I think the headline is missleading, if I understand it correctly.
ChatControl is already possible, and implemented for major communication service providers that most of the people use. It’s just not mantadory.
Currently a regulation is in place allowing providers to scan communications voluntarily (so-called “Chat Control 1.0”). So far only some unencrypted US communications services such as GMail, Facebook/Instagram Messenger, Skype, Snapchat, iCloud email and X-Box apply chat control voluntarily (more details here). source
The article states that they decided that they will not blanketly require it, but I don’t think it says anything about rolling back the first version of ChatControl that’s already in effect.
EDIT: I was wrong, the article actually does mention it, even though on pretty vague terms:
The current voluntary chat control of private messages (not social networks) by US internet companies is being phased out. Targeted telecommunication surveillance and searches will only be permitted with a judicial warrant and only limited to persons or groups of persons suspected of being linked to child sexual abuse material."
The new law would have required breaking end-to-end encryption (E2EE) as the companies would be required to scan messages. CSAM is just the pretext they use to compromise all communication. Same as “think of the children” is used to steal other rights.
That is true, but can’t they (a company that wants to, not the goverment) do that already if they want to, under ChatControl 1.0? And I wouldn’t say that whether a service is E2EE or not makes any difference here - scanning private user messages shouldn’t be allowed, whether they are encrypted or not. IMO if ChatControl 2.0 passed and was made mantadory for everyone, the fact that it is mostly noticable on E2EE apps is only a side-effect of blanket surveilance, and not the main issue with the proposition.
What’s the point of them agreeing that they will let the 1% of users of E2EE services keep their privacy, while they already scan 90% of communication (I mean, just GMail + FB/IG + iCloud, that is already being scanned, makes for most of the worlds communication) for the past year or so?
Now I’m curious whether Facebook/Instagram, who does offer encrypted chats and also scans all your content under ChatControl 1.0 voluntarily, also scans the encrypted chats or not. I’d vager they do, but that’s just a speculation.
But they did briefly mention that they will begin “phasing out” chatcontrol 1.0. I wonder what does that means, and how long will it take.
That’s the goal of end-to-end encryption. To make it impossible to scan. With E2EE company doesn’t have the decryption key, so there is no legible content to scan.
P.S. It’s still possible to collect metadata like when or who the message was sent, which is why services like WhatsApp which have E2EE are not recommended, but the content is safe.
the fact that it is mostly noticable on E2EE apps is only a side-effect of blanket surveilance, and not the main issue with the proposition.
Isn’t it though? We moved past the non encryption communication being safe a long time ago. And just because they will phase the old law, it doesn’t remove the ability of companies to still scan the messages or cops to request that data from those companies. Those companies still have access to the server and your encryption key where your messages are stored. E2EE on the other hand makes it technically impossible even if they want to do that or court orders them to do that.
I think the headline is missleading, if I understand it correctly.
ChatControl is already possible, and implemented for major communication service providers that most of the people use. It’s just not mantadory.
The article states that they decided that they will not blanketly require it, but I don’t think it says anything about rolling back the first version of ChatControl that’s already in effect.EDIT: I was wrong, the article actually does mention it, even though on pretty vague terms:
The new law would have required breaking end-to-end encryption (E2EE) as the companies would be required to scan messages. CSAM is just the pretext they use to compromise all communication. Same as “think of the children” is used to steal other rights.
That is true, but can’t they (a company that wants to, not the goverment) do that already if they want to, under ChatControl 1.0? And I wouldn’t say that whether a service is E2EE or not makes any difference here - scanning private user messages shouldn’t be allowed, whether they are encrypted or not. IMO if ChatControl 2.0 passed and was made mantadory for everyone, the fact that it is mostly noticable on E2EE apps is only a side-effect of blanket surveilance, and not the main issue with the proposition.
What’s the point of them agreeing that they will let the 1% of users of E2EE services keep their privacy, while they already scan 90% of communication (I mean, just GMail + FB/IG + iCloud, that is already being scanned, makes for most of the worlds communication) for the past year or so?
Now I’m curious whether Facebook/Instagram, who does offer encrypted chats and also scans all your content under ChatControl 1.0 voluntarily, also scans the encrypted chats or not. I’d vager they do, but that’s just a speculation.
But they did briefly mention that they will begin “phasing out” chatcontrol 1.0. I wonder what does that means, and how long will it take.
That’s the goal of end-to-end encryption. To make it impossible to scan. With E2EE company doesn’t have the decryption key, so there is no legible content to scan.
P.S. It’s still possible to collect metadata like when or who the message was sent, which is why services like WhatsApp which have E2EE are not recommended, but the content is safe.
Isn’t it though? We moved past the non encryption communication being safe a long time ago. And just because they will phase the old law, it doesn’t remove the ability of companies to still scan the messages or cops to request that data from those companies. Those companies still have access to the server and your encryption key where your messages are stored. E2EE on the other hand makes it technically impossible even if they want to do that or court orders them to do that.
Facebook says they plan to roll out full E2EE by 2024.