EU: Users who refuse scanning to be prevented from sharing photos and links

I think it's no surprise that it might appear like that.

For me, I found the way EU handles food safety as opposed to the US to be a great summary of their philosophies: in EU a food needs to be proven to be safe to be allowed, while in the US the food needs to be proved unsafe to be banned.

Yes, I can roam freely in all the Union's states, use the same currency in most of them, use my cellphone with no roaming costs, have access to health care if needed... that's the result of imposing less regulation, not more.

Is deregulation desirable?

They self identify as a "regulatory superpower", the EU officials see their primary strength not in the economic and social strengths of their member states, but in the gigantic bureaucracy that they have created.

EU economies have benefited greatly from the removal of barriers between countries. The EU officials didn't see that as a sign that the strength of the EU lies in their members freedom, but as a sign that now every single issue should be regulated by EU officials.

That is why you have laughable things like the recent AI regulations. An entire continent with barely a single AI company wants to tell the rest of the world what to do. The cause is pretty clearly in the delusional minds of EU officials who genuinely believe that their regulation are worth more than the paper they are written on.

Lawyers and regulators are the strongest and most cutting edge sectors of the EU economy

I guess you haven't spent much time in Europe recently. Deregulation is considered a swear word over there. I do not advise using it around Europeans.

Also, if you say something that sounds like "free speech" their heads explode. It's quite spectacular to watch.

I don't know who first said it.. but something something "they call them lawMAKERS, what do you expect them to do, remove laws? OF course they'll just make new laws"

Even deregulation is of course some kind of regulation, but what comes to my mind is:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...

A summary is here: http://publications.europa.eu/resource/cellar/c56fbf1c-97bd-...

It abrogated the various national laws concerning product quantities, ie. in France you could sell shampoo in 250ml or 500ml bottles, but not 295ml. Or you could sell mushrooms in 250g and 500g boxes, but not 230g or 490g.

This is now allowed, which made this in effect a deregulation enabling shrinkflation.

A bit off topic, but I was thinking recently if EU ever deregulates anything?

Alas, the EU isn't special in this regard.

Deregulation isn't really popular these days. But it has happened from time to time here and there.

That depends on what you mean by deregulate. There's a lot of simplification through the single market and free movement of labor.

I'm astonished that the chats of EU officials and politicians are not exempt. A mistake, no doubt, one which will be corrected shortly

How is this supposed to work in reality? Do we really want to provide Meta, Apple and Google with a list of phone numbers of accounts of militarly and security personell in order to have their feature-flags for sharing links/photos enabled?

So the two major fields where you really want to snoop their private chats to see if they are up to no good, are excempted?

As far as I can tell from the article, the justification for the proposed rules is "won't someone think of the children".

Those two major fields you mention might do well with more oversight in general. But I doubt they are especially prone to dealing with children?

They are claiming that it is privacy preserving, since it uses AI and not humans, and only for catching csam

Assuming those claims are true(I know, that is a big ask, but they claim it) what function do exceptions provide unless they are purposely giving those exceptions for the production and distribution of csam by those groups?

More likely their claims of the privacy and/or purpose are false.

I haven't gone in detail on the draft, but what is nuts is that those are exempt, as well as everyone who uses a service not-for-profit.

So, if you self-host [1], you don't need to adhere to the legislation.

But, wait… Are you telling me that security officials are allowed to use not their self-hosted infrastructure, but use public one to send (I assume, based on their exemption) confidential data?

And, as @WA proposed, will be a list of contacts of these officials given to all for-profit organisations?

What a stupid joke it is!

[1]: See third row at https://www.patrick-breyer.de/en/posts/chat-control/#current... .

Could the platforms the authorities use decide to not exclude them and treat them the same anyways (ie scan them like everyone else's) or are they codifying that that kind of scanning only applies to the common people?

One can only hope, though given how much more authoritarian everyone (in the US, at least) has gotten, I am not holding out much hope. Good luck fighting this; I mean that sincerely.

This is a naive view of the matter.

These proposals keep returning because there are legitimate concerns that are being left unadressed by industry self-regulation.

When nobody wants to have a conversation about good measures, politicians are going to try again, even the new ones.

It is sincerely horrifying what the reckless deployment of generative AI is doing in this space. And it's all dismissed as "Well you can't stop math anyway so we're not going to do anything" and (implicitly) "The ends justify the means, sacrificing a few children is worth it to get AGI". These are terrible optics.

If tech does not hold itself accountable, privacy is going to die sooner or later. The politicians need only win once.

Or we could end up like a variation of Putin's Russia where power screws were tightened gradually till putin got absolute power

the backlash will inspire a new generation to consign fossils to the dustbin of history

Most of what I've seen of "a new generation" leads me that, on average, they're disturbingly willing to comply with any kind of authority on any kind of pretext. And some of the rebellious outliers are kind of Naz-ish.

Not wildly different from any previous age groups, of course, but definitely not some giant anti-authoritarian wave.

... and people of any age will only reliably "backlash" if they're actually inconvenienced. Most people will just accept the spying and go back to sharing stupid memes. Until it's too late, anyhow.

Nah, this plan is outright evil. We all learned from the cookie banner madness that everybody just opts-in to everything all the time, just to make the thing go away. This proposal gives us a fake choice, because so many coordination of real life activities happen in WhatsApp in the EU that you have to opt-in to still participate in a meaningful way.

I'm not talking about sharing vacation photos with your friends, but stuff like:

- here is a link that explains how to do taxes for your nonprofit

- here is our new school logo

- this is a link to the soccer tournament schedule

and so on.

If it ever gets promoted to law, my predictions is: ASCII art is back.

Actually 99.99% of users won't give a single fuck and will just allow scanning. People don't care at all in case you didn't notice.

I think you overestimate the technical knowledge and skills of many people. For every crafty career criminal there's a dumb idiot doing dumb stuff on account of being a dumb idiot. And even crafty career criminals can and do make mistakes.

Of course it won't catch 100% of it, but very few laws or measure do that (and those that do almost always come with very high amounts of false positives). Also links are not hard to scan for either, and you can't "just" upload CSAM to anywhere either and not expect troubles sooner or later (unless you know what you're doing, in which case we're back to the previous paragraph).

I think it's very hard to deny that of course it will catch a non-zero number of people, although it's hard to determine exactly how many beforehand. That doesn't mean it's a good law, it just means that all these type of "it won't even catch anyone!" argument are just bad arguments.

The goal is money and control. They enact a partial "solution" so later on they'll say they need more access to private data because of the loopholes. Meanwhile the industry of surveillance and compliance grows providing more paper pushing jobs to the establishment. Power-tripping politicians also get the ability to spy on opponents and basically anyone they please.

Having the bad content hosted "elsewhere" is still a good gain for any service provider. It reduces the number of safe harbors for harmful actors.

Outside public content can be scanned as part of "defense in depth" too.

This is just annoying

That's the most positive take you can have on this.

Incredible that they think this will even slow anything at all.

They don't, or they don't care. Measures like these have two purposes:

1. To make it seem like someone is doing something. Constituents don't accept the idea that their representatives are powerless to fix certain hot-button issues. Even if a new law or regulation will have minimal or no effect on a problem, as long as legislators (or whomever) can pay some "experts" to say good things about it, many constituents -- most of whom don't understand the issues involved -- will be (somewhat) satisfied.

2. Continuing to establish and normalize surveillance technology and make it a part of normal life. The more that government types can mandate that people can't do in private, the easier it is for them to do... well... whatever they want to do.

But you don't even need to use a link! You could just convert and send the image as base64 or you could compress and encrypt it with 7z. I am sure there are many other methods. How accessible that would be on a phone though is another story, but I dont think it would be that hard.

Very likely, and self-hosting too. I imagine some sort of licensing system eventually.

If and how :)

Yes, ChatKYC is in the works.

Pretty sure Signal currently can't look at my photos that I send to friends. So that part is wrong. AFAIK WhatsApp is also encrypted. But I don't know if they can see the photos server side.

It’s absurd to suggest that users of an e2ee chat service can reasonably expect the government to “take a look” at the pictures they share. Software should have no such backdoors. This law does nothing to dissuade criminals but it does degrade the privacy expectations of regular people who are not suspected of any wrongdoing.

I know why you were voted down, and I don't think it's fair.

But the problem with your example is:

-criminals CP-sharing etc use end-to-end encryption -> politicians: encryption must be weakened, but that doesn't work...damn opensource

-Now we need local scanners on every phone, but damn those Linux laptops the criminals use still have no scanner.

-And now we need an authorized operating system ...., but damn those open source guys.

-So now there is a full file system scanner chip in every router, laptop and phone. If you get caught using a device without this chip -> straight to jail.

It goes on and on, and next we have to leave the laptop on so gov can always inform us about important stuff ;)

"It's a bad thing that is already happening, so why not make it worse by mandating it on government level" is not as good a take as you think it is.

I don't think it's all that draconian for authorities to take a look, too, after you have already voluntarily !!! sent them to a for-profit corp with questionable morals.

You don't have to send the photos to a for-profit corp though. E2E encryption is entirely possible. What the law should be enabling is for people to sue companies that claim to do E2E encryption then compromise it by independently sending things to law enforcement.

You and I probably have quite a different meaning of balance, although I am indeed not sure what there is to balance. Freedom and security? What do you mean by this? There is a false perception that this is big tech vs the EU, but instead it is big tech and the EU against you.

This is not an issue where there can be much of a compromise. My chats are private and not to be surveilled by a central authority. This isn't a policy that faces the challenges of new technology, this is something that should have stayed in the last century.

The internet did raze down quite a few borders and despite some risks, it is very much worth it to keep it in this form.

If the EU wanted to be constructive in strengthening and protecting users, it would have created legislation that big tech cannot screen user content with impunity. Instead it now forces them to do so and report "wrongdoings" to something that isn't even a real police force.

Please be aware that even if you choose not to share pictures and decide not to use end-to-end encryption services, the installation of the CSS software will still be mandatory.

The control over the scanning of your device remains with them, and the likelihood of this power being exploited is almost guaranteed.

Not to downplay the very obviously tragic suicides, I still disagree with the premise that stuff like that would be reduced or our general safety would be improved by mass scanning.

TSA for example is one of the most invasive security screenings most people endure on a quasi-regular basis and it's been the source of overreach and still does not catch much of anything whatsoever.

Criminals are incentivized to get around this scanning, regular users are not. Who really bears the burden here?

Several of these apps currently have end-to-end encryption, which means that no, they aren't scanned. Even if they were, what a state can do with them (falsely accuse me of heinous crimes) is a lot more dangerous than what a corporation is likely to do with them (show me different ads).

Pretty much all of the blackmailing scams that drove teenagers to suicide were being perpetuated from outside the country that the victim was living in

The recent cases in the Netherlands (where I live) were all Dutch perpetrators.

Anyway, this technology won't catch that -- sending nude pictures is, after all, both perfectly legal and very common. The scanning software can't know that the picture is sent to somebody only acting as a boyfriend rather than an actual boyfriend.

I can see the point of a database of known child porn pictures. The phone app could keep a database of hashes of those exact files, and check for them.

Other than that, I don't see what good automatic scanning can possibly do, and there is a HUGE potential for abuse.

If I take pictures and never share them, no scanning is done. If I copy private pictures to my wife's phone when we are meeting in person, no scanning is done. Similarly, I can archive pictures to my PC or print them out and all of that respects my privacy.

"We'll only beat you on Tuesdays" is not balanced.

This is surely the wrong conclusion to draw from this.

Alas, the anti-EU parties are typically even more insane.

I suggest voting with your feet. The only vote that actually makes a difference.

The anti-EU parties are generally in favor of this kind of stuff.

Here anti-EU parties want even more draconian laws against privacy.

Or kill the potential victims, that will prevent future crimes too!

European parliament has no real power, it's a democratic illusion, just like the elections in USSR. You don't believe me? Then explain me how the EP repels an already voted law. It can't.

And for the 3rd time people confuse the Council with the Commission ;)

For me it feel just like smoke screen rather than genuine intention to help child abuse. Is child abuse from predators such a big problem to variant all population being under radar? Most likely predators are not even 0.1% of population.

It would be better instead to empower and educate parents with tools to protect their children rather than outsourcing to government or public companies.

They're aren't responsible. They've convinced a lot of people to pay them a fortune over their lives to be responsible, but they aren't. The perpetrators are responsible.

When responsible people with power feel powerless

In other words, the problem is these peoples' insatiable power addiction.

I'd say the big problem with catching those perpetrators online is that they will most likely not be inside your country.

It’s “policing” ’s job to enforce laws and catch criminals in the modern world. They don’t care about rights, Constitutions, or morals and they never will. Thus it’s up to the people who elect those who pull these stunts to fire the politicians the next chance they get and let them know why they got fired. Police are just scorpions and the scorpion will do what is in its natural. Fire the bums who make the laws they enforce, they are the real source of the new laws not the police.

A gentle reminder that this week we're voting in EU election so it's a great time to check who supports Chat Control and to vote accordingly.

Any idea where we can find that information (those who proposed and voted on it)?

They all do, even if they say they don't.

Nothing weird, that's just how governments work when they are not united under a strong leader like Putin or Erdogan.

Different organisations have different goals and those into "security" just want to delegate their jobs to computers when they chill, get paid and prized for their success. Some more cynical ones are also plotting for political control, I'm sure.

I'm very annoyed by this trend of government organisations really really desire to look into our stuff all the so they don't have to do their jobs the hard way like finding suspects and investigating them. Bunch of wankers and nothing more, aren't they?

If aligned government bodies is desired then a dictator is needed. EU isn’t suited for this.

It's not wierd at all because you assume the same mental framework. What's been obvious for EU politics for years now is that they do not assume government/security privacy violations as same kind of violation as private person/company violating privacy.

Remember that GDPR has carveouts for governement as well.

Everyone speaks like "privacy" has a common, shared meaning across all people and it couldn't be farther from truth. And we need to keep that in mind - for governments, online posters and even organizations like Signal.

It's not weird, minimal data for corporations maximal data and control for the states, i think it's disgusting but hey they say the EU is democratic so at the end of the day it's our fault.

Officially, they are worried that something bad might happen to the kids.

But if they aren't doing anything wrong, why are they so afraid?

I would be afraid of eg a would-be assassin, even if I never did anything wrong in my life. So this is a weird argument to make.

I'm pretty sure that in the EU (and the USA), even fictional CP is illegal. That is, even drawings or stories of CP are illegal, and certainly AI-generated images would fall under that banner.

Late stage sexual revolution.

I thought Germany was pretty big on privacy protection. What exactly do you mean?

And without any protections Google would be a massive host and facilitator for CSAM. Let's not be naïve about this.

Google support is notoriously non-existent and/or obtuse, and that's the real problem here. Combined with that it's a "ban for life" black/white type thing, that it's not really possibly to appeal anywhere reasonably independent, and that type of stuff. There's tons of innocent reasons your account can get banned, and this is just one o them.

Doing anything that allows random people to upload or send stuff is being flypaper for the worst of the worst of dickheads. You really do need some kind of protection.

I'll go a step further and say that providing such a large platform which ties in to so many aspects of life (whether you want to or not) means accepting some responsibility. This means having at least vaguely helpful support. And also means not being a massive host for CSAM.

I remember a time when I worked as a repair tech and randomly clicked something on the frontpage of Google Video just to test if Flash Player was working without really looking what it was, and it was some guy blowing his brains out. And "young 12-year old Alice proudly shows her small tits" type stuff being quite common to just come across without looking for it on Kazaa, "warez" sites, and the like.

Where do you strike the balance on all of that? Good question. But pretending the balance doesn't exist is not helpful.

It is really concerning that I probably need to ask my parents to stop sharing any photos and videos of my young son digitally (privately via WhatsApp) when he's staying at their place and they are teaching him to swim in their swimming pool. False positives like these can ruin your life.

But by then it'll be too late. They will promise they'll tweak the filters and whitelists, but in the end, the scanning will stay. They only have to succeed once to implement this law, and it's here to stay... we have to succed in repealing it every time and must never fail.

Per earlier news the scanning is said to have a 10% false positive rate[1].

[1] https://www.reddit.com/r/privacy/comments/voaicx/10_error_ra...

Ye it is surrealistic to watch.

It seems like all it takes is to point to a credible external threat and sane people are pushed down by 'lurker' insane people in a heartbeat.

Colonialism except for few colonies here and there was a big source of cost for european Nations. Buying raw goods from cashstrapped Kleptocracies is a lot more efficient / cheaper