0

There has been multiple attempts to criminalise end to end encryption (E2E). Currently in the news is the EU Chat Control 2.0 (though it seems it has now been withdrawn), the UK passed the Online Safety Bill and the US DoJ is "committed to developing a coherent national and international policy that encourages responsible encryption".

My understanding it that the existing legislation in Europe and most of the conversation in the US relates to scanning content pre-encryption. This has the stated goal of identifying CSAM.

Would these laws put any requirements on third party client developers or users?

While I shall try to come up with an example to illustrate my point, please not that this is a question of law. If your answer comes down to a question of fact I have probably made a mistake with this example.

My understanding is the idea of these laws is to require for example the WhatsApp or Signal client to run a government approved algorithm prior to encrypting messages, and take some action in the case of a "hit". Because of the nature of E2E this MUST happen in the client, it cannot happen in the server.

Third party clients are available for WhatsApp and Signal. The real world situation seems complicated and is largely irrelevant but it may be relevant that in the case of WhatsApp these are contractually restricted, and the Signal App is licensed under the AGPL-3.0. I take this to mean they are OK with thrid party clients, but it seems at least that they are not advisable.

One way Signal could attempt to comply with the law would be to add the required scanning in a way that could be trivially removed by a third party client. Anyone who wanted to avoid the scanning could just use that client. It seems no obvious way to stop this without requiring some server side encryption. Is there a legal solution to this in the laws?

Improve this question
13
  • 1
    Why must it happen in the client? Why can't it be implemented as a MITM by the service provider? I.e. the client divulges the keys to the service provider who is then free to inspect the packets as they pass through their server, but the communication remains end to end encrypted as far as anyone other than the service provider is concerned.
    – JBentley
    Commented Jun 23 at 12:03
  • 1
    @JBentley Because the service provider is not an "end". That would be something, but not E2E.
    – User65535
    Commented Jun 23 at 15:25
  • 2
    @User65535 Yes, but the law doesn't care if you have to call it something other than E2E in order to comply. Your assertion was that "because of the nature of E2E this MUST happen in the client, it cannot happen in the server."; I'm countering that that isn't the case (from the legal, rather than the technical, point of view).
    – JBentley
    Commented Jun 23 at 22:02
  • 1
    @gnasher729 I already addressed that in my second comment. We're concerned here with the law, not the technology. The question is founded on an assumption that "the idea of these laws is to require for example the WhatsApp or Signal client to run a government approved algorithm prior to encrypting messages". My point is that the law requires no such thing. As I already said, the law doesn't care whether you call your solution E2E or not.
    – JBentley
    Commented Aug 5 at 13:09
  • 1
    @JBentley Why do you say that? There are multiple open source implementations of this for current systems such as Whatsapp (not to mention email) that do not allow unencrypted data to be transferred to a third party. You can do it yourself with built in tools in many OS's, like gpg.
    – User65535
    Commented Aug 5 at 14:30

3 Answers 3

Reset to default
0

Neither the existing UK Act or the draft text of the potential EU Regulation have provisions concerning third-party clients.

The UK Act

We cannot know what future laws might do, but the existing UK Online Safety Act does not treat third party clients specially. The act creates obligations for "providers" of "user-to-user services and search services."

A "user-to-user service" is:

an internet service by means of which content that is generated directly on the service by a user of the service, or uploaded to or shared on the service by a user of the service, may be encountered by another user, or other users, of the service

There is no requirement in the Act for a regulated provider to conduct scanning of content prior to encryption.

Speculative regulations

The current draft text of a proposed EU Regulation includes at Article 10a:

In order to implement this Regulation, providers of interpersonal communications services shall install and operate technologies to detect, prior to transmission, the dissemination of known child sexual abuse material or of new child sexual abuse material.

The obligation would be on "providers of interpersonal communications services." The draft does not give any special treatment to third-party clients.

In that draft, "interpersonal communications service" means "a publicly available service as defined in Article 2, point 5, of Directive (EU) 2018/1972, including services which enable direct interpersonal and interactive exchange of information merely as a minor ancillary feature that is intrinsically linked to another service."

Article 2, point 5 of Directive (EU) 2018/1972 says:

'interpersonal communications service' means a service normally provided for remuneration that enables direct interpersonal and interactive exchange of information via electronic communications networks between a finite number of persons, whereby the persons initiating or participating in the communication determine its recipient(s) and does not include services which enable interpersonal and interactive communication merely as a minor ancillary feature that is intrinsically linked to another service

Improve this answer
1
  • Although the UK act doesn't explicitly state that service providers are required to scan content prior to encryption, they are effectively required to do either that or some form of decryption by Section 121(2)(a) if served with a notice by OFCOM.
    – JBentley
    Commented Aug 5 at 17:42
-4

Even if robbing banks is easy; it’s still illegal

The law is not really concerned with how easy or hard it is in a technical sense to avoid compliance; non-compliance is still illegal.

Improve this answer
1
  • I do not understand this answer. Are you saying the network, such as Signal, would be breaking the law or the user?
    – User65535
    Commented Jun 21 at 12:31
-4

Would these laws put any requirements on third party client developers or users?

Why wouldn't them?

Those laws would not give a shit whether the client app is official or not (i.e. offered by a third party). The point of such a law would be to require any messaging apps to implement the pre-encryption scanning requirement. Whether the app developer has any affiliation with the official app would not be relevant.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .