Roberta Metsola's actions this week jeopardise the legitimacy of the EU project as a whole.
It's clear that member countries use the EU as a blame-laundering mechanism to pass domestically unpopular laws, but the forcing of this vote under the urgency procedure that requires absolute majority to reject, on the last EP session before summer break is so blatant that it might awaken people that might've overlooked the structural failures of the EU and finally radicalise them
EDIT: bad wording, it's not that the urgency procedure causes the voting to require absolute majority, it's that an absolute majority second-reading is forced through an emergency procedure which is designed for first readings of legislation that's the implied meaning above
I don’t understand how a governing system requires a majority to reject a change to the status quo. The status quo must be maintained unless a majority decides to change the status quo.
It is the equivalent of having a gas pedal in a car that is fully activated unless you put your foot down.
This article seems to make good points about how useless and invasive Chat Control 1.0 is, but then posits Chat Control 2.0 as the answer. Is the latter not also terrible for privacy, demanding backdoors in all encrypted chat tech?
The defence against this is to vote these MF MEPs out and kick asses of non–elected Eurocrats. Not going to happen.
Tech solution: Open GPG with PQE protocols. There is nothing else left (other than One Time Pads.)
And this is just the beginning. With LLMs and AI they will have resources to scan every character we type.
What changes with the return of Chat Control 1.0—and what stays the same:
*What is coming back:*
US tech companies are once again allowed to scan private messages without a warrant or prior suspicion. This affects direct messages on platforms like Instagram, Discord, Snapchat, Skype, and Xbox, as well as emails via Google’s Gmail and Apple’s iCloud.
*What remains unchanged:*
Public social media posts and files hosted in cloud storage could already be scanned without this law. Furthermore, private messages can always be reported by users, or monitored by authorities using targeted, court-ordered wiretapping.
*What is still NOT being scanned:*
End-to-end encrypted chats, such as those on WhatsApp, have always been exempt from these scans. Additionally, European providers of messaging and email services have never implemented chat control measures.
After the whole internet lost its mind about Apple CSAM scanning and being horribly off target, I'd recommend to ignore news reports and go to the sources when making an opinion.
The only issues I can see is the error rate for non-CSAM scanning and how the latest vote was conducted.
Although the scanning part, it is still law enforcement that has to review that information and determine if there is a case. Most of the those are teens sharing naked photos with other teens.
> End-to-end encryption is a term used to describe blocking or preventing any third-party recipient from viewing, reading or becoming aware of information that one individual has sent to another. In response to growing concerns about online data security, many technology companies are adopting this strategy with potentially dire circumstances.
> The use of end-to-end encryption would prevent the companies or any third-party from detecting illegal activity occurring on their platforms, including the activity of people who use the internet to perpetuate online demand for graphic sexual abuse material of children.
> We believe personal security is extremely important and support efforts to improve online privacy. But, if this solution is implemented with no exceptions for detecting child sexual exploitation, millions of incidents of abuse will remain hidden, leaving these young victims without any help or protection from these horrific crimes.
And your REALLY think E2E is going to "protect" you?
If the "services" want to watch, don't worry they will, "they don't need your password". But I guess they "do" that only for the very baddies, aka child exploitation, human trafficking, terrorists, killers, drug dealers, etc.
We all know here that "information system security" does not exist, this is a fantasy: there is only some "best effort" with a wide spectrum of compromises. If somebody talks to you about "deliverable security", that guy wants to sell you something.
E2E will protect you only against John Doh, "hacker only on Sundays". And we better keep that in mind.
> In these talks, the EU Parliament is pushing for a paradigm shift in how we approach online child safety, demanding: [..] Strict security standards for messaging apps (“Security by Design”) to prevent cyber grooming.
It's dispiriting to see a supposedly pro-privacy politician launder backdoors as "strict security standards".
I'm curious where I can go to see real regularpeople who support this, is there like a different side of reddit, comments section? I don't know anyone who is blatantly anti-privacy and I want to hear their reasoning. Otherwise this just seems to be the EU rolling into a weird distributed autocracy without anyone blinking an eye.
Here's a quote from the article itself, which works for both pro and con arguments:
"What is still NOT being scanned: End-to-end encrypted chats, such as those on WhatsApp, have always been exempt from these scans. Additionally, European providers of messaging and email services have never implemented chat control measures."
As I'm not trained in law, I have no strong opinions on if this proposal is a net positive or negative, almost any big name LLM will do a better job than I can manage by looking at the legal text, stroking my goatee and saying "I recon…". But what I can say that I've just seen a headline about a class action lawsuit in the USA due to grok making CSAM and the company failing to assist the police in their investigations, and another about Meta facing a lawsuit in India for delivering advertising for CSAM on Instagram.
My steelman in favour of the legislation:
The regulation closes a legal gap that would otherwise force platforms to stop using existing CSAM detection systems; it's a temporary framework that doesn't require universal mandatory scanning or ban E2EE, just keeps the legal basis for companies which choose to use detection/scanners while lawmakers continue negotiating a more comprehensive longterm solution.
My steelman against the legislation:
Scanning private communications, even allowing companies to "voluntary" do this, sets the precedent that the confidentiality of private correspondence is conditional rather than fundamental. Also, automated scanning inevitably has false positives. Also, has chilling effect on free speech, undermines trust in encrypted messaging.
Also, situationally, that it's "voluntary" means offenders can migrate to platforms which don't "voluntarily" do this.
"a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor, 17 abstentions), the motion to reject it failed to secure the required absolute majority of 361 votes. As a result, mass scanning is now permitted again until 2028."
"Oh no we can't get a majority to pass the law!"
"Have you tried getting a majority to not pass the law?"
"Worth a shot!"
"It worked, should we also do this multiple times?"
Honest question: when Europeans give so much power to EU and usually favor regulations by the government, isn't it natural that the government will try to implement more control? And it looks EU officials do not have to accountable for anything. They will not suffer personally even when their policies wreck havoc. I don't quite understand why Europeans can trust EU at all. Case in point, EU HQs shut down its air conditioning on floors 1 through 7 to prevent electrical overloads, leaving the upper levels used by top officials unaffected. Yet did anyone like Leyen get punished? Note I'm not naive enough to believe politicians don't have special treatment in other countries. But at least in some countries, politicians will not be so shameless that they'd do it in broad day light.
Adding the reminder that these votes and majority rejecting are of unelected bureaucrats, so the way that it was framed was approved from above while making practically impossible to reject but still theoretically possible so people are forced to swallow it.
Wow does it become law if the majority of those present opposed it? The American Congress might be utterly dysfunctional, but we’ve never had a law pass despite the majority of members voting against it. What am I missing?
EU cant claim the moral high ground anymore with the way this was done. They've joined the rest of the world now. This was a win for foreign companies and makes me wonder if the EU has been infiltrated by outside interests.
Can it be undone? One of the key aspects of any society is that it can in fact change law/policy/leaders/etc without war/rebels. yes harm happens when bad crap gets in but if the system still supports change, it is working.
For all the bad in trump era like roe vs wade among many others. The same mechanism are what allowed roe vs wade to exist. A double edge sword but better than alternative variants of totalitarian multi decade long regimes.
Once you realise the age group that are in that bracket of european law making you realise it's gen X AKA the helicopter parent generation and it all becomes less shocking.
How do we design such apps? Let's rule out age attestation (to allow only some age ranges) or scan of content because they are orthogonal to apps. What are the design patterns that prevent adults to meet kids? No messaging?
From Google: "The law seeks to require digital platforms and messaging services (like WhatsApp and Gmail) to automatically scan users' private messages, emails, and photos to detect and report illegal content"
-- EU policy makers are really honest people, hats off to them. There's no way politicians in my country allow their chats to be scanned, because they're very corrupt.
The passing of laws that affect technology platforms has always been on topic on HN. That shouldn't be surprising on a site that's specifically for people interested in technology and tech industry topics.
I do not believe solutions to these issues will be found with government regulators. I believe they can be enabled by new technology that is designed to balance interests on all sides and actually enforce the guarantees IN CODE AND PROTOCOLS.
Having said that, I don’t think the tech industry is what it once was, dominated by cypherpunks working to create a better world. It has been captured by greed and “moving fast and breaking things”, as well as infighting. Greed (both in the form of web3 numbers go up, and benefiting from the greater fool while delivering no utility) and moving fast (web2 facebook / VC / dump shares on the public / lock in / extract rents). So no wonder the government eventually steps in, when the industry spends a decade without adults steering the ship. We have giant platforms controlling everything, and the rest has devolved into zero sum games and memecoins. The tech industry hasn’t led or even organized enough to get behind technology that can liberate users. Instead it’s been captured by for-profit interests. Mozilla and Apache are rounding errors.
Here is what open source can do when it comes to mass surveillance, and this would also solve the Flock problem here in the States, too:
If the EU just were to redirect the resources they're currently allocating to regulations like AI and Chat Control rather towards developing a genuinely competitive OpenAI or Anthropic alternative …
There are at least two options to verify age without humiliating procedure of taking a selfie with a passport like a porn actor.
First, there are USB tokens that can hold a private key and sign messages. Such tokens could be sold at places accessible only to adults and verify that they are indeed adult. Obviously every token should hold the same private key.
Second, OS could implement "parent mode" which allows installing only white-listed, government approved apps (no Telegram or Whatsapp or other dangerous apps, but school apps are ok) and opening only white-listed government-approved websites. Put in jail the parents who did not set up a parent mode. Problem solved without passports and verifications.
If, however, the government insists on selfies, it means they just want to identify users and compile lists of "untrustworthy", "rebelious" and other persons of interest.
Also, employees who do verification, sometimes create internal chats where they post pictures of clients and mock their appearance. We had such case with Alfa-Bank in Russia, where the photo of a funny client with a passport and third-grader level comments leaked to Instagram account of employee's friend. The bank paid approximately $20 as a compensation.
So much effort and emotions wasted. EU should have a mechanism that disallows repeatedly pushing for things until they are greenlit. Lack of this type of measure renders whole governance incapable of being taken seriously.
142 comments
[ 2.2 ms ] story [ 122 ms ] threadWelcome to the Brave New 1984 We World. Big Brother loves us.
We are living through the time best described by Zamyatin, Orwell, and Huxley.
It's clear that member countries use the EU as a blame-laundering mechanism to pass domestically unpopular laws, but the forcing of this vote under the urgency procedure that requires absolute majority to reject, on the last EP session before summer break is so blatant that it might awaken people that might've overlooked the structural failures of the EU and finally radicalise them
EDIT: bad wording, it's not that the urgency procedure causes the voting to require absolute majority, it's that an absolute majority second-reading is forced through an emergency procedure which is designed for first readings of legislation that's the implied meaning above
It is the equivalent of having a gas pedal in a car that is fully activated unless you put your foot down.
Who is working on that? I suspect the main challenge is not technical, but human - persuading users to switch messenger apps is almost impossible.
What changes with the return of Chat Control 1.0—and what stays the same:
*What is coming back:* US tech companies are once again allowed to scan private messages without a warrant or prior suspicion. This affects direct messages on platforms like Instagram, Discord, Snapchat, Skype, and Xbox, as well as emails via Google’s Gmail and Apple’s iCloud.
*What remains unchanged:* Public social media posts and files hosted in cloud storage could already be scanned without this law. Furthermore, private messages can always be reported by users, or monitored by authorities using targeted, court-ordered wiretapping.
*What is still NOT being scanned:* End-to-end encrypted chats, such as those on WhatsApp, have always been exempt from these scans. Additionally, European providers of messaging and email services have never implemented chat control measures.
So, E2E is unaffected?
Because its an extension of an existing bill.
After the whole internet lost its mind about Apple CSAM scanning and being horribly off target, I'd recommend to ignore news reports and go to the sources when making an opinion.
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=COM...
The only issues I can see is the error rate for non-CSAM scanning and how the latest vote was conducted.
Although the scanning part, it is still law enforcement that has to review that information and determine if there is a case. Most of the those are teens sharing naked photos with other teens.
> Overview
> End-to-end encryption is a term used to describe blocking or preventing any third-party recipient from viewing, reading or becoming aware of information that one individual has sent to another. In response to growing concerns about online data security, many technology companies are adopting this strategy with potentially dire circumstances.
> The use of end-to-end encryption would prevent the companies or any third-party from detecting illegal activity occurring on their platforms, including the activity of people who use the internet to perpetuate online demand for graphic sexual abuse material of children.
> We believe personal security is extremely important and support efforts to improve online privacy. But, if this solution is implemented with no exceptions for detecting child sexual exploitation, millions of incidents of abuse will remain hidden, leaving these young victims without any help or protection from these horrific crimes.
https://ncmec.org/theissues/end-to-end-encryption
If the "services" want to watch, don't worry they will, "they don't need your password". But I guess they "do" that only for the very baddies, aka child exploitation, human trafficking, terrorists, killers, drug dealers, etc.
We all know here that "information system security" does not exist, this is a fantasy: there is only some "best effort" with a wide spectrum of compromises. If somebody talks to you about "deliverable security", that guy wants to sell you something.
E2E will protect you only against John Doh, "hacker only on Sundays". And we better keep that in mind.
To avoid being affected by this law, you can just download Signal, or use any other encrypted messaging service.
It's dispiriting to see a supposedly pro-privacy politician launder backdoors as "strict security standards".
Here's a quote from the article itself, which works for both pro and con arguments:
As I'm not trained in law, I have no strong opinions on if this proposal is a net positive or negative, almost any big name LLM will do a better job than I can manage by looking at the legal text, stroking my goatee and saying "I recon…". But what I can say that I've just seen a headline about a class action lawsuit in the USA due to grok making CSAM and the company failing to assist the police in their investigations, and another about Meta facing a lawsuit in India for delivering advertising for CSAM on Instagram.My steelman in favour of the legislation:
The regulation closes a legal gap that would otherwise force platforms to stop using existing CSAM detection systems; it's a temporary framework that doesn't require universal mandatory scanning or ban E2EE, just keeps the legal basis for companies which choose to use detection/scanners while lawmakers continue negotiating a more comprehensive longterm solution.
My steelman against the legislation:
Scanning private communications, even allowing companies to "voluntary" do this, sets the precedent that the confidentiality of private correspondence is conditional rather than fundamental. Also, automated scanning inevitably has false positives. Also, has chilling effect on free speech, undermines trust in encrypted messaging.
Also, situationally, that it's "voluntary" means offenders can migrate to platforms which don't "voluntarily" do this.
"a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor, 17 abstentions), the motion to reject it failed to secure the required absolute majority of 361 votes. As a result, mass scanning is now permitted again until 2028."
"Oh no we can't get a majority to pass the law!"
"Have you tried getting a majority to not pass the law?"
"Worth a shot!"
"It worked, should we also do this multiple times?"
"Of course not! Pass the law, quickly!"
Soviet Union 2.0
For all the bad in trump era like roe vs wade among many others. The same mechanism are what allowed roe vs wade to exist. A double edge sword but better than alternative variants of totalitarian multi decade long regimes.
How do we design such apps? Let's rule out age attestation (to allow only some age ranges) or scan of content because they are orthogonal to apps. What are the design patterns that prevent adults to meet kids? No messaging?
-- EU policy makers are really honest people, hats off to them. There's no way politicians in my country allow their chats to be scanned, because they're very corrupt.
Incidentally, the comment immediately below this one begins with the words "I'm curious". So I think we're good.
Having said that, I don’t think the tech industry is what it once was, dominated by cypherpunks working to create a better world. It has been captured by greed and “moving fast and breaking things”, as well as infighting. Greed (both in the form of web3 numbers go up, and benefiting from the greater fool while delivering no utility) and moving fast (web2 facebook / VC / dump shares on the public / lock in / extract rents). So no wonder the government eventually steps in, when the industry spends a decade without adults steering the ship. We have giant platforms controlling everything, and the rest has devolved into zero sum games and memecoins. The tech industry hasn’t led or even organized enough to get behind technology that can liberate users. Instead it’s been captured by for-profit interests. Mozilla and Apache are rounding errors.
Here is what open source can do when it comes to mass surveillance, and this would also solve the Flock problem here in the States, too:
https://community.qbix.com/t/balancing-privacy-and-accountab...
More broadly, here is what needs to be done across the board:
https://www.laweekly.com/restoring-healthy-communities/
Chat Control 1.0 and 2.0 Explained
https://news.ycombinator.com/item?id=48818311
Chat Control passed first round in EU Parliament
https://news.ycombinator.com/item?id=48819008
First, there are USB tokens that can hold a private key and sign messages. Such tokens could be sold at places accessible only to adults and verify that they are indeed adult. Obviously every token should hold the same private key.
Second, OS could implement "parent mode" which allows installing only white-listed, government approved apps (no Telegram or Whatsapp or other dangerous apps, but school apps are ok) and opening only white-listed government-approved websites. Put in jail the parents who did not set up a parent mode. Problem solved without passports and verifications.
If, however, the government insists on selfies, it means they just want to identify users and compile lists of "untrustworthy", "rebelious" and other persons of interest.
Also, employees who do verification, sometimes create internal chats where they post pictures of clients and mock their appearance. We had such case with Alfa-Bank in Russia, where the photo of a funny client with a passport and third-grader level comments leaked to Instagram account of employee's friend. The bank paid approximately $20 as a compensation.
All for a safe and secure society.