Eu revives chat control, ways to navigate it if this happens?

de0u

kihygrdb any client side scanning by apps can be bypassed in 5 seconds, so it's almost 100% sure they will go with OS scanning

That is interesting alarmist speculation, but if the EU will pass a law mandating OS-level scanning then the text of the law will need to say that, and before that point the text of a draft will need to say that. Alarmist speculation is easy to type, but of low value compared to citing a primary source.

de0u

kihygrdb im worried that i haven't received an official answer by GOS team.

I suspect that if you want an official answer from the GrapheneOS team it would be more likely to come in response to a citation of a primary source than in response to alarmist speculation.

Speeduser7533

troika

Been looking at SimpleX. The main challenge is getting others to implement it. I have enough trouble getting people to use Signal.

de0u

kihygrdb If GOS is going to implement this stuff i will go to jail..

Please note that I don't speak for the GrapheneOS project.

That said, my understanding is that many privacy advocates are opposed to legal mandates for automatic scanning of, e.g., child sexual abuse material because the scanning systems themselves are intrusive, subject to false positives, and, once in place, could be used to scan for other things at the momentary whim of whoever is running the government at any moment. Here is a somewhat-recent statement by the EFF (which was written in response to the actual text of draft regulation, not in response to alarmist clickbait): https://www.eff.org/deeplinks/2023/04/earn-it-bill-back-again-seeking-scan-our-messages-and-photos

However, if anybody has a concern about a CSAM-scanning law based on using GrapheneOS (or any other OS) to actually receive and transmit CSAM, I doubt that major privacy advocacy groups support that. It might be best to seek psychological counseling.

Please note that I don't speak for the GrapheneOS project.

other8026

First of all, sorry for locking the thread for so long. I wanted to read through and write a response to hopefully get things back on track.

kihygrdb I'm going to need you to please take a step back and stop assuming the worst is going to happen.

I am not a lawyer. Not in the EU or anywhere else. I don't know anything about laws except the very straightforward ones. But I will try to address some of the things that were said here.

kihygrdb Does anyone know if GOS is going to comply to this?

kihygrdb seems there is no official answer

Nobody can see the future, and what's the point in official answers for laws we don't know the content of yet? The project doesn't have time to respond with official answers to every imagined scenario.

Graphene1 Id be shocked if Apple Intelligence and Gemini are not already doing this.

The last time Apple was thinking about on-device scanning they informed users about it before it even happened. There was such a backlash that they didn't follow through with it. I don't think they'd add this kind of feature secretly. Not to mention the public would find out anyway because of court documents, etc.

de0u Primary source

I think de0u is right that we would need something more to go on than mere speculation.

One thing we try to avoid here on the forum is imaginary scenarios where it's us vs. our imagination because imagined adversaries can be infinitely capable of doing the things that scare us the most. In this case it's about governments making laws to take away our freedoms, not scary hackers, but it's basically the same thing.

I've already hidden a couple of posts here. If discussion continues to be a little too alarmist or out of hand, I or another moderator may delete more posts and/or suspend people temporarily. Please, let's try to be reasonable here.

Graphene1

I'm going to link the bellow YouTube vid which makes out as if AI scanning is already profiling users, this would certainly assist the EU's surveillance plans. Whether it's true or not I don't know.

Feel free to delete this post if it's nonsense.

https://www.youtube.com/watch?v=EPWHw3VxXCs

de0u

Graphene1 I'm going to link the bellow YouTube vid which makes out as if AI scanning is already profiling users [...]

I don't have time to watch the video, so I skimmed the transcript. What I see there is all descriptions of things that hypothetically could happen without any indication that any of the suppositions are backed by any evidence. I didn't see anything there more evidentiary than if I were to claim that Google hid microscopic unicorns inside each Pixel made in the past five years, and (in the phrasing of this YouTuber) "Picture this! One day you say something dismissive of unicorns, and then all of the microscopic unicorns inside your Pixel shoot out and stab you with their microscopic horns".

If it is possible to point me toward somewhere in the video where the YouTuber provides any evidence of any of the "picture this!" scenarios actually happening on an iPhone 16, that would be good. Or perhaps it is possible to point out relevant experience this person has... maybe he's received some bug bounties for uncovering security or privacy failures?

I think it's important to separate out "Person X says bad thing Y is happening, and Y sounds very very bad, so we'd better hurry up and watch ads to monetize Person X's YouTube channel" from "Person X says bad thing Y is happening and is presenting evidence, so we'd better pay attention".

Edit: Maybe when watching one of those videos it would be good to set an internal timer for like two minutes, and if after two minutes there are allegations with no evidence, maybe that's not a good source to place trust in. Or five minutes, whatever.

de0u

Graphene1 Or, heck, maybe watch some DEF CON or Black Hat videos. That's what it looks like when somebody has evidence of a bad thing.

Graphene1

de0u the reality is you don't know, I don't know. Ultimately the tools are in place to conduct this level of surveillance and governments are chomping at the bit to take away people's privacy and freedom.

If the UK can ban encrypted iCloud backups at the click of a finger, the EU are floating chat control, and people are being jailed in the UK over speech. Why would govs not want AI that's already in the place to assist with what they feel necessary?

I'm sure there is a level of assumptions and click bait YouTubers capitalising on the current landscape but the fact that there's a possibility this is going on is frightening enough.

If folks here had no concern I'm fairly certain many wouldn't be running an AOSP fork.

I say this with respect to you, others on the forum and the GOS team, I fully understand we are speculating. This response is to keep the conversation going as it's interesting to me (albeit worrying 😅)

Sources he claims are on his substack although they are certainly not silver bullets.

https://karat.substack.com/p/your-iphones-new-ai-is-spying-on

de0u

Graphene1 The reality is you don't know, I don't know.

If we both don't know, then the way to knowledge is evidence.

Speculative videos without evidence are not a way to knowledge.

Videos that speculate about things we are already speculating about can deepen our suspicion (and provide a good income to the authors).

But deepening our suspicion is not the same thing as deepening our knowledge.

de0u

Graphene1 Ultimately the tools are in place to conduct this level of surveillance and governments are chomping at the bit to take away people's privacy and freedom.

If the UK can ban encrypted iCloud backups at the click of a finger [...]

I think this example proves the opposite of the claim made in that video.

The UK told Apple to put a back door in iCloud encryption and Apple publicly refused and insread disabled iCloud encryption in the UK.

The author of that video claimed that governments wanted Apple to put secret AI scanning into iPhone 16s and claimed (again, without a shred of evidence) that it's already there.

TrustExecutor

n3t_admin They do get it. And they care. They take careful measurements to make sure our freedoms are restricted. Politicians are absolutely not stupid, they have an agenda.

argante

TrustExecutor Yes, and these are the hallmarks of a government that seeks to maintain power by gradually restricting freedom.

Salami slicing tactics, also known as salami slicing, salami tactics, the salami-slice strategy, or salami attacks, is the practice of using a series of many small actions to produce a much larger action or result that would be difficult or unlawful to perform all at once.

Salami tactics are used extensively in geopolitics and war games as a method of achieving goals gradually without provoking significant escalation.

Divby0

TrustExecutor

I think it's much simpler: follow the money. It's been the driving force all along in recent years. (None the less very sad and very dangerous ...)

https://borncity.com/win/2023/09/27/european-union-which-lobby-organizations-are-behind-the-plans-for-chat-control/

Eumenia

n3t_admin That 100% depends on the implementation. As of right now, I am not aware of the technical implementation planned for chat control. If implemented at the OS level (by Apple and Google), which I find WAY more likely than trying to pressure a bazillion different developers into this, it won't really matter which app you use. Every app can just go on a list and be scanned on the OS level, just like a rootkit.

If they do it on a OS level, it could be forked out off open source systems lime Android or Linux.
They would need to put the backdoor in the bootloader or boardloader.

argante

Eumenia And this poses a risk of locking the bootloader. For this type of restriction to be enforced, it must be ensured that it cannot be disabled by, for example, installing GOS etc.

Graphene1

de0u let's hope your right.

ryrona

I have read the new draft for Chat Control, and it is very similar to the original one. We all knew they would make at least one more attempt at Chat Control, but I think most of us expected it to be an even more weakened version than the last one that failed to get majority, so it is a bit puzzling they are essentially trying the original proposal again. Even more so, since EU recently published directives to us operating websites in the EU on how to protect minors from grooming and other harms, and those directive took a very different approach, pretty much the opposite of Chat Control, and one that is well aligned with children's rights and broadly respects the privacy of everyone. So I don't know what they are doing honestly.

I am going to try to clarify some concerns raised in this thread:

OS level scanning has never been part of Chat Control, and is not part of this version either as far as I could tell. What is talked about in this new proposal is that apps that allow upload, sending or streaming of image data (including photos, attachments and video calls), are forced to scan said image data prior to sending it using an EU government approved AI and image hash based online CSAM scanning tool. The user will be asked for consent before scanning, and if they refuse, the sending of the image must be blocked by the app instead. (This last sentence appears new in this draft, so probably why they try this new proposal.)
They have added a new addition that the implemented solution must not compromise the security of end-to-end encryption, nor discourage apps from implementing end-to-end encryption. However, since the client side scanning is mandatory unless you disable all image, video and file sending functionality, this new addition does not mean anything at all in practice. But it is definitely to kind of writing I would expect them to do to maliciously attempt to push the same thing one more time.
In previous drafts, open source projects have been excluded from having to implement this scanning, as the proposal only applied to companies making revenue. I couldn't find that specific writing this time around, but that also means it wasn't highlighted as a removal, so it is probably still there somewhere in that huge document. So what that means is that WhatsApp would be forced to implement this, but your average open source Matrix compatible messenger app wouldn't have to. Situation with Signal is less clear to me, as it is owned by a non-profit organization.
The provisions that forbid individuals below the age of 16 from using messengers and any other social media does not appear to be in this new proposal. Nor does age verification.
This new proposal still grossly violate children's rights, as a child can no longer send private sexual pictures with a peer without said picture now being sent to a to-the-child unknown adult for visual inspection. This proposal still does the exactly opposite of what it claims. Instead of protecting children from having their private pictures spread on the internet, it makes such spreading of their private pictures mandatory by law.
At least in the original prosposal, the law does not apply to citizens, only to companies. We are still allowed by law to use end-to-end encryption without their scanning by means of open source softwares, peer-to-peer networks, and darknets, just as today. Companies (at least profit making ones) are not allowed to make it available to us, but even just a few years ago there were no end-to-end encryption in commercial messenging apps, that is a new trend. We used to rely on open-source and peer-to-peer networks or darknets for that. So at worst, this is a set back of about 10 years, meaning, your average unknowing citizen will use effectively unencrypted and monitored chats, like how it used to be.
The law will be close to 100% ineffective at lowering the rampant spread of CSAM on internet, since the means it is spread is largely excluded anyway. Yet they keep pushing this instead of actual known effective solutions at prevention such as 1) changing the populations opinions about child porn by talking about attraction to children and healthy coping mechanisms, eg talking about it in sex ed; research shows most who start watching child porn does it before the age of 25, most common onset is in the teens, yet topic is not talked about, 2) anonymous online therapy to help break child porn addiction; effective therapy exists and research shows about 45% of everyone who watch child porn wants to stop, but no funding this far, and 3) providing reasonable alternatives to child porn for those attracted to children, instead of illegalizing all alternatives too which is largely unhelpful.

kihygrdb

ryrona so all this alarmism about this law is baseless?

Eumenia

ryrona OS level scanning has never been part of Chat Control, and is not part of this version either as far as I could tell. What is talked about in this new proposal is that apps that allow upload, sending or streaming of image data (including photos, attachments and video calls), are forced to scan said image data prior to sending it using an EU government approved AI and image hash based online CSAM scanning tool. The user will be asked for consent before scanning, and if they refuse, the sending of the image must be blocked by the app instead. (This last sentence appears new in this draft, so probably why they try this new proposal.)

Is this AI open source?
So someone independent could verify anything?

de0u

DeletedUser410 Would the scanning be on device meaning that EU would want manufacturer to install some sort of scanning software on the devices?

I believe that question was already addressed earlier in this thread (ryrona).

« Previous Page Next Page »