Protecting Children's Safety Requires End-to-End Encryption

https://simplex.chat/blog/20240601-protecting-children-safety-requires-e2e-encryption.html

by Sami_Lehtinen • 2 years ago

116 81 2 years ago

CJefferson6• 2 years ago

I'm happy to have a discussion about this, but I don't buy that end-to-end encryption will, overall, increase children's safety. I'm happy to see strong evidence one way of the other, but this article is very one-sided.

Child grooming on the internet is a huge problem, and I suspect (again, happy to see evidence against it) it's better to allow scanning of children's communications, rather than ensuring their communication with whoever they are talking to is end-to-end encrypted.

I don't think it's reasonable to make this the parent's responsibility, when basically the whole world is internet connected, and those parents are fighting against multi-billion dollar international corporations, who dedicate huge teams of highly paid people to ensuring children get addicted to their platforms. Looking at the children in my life, it's very hard to keep them off social media, even if you don't give them devices they will just use their friend's, or devices at school.

_cenw• 2 years ago

Most of the abuse already happens on "responsible" platforms that provide zero expectation of privacy, like Discord.

Scanners are just not good at finding anyone but second-degree consumers, and that seems to happen more on web forums (and also, focusing attention here doesn't get rid of producers).

gherkinnn• 2 years ago

those parents are fighting against multi-billion dollar international corporations, who dedicate huge teams of highly paid people to ensuring children get addicted to their platforms

So why not put a stop to this then?

With any luck we'll come to realise that these platforms and the people working on them are the same scum that run the tobacco industry.

CJefferson6• 2 years ago

I completely agree with you, we will look back on the big social media companies exactly the same way we look at big tobacco, they knew all along the damage they were causing, and spent heroic efforts covering it up to make profits.

InDubioProRubio• 2 years ago

It could done though, via in channel-system- analysing communication, communicating to parties outside the black box, without monitoring the conversation otherwise. If the NNaNNy detects inapropriate conversations by parties underage, it calls the police.

derefr3• 2 years ago

Why does scanning of children's communications need to involve non-E2E-encrypted communication? The parents can just be the admins of their children's devices and tell those devices to capture and report communications before they're encrypted.

Arainach2• 2 years ago

Putting aside that children as a group are brilliant and constantly jailbreaking every kind of device management they are subjected to, the vast majority of parents aren't technical enough to understand this problem much less set themselves up as "admins" and the vast majority of those who are technical enough to understand do not have the time. They're already trying to ensure their children are fed, educated, socialized, emotionally supported, and so on.

This is a wonderful example of engineers thinking everything is a technical problem when almost everything is instead an organizational or human problem.

baq• 2 years ago

A lot of parents are at the very least extremely unaware of what their children are doing on the internet.

abc123abc1232• 2 years ago

Do you think pedos don't read the news? Of course, if privacy is dismantled by law, they will move to other platforms. They are not stupid.

The ones who suffer will be dissidents, political opponents, people who do victimless crimes, regular people where the scanners scanned wrong etc.

All it would take is for one socialist or fascist to come into power, and our dear politicians will have created the perfect platform for imprisoning dissidents.

This discussion is short sighted, naive, and so forgetful of history and the benefits of privacy that I really truly have come to believe that politicians at large are the retards they appear to be.

lukan2• 2 years ago

"They are not stupid."

Some are, those are caught.

But those who are not, learned to be very sneaky. They have to hide their dark side ALL the time. That is a pretty intense training in terms of operational security.

And the solution to this is probably not technical, but social. People could get to know their neighbors more.

My experience with those guys is, it still shows, if you pay attention. But if you are sure your neighbor is not a pedo, then it is one more person you can trust to keep a lookout for the dangerous types. You know, classic community building stuff.

vaylian3• 2 years ago

it's better to allow scanning of children's communications, rather than ensuring their communication with whoever they are talking to is end-to-end encrypted.

This is not purely a technical matter. Children and adolescents want confidential communication just like older people. You might argue, that it is in the best interest of minors to have someone/something look at their private communication to intervene if necessary, but there are much better and more versatile ways to protect the children: Educate them and their parents. Children need to learn how to manage trust with strangers in the offline and online world anyway and the internet doesn't change that. In fact, sexual abuse usually has an offline component to it that you can only effectively protect against by educating children.

xzjis2• 2 years ago

there are much better and more versatile ways to protect the children: Educate them and their parents.

That's exactly it, we should address the root cause of the problem, not its consequences by punishing and threatening to be punished. It's much more effective.

newswasboring6• 2 years ago

Educate them and their parents. Children need to learn how to manage trust with strangers in the offline and online world anyway and the internet doesn't change that.

I'm not sure this is even possible. I understand children are smart but I don't think they are this smart. We can educate children to be cautious but i don't think we should expect them not to get out witted by an adult.

CJefferson6• 2 years ago

There are many ways we don't give children the same rights as adults. They might want confidential communication, but I'm not sure they should have it.

Why are you so sure that it is better and more versatile to educate them and their parents? We've been educating children, and parents, basically forever (and I've done a lot of educating of children myself). While they are young and still learning, I really believe they do need a mixture of freedom and guard-rails, to ensure they can't do themselves too much harm while still developing.

wadim• 2 years ago

Didn't we have quite a few scandals involving LE saving and sharing media as well? Doesn't make it much better, you'll just have a bigger pool of people looking at the unencrypted chats.

I think a better solution would be filters which run only locally and can block problematic messages, as well as alarm platform provider/LE/parents. E2E still works, but you have some safety as well.

Xelbair• 2 years ago

Who decides what's problematic message or not?

abofh9• 2 years ago

It is 100% the parents responsibility to have an active enough role in their Child's life to know who they're interacting with and to provide appropriate supervision. If your child is getting addicted to something, it's because they've been enabled, perhaps through their friends devices or what have you.

You cannot push the burden of being a responsible parent on people who do not wish to be your childrens parent. Society owes you places they can go that they are safe, not padded walls on every sharp corner they might bump into -- that's baby proofing, and it has to be done at home.

ben_w6• 2 years ago

The entire point of being a teenager is to get away from your parents and find new peer groups.

Unfortunately, what we evolved for is 160 people in a village with a peer group of about a dozen within a few years of us, not even a school with hundreds to thousands, let alone the internet with two people for every heartbeat in a human lifetime of which 440 million (~= the population of the EU) is within a few years of us.

And given the power imbalance between manipulative corporations and normal people is sufficient for the former to convince the latter to watch adverts while conversing with their friends — the entirety of Facebook's business model — it's not even clear to me that the internet in its current state is a good thing for adults either: to many of these companies, even the ones that are legal rather than criminal scams, we are the trees upon which money grows.

thelibertines• 2 years ago

I hear you, but children aren't raised by parents alone.

They are also raised by society and environment. It has to go hand in hand.

Implementing structures in communications and tech that evolve around actual real-life material conditions and challenges, is what will make any innovation useful.

Society can no longer afford to separate well-being and technology as two separate concerns for the long run. It's either for humans and what their realities really look like, or it's for nothing, imo.

Whether the above is really a great step, I can't say, tho.

js8• 2 years ago

I don't follow your argument in the last paragraph. What has the fact that children get addicted to social networks to do with the encrypted, peer-to-peer communication? It seems to me like they are two different things.

While I agree it might be healthy for children to avoid social networks (its addictive features, like algorithmic feeds), I don't think it's healthy for them to avoid any Internet communication.

That's how humans are gonna do things in the future, you plug-in yourself to the collective consciousness, unmediated instant communication with many, many people (of your own choice). It's a positive thing, and children need to learn how to operate in that environment. Forbidding them from communicating (for fear of predators) is backwards. It's like forbidding computers to kids because there are violent video games.

axegon_• 2 years ago

Not a whole lot to discuss here, I fully agree. This goes beyond children's safety and into general privacy(which the vast majority of people are totally clueless about, contrary to their beliefs): no amount of encryption can compensate for bad privacy habits. People tend to think that the bottomless pit that is the internet and the billions of users will keep them hidden, which couldn't be further from the truth. And speaking of the truth, all people are surprisingly unique in their own way and there is no such thing as "average". I've been fiddling with this idea for a while and I am putting it to the test in my spare time and so far the results are astonishing: it's far easier to doxx someone online as a consequence of a personal fact that they've publicly shared than some data leak by a private company or even a government institution. Leaks make matters worse, sure but the pile grows exponentially and not linearly(which seems to be what most assume): People get freaked out about their number being posted somewhere online while not realizing that by saying something along the lines of "I studied in London in the early 2010's, then in Edinburgh until 2015" and "I lived in Paris between 2017 and 2019" and someone wants to find their identity, they've willingly helped them narrow down the identity to a handful of people - likely in the very low double digits. Add one more random fact, such as "I have a Volvo xc 70" and you've basically put a pin on yourself on the map.

Most people have probably never considered this. It may sound like a cliche but it's far more important to educate people as well as their children from a very early age about those things than to assume that outsourcing the problem to technical solutions would somehow solve it - it won't.

EMIRELADERO• 2 years ago

Child grooming on the internet is a huge problem, and I suspect (again, happy to see evidence against it) it's better to allow scanning of children's communications, rather than ensuring their communication with whoever they are talking to is end-to-end encrypted.

How can you do this without compromising anonymity? The inevitable conclusion of this argument is that an ID check will be mandatory in order to enable E2EE messaging, otherwise any child could be instructed to enable it by a bad actor.

deletein72h• 2 years ago

who dedicate huge teams of highly paid people to ensuring children get addicted to their platforms

one word: corruption. there's no solution for it because it's a matter of character. now I've spent quite some time in school and university with people who now work for criminal police, police, governments, media, and I know that some of them, if not most, shouldn't be trusted withe safety of other peoples' children. and i also know that some of them absolutely will sell data collected through scanning children's messages and I also know that there's plenty of people in psychology, again, I know some, who would absolutely use said data for therapeutic experiments, marketing campaigns, and so on just to see what can be done with people. this shit has been going for decades in different segments of the population. so we absolutely must establish strong encryption practices wherever we can, especially for children, who's future is still in development, who are learning to be productive and constructive, however long it may take. even more data points for those who already fucked up with what they collected in the past is a bad idea and it's not a matter of competence, these guys are good, it's a matter of character, these guys need to tend to different desires, but they have been "set up" to be what they are now and they are spreading and applying that shit more and more systematically now.

thefz• 2 years ago

Child grooming on the internet is a huge problem, and I suspect (again, happy to see evidence against it) it's better to allow scanning of children's communications

Assuming the scan always happen by a well-intentioned actor, and that no data is ever leaked, and that the children consent to the scanning... lots of assumptions here.

ANY human communication has the right to be private.

Imagine a proposal to install microphones on kids to record anything they say just in case. It would be outrageous, right? We focus on electronic communications just because if we want, we can break their privacy.

devwastaken• 2 years ago

In the U.S anyone under 18 have been and can easily be prosecuted and entered into the widely abused sex offender registry for not just other minors, but themselves. The law is designed to be strict in a world where teens are breaking it constantly. Puritan cultures like this are not hard to find, and act solely to punish people and abuse government authority.

salawat• 2 years ago

I don't think it's reasonable to make this the parent's responsibility, when basically the whole world is internet connected...

I think it is, tbqh. It's a tool. They have to be taught to wield it responsibly.

fighting against multi-billion dollar international corporations, who dedicate huge teams of highly paid people to ensuring children get addicted to their platforms.

I dare say... I see the problem here, and it isn't one scanning everyone's communications is an effective mitigation for.

squigz4• 2 years ago

Child grooming on the internet is a huge problem

I'm happy to see strong evidence on this.

epoberezkin2• 2 years ago

You should understand that you cannot have the cake and eat it.

The logic here is very simple:

1) Any scanning messages of children and their parents means providing access to them, effectively removing the protection provided by the encryption.

2) If these messages are accessible to any algorithm or systems, however secure, there is no way to guarantee that the bad actors will be prevented from accessing these messages - it's only the question of time until this information is leaked.

3) If these messages are accessible to bad actors, it will enable more grooming - because they will be used to train language models to more effectively manipulate children and other people.

So while politicians can engage in their wishful and magical thinking about some wonderful technology that will allow, what they call, a "lawful access" but at the same time will somehow prevent unlawful access by bad actors, everybody with a bit of technical knowledge understands that it is simply impossible - it's either e2e encrypted and nobody other than the communicating parties can access it, or it is not - and then anybody with resources can access it, including bad actors.

That's why they want to scan messages of everybody other than themselves: https://www.eureporter.co/business/data/mass-surveillance-da...

It was never about protecting children - it is simply about eradicating the privacy as we know it, and preventing any dissent from being formed, and criminalising private conversations in the same way free speech is being criminalised. These ideas are not new - it's just now that they try to weaponise "let's protect the children" narrative to achieve it.

The only way to protect children and vulnerable people online is to reduce their discoverability on online platforms, not to expose their communications to enable more efficient grooming - which would be the effect of the scanning.

egberts13• 2 years ago

You cannot say flat-out say that E2E alone must be maintained, you must make it harder for others to reach you, thru something done in-person/screen-only QR-code, Bluetooth'd contact vCard, ..., something that prevents drive-by spammers/perps/malicious actors from randomly attaching to an account.

The key thing is to make distribution of account name harder:

1. Send 256-char hash of your account 2. They tag your hash with a name of their own choice

Disassociative of name to account gets maintained when used with a Signal protocol, which is what Signal app can do.

Again, weak sauce on claiming E2E is alone essential for child's privacy.

bboygravity2• 2 years ago

How do you know what's running on Signal's server?

Sidenote: Signal is based in the USA. They do not have the benefit of the doubt.

egberts13• 2 years ago

You have association revealed openly to anyone having access to Signal server by User ID but barely know the name or phone associated with either end, much less ever able to see any actual and readable message content.

Unless it is the end-device being "accessed"/compromised, which any nation-state can do.

poincaredisk• 2 years ago

You and GP bring signal into this, but TFA is hosted on simplex.chat blog - the communicator famous for not having user accounts at all, so it trivially fixed the problem GP mentioned.

teekert• 2 years ago

I find the argument a bit weak because client side scanning is not the same as creating a central store for all send images. I do indeed find it very concerning that flagged content will eventually be looked at by a human, and said human may be a criminal, or said human and her computers will indeed be the target of hackers looking to extort.

Would be nice if this scenario would first play out for a politician that helped establish Chat Control.

xzjis2• 2 years ago

Would be nice if this scenario would first play out for a politician that helped establish Chat Control.

Unfortunately French politicians already thought about it, and politicians will be exempted from Chat Control.

TrackerFF• 2 years ago

Not related to encryption, but "child safety" seems to be a really popular subject for ushering in all kinds of overreaching policies.

Encrypted communications? Think of the children.

Legalizing cannabis? Think of the children.

LGBTQ+ rights? Think of the children.

Non-western immigrants? Think of the children.

Non-western social media becoming too popular? Think of the children.

etc.

Sorry if this was political, but every time I see someone use "Think of the children" as their main argument, I can't help but to think there's some ulterior motives, and kids (who can't voice their opinion, or won't be heard / taken seriously if they could) are just being used as pawns - because who would want to argue against the safety of kids?

abc123abc1232• 2 years ago

Nothing new.

https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

We quickly forget our history.

concordDance2• 2 years ago

Amusingly, for every single political example you gave, I've heard "think of the children" from both directions.

squigz4• 2 years ago

Can you elaborate? Can't say I've ever heard someone say we should legalize cannabis so the kids can smoke it too.

ryan-c• 2 years ago

LGBTQ+ rights? Think of the children.

A lot of people prefer dead kids to queer kids, unfortunately.

brnt• 2 years ago

Not related to encryption, but "child safety" seems to be a really popular subject for ushering in all kinds of overreaching policies.

Approximately the same age as pretending everything is a slippery slope the other way.

Who knew: extremists are evergreen and forever doomed to not be reasonable by definition.

Taniwha• 2 years ago

Really - today in NZ we have a political stoush where a serving politician has been chatting with young teenagers on snapchat - while there are lots of places where perfect security is important, with predatory adults around perhaps it's not the solution for protecting kids

andrewstuart• 2 years ago

Please, not the "we're protecting the children".

It always starts with "we're protecting the children".

It always ends with "we're censoring the Internet".

Protecting Children's Safety Requires End-to-End Encryption

Related Stories