The EU thread

[Zanza]

Zeit has some good maps of the German results :

https://www.zeit.de/politik/deutschland/2024-06/wahlergebnisse-europawahl-deutschland-landkreise-live

What the hell is the BSW? Or the FW?

And here I thought I had learned my German parties.

In German federal elections, you have to win 5% of the vote to get any seats. That rule does not apply to the EU parliament elections.

[Syt]

https://www.techradar.com/computing/cyber-security/proposed-eu-chat-control-law-wants-permission-to-scan-your-whatsapp-messages

Proposed EU Chat Control law wants permission to scan your WhatsApp messages

Shared photos, videos, and URLs are now the target

The EU is currently considering a new plan to scan citizens' encrypted communications, in yet another chapter of its fight against online child sexual abuse material (CSAM).

After harsh criticism, legislators have abandoned the idea of allowing law enforcement to access text messages and audio—shared photos, videos, and URLs are now the target. Yet, experts still warn that citizens' privacy is at risk.

Belgium, which heads the Council of Europe until June 30, proposed the new text as a compromise on what was nicknamed Chat Control law last May, and it's now under review.

There's a catch, though. People must consent to the shared material being scanned before being encrypted. Choosing to reject the scanning will lead to users being prevented from using this functionality at all. The tech world isn't buying it, in fact, Romain Digneaux, Senior Public Policy Associate at Proton, describes it to TechRadar as "a blatant attempt to pull the wool over our eyes."

"This compromise from the Belgian Presidency is a depressing step backward compared to the European Parliament's position," Digneaux told me.

"It will potentially subject all EU citizens to mass surveillance, undermining their fundamental rights while doing nothing to address the spread of CSAM online, nor any of the criticism from the European Data Protection Supervisor and countless experts."

Encryption, meaning the process of scrambling data into an unreadable form to prevent third-party access, is at the base of online communications's security behind today's privacy software.

Virtual private networks use it to secure internet communications and conceal your online activities, for example. Popular messaging apps, like WhatsApp and Signal, or secure email providers like ProtonMail implement encryption to guarantee your messages remain private between you and the sender (end-to-end). Not even the provider itself can access it. As the presentation leaked by digital rights group Netzpolitik shows, Belgian legislators now recognize the need to protect end-to-end encryption.

"Regulation shall not create any obligation to decrypt or create access to end-�to-�end encrypted data, or that would prevent providers from offering end�-to-�end encrypted services," the proposed wording reads. So, how are they planning to implement the CSAM scanning then?

User consent or blackmail?

The key here is the 'user consent' clause. That's the way to make the scanning of privately shared multimedia files not an obligation but a choice. How they plan to do so resembles more to blackmail, however. As we mentioned, if you want to share a photo, video, or URL with your friend on WhatsApp you must give consent, or just stick to texting, calls, and vocal messages.

Commenting on this point, Digneaux said: "There is no consent. There is no choice. If innocent users don't agree to let the authorities snoop on their messages, emails, photos, and videos they will simply be cut off from the modern world."

Proton isn't alone in feeling this way. A group of over 60 organizations—including Proton, Mozilla, Signal, Surfshark, and Tuta, alongside 50+ individuals, signed a joint statement to voice their concerns against the new proposal.

"Coerced consent is not freely given consent," wrote the group. "If the user has no real choice, feels compelled to consent, or would defacto be barred from the service if they do not consent, then the consent given will not be freely given."

Worse still, experts also warned that such intrusive powers might end up being unfit for catching the bad guys. That's because cybercriminals could simply embed the illegal photos or video on a different type of file, for instance. Moreover, as Digneaux pointed out, criminals already use their own services to conduct illegal activity.

A rebrand of client side scanning

The plan to perform CSAM scanning while protecting encryption also includes a new 'upload moderation' provision. Legislators seek to implement content detection before being transmitted—so, before being encrypted. Again, tech experts believe this approach is rather "a mere cosmetic change" from the Chat Control proposal.

The original bill was pushing for client-side scanning instead, a method that requires the device to automatically analyze files for unlawful material and flag them to authorities. To date, there's no way to do this without creating dangerous backdoors into the encryption. This is further supported by the fact that the UK postponed its side-scanning provision for the Online Safety law until it is "technically feasible" to do so.

However, experts now argue that also scanning messages at the upload point defeats the end-to-end principle—complete protection between the sender and receiver—that characterizes strong encryption. They warn this may create new security vulnerabilities for third parties to exploit too.

Digneaux deemed the move as just a "disingenuous rebrand" of client-side scanning. He told me: "No matter what the Presidency claims, it is not a silver bullet to protect privacy. It's simply a backdoor to encryption in disguise. European users will become ideal targets for hackers, putting people and businesses more at risk."

This is why secure end-to-end encrypted messaging apps like Signal (see above) are already reiterating they will leave the EU market rather than undermine privacy protections.   

As Netzpolitik reported, though, the new approach remains ambivalent among the country members. During a meeting held at the end of May, Germany and the Czech Republic expressed perplexities about the Belgian proposed scanning solutions before encrypting the messages. Austria, Estonia, and Luxembourg also criticized the 'user consent' provision. While France said that they could accept 'upload moderation' under user consent but demanded that "there should be no circumvention of encryption."

Overall, though, France seems more positive about the proposal and ready to find a compromise that could work for all. That's also why the country's support is set to be decisive for the final agreement.

"We're counting on France to maintain its support for cybersecurity, encrypted services, and privacy," Digneaux told me. "If these proposals are not thrown out now we risk dismantling the vital cybersecurity protections that encryption offers putting everyone at risk. But saddest of all, EU citizens will be treated as guilty before being proven innocent by the very people appointed to protect them."

It is also worth noting that legislators plan to exempt staff of intelligence agencies, police, and the military from the CSAM scanning.

[Crazy_Ivan80]

And then they wonder why there's a modicum of distrust if the eu behaves like the ccp.

[Sheilbh]

It reminds me of the DSA and DMA - there are very real, serious risks from this legislation (especially in the hands of an authoritarian government). But it's incredibly difficult to make that argument when the other side is CSAM - or in the case of the DSA and DMA, disinformation, the power of big tech and various real problems like content promoting self-harm to young people. But I think these are often very blunt and potentially quite dangerous powers.

Separately, undercover investigation on the FdI youth wing (you can auto-subtitle on YouTube). This is the descendant of the movement that Meloni joined, aged 15:

I know I bang on about it - but the fact that she's not "populist", isn't Eurosceptic (or endangering the Eurozone) and sound on Ukraine (in line with the Atlanticist tradition of Italian post-fascism) should not blind us to the FdI's politics or why they're dangerous. I'd also add that while she's not provoking fights with other leaders or Europe, Meloni's government has tightened its grip on the media quite dramatically in the last couple of years (media campaigners have said Italy is entering the "Hungary zone" on press freedom). But she's also proposing a referendum style direct election of a PM who will immediately be given a majority in the legislature (which actually is not a million miles from Mussolini's Acerbo Law).

This video includes the leader of the FdI at a European level doing a fascist salute - this isn't a "moderate" version of the far right. It just looks and sounds different (and crucially less pro-Russia) than, say, Le Pen.

[Threviel]

I've been thinking about the argument that encroachments in privacy would be bad if government went bad. What's to stop a government gone bad from just legislating encroachments anyway? Is there validity to the argument?

[Sheilbh]

I've been thinking about the argument that encroachments in privacy would be bad if government went bad. What's to stop a government gone bad from just legislating encroachments anyway? Is there validity to the argument?

That's fair. Ultimately there's nothing - it comes down to politics. I suppose forcing a bad government to say what it wants to do and try to do it is helpful in that sense. But I have a general suspicion of this sort of thing and any sort of "emergency legislation" which is passed for good reasons by good governments - because if the police especially, but state institutions generally, have a power in law then they will use it and, probably, it will be used in ways it wasn't originally intended for. It's like legal Chekhov's gun - so you should be careful what powers you introduce.

I think in a European law context, there can be a disconnect between the law in abstract and the powers it creates from the national member state governments responsible for enforcing/using those powers. So for example you can see the logic of platforms having to comply with mandatory take-down orders of illegal content, unmasking anonymous users and to respect "trusted flaggers" to help distinguish disinformation.

However those powers are at the national level and can be exercised by "authorities" (which expressly includes the police) with no requirement for a court order or even hearing. We saw this in the French riots following the death of Nahel Merzouk last year where Macron mused about shutting down social media networks and Breton said (rightly) that this is a power that will exist with the Digital Services Act. He said it would be up to judges which is not true on a European level (but could be in French legislation).

[Valmy]

Well also it establishes the infrastructure the bad government could use to enforce its bad intentions quickly. Trying to build an intricate spy network to control your citizens from scratch would be more work than having one provided to you.