Norman What are the possible implications for EU-citizens when it comes to this? Are we still going to be able to use services like Signal without client-side scanning?
fernlike "This Regulation shall not create any obligation that would require a provider of hosting
services or a provider of interpersonal communications services to decrypt data or
create access to end-to-end encrypted data, or that would prevent providers from
offering end-to-end encrypted services."
This is a very strong statement, and it looks like it is clarified further from the first draft of the new compromise solution. It says no other part of the regulation must be interpreted in such a way as to force a service provider to backdoor or not offer end-to-end encryption. To be clear, not even the strong obligations on service providers to do risk assessments and implement all reasonable measures to prevent child sexual abuse online can override this. Service providers are still allowed to offer secure end-to-end encryption, and can not be penalized for that. This was the compromise.
Service providers might still have legal responsibility to implement other features now, such as better ability for you as the user to decide who can initiate chats with you, and an actual effective and easy-to-use reporting system where the encryption keys to the reported messages or chat are attached with the report. But these are features that are beneficial for everyone anyway, and where you as the user is empowered rather than the opposite.
I do worry that this accepted version of the regulation still permits or maybe encourages age verification and the disallowing of minors from using the platform to prevent abuse. Since laws against age discrimination rarely override laws that mandates age discrimination, this might still effectively negatively affect the rights of minors, and lead to age verification becoming more common place also among end-to-end encrypted chat apps that require account signups.
Norman From what I'm understanding, Signal could be affected if it is deemed as a 'high-risk' service in the context of this bill.
Yes.
Norman That would require them to perform client-side scanning no?
No. They will still be allowed to offer their service in the European Union, with the same secure end-to-end encryption as they have today.
This accepted compromise version of the regulation clearly says that the regulation must not be interpreted in a way where service provider would have to weaken the encryption or stop to offer it. They are legally required to take other kinds of actions against child sexual abuse if deemed high-risk.
Norman Of course they're not going to agree to this so I wonder what happens then.
They can still offer their service in the European Union.
If things would had gone another way, and an earlier revision of the text would have been accepted, Signal would probably have withdrawn their service from EU, refusing registration of EU phone numbers and banning all existing accounts, rather than complying. Matrix on the other hand would have complied, they have been clear about that.
Norman How is grapheneOS affected?
Not at all. Actually, even if the worst revision of the text would have been accepted, GrapheneOS would not be affected at all, as the text was never about operating systems or software, but about service providers, such as providers of messaging apps. GrapheneOS does not include any end-to-end encryption at all.