Thread by @AlecMuffett

Well, this is some interesting reading for the afternoon.

alecmuffett.com/alecm/tmp/eu-c…

"We want a backdoor, but we don't want just *anyone* to be able to use it. Only us good guys."

May be of interest to, oh, I dunno, @alexhern @jamesrbuk @tim @lorenzofb @josephfcox @MikeIsaac

@alexhern @jamesrbuk @tim @lorenzofb @josephfcox @MikeIsaac Apparently I am slightly late to the party, but that's okay.

@alexhern @jamesrbuk @tim @lorenzofb @josephfcox @MikeIsaac So: When building Facebook Messenger Secret Conversations, as I've explained before I was asked whether it would be able to be "backdoored" in order to fight "Organised Crime"; the proposal being that <various narcos> would NOT REALLY be using E2EE.

The answer was no, BUT…

…amongst many of the reasons for "NO" was simply: where and how do you distribute the list of "bad people" in a secrecy-preserving manner?

It's not like you can/should check the list of phone numbers of FBI's Most Wanted, into the codebase and/or app configuration infra.

Hey Everybody - it's okay!

The EU will *give* you the technology to wire into your apps.

What could possibly go wrong?

Whilst we're here, the matter of "false positives" sent to Law Enforcement would be improved if @MissingKids stopped pushing vastly inflated statistics with duplicate and other forms of non-critical content.

alecmuffett.com/article/15902

Yep, it looks like the EU will want to be scanning your baby's remote bathtime singalong for potential child sexual abuse.

If you're a parent and you have to travel for work, you should be concerned who's gonna spy on your family traditions.

https://mobile.twitter.com/AlecMuffett/status/1405962815068835842

Unsurprisingly the conclusion amongst the politicians is that "We need to spy on all content & activity in order to establish whether it is (C) CSAM, or (D) potential CSAM, and also we have to (E) monitor contact metadata to identify grooming"

Or spies. Whistleblowers. Whatever.

I concur with Ed on this, except that I think they will try to take the E-SIM approach of a tamperproof and opaque machine-learning model to inject into a predefined and obligatory app API.

Enables per-state, per-user customisation.

https://mobile.twitter.com/Ed_Geraghty/status/1524054801360764929

The EU mindset—something that leaks out in the #DSA which (e.g.) @1Br0wn & @RDBinns are so fond of—is that enabling the world to be more open & connected is a societal & political pollution problem, and that "the polluter should pay"; ergo: bill GAFAM for enabling communications:

At least this proposal + the #DSA contains the seeds of [one means of] its own doom — that #interoperability will require/permit/enable the re-adoption of "OffTheRecord" (OTR) superencryption on top of existing platforms, thereby making all this useless:
alecmuffett.com/article/14656

For those who are unaware, OTR is at otr.cypherpunks.ca and is the painful, clunky but effective analogue of "PGP over Email", but instead is E2EE superencryption on top of most of the popular contemporary instant messenger platforms.

I predict a retro comeback.

Ergo: once again the backdoors will only really impact *innocent* people, and the actual miscreants will be harder, ever-harder to detect. By incessantly focusing upon content signatures and matching, all CSAM content will be driven even FURTHER underground.

Time for a new #ReadyMadeTwitterSearch:

> End-to-End Encryption: European Union Backdoors — EU initiatives to mandate encryption backdoors

...located at:

github.com/alecmuffett/re…

https://mobile.twitter.com/AlecMuffett/status/1524066299600683008

Aside: it'd be extraordinarily foolish for EU authorities to (e.g.) block DNS lookups for alecmuffett.com because of this document, but just in case such were to happen, it's also available on an unblockable onion site:

…rgmsmo56szaaighyjurp4ccuj63zkad.onion/alecm/tmp/eu-c…

So, following this argument, in the EU:

(1) speculative "freedom from" risk of abuse & degradation

…is more important than…

(2) concrete "freedom to" have privacy and confidentiality

…even where all parties in (2) — including the victims from (1) — are impacted.

Elsewhere I am currently working my way through @jon_rauch's audiobook "Kindly Inquisitors", and I feel this is closely aligned to his chapter regarding "speech as harm".
amazon.co.uk/Kindly-Inquisi…

@jon_rauch Oh, this is a twist:

https://twitter.com/rossjanderson/status/1524122579270778880

> [content] scanning is often the only possible way to detect [grooming] and…the technology used does not ‘understand’ the content of the communications but rather looks for known, pre-identified patterns that indicate potential grooming

These people have not read @Riana_Crypto

@Riana_Crypto Not to mention elsewhere:

HOW TO IDENTIFY PATTERNS OF BAD BEHAVIOUR WITHOUT BREAKING THE PRIVACY OF END-TO-END ENCRYPTED DATA.

FROM WHATSAPP. IN 2017. FIVE YEARS AGO.

Oh, I had missed this. This is just shoddy work, props to @PrivacyMatters for pointing it out:

https://twitter.com/PrivacyMatters/status/1524122218044682240

@PrivacyMatters > End-to-End Encryption: European Union Backdoors — EU initiatives to mandate encryption backdoors

…see the latest Twitter discussion with a #ReadyMadeTwitterSearch at:

github.com/alecmuffett/re…

I still reckon that this is the funniest and most ironic part of the entire @EU_Commission #CSAM document — and it's on the front page.

I wonder if they would ever discuss it amongst themselves over a messenger app?

Cited link is: ec.europa.eu/info/sites/def…

One key observation for EU citizens — and indeed for people everywhere — to take from the ongoing "abortion" debates in the USA, is that your Government cannot & should not be excluded from the "threats" against which privacy is a necessary defence.

https://mobile.twitter.com/Riana_Crypto/status/1524196807206596608

Social problems [like child abuse, grooming, even racism & hate speech] are not solvable via technical means; this is what #RanumsLaw has taught us for literal decades.

It's not like "cleaning up pollution".

It's about addressing *people*.

https://mobile.twitter.com/AlecMuffett/status/1524079648497410050

Slightly off-topic, in case you missed it, there is even more Illiberal and misconceived internet messaging legislation under discussion in Belgium:

https://twitter.com/bitsoffreedom/status/1523948306535174144?s=20&t=lSgvHhd5DC9TJdiL5M2ucg

Good Morning! In case you missed it, today is the day that the European Union declares war upon end-to-end #encryption, and demands access to every persons private messages on any platform in the name of protecting children:

https://twitter.com/AlecMuffett/status/1524066299600683008

HEADSUP: about 40 (?) minutes until the official announcement.

If you want to track sentiment about European Union initiatives to stop #privacy and mandate #backdoors to "fix" #CSAM, you can see the latest discussion with a #ReadyMadeTwitterSearch at:

github.com/alecmuffett/re…

Article: ifun.de/eu-will-chat-k…

Article: imore.com/leaked-eu-plan…

Article: berliner-zeitung.de/news/chatkontr…

So: the official draft has been published at ec.europa.eu/commission/pre… along with all the expected framing material; a basic check with diffchecker.com/pdf-diff/ shows that the leaked draft is very accurate, apparently missing only a couple of sets of costings plus some renumbering.

Curiously (see diff in previous tweet) Article 83 in the final copy, appears to be missing? Or perhaps it has been abstracted elsewhere?

Here is some creative spin for the proposal:

https://mobile.twitter.com/euhomeaffairs/status/1524330785444143105

. @EU_Commission @EUHomeAffairs — tell us more about these "strong safeguards", other than that you will demand them?

@EU_Commission @EUHomeAffairs 🧵Thread from @EDRi:

https://twitter.com/edri/status/1524352469047951362

The Cambridge University security research group chime it:

https://twitter.com/rossjanderson/status/1524402674480914433?s=20&t=tVIIvjpIcocLRCN60JbH5w

Article:
arstechnica.com/tech-policy/20…

Article: protocol.com/bulletins/eu-c…

Article: nrkbeta.no/2022/05/11/ny-…

OMG #MUSTREAD - this is an important & *different* analysis thread on why the EU #CSAM #ChatControl draft legislation is misconceived and has clearly been drafted without input from diverse civil society viewpoints.

TLDR: "magical thinking" regarding #AI

https://mobile.twitter.com/ellanso/status/1524461000094855168

"the technology does not work like you think it works" - the @EU_Commission should have sought more input from civil society.

https://twitter.com/ellanso/status/1524461025382354944?s=20&t=mlJ77hHb1HAFwFpXIQU_WA

cc: @rossjanderson

@EU_Commission @rossjanderson Article: eff.org/deeplinks/2022…