European Parliament Draft to Enforce End-To-End Encryption for Citizens' Privacy

http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-%2F%2FEP%2F%2FNONSGML%2BCOMPARL%2BPE-606.011%2B01%2BDOC%2BPDF%2BV0%2F%2FEN

by dpflan • 9 years ago

218 76 9 years ago

europarl.europa.eu

newzzy• 9 years ago

tldr?

dpflan• 9 years ago

Perhaps this article?

http://www.tomshardware.com/news/european-parliament-end-to-...

onestone2• 9 years ago

Apparently the EU Parliament is trolling Theresa May.

toyg3• 9 years ago

Not just EP, but the Council and Commission as well, since they initiated the legislative process. That means the 27 governments are also behind it, at the moment. This is very surprising to me - no government is free of authoritarian elements, especially in centralistic States like France, Hungary, Italy or Spain. Their unilateral disarmament would be peculiar.

I don't see this proposal going all the way, to be honest, it seems too idealistic. I expect it will be perverted into its opposite, e.g. justification for "review methods" that states could apply to "check if your encryption is secure", which would result in compromising that very security. Remember that EU law is adapted at individual state level; for generic stuff like this, there is plenty of space for interpretation by national legislators.

As a supporter of the EU concept, I think this is dangerous territory for the Union, at a time when its popularity is pretty low. I hope I'll be proven wrong.

TomMarius2• 9 years ago

"27 governments" aren't behind this. Members of the EP from 27 states are behind this, but in many cases, they have nothing in common with the actual government of the country. So little voters care about and participate in the election (often less than 25%) it's easy to win - and the parties that participate in the government don't care at all, thus making EP election the ideal target for otherwise irrelevant parties.

SimonPStevens• 9 years ago

Contrast this to the 'soon to be former member of the EU' UK where Theresa May is trying to force companies to add backdoors and ban end to end encryption.

:-(

Xoros2• 9 years ago

Hand in hand with new French president.

:-(

https://www.buzzfeed.com/amphtml/patricksmith/france-and-the...

fauigerzigerk3• 9 years ago

The article doesn't say that.

sarnowski• 9 years ago

Somehow the actual EU states aren't really behind this. Germany's interior minister just recently proposed a new attempt at legalizing spying citizens devices.

http://uk.mobile.reuters.com/article/idUKKBN1951VG

caiob5• 9 years ago

Trying to make sense of these drafts still being written in English, given that with Brexit, none of the countries in EU zone have English as their first language (with exception of Ireland). Convention?

TkTech• 9 years ago

It is still the current lingua franca for most of Earth. Most of their populations learn English as a 2nd (or 3rd) language.

It's no different then past legislation and politics being done in Latin.

caiob5• 9 years ago

Hmm... if we're picking a lingua franca for the Earth, that would have to be Mandarin (~14% of the world's population speak it)

toyg3• 9 years ago

Beyond ideological posturing, it's a fact of life that English is the language that most educated people across Europe know today (in addition to their national one). Blame Hollywood and Abbey Road. Dropping it just because the UK is currently in stupid-mode wouldn't achieve anything.

isostatic2• 9 years ago

UK is still in the EU, and hopefully won't leave

Lev1a• 9 years ago

They will. And when they're out maybe they'll realize what they left behind for a few more votes in their parliament by riling up the populus against the EU.

tormeh2• 9 years ago

The US, Hollywood, Nazi Germany and The Soviet Union has made English the lingua franca of the world. It makes sense to use it. That said, French is the working language of much of the EU bureaucracy so there's probably a French version out there somewhere.

caiob5• 9 years ago

Shouldn't the first version be in French then?

bdz• 9 years ago

Malta too. Not just Ireland.

caiob5• 9 years ago

I thought Maltese was Malta's official first language.

visarga• 9 years ago

We still need English to talk amongst ourselves. Thanks UK for leaving this parting gift.

pferde2• 9 years ago

I wonder, why the negative stance? Except for any beef you might have against the UK as a country, is the language itself really so bad that using is a problem? I consider it good enough for the job it is doing.

Or are you, and some others in this subthread, just bikeshedding because it's fun?

_ph_• 9 years ago

Actually, this is a huge opportunity. The EU really needs an official language. So far, politics have prevented selecting the language of one large member state to the point where there were proposals to select latin. This document shows that English is the de-facto most common language in the EU. After Brexit, there would be less political opposition to make English official, after all only Ireland uses it as its official language so far.

As a German, I would be equally happy if it were French, as long as we finally get an "official" language throughout the EU, but English is much more a likely candidate now, so we should seize the opportunity.

peteretep• 9 years ago

What language do you believe has the highest comprehension rate for EU citizens? How big do you think the gap is between that and the second one?

lokedhs• 9 years ago

The actual documents are available here, most of the documents are translated into all the official languages:

http://eur-lex.europa.eu/procedure/EN/2017_3

However, this particular document (which you can find by clicking on the “European Parliament - Legislative observatory” at the bottom) is a draft document, and I don't believe they translate those. Once it becomes official they should be translated.

mbroncano• 9 years ago

It certainly seems the EU is becoming an actual land of the free

aneutron• 9 years ago

As was mentioned earlier, we should probably wait to see the individual states interpretations of such laws. It sounds too good to be true IMO.

Buge• 9 years ago

Are they requiring all communication to use e2e encryption? That seems like a restriction on freedom. What if I want to use some other protocol?

drdaeman• 9 years ago

This comment has a point.

I'm all for a secure E2E for all private communications, but not through prohibitions encoded into laws. Unless it's wartime or similar kind of emergency, it's best to never let the government of any kind to be in control of what[1] you can create (and share with others) and what you can't. No matter how benevolent current one looks like, such capability will be abused by the next one. Better have a constitution-level protection that no government can dictate what technology you must or must not use.

Not to say that it's not uncommon for legislatures to be quite awkward when trying to describe technology. And stay up-to-date with possible future breakthroughs.

In my opinion, if someone has an idea (and implementation) of something amazing that won't be E2E, it doesn't make any sense to ban that. Label as "doesn't provide end-to-end security"? Okay, I'm not fan of this stuff, but knowledge gap is significant, so that may be well-justified. Prohibit advertising as "100% secure"? Sure, as long as that's not one-time pads stuff, that's most likely misleading advertising claims worth investigation. But banning the software or the service? That's nuts. And it impedes on freedom to create things.

___

[1] Okay, as long as that's not a nuke. Obvious exceptions apply. (Cryptography is not munitions or a hazardous material, right?)

wbillingsley3• 9 years ago

Well, apart from the protection racket aspects of it that are going on at the moment.

Ah, this is a nice country. It would be a shame if something were to happen to it. I'm so sorry you were thinking of leaving, and stopping paying us billions per year. We really must ask you to hand over a hundred billion before we'll talk about any kind of trading relationship with you -- it would be such a shame if we happened to design the barriers in such a way that would accidentally maximise harm to your economy. But you know you're always welcome to stay and keep paying us just a few billion each year.

HatchedLake721• 9 years ago

Racket? Sorry, but this is nonsense that Daily Mail spreads. The £100bn is not a Brexit divorce bill, it's UK's financial commitments as a member state.

Just because you leave to live in another country, doesn't mean you can stop your mortgage payments and still expect to have a relationship with the lender.

Leave if you wish, but honour your financial commitments you agreed and signed by either paying the whole mortgage upfront or agree to pay over the X period (which is what will most likely happen during negotiations).

doktrin• 9 years ago

You're probably being downvoted for hyperbole, but IMO there's undeniably a palpable undercurrent of petty vengefulness in EU leadership - as evidenced for example with Gibraltar. It doesn't inspire confidence, and is probably counterproductive : honey is generally more effective than vinegar.

vixen99• 9 years ago

Can a 'land of the free' encompass the concept of a territory where laws are made by unelected officials working behind closed doors? Some folk across the EU especially in the eastern European countries are now seriously wondering what they've signed up to.

5ersi• 9 years ago

Members of European Parliament are directly elected. Also most EP work is public: http://www.europarl.europa.eu/

glasz• 9 years ago

don't let yourselves be fooled, fools. if this takes any real form, it'll be gutted and ripped apart until there's nothing of essence left because it would mean the following ingenius legislation be repealed.

and. that. will. never. happen.

https://en.m.wikipedia.org/wiki/Telecommunications_data_rete...

https://en.m.wikipedia.org/wiki/Passenger_name_record

Tyrannosaur• 9 years ago

I often take a pessimistic view to such good-looking things too.

But taking a look at your first link, it appears to already not be in force anymore? For the same reasons that the new recommendation is being drafted- government surveillance violates fundamental rights to privacy.

"On 8 April 2014, the Court of Justice of the European Union declared the Directive 2006/24/EC invalid for violating fundamental rights. The Council's Legal Services have been reported to have stated in closed session that paragraph 59 of the European Court of Justice's ruling "suggests that general and blanket data retention is no longer possible".[15] A legal opinion funded by the Greens/EFA Group in the European Parliament finds that the blanket retention data of unsuspicious persons generally violates the EU Charter of Fundamental Rights, both in regard to national telecommunications data retention laws and to similar EU data retention schemes (PNR, TFTP, TFTS, LEA access to EES, Eurodac, VIS)."

yorwba• 9 years ago

Page 30:

When the processing of electronic communications data by providers of electronic communications services falls within its scope, this Regulation is without prejudice to the possibility for the Union or Member States under specific conditions to restrict by law certain obligations and rights set out in this Regulation when such a restriction is targeted at persons suspected of having committed a criminal offence and constitutes a necessary and proportionate measure in a democratic society to safeguard specific public interests, including national security, defence, public security and the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. Therefore, this Regulation should not affect the ability of Member States to carry out lawful interception of electronic communications or take other measures, if necessary and proportionate to safeguard the public interests mentioned above, in accordance with the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of the European Union and of the European Court of Human Rights.

This is not about preventing state surveillance, this is about regulating non-state actors' ability e.g. to track users without their consent.

Edit: However, on page 74

The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services.

It seems to me that this requires end-to-end encryption, but the regulation is scoped in such a way that the requirement may be lifted when it inconveniences law enforcement.

HappyTypist2• 9 years ago

The key is the OR:

* "sufficient protection in place against unauthorised access or alterations"

* "guaranteed by the nature of the means of transmission used "

* "OR"

* "state-of-the-art end-to-end encryption of the electronic communications data"

aka:

- HTTPS, non-ETE: fine

- HTTP, non-ETE: not fine

- HTTP, ETE: fine

skrebbel3• 9 years ago

Any tldr? I have a very hard time getting through this, but as the founder of a Europe-based messaging company (https://talkjs.com), I wonder whether this is trouble.

En-to-end encryption is great but it also kills quite a number of use cases. For example, our group conversations couldn't be e2e encrypted because then users can't see the message history from before they joined it. In whatsapp this is indeed the case, but for our platform it is a core feature. Same for Slack, I suppose. Similarly, Slack search would be totally out of the door. (unless, again, you make it only search the stuff sent to you)

HappyTypist2• 9 years ago

"The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used or by state-of-the-art end-to-end encryption of the electronic communications data. Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited. Member States shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services"

I interpret this as the following clauses:

* "sufficient protection in place against unauthorised access or alterations" [through]

* "guaranteed by the nature of the means of transmission used "

* "OR"

* "state-of-the-art end-to-end encryption of the electronic communications data"

aka:

- HTTPS, non-ETE: fine

- HTTP, non-ETE: not fine

- HTTP, ETE: fine

c222• 9 years ago

Couldn't group chats be encrypted with a shared key that is provided to the new user by whoever invites them to the chat? The messages would still be encrypted and decrypted only at the ends.

doctorless• 9 years ago

What about removing a user from chat? What if the shared key is leaked? How do you deliver the key to the new user? Who provisions new keys if a shared key is leaked? There are a variety of problems (all solvable/already solved, yes) with the shared secret strategy, and addressing them costs money and time.

skrebbel3• 9 years ago

In all honesty if you keep the key on a server you might as well not encrypt the messages to begin with (except in transmission ofc, but hey, https).

Storing the key right next to the encrypted messages makes it no more secure than ROT13'ing the messages.

ghughes• 9 years ago

I think ubiquitous end-to-end encryption is the inevitable future of 1:1 and group communication. The momentum is in that direction. In your case, supporting the browser as a platform rules it out right now, but hopefully that will change when browsers provide an environment for doing serious crypto, where the server can't just quietly push down some new JS that leaks messages back to itself.

I'm in the alpha stage of building an end-to-end encrypted social network (https://sharewithsup.com, invite code: eff, currently iPhone only). Under the hood, it establishes E2E group channels between friends and uses those for everything (posts, comments, photos, events, etc). History is relayed between friends and search uses a local index, but the UX is still similar to Facebook. My point is - in addition to namedropping my app - that it's possible to find ways to implement features that at first seem hard with E2E. Just not on the web, yet.

sekhat• 9 years ago

our group conversations couldn't be e2e encrypted because then users can't see the message history from before they joined it.

Why not? Can't one of the other clients in the group send the history of the chat when a new member joins?

funnyfacts365• 9 years ago

And when somebody steals your private key they have access to everything? Yeah, no...

infodroid• 9 years ago

Please append [pdf] to the title.

European Parliament Draft to Enforce End-To-End Encryption for Citizens' Privacy

Related Stories