Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Brian E Carpenter <[e-mail]>]

Andrew,

On 18-Dec-23 23:43, Andrew Campling wrote:

...
> Reflecting further on the IAB statement, I do believe that the lack of inclusion of a clear definition of client-side scanning within the IAB's statement is problematic.  I suspect that the real issue relates to the results of that scanning being shared with a third party without the knowledge of the user rather than the scanning per se.

The statement is about *mandatory* scanning, which clearly implies that an official third party is involved.

IMHO, it should be my choice whether my email agent is set up to detect occurrences of "Scunthorpe" in incoming email. Alternatively, it should be my choice whether my mail service provider performs that check for me. But none of this is a protocol issue, or a protocol security issue, so however bad one believes the societal harm to be, I'm at a loss to see why it's an IETF issue.

The IAB statement is about the effect of specific government requirements that "undermine end-to-end encryption", and that *is* a protocol security issue, so it's a legitimate topic for the IAB and the IETF.

     Brian