Signal would 'walk' from UK if Online Safety Bill undermined encryption

I will say it again, something has got to give. You can't have humane treatment of child rapists and fear government overreach.

It is in fact possible to backdoor communication systems for lawful intercept access. It is possible to also design public auditing of such systems so that a warrant or lawful order being used to intercept communications can be logged and audited by the public. Warrants are not forever secret, with that stipulation a check against abuse of lawful intercept can be incorporated into non-E2E encrypted protocols.

However, what I have learned is that it isn't just privacy or government overreach technophiles like many on HN seem to use as a reason but also a desire to undermine legitimate lawful intercept in foreign countries.

"What if the Chinese government intercepts dissident communication" they're the legit authority there, it will be publicly audited still but they have every right to do so and you have no say in what a foreign government does in their own jurisdiction.

The internet itself should be eradicated if we can't do everything at all costs to prevent harm against the weakest.

It is dual French and British. That said, France's record on freedom of encryption is not that stellar either, even if it is not as bad an enemy of the Internet at the UK. Element should preemptively move its HQ to Iceland or similar.

To be clear, this is a really serious situation.

The current Online Safety Bill wording from https://bills.parliament.uk/publications/49376/documents/282... (https://bills.parliament.uk/bills/3137) is as follows: clause 124(3) declares that OFCOM (the telco industry regulator) can impose "proactive technology" to comply with or remediate illegal content, child safety or fraudulent advertising(!):

    (3) A proactive technology requirement may be imposed in a confirmation decision only for the purpose of complying with, or remedying the failure to comply with, any of the duties set out in—
      (a) section 9(2) or (3) (illegal content),
      (b) section 11(2) or (3) (children’s online safety),
      (c) section 23(2) or (3) (illegal content),
      (d) section 25(2) or (3) (children’s online safety), or
      (e) section 33(1) or 34(1) (fraudulent advertising).
 

and clause 202(1)(a) then defines "Proactive technology" to mean:

    202 “Proactive technology”
     (1) In this Act “proactive technology” means—
       (a) content moderation technology,
       (b) user profiling technology, or
       (c) behaviour identification technology,

In other words, the Bill gives the industry regulator the ability to impose a requirement that communication apps implement content moderation technology - which for an end-to-end encrypted system, obviously means the ability to scan and exfiltrate encrypted content to moderators (as how else can you moderate content). As a result, anything that whatever scanning technology deems illegal would have to end up in an unencrypted moderation queue (presumably provided by the app vendor?!), thus completely violating the encryption privacy guarantees. For instance, folks in Ukraine using Signal/Element/etc to discuss being bombed might end up with their messages exfiltrated by the scanning software to a moderation queue because they include the word 'bomb', which is then a sitting target which bad actors would use to gather intelligence and entirely sidestep encryption.

The penalty for not complying is still being determined, but could mean jail time for those building the apps: https://www.telegraph.co.uk/politics/2023/01/16/rishi-sunak-...

This is LITERALLY the online equivalent of putting a CCTV camera in everyone's bedroom, hooking it up to an machine learning classifier to detect 'illegal activity', and then sending unencrypted recordings to a moderation queue run by the CCTV vendor.

It's terrifying, and we have to stop it, before it sets a precedent that the EU follows with ChatControl, or that the US follows (or uses it as an excuse to remove E2EE entirely).

The way to stop it is to yell about it loud on social media, talk go the press, and if you're in the UK, write to your MP (they do actually read these letters).

Signal & others, if you're reading this: we need to coordinate on an open letter to UK Parliament (probably the House of Lords Committee) to present a united front against this; please ping me at matthew[at]matrix.org to sync.

The OSB is alarmingly advanced through the legislative process, and we are running out of time to stop it.

[flagged]

What do you think of the EU "Chat Control" proposals?

https://www.patrick-breyer.de/en/posts/messaging-and-chat-co...

> The European Commission went a step further on the 11 May 2022 by presenting a proposal which would make chat control mandatory for all e-mail, chat and messenger providers and would even apply to so far securely end-to-end encrypted communication services ... All of your chat conversations and emails will be automatically searched for suspicious content. Nothing remains confidential or secret. There is no requirement of a court order or an initial suspicion for searching your messages. It occurs always and automatically.

One way to increase awareness of these proposals would be for E2EE messengers to include an in-app notice and call to action, for customers in affected countries.