, but the people pushing it aren't idiots; just dangerous.

OK thank you for elaborating. I tend to assume that such laws - "let's listen in on everything you do" - need firm and solid justification. Coming up with a simple counter-example on first try signals to me the problem has not been handled effectively (understatement of the year). I'm not talking about having the perfect solution, just.. something that does not immediately fall down on first try within a few minutes.

This world confused me sometimes.

If you sell your keyboard as a service to people in questionable lines of business, then yes, you will need to comply with these laws. You can probably also expect a visit from three letter agencies. Which these targeted platform companies also do.

Exactly, this just pisses off companies with added costs, strips freedoms and criminals move to using their own encrypt and decrypt step that the "Scanners" just see as bullshit gibberish or some form of stenography image etc.

Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.

A timely reminder that 9/11 hijackers communicated in the clear. Examples:

“The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering.” — Mohamed Atta

“Two sticks, a dash and a cake with a stick down. What is it?”[2] — Mohamed Atta

“The first semester commences in three weeks. Two high schools and two universities. ... This summer will surely be hot ...19 certificates for private education and four exams. Regards to the professor. Goodbye.”[2] — Abu Abdul Rahman

Even in China with extreme surveillance and censorship in place, Chinese people have been quite creative in their ways of circumventing censorship. An example approach is cutting and pasting official political videos together in a way that changes their meaning ever so slightly. Automatic censorship algorithms are fooled, and human analysis and censorship are necessary and very expensive to carry out. Other examples are playing with the sounds of words, or using memes or rapidly-changing euphemisms.[3] It's too difficult to automatically censor stuff where people have taken a normal word such as "chair" and send each other images of chairs as a sign of protest. An image of a chair and a birthday cake with a number of candles could indicate a date of protest. Or a chair in a picture with a number of ducks in the background, or a number of chairs stacked on top of each other. And if censors start blocking all chairs, everyone just shifts to buses, or pieces of paper, or bananas, or whatever.

[1] https://community.apan.org/cfs-file/__key/docpreview-s/00-00...

[2] https://www.nytimes.com/2004/12/20/business/technology/on-th...

[3] https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_Chin...

> What do they do if I send: AFBC67CEDA7AD?

If this sort of surveillance stuff gets accepted, in time, you're gonna get noticed, put into database, and maybe called for questioning. Why are you using encryption, people that have nothing to hide do not use it.

"We kill people based on metadata"

Frankly, GB was totally right in leaving, and if I had the ability to vote for stay/leave right now, I'd want to go. But this position is totally unwanted. You're being called Nazi or at least extreme-right the minute you utter it. This way of dealing with supposed democracy is what makes me want to leave even more. The EU has become a strange beast. The current election ads make that pretty clear. It basically reduces to "vote us, we're cool, we are deocracy" which is almost dystopianly void of real content.

Where are you living, if you don't mind sharing? I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

And I disagree. You take for granted all the good regulating and all the things enabled by the EU, and focus on the one bad regulation we're discussing, which is not even a law yet. I, personally, am not looking forward to the future without EU (I remember my country before it joined and the progress is immense).

> Where are you living, if you don't mind sharing? I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

Try the largest German-speaking subreddit, for example.

> I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

I think elsewhere online this may happen.

Also, some public broadcasters use the "far right" word group suspiciously often, almost as if it was some kind of effort to softly suggest to people how not to vote, but I must be imagining things, because they would never do that:)

Yeah, thats the problem. "they would never do that" has been violated far too often by supposedly centered media outlets. During corona, our state contrtrolled media actually really said that citizens are not supposed to listen to any other media because everyone else is likely lying. And since it is blatantly obvious that center-left parties will get a haircut for what they did during corona, again, the state controlled media are now doing exactly what you describe, warning the citizens of the evil right parties. And I am forced to pay for this, 50 cent a day. This isn't democracy anymore, its blatant manipulation of public opinion.

"Progress", sure. What you actually mean is "we got a lot of free money to build things with". Its easy to like the EU if you are in one of those countries that gets way more out then you have to put in.

GB has their own version of chat control: https://en.wikipedia.org/wiki/Online_Safety_Act_2023

England's government already passed essentially the same thing.

UK has passed that law before EU. https://en.m.wikipedia.org/wiki/Online_Safety_Act_2023

Yeah, UK left because they thought EU wasn't draconian enough.

When apps created for overthrowing governments in other countries begin to backfire amid record low approval ratings, it all of a sudden turns out that “human rights” are merely a cudgel to beat others with.

Reply on news.ycombinator.com