Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

European Court of Human Rights bans weakening of secure end-to-end encryption

eureporter.co

Post reply on HN
Print view View original

61–70 of 273 posts

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#61

Post by bondarchuk »

Quanttek wrote: post #40
Aachen wrote: post #31

Earlier quoted context omitted.

> The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. *when no adequate safeguards against abuse are in place Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neithe…

Yes, that is very true. The Court generally does not oppose surveillance measures in general, as long as adequate safeguards are in place. However, I read the relevant paragraphs (paras 76-79) to be quite a strong rejection of any statutory obligation that would effectively require the installation of a backdoor undermining E2EE. The criticism of a lack of adequate safeguards and the risk of abuse is more focused on…

Yes, this was a problem all along with arguments against surveillance (/encryption weakening) based on "it can be abused by bad actors" - it implies that one would be ok with surveillance if it could not be abused by bad actors. While it's tempting to use such arguments (it looks like they had effect in this case at least) it remains necessary to emphasize the true reasons one takes a stand against surveillance e.g. authoritarian overreach or a fundamental right to privacy.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#62

Post by sofixa »

krastanov wrote: post #30
tokai wrote: post #18

Earlier quoted context omitted.

Its a judgement that will provide precedence. A Pirate Party member of the European Parliament comments because its a core issue to the party. Why would there be anything about the Pirate Party in the ruling?

I thought precedents only matter in the US "common law" framework, but most of the EU is following the "civil law" framework where precedents do not matter. Does this precedent really matter?

It's funny seeing "common law" referred as a US thing when it's literally been in use in the UK for centuries before the US was a thing, and that's where the US inherited it from.

And precedent has it's place in civil law countries too, mostly around clarifying existing legislation in case of ambiguity, but it isn't an automatic ironclad thing.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#63

Post by burkaman »

Aachen wrote: post #31
Quanttek wrote: post #24

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted". To come to that conclusion, it re…

> The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. *when no adequate safeguards against abuse are in place Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neithe…

From paragraph 64:

> For a detailed description of safeguards that should be set out in law for it to meet the “quality of law” requirements and to ensure that secret surveillance measures are applied only when “necessary in a democratic society”, see Roman Zakharov, §§ 231-34, and Big Brother Watch and Others, §§ 335-39

I am not a lawyer and not motivated enough to go read those decisions, but if anyone is curious that is probably the place to start to figure out what might count as "adequate safeguards".

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#64

Post by tpm »

Deukhoofd wrote: post #60
max_ wrote: post #54

Earlier quoted context omitted.

I was assuming it had jurisdiction over the EU? What is the actual real world impact of this?

It's a part of the Council of Europe, which includes all European countries besides Russia and Belarus (who got kicked out last year). It has no real enforcement powers for its judgements, though most countries do adopt most its judgements, and it has pushed human rights in Europe forward a lot. While the EU could potentially just ignore the statement, there's a good chance they won't, especially as the European Parl…

EU can't ignore it - while the ECHR is separate from the EU, the EU itself is legally bound to follow the ECHR rulings.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#65

Post by robertlagrant »

noir_lord wrote: post #51
stranded22 wrote: post #48

Earlier quoted context omitted.

The UK DOES NOT WANT TO LEAVE THE ECHR. Select people in the government want to, not the whole of UK.

To tack onto this I don't think most people in the UK understand what the ECHR does and why leaving the EU didn't alter our obligations under the ECHR. The media carries a lot of responsibility for that but not all of it - nearly every person in the UK carries a little box with access to a huge chunk of the sum total of all human knowledge, they just choose to not to use it. If that sounds elitist or arrogant it's be…

It doesn't sound elitist or arrogant - quite the opposite. It just assumes that people know what's true and what's not up front, and know when the media is telling them the truth. Their little box doesn't only tell them true things.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#66

Post by M2Ys4U »

Quanttek wrote: post #24

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted". To come to that conclusion, it re…

>While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling.

It's worth noting that UK courts can't overturn Acts of Parliament.

The best they can do is issue a declaration of incompatibility, which enables ministers to use secondary legislation to correct any defect rather than having to go through the process of passing another act (if they have the political will to do so...).

Having said that, a lot of how the Online Safety Act tries to get things done is through secondary legislation and statutory codes and guidelines; these all can be quashed by the courts (unless the Act constrains the way the other instruments are made in such a way that it'd be illegal not to make an infringing instrument) so it'll be interesting to see how that plays out.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#68

Post by rsynnott »

iamthirsty wrote: post #47
Quanttek wrote: post #24

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted". To come to that conclusion, it re…

> the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. The UK wants to leave the ECHR[0], so they might be able to get around it — unfortunately. — [0]: https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-l...

The UK leaving the ECHR, at this point, seems incredibly far-fetched; even amongst the Tories it's hardly a consensus position, and they realistically only have a few month of working time left before the next election.

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#69

Post by rsynnott »

max_ wrote: post #54
guappa wrote: post #52

Earlier quoted context omitted.

Despite the name, it's not the eu :D

I was assuming it had jurisdiction over the EU? What is the actual real world impact of this?

The EU requires EU members to be subject to the ECHR, but it is a separate body and various non-EU countries are subject to it (though, particularly outside the EU, compliance varies).

Re: European Court of Human Rights bans weakening of secure end-to-end encryption

#70

Post by Karellen »

bondarchuk wrote: post #61
Quanttek wrote: post #40

Earlier quoted context omitted.

Yes, that is very true. The Court generally does not oppose surveillance measures in general, as long as adequate safeguards are in place. However, I read the relevant paragraphs (paras 76-79) to be quite a strong rejection of any statutory obligation that would effectively require the installation of a backdoor undermining E2EE. The criticism of a lack of adequate safeguards and the risk of abuse is more focused on…

Yes, this was a problem all along with arguments against surveillance (/encryption weakening) based on "it can be abused by bad actors" - it implies that one would be ok with surveillance if it could not be abused by bad actors. While it's tempting to use such arguments (it looks like they had effect in this case at least) it remains necessary to emphasize the true reasons one takes a stand against surveillance e.g.…

Do you think that phone taps and mail-opening warrants, issued by judges, based on evidence submitted to the court that such warrants are appropriately targetted and based on existing evidence and reasonable suspicion, are intrinsically "authoritarian overreach"?
Post reply on HN