The Belgian government has removed ‘backdoor requirement’ from new law

https://tutanota.com/blog/posts/belgian-encryption-backdoor-law-stopped/

by Sami_Lehtinen • 5 years ago

433 78 5 years ago

thecopy• 5 years ago

... for now.

I am very pleased to see that the _current_ administration came to their senses and listened to reason. However, this is a fight i am afraid we will always have to fight over and over again unless right to encryption is codified in EU constitution or a similar document.

bitcharmer• 5 years ago

Came to say this. It's only temporary victory, sadly.

The efforts to ban encryption won't stop here.

jhgb7• 5 years ago

Time for all companies to stop providing online services in Belgium, then.

randomNumber7• 5 years ago

The efforts to ban encryption won't stop here.

How is this supposed to work? Can't the bad guys just send each other encryped emails anyway? Or hack together some peer-to-peer messenger?

ben_w3• 5 years ago

Encryption is necessary for the entire modern economy, but also worthless when keystrokes can be remote-sensed, faces and other biometrics generated by the same AI that scan for them, and displays can be Van Eck phreaked.

Our near-term future has both unbreakable encryption and omniscient surveillance in the hands of low-budget and non-technical people, and in a fight between the two, surveillance wins.

I don’t know where the world goes from here, but I’m confident the status quo won’t be for much longer.

jack_pp• 5 years ago

Except remote sensing keystrokes isn't as scalable as mass intercepting unencrypted network traffic

bnjms• 5 years ago

Is Van Eck phreaking really a concern since moving from CRT? I know there is a paper showing it was possible for CRT but it seems impossible now. It would be easier to install a custom cable to wirelessly send the display currently.

IG_Semmelweiss• 5 years ago

Faces and biometrics are finding a formidable opponent in one of the positive externalities of COVID:

Masking.

Masking has effectively been normalized in the western world thanks to COVID. Masking is a huge win for a free society. Before COVID, it was actually illegal to hide your face in some US States and many countries [1]

Mask + sunglasses, and you should be effectively anonymous in public.

https://en.wikipedia.org/wiki/Anti-mask_law

eitland• 5 years ago

Everytime something good happens someone have to come up with something to make our efforts seem hopeless.

I'll say our efforts are not without hope for now.

snarf21• 5 years ago

Agreed, I think we need to change the narrative to get the politicians to "get it". Instead of all the talk about protecting us from __________ (random evil), we need to highlight the consequence of these plans. We need journalists to ask politicians to hand over their unlocked phones with the "promise" that they won't share anything they learn. That is what these backdoors would enable. We need to make them understand the downside because all "save the kids" will always have public support.

trompetenaccoun• 5 years ago

Even constitutions only offer very limited protection. There was a recent case in Germany where the government simply ignored the ruling of the supreme court (Federal Constitutional Court). And keep in mind that this is the government with leading influence on the EU. I don't know about everywhere else but at least in Europe rule of law isn't as strong as people assume.

throw10920• 5 years ago

The US constitution also offers limited protection - it's subject to interpretation by judges, and re-interpretation by a growing body of people who think that it "needs to be updated" and "is a living document" and "is not absolute". Your fight for your rights will never end, as evil people will always be elected to office. Just because your officials are not literally Hitler doesn't mean that they won't be trying to infringe upon your rights.

prof-dr-ir• 5 years ago

Article 7 of the Charter of Fundamental Rights, which was adopted with the Lisbon treaty, reads (in its entirety):

"Everyone has the right to respect for his or her private and family life, home and communications."

On the short term a change to the treaties of the Union is not realistic, in my opinion. So I am afraid we might be stuck with having "to fight over and over again", using the above as a foundation. I guess I think of it as educating the politicians.

Fortunately the pro-privacy voices in the EU seem loud enough. For example, in this case the Belgian national privacy authority had already complained about the proposed law. And Germany seems to have adopted the right to encryption in its latest coalition agreement.

mytailorisrich• 5 years ago

Yes, but this article of the Charter (and other laws) does not prevent lawful interception.

This is the crux of the issue: the so-called "pro-privacy" camp wants absolute privacy of communications.

Law enforcement and intelligence services are not against privacy, they are against systems that provide absolute privacy because these systems prevent even lawful interception.

Voice calls on your smartphone are private but may be lawfully intercepted. This is so because mobile networks are in the hands a few licensed and heavily policed operators. On the other hands, we've reached a point where it is simple to develop and publish software apps that allow anyone to communicate in a way that is impossible to intercept as far as we know.

This is not a simple issue. There is a valid concern but at the same time the potential ways to address it (e.g. backdoors, etc) are not very satisfactory.

1337shadow3• 5 years ago

I guess I think of it as educating the politicians.

What about the other way around? What makes you think it's not police hackers who value privacy just like us, and who strive to protect us, who requested this to politicians? That seems more likely.

netcan• 5 years ago

If it's a "fight over and over" situation, the ratcheting dynamics are important.

IE, "we" need to walk away from a win with something more than "status quo defended." Otherwise, the situation is "hold ground until we fail."

hellojesus• 5 years ago

I don't think encryption backdoors will ever be enforceable, even if it becomes a legal requirement. What's to stop someone from just doing it anyway if we use protocols that allow for plausible deniability?

sebow• 5 years ago

Not to downplay this result, after all this was achieved in Belgium, home of Brussels & EU institutions, which probably have great influence over local politics. However it's still sad that we have to celebrate such small victories and we're not fighting towards establishing law that promote positive rights towards protecting privacy both against private and public entities.

We're on the back foot here, and the general public is not even aware of this.I used to think this was about technological literacy but i don't think that's the case: most people don't know what's going on, they don't necessarily care how it happens, they just need to know the end "result", which they don't.Another issue is "law language" being hard to swallow, and politicians can always wrap this language as a candy and pretend it's to : protect the children, against terrorism, or some other minuscule reason that won't justify the abuse and also logistically can't be enforced in an online medium.

AdrianB1• 5 years ago

They fought against a law and changed one article. "They fought" but there were many others in that fight. The article is very poorly worded, I guess they contributed to a change in the law but not repealed the law (like the title suggests) and they were not the major contributor. They need a better writer.

HanaShiratori• 5 years ago

Well tutanota is a small company with around two handful employees afaik, I'd assume their budget for maintaining their blog is very limited. Obviously they use their own media channels to portrait themselves as positive as possible, nothing wrong with that in my eyes. It's not that they were spreading any lies or so

xchip• 5 years ago

Thanks!

BlueTemplar• 5 years ago

Meanwhile there's a high likelihood that there's a backdoor in the Intel processors (and maybe now also AMD ones ?) that was put there by the NSA... and hardy anyone seems to care ?

https://blog.invisiblethings.org/2015/10/27/x86_harmful.html

themitigating• 5 years ago

This seems to be talking about bugs that could be exploited. If there was evidence for a backdoor then it would be global news.

You might believe there's a backdoor but unless you can prove it what do you want people to do?

generalizations• 5 years ago

bugs that could be exploited

That's how you hide a backdoor in open source software.

smoldesu• 5 years ago

Those MINIX cores have been a subject of scrutiny for many years, just not by the people who you'd encounter in your day-to-day. There are definitely people who care, but they've basically started waving the white flag at this point. Pretty much every modern CPU (as well as the software running on it) has some degree of government oversight/intervention, trying to circumvent it is a hobbyist effort, and an often unsuccessful one at that.

charcircuit4• 5 years ago

Intel's processor's ME does not have a backdoor and the chance there is a remotely exploitable vulnerability is minimal.

Hardly anyone cares because it is mostly schizo people who fall for these conspiracy theories.

ttybird22• 5 years ago

"Intel's processor's ME does not have a backdoor"

Can you prove it? It would at least raise confidence if

* It was open source.

* It could be disabled.

* NSA hadn't requested from intel for their own undocumented way to disable ME.

"the chance there is a remotely exploitable vulnerability is minimal"

https://www.intel.com/content/www/us/en/support/articles/000...

"Hardly anyone cares because it is mostly schizo people who fall for these conspiracy theories."*

I can't appreciate the slur against people with schizophrenia. In addition to that, it feels like you would say the same about NSA spying before the Snowden revelations.

Although I do wonder, if there was a backdoor in intel processors for the law enforcement to access, would you support it?

siwyd3• 5 years ago

Wouldn't a company such as WhatsApp (Facebook) drop the Belgian user base in a heartbeat if they would actually be confronted with a law like this? My guess is they would much rather lose a few million users than having to deal with the bad publicity and the intrusive technical challenges that come with a requirement such as this.

nopcode5• 5 years ago

Belgium isn't as small as people think. Both in total GDP and GDP per capita it is around top 20 country globally.

Facebook isn't allowed to track non-Facebook users in Belgium. As a response, all Facebook pages are now behind a login wall in Belgium.

Lootboxes (random rewards in videogames) are not allowed in Belgium, games no longer provide "random" drops (EA, Valve, ...)

siwyd3• 5 years ago

I totally agree that it's probably worthwhile to implement some country specific logic for a user base of that size and ad revenue per user. But specifically with regards to this, I really can't imagine they would agree to do this. Suppose they do, it's probably not a bad guess that they would lose more users globally due to the bad publicity it would generate than they would lose by cutting off Belgium.

On the technical front, your examples are good and valid, but they seem like features that are pretty straight forward to feature flag per country. Something like disabling end-to-end encryption looks a lot more intrusive to me (without being a subject matter, feel free to correct me). Whatever WhatsApp built, they built it to enable end-to-end encryption on a global scale, to enable anyone from around the globe to send an encrypted message around the globe. Poking a hole in that seems non-trivial.

nopcode5• 5 years ago

I wish we would just come up with a strong, transparant legal decryption framework already. We moved our lives completely digital before e2e encryption came around, claiming that we cannot go without e2ee is false.

The "new law" is actually an update of an existing law and it would've forced "apps" (e.g. WhatsApp) to provide the same kind of text logs on request like the telcos have been doing for call log/SMS/location.

vorpalhex3• 5 years ago

It took governments a while to catch up, and now they have. In the arms race between privacy and surveillance, E2E is the next shield against the weapon of mass surveillance.

Governments have always had warrant requirements, until they decided they didn't need them. If you want my data, get a warrant.

The US had it's own top secret database breached.. because they used a discount contractor. I choose to keep my data in higher regard.

Bulk SMS/location is also a horrible failure of justice and it harms innocent people so that a few criminals may be caught. This is backwards.

It is better that a criminal go unpunished than for a single innocent person to be harmed wrongfully by the government.

nopcode5• 5 years ago

  > It is better that a criminal go unpunished than for a single innocent person to be harmed wrongfully by the government.

That really depends on the number of criminals and the total harm they cause to our society versus the harm caused by the government.

We've been having "liberty versus security" debates for centuries and the balance is always changing.

michaelt• 5 years ago

The USA has secret courts that are happy to issue secret warrants to spy on every single customer of a major telco.

Your "legal decryption framework" will be abused precisely the same way - it would be laughably naive to expect anything else.

qkhhly• 5 years ago

hmm... reading western news for a while you would think china is the only one that has back doors.

The Belgian government has removed ‘backdoor requirement’ from new law

Related Stories