European Court of Human Rights bans weakening of secure end-to-end encryption

https://www.eureporter.co/world/human-rights-category/european-court-of-human-rights-echr/2024/02/14/european-court-of-human-rights-bans-weakening-of-secure-end-to-endencryption-the-end-of-eus-chat-control-csar-mass-surveillance-plans/

by robtherobber • 2 years ago

1673 255 2 years ago

eureporter.co

eastbound2• 2 years ago

Is there an exception for emergency purposes?

mratsim• 2 years ago

When there is an emergency to break into a house, the police needs to get a mandate from a judge.

gjsman-10003• 2 years ago

Well, there is actually an exception to that too - the Police can break into any home, without a warrant, in the US, if they can prove they had reasonable cause to believe that there was imminent and immediate threat of bodily harm or death.

If you are a police officer and see a guy clearly pointing a gun at someone else through the window, yes, you can break in if the circumstances warrant that.

_cenw• 2 years ago

No, they don't. Many countries have the concept of "imminent danger", which allows police to skip the warrants. It's called "Gefahr im Verzug" in Germany, for instance.

rtkwe• 2 years ago

Depends on where you are. In the US there's the Exigent Circumstances exception to the warrant requirement. Not sure if the same theory has been included in EU countries but I would be surprised if it hadn't, a quick search didn't turn up much english language about it.

https://www.ce9.uscourts.gov/jury-instructions/node/155

vdaea4• 2 years ago

That's not true at least in Spain. There's "In flagrante delicto" which means if the police suspects something going on they can kick your door down.

It was used many times during the pandemic: when they suspected you were having too many people over at home, they acted. Unconstitutionally, mind you.

The EU is not the utopia many think it is.

nottorp• 2 years ago

If it's done right, it can't be subverted in case of "emergency" can it?

If it's full of bugs, it simply doesn't matter.

AJ007• 2 years ago

The "e2e" concept that most are familiar with is basically fake: the provider is responsible for the client that does the encryption and decryption. Of course they can break it if forced. Software exploits are a separate matter and also easier to deal with when the end user isn't truly in control of the encryption (or easier if they don't know what they are doing.)

priprimer• 2 years ago

there’s only and opposing secret court mandating the opposite: publicly available encryption must be weakened on release

Quanttek6• 2 years ago

I think that depends on what you mean: a general state of emergency or a specific situation where the police deem there to be an emergency (e.g. classic hidden bomb scenario)

Regarding (2), the Court found that a statutory obligation to decrypt E2E-encrypted data upon (judicial) request to be disproportionate, but it could still be imagined that – if more narrowly construed – a law could be considered to be proportionate. But the Court does seem quite unwilling to entertain the idea of backdoors for E2E encryption.

Regarding (1), the European Convention on Human Rights (ECHR) allows so-called derogations from certain rights in "time of war or other public emergency threatening the life of the nation" (Art 15 ECHR), insofar as they are necessary and the state of emergency has been properly declared. The right to privacy is such a right, so a State that faces an insurgency may declare a state of emergency and, as part of its emergency measures, could probably demand the decryption of E2E communications if it's necessary to fight the insurgency (e.g. it's a guerilla group using an E2E messenger) - but hard to judge in the abstract.

layer8• 2 years ago

Exceptional circumstances can warrant exceptional measures, but also require exceptional justification, for example by means of a juridical decision for the individual case (i.e., a judge issuing a warrant allowing the police to install and use a backdoor on a concrete individual).

eastbound2• 2 years ago

Let’s just remind that “exceptional justifications” in Canada were “Truckers are protesting with honks in the middle of cities”, so not exactly a matter of national security and in the USA, NSA took it to mean “Any US or non-US citizen on US or non-US soil” (for national security letters).

steelframe• 2 years ago

Is there an exception for emergency purposes?

The problem is when the "emergency" is "the citizen may be engaged in political activities that are against the interests of the ruling party."

meindnoch• 2 years ago

Yes, in case of an emergency you can ask God to give you the prime factorization of 4096bit numbers.

Macha• 2 years ago

Honestly, after so many things turning into "they'll just come back and try again in two years", it's a little reassuring to see some longer term roadblocks being put in place against these anti-E2EE proposals.

p0w3n3d• 2 years ago

yeah, preferably through the Agricultural and Fisheries Commission or a similar body

Aachen4• 2 years ago

I am a bit confused. The article seems fairly political, quoting some promotional text by the pirate party and not describing what case was brought in front of a judge and what the ruling bans specifically, so I clicked through to the actual court case linked at the bottom.

It has nothing to do with the pirate party or chatcontrol or any such thing. The court case was one person against the Russian government for fining Telegram when they didn't hand over plain text chat messages, if I'm skimming the initial facts section correctly. The whole article doesn't even contain the word russia. What is the article reporting on and why does it portray it as being related to the recent chatcontrol legislation?!

Edit: found the decision

80. The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored without adequate safeguards against abuse and the requirement to decrypt encrypted communications, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society.
81. There has accordingly been a violation of Article 8 [privacy] of the Convention [of human rights]

Sounds like you can indeed extend that to any other encryption-circumventing law, like chatcontrol, but without considering the specific circumstances that were present in this Russian law, I'm not sure that it will be accurate. Note, for example, the wording in paragraph 80 "without adequate safeguards against abuse". Maybe chatcontrol had those, if that had been brought in front of the same judges

tokai3• 2 years ago

Its a judgement that will provide precedence. A Pirate Party member of the European Parliament comments because its a core issue to the party. Why would there be anything about the Pirate Party in the ruling?

Aachen4• 2 years ago

Why would you include "We Pirates will now fight even harder for our digital privacy of correspondence!" (and then continuing to link their website as a source of truth on the matter) in a non-promotional piece? This is an advertisement, not a news article

One which I agree with, to be clear. I'm not opposed to the pirate party's views on digital matters. This party's goals/narrative just has no place in a piece about a court case

krastanov• 2 years ago

I thought precedents only matter in the US "common law" framework, but most of the EU is following the "civil law" framework where precedents do not matter. Does this precedent really matter?

vaylian• 2 years ago

The article is not the original. The original text can be found here: https://www.patrick-breyer.de/en/european-court-of-human-rig...

gjsman-10003• 2 years ago

Reminder that the European Court of Human Rights, although very powerful and influential, does not have the authority to force anyone to abide by their rulings.

Also, here's a better article: https://fortune.com/2024/02/13/end-to-end-encryption-russia-...

sampo• 2 years ago

Also, despite its name and despite its location in Strasbourg, European Court of Human Rights is not an EU institution.

https://en.wikipedia.org/wiki/European_Court_of_Human_Rights...

Quanttek6• 2 years ago

Slightly misleading: The Court's judgments are legally binding upon the State members of the Council of Europe. However, it is true that there is no armed enforcement mechanism – something that most domestic courts lack too – and instead decisions are enforced and monitored by the Council of Ministers (the equivalent of the UN General Assembly). However, most of its decisions are complied with most of the time by most nations (safe for Russia and Turkey), frequently because domestic courts will abide by the Court's rulings to overturn laws through its own decisions.

hkt2• 2 years ago

Not so. The UK, for instance, appears to treat these rulings as binding. This is why the UK conservatives want to scrap the Human Rights Act and replace it with a supposedly identical Bill of Rights, the key difference being a presumption that the UK's supreme court would cease to defer to the convention court.

A couple of examples relating to this that come to mind:

* Deporting refugees to Rwanda was stopped by an injunction from the ECHR * Depriving prisoners of votes was ruled illegal in 2005 or so

There are a few others but these two come to mind.

My understanding is that although the treaties (plural?) of the CoE and ECHR don't assume judgements are binding, a number of countries made them binding in their legal systems via domestic legal instruments.

shaoonb• 2 years ago

I believe both your examples are ones where the UK did not follow the decision of the ECHR.

Georgelemental4• 2 years ago

For example, Azerbaijan (a brutal and militarily aggressive dictatorship) is a member

HenryBemis• 2 years ago

The article is semi-garbage (politics aside it is a badly written/biased article).

Better read the decision.

https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854...}

CASE OF PODCHASOV v. RUSSIA

(Application no. 33696/19)

roenxi• 2 years ago

In defence of the article - it linked the decision. That means it is automatically in something close to the top 20% of articles about political topics.

And the actual decision is quite readable; on a quick skim it seemed to agree with what the article said.

dns_snek• 2 years ago

HN markup seems to be breaking the link, here's an alternative one: https://hudoc.echr.coe.int/eng/?i=001-230854

ryukoposting• 2 years ago

Relevant English text from the Court's press release:

The applicant, Anton Valeryevich Podchasov, is a Russian national who was born in 1981 and lives in Barnaul (Russia).
Mr Podchasov was a user of Telegram, a messaging application which was listed as an “Internet communications organiser” (организатор распространения информации в сети Интернет) by the Russian State. It was therefore obliged by law to store all communications data for a duration of one year and the contents of all communications for a duration of six months and to submit those data to law-enforcement authorities or security services in circumstances specified by law, together with information necessary to decrypt electronic messages if they were encrypted.
Relying on Article 8 (right to respect for correspondence) and Article 13 (right to an effective remedy) of the Convention, Mr Podchasov complains of the legal requirements to store, pass on and decrypt data, and that he did not have an effective remedy for this complaint.
Violation of Article 8
Just satisfaction: The finding of a violation constitutes in itself sufficient just satisfaction for any non-pecuniary damage sustained by the applicant

Source: (this is broken) https://hudoc.echr.coe.int/eng-press/#{%22fulltext%22:[%2233...}

Edit: Yuck, this website makes it impossible to permalink anything. What a horrible idea for an organization that's supposed to make very important decisions that people need to reference.

Quanttek6• 2 years ago

Click on "details" and you can permalink

1f60c• 2 years ago

  FOR THESE REASONS, THE COURT
  
  Holds, unanimously, that it has jurisdiction to deal with the applicant’s complaints in so far as they relate to facts that took place before 16 September 2022;
  Declares, unanimously, the complaint concerning the alleged violation of the right to respect for private life and correspondence admissible;
  Holds, unanimously, that there has been a violation of Article 8 of the Convention;
  Holds, by five votes to two, that there is no need to examine the complaint under Article 13 of the Convention;
  Holds, by six votes to one, that the finding of a violation constitutes in itself sufficient just satisfaction for any non-pecuniary damage sustained by the applicant;
  Dismisses, by six votes to one, the applicant’s claim for just satisfaction.
  
  Done in English, and notified in writing on 13 February 2024, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.

Quanttek6• 2 years ago

Relevant paras:

(γ) Statutory requirement to decrypt communications
76. Lastly, as regards the requirement to submit to the security services information necessary to decrypt electronic communications if they are encrypted, the Court observes that international bodies have argued that encryption provides strong technical safeguards against unlawful access to the content of communications and has therefore been widely used as a means of protecting the right to respect for private life and for the privacy of correspondence online. In the digital age, technical solutions for securing and protecting the privacy of electronic communications, including measures for encryption, contribute to ensuring the enjoyment of other fundamental rights, such as freedom of expression (see paragraphs 28 and 34 above). Encryption, moreover, appears to help citizens and businesses to defend themselves against abuses of information technologies, such as hacking, identity and personal data theft, fraud and the improper disclosure of confidential information. This should be given due consideration when assessing measures which may weaken encryption.
77. As noted above (see paragraph 57 above), it appears that in order to enable decryption of communications protected by end-to-end encryption, such as communications through Telegram’s “secret chats”, it would be necessary to weaken encryption for all users. These measures allegedly cannot be limited to specific individuals and would affect everyone indiscriminately, including individuals who pose no threat to a legitimate government interest. Weakening encryption by creating backdoors would apparently make it technically possible to perform routine, general and indiscriminate surveillance of personal electronic communications. Backdoors may also be exploited by criminal networks and would seriously compromise the security of all users’ electronic communications. The Court takes note of the dangers of restricting encryption described by many experts in the field (see, in particular, paragraphs 28 and 34 above).
78. The Court accepts that encryption can also be used by criminals, which may complicate criminal investigations (see Yüksel Yalçınkaya v. Türkiye [GC], no. 15669/20, § 312, 26 September 2023). However, it takes note in this connection of the calls for alternative “solutions to decryption without weakening the protective mechanisms, both in legislation and through continuous technical evolution” (see, on the possibilities of alternative methods of investigation, the Joint Statement by Europol and the European Union Agency for Cybersecurity, cited in paragraph 33 above, and paragraph 24 of the Report on the right to privacy in the digital age by the Office of the United Nations High Commissioner for Human Rights, cited in paragraph 28 above; see also the explanation by third-party interveners in paragraph 47 above).
79. The Court concludes that in the present case the ICO’s statutory obligation to decrypt end-to-end encrypted communications risks amounting to a requirement that providers of such services weaken the encryption mechanism for all users; it is accordingly not proportionate to the legitimate aims pursued.
(δ) Conclusion
80. The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored without adequate safeguards against abuse and the requirement to decrypt encrypted communications, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society. In so far as this legislation permits the public authorities to have access, on a generalised basis and without sufficient safeguards, to the content of electronic communications, it impairs the very essence of the right to respect for private life under Article 8 of the Convention. The respondent State has therefore overstepped any acceptable margin of appreciation in this regard.
81. There has accordingly been a violation of Article 8 of the Convention.

duxup• 2 years ago

This article doesn’t actually contain any information that backs up the title, or if the title is true at all.

There’s a quote from some party member who doesn’t seem directly involved, and almost no information about the actual case / ruling.

Quanttek6• 2 years ago

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted".

To come to that conclusion, it referred to the wide-scale impact such a weakening of E2E through backdoors would have and referred to "calls for alternative 'solutions to decryption without weakening the protective mechanisms, both in legislation and through continuous technical evolution.'" Looking at the cited material, these include traditional policing, undercover operations, metadata analysis, international police cooperation, live forensics on seized devices, guessing or obtaining private keys held by parties to the communication, using vulnerabilities in the target’s software or sending an implant to targeted devices.

While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling.

(It should be noted that, although the backdooring of E2E was considered to go beyond how the right to privacy may legitimately be restricted, the right to privacy is a so-called derogable right, i.e. a government can, upon declaration of a state of emergency, derogate from the right insofar that is necessary to address an emergency "threatening the life of the nation" (Art 15 ECHR))

Relevant paragraphs are paras 76-80 here: https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854...}

Aachen4• 2 years ago

The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy.

*when no adequate safeguards against abuse are in place

Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neither is very specific about what it means)

Quanttek6• 2 years ago

Yes, that is very true. The Court generally does not oppose surveillance measures in general, as long as adequate safeguards are in place. However, I read the relevant paragraphs (paras 76-79) to be quite a strong rejection of any statutory obligation that would effectively require the installation of a backdoor undermining E2EE. The criticism of a lack of adequate safeguards and the risk of abuse is more focused on other aspects of the law.

That also becomes clear in the key paragraph 80: "The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored _without adequate safeguards against abuse_ and the _requirement to decrypt encrypted communications_, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society"

The Court does not qualify the requirement to decrypt E2EE communications with the same safeguards requirements. That of course does not exclude the possibility of the Court finding that a more narrowly-construed law is not in violation. But the Court clearly signals its skepticism towards any "requirement that providers of such services weaken the encryption mechanism for all users" (para 79).

burkaman• 2 years ago

From paragraph 64:

For a detailed description of safeguards that should be set out in law for it to meet the “quality of law” requirements and to ensure that secret surveillance measures are applied only when “necessary in a democratic society”, see Roman Zakharov, §§ 231-34, and Big Brother Watch and Others, §§ 335-39

I am not a lawyer and not motivated enough to go read those decisions, but if anyone is curious that is probably the place to start to figure out what might count as "adequate safeguards".

iamthirsty2• 2 years ago

the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling.

The UK wants to leave the ECHR[0], so they might be able to get around it — unfortunately.

—

[0] https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-l...

stranded22• 2 years ago

The UK DOES NOT WANT TO LEAVE THE ECHR.

Select people in the government want to, not the whole of UK.

rsynnott2• 2 years ago

The UK leaving the ECHR, at this point, seems incredibly far-fetched; even amongst the Tories it's hardly a consensus position, and they realistically only have a few month of working time left before the next election.

M2Ys4U4• 2 years ago

While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling.

It's worth noting that UK courts can't overturn Acts of Parliament.

The best they can do is issue a declaration of incompatibility, which enables ministers to use secondary legislation to correct any defect rather than having to go through the process of passing another act (if they have the political will to do so...).

Having said that, a lot of how the Online Safety Act tries to get things done is through secondary legislation and statutory codes and guidelines; these all can be quashed by the courts (unless the Act constrains the way the other instruments are made in such a way that it'd be illegal not to make an infringing instrument) so it'll be interesting to see how that plays out.

seanw444• 2 years ago

It's worth noting that UK courts can't overturn Acts of Parliament.

Interesting. I didn't know this, and as an American, it seems quite odd. Decisions by the parliament are treated as immutable there?

Here, if a bill passed by Congress is deemed unconstitutional, it can be struck down by the Supreme Court.

pjc502• 2 years ago

It's worth noting that UK courts can't overturn Acts of Parliament

Eh. I think that grossly understates https://en.wikipedia.org/wiki/R_(Factortame_Ltd)_v_Secretary... ; while it does not remove the law from the books, incompatibility with ECJ rulings does effectively disapply the law.

This is why there's such a fight over the Rwanda bill: https://www.bbc.co.uk/news/uk-politics-68283703 . ECHR is effectively constitutional law in the UK, not an ordinary Act of Parliament. Courts have ruled that deporting people to dangerous countries breaches ECHR. The government is trying to legislate the ""fact"" that Rwanda is ""safe"" in order to circumvent that, because they're not quite yet ready to throw out ECHR entirely and haven't had decades to pack the courts.

chippiewill• 2 years ago

The best isn't necessarily a declaration of incompatibility, that's mostly specific to ECHR.

In general if parliament passes legislation that contradicts earlier legislation that wasn't repealed and it wasn't deliberate then a judge can determine that parliament didn't intend to override that earlier legislation and that the new legislation doesn't apply in a given context.

Parliamentary supremacy exists, but only where parliament takes a deliberate action.

JNRowe• 2 years ago

I wholeheartedly recommend How Parliament Works¹ for people who want a deep dive on these points. It is nowhere near as dry as you'd imagine for a five hundred page book about parliament.

While used copies are super cheap I'd also recommend picking up a current revision. Recent years have seen far more use(or attempts to use) some of the more obscure tools of both houses. The updates include more explanation of those topics, along with descriptions of recent cases before the courts.

¹ https://www.amazon.co.uk/dp/1032015012

turquoisevar2• 2 years ago

Prefacing this with the fact that I never had a good feel for UK law due, in part due to it being a common law system vs. the common law system I’m more familiar with on mainland Europe. Plus, I’ve not kept up with what, if anything, the UK maintained concerning supranational jurisdiction after Brexit.

That said, what you describe is similar to that of some EU countries. Take the Netherlands for example.

In the Netherlands, courts can’t test laws passed by the Dutch parliament to the Dutch constitution. Even the Dutch Supreme Court doesn’t have that power (and Dutch legal scholars will therefore deny that the Dutch Supreme Court is a so-called “constitutional court” like the Germans have, for example).

Still, in practice, this is a non-issue because the legal hierarchy places international and EU law above Dutch law, making it the supreme law of the land.

Subsequently, this allows Dutch courts to test against international and EU law, which, for the most part anyway, have similar provisions to that of the Dutch constitution when it comes to (human) rights.

I suppose the question I’m asking is if in practice, the situation is the same or similar in the UK?

thaumasiotes• 2 years ago

It's worth noting that UK courts can't overturn Acts of Parliament.

Is that true? I thought the UK had semi-recently (2009) introduced a Supreme Court for this purpose.

https://www.unz.com/jderbyshire/lessons-from-britains-nation... says this, just a couple of months ago:

Just this week, on Wednesday, Britain’s Supreme Court struck down the latest attempt to implement the Rwanda plan. (Having a “Supreme Court” that strikes down Acts of Parliament is a fairly recent development in Britain.)

martingxx• 2 years ago

The UK government almost seem to be deliberately passing multiple pieces of legislation that they know will be overturned due to ECHR, because they believe such rulings would strengthen their argument for withdrawing from the convention.

TheRealPomax• 2 years ago

Perhaps a dumb question, but why would the EU courts be able to overturn laws in the UK now that the UK is not part of the EU anymore?

AAAAaccountAAAA• 2 years ago

ECHR is not an EU court, but a separate entity, having for long had many non-EU member states.

shortsunblack3• 2 years ago

ECtHR is not an EU court. UK is part of Council of Europe, which also includes Russia. Being member of Council of Europe entails mandatory treaty law of ECHR.

sandworm1012• 2 years ago

> information necessary to decrypt electronic messages if they were encrypted

That reminds me of Lavabit, which I once used as my primary email. In response to demands for decryption information, Lavabit handed over their private keys. On paper. Typed out. Possibly with a typo somewhere on page 6, or 12.

https://thenextweb.com/news/you-wont-believe-what-email-prov...

yxhuvud• 2 years ago

Nice. I can imagine certain ISPs (that I will not shame by name) won't be very happy right now. This really throws a wrench in some proxy models.

Good riddance.

KoolKat23• 2 years ago

Please do name and shame. This would benefit everyone.

kypro• 2 years ago

I realise the article contains the same typo, but the title is bugging me – it needs a space between "end" and "encryption". "Endencryption" is not a word.

@dang ?

yusml• 2 years ago

Yeah, it's bugging me as well. haha.

robtherobber• 2 years ago

Ah, apologies about that, I didn't even notice it. Happy to see it corrected.

max_2• 2 years ago

Europe has done something that I actually love.

I was worried the "let's think of the children" narrative would take over.

The value of encryption has a future in Europe at least.

guappa6• 2 years ago

Despite the name, it's not the eu :D

max_2• 2 years ago

I was assuming it had jurisdiction over the EU?

What is the actual real world impact of this?

LightBug1• 2 years ago

Excellent news.

The European Court of Human Rights ... the court our idiotic UK gvoernment are trying to paint with the same brush they painted the EU.

sackfield• 2 years ago

It's nice to know this also applies to the UK even after Brexit (still a member of the ECHR).

Georgelemental4• 2 years ago

Azerbaijan is in the ECHR too; doesn't stop them from imprisoning political dissidents, employing slave labor, committing war crimes, attacking other ECHR members, or performing ethnic cleansing.

gpderetta2• 2 years ago

Well yes, generally the ECHR has no powers to compel compliance.

But ECHR rulings are binding to EU members (and the the various organs of the EU including the ECJ have way to enforce them).

ECHR are also still binding in the UK because legislation that says otherwise hasn't been passed yet.

TheFuzzball• 2 years ago

The Tories have been talking about leaving the ECHR for years now.

hayd• 2 years ago

They should've left, obviously, not sure what they've been doing with an 80 seat majority. But a silver lining is Cameron/May's "Snoopers' Charter" is utterly dead now.

rrrrrrrrrrrryan• 2 years ago

Man, Europe is really setting an example lately for how it's possible to roll out sensible technology regulations.

Georgelemental4• 2 years ago

Now if they could only do a good job developing the technology itself…

IlikeMadison• 2 years ago

they already do

scotty798• 2 years ago

Why do what everyone can do if you can do the thing only you can do?

ASML

When there's a gold rush, make shovels.

klabb3• 2 years ago

If only California could do a good job starting as many companies as Delaware.

miohtama2• 2 years ago

This decision was needed because the EU was about to ban end-to-end encryption. It’s not the EU commission, but a judge that ruled. AFAIK Commission can still ignore this.

gpderetta2• 2 years ago

They in fact cannot.

ko27• 2 years ago

You have it the other way around. Majority of EU member countries wanted to to ban E2E, but the EU institutions prevented that.

asyx• 2 years ago

As far as I remember, the commission tried to introduce the chat control nonsense but the parliament shut it down.

denton-scratch6• 2 years ago

The judgement cites using vulnerabilities in the target’s software or sending an implant to targeted devices as examples [of legitimate ways to defeat E2E encryption].

That looks like a bad judgement, to me; exploiting vulnerabilities, or using implants, is generally some kind of criminal hacking. So the court seems to be saying that's not OK, unless you're a government. I.e., governments don't have to obey the law.

There are quite a few EU governments that would prefer not to have to comply with the law. Every EU government gets to plant a judge on the ECHR bench.

denton-scratch6• 2 years ago

Every EU government gets to plant a judge on the ECHR bench.

Every EU Council member?

Not sure why I was downvoted, because the downvoters didn't care to comment.

Georgelemental4• 2 years ago

A "Court of Human Rights" that counts Azerbaijan as a member is not a court that should be taken seriously.

lacoolj• 2 years ago

this is a HUGE win and could very much help set precedent across the globe (looking at our congress specifically, USA). Still more hurdles to jump over but a great step in the right direction

nadermx• 2 years ago

They also ruled a while ago on site blocking, which has at least been tested in the Mexican supreme court[0]

translated via google "As the United Nations Human Rights Council has stated, blocking an Internet page implies any measure taken to prevent certain online content from reaching an end user. In this regard, it must be taken into account that restrictions on the human right of freedom of expression should not be excessively broad, on the contrary, they should refer to specific content; Hence, generic prohibitions on the operation of certain websites and web systems, such as blocking, are incompatible with the human right of freedom of expression, except in truly exceptional situations, which could arise when the contents of an Internet page are translate into prohibited expressions, that is, classified as crimes in accordance with international criminal law, among which the following stand out: (I) incitement to terrorism; (II) the advocacy of national, racial or religious hatred that constitutes incitement to discrimination, hostility or violence - dissemination of "hate speech" on the Internet; (III) direct and public incitement to commit genocide; and (IV) child pornography. Likewise, the exceptional situation regarding the prohibition of generic restrictions on the right of expression could also be generated when the entire contents of a web page are illegal, which logically could lead to its blocking, as it is limited only to hosting expressions that are not permissible by law. the legal framework."

[0] https://vlex.com.mx/vid/tesis-aisladas-683012725

holoduke• 2 years ago

What the hell is wrong with our democratic values to begin with? Why do we need high court decisions for these insane ideas of making a better world. Are these people infected by some corporate lobby or what is it why they cannot think in favour of human kind. I cannot phantom this.

WalterBright• 2 years ago

Weakening of secure end-to-end encryption means the encryption is worthless.

germandiago• 2 years ago

Good news

Nostromos• 2 years ago

There's a degree of push/pull on government and industry as far as encryption is concerned. Government shouldn't be injecting vulnerabilities into algos but they also need a way to read messages from criminals and terrorists. Industry wants some way for customers to feel safe using their product to message or whatever their (legal) use case.

Without some local pressure, this cedes encryption commercialization to the US. Sure academics will still love their novel algos but until someone can make money from them, they'll sit in papers, ready for the enterprising american dev to turn into the next big encrypted chat app that is more secure than Signal or something like that.

European Court of Human Rights bans weakening of secure end-to-end encryption

Related Stories