Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Eliot Lear <[e-mail]>]

Hi!

On 18.12.2023 23:14, Eric Rescorla wrote:
>
> ISTM that this is an example of a setting in which we have a term of 
> art which is used in a way somewhat different from its literal meaning.
>
> Specifically, it is very common right now to have clients of various 
> kinds scan for material that the recipient doesn't want to receive, 
> such as in the case of spam filtering, virus scanning, or Apple's 
> sensitive content warning [0]. In many if not most of those cases, the 
> operator of the device opted into or at least actively wants that kind 
> of scanning. I think we can agree that this type of scanning works to 
> some extent and isn't incompatible with open source or open protocols. 
> This is, of course, scanning that happens on the client, and I believe 
> it's what Brian is referring to.
>
> What the IAB statement is referring to is something different, which 
> is to say scanning which is imposed upon the operator of the device 
> whether they want it or not, and is designed to stop the operator from 
> sending and receiving certain classes of content. As you note, it's 
> common practice to refer to this and not the type of scanning in the 
> previous paragraph as "client-side scanning" (in contract to 
> "server-side scanning"), but it's really the mandatory part of it that 
> makes it distinct from other cases in which scanning happens on the 
> client.


IAB statements are necessarily brief.  When they become lengthy, they 
have another vehicle: RFC.  With that in mind, there are clearly 
challenges in delineating in code the two cases you describe, as the 
interfaces that are used for one case could possibly be used for 
another; and that does strike me as intersecting the Internet 
Architecture.  I'm also confident that you have already blogged on this 
in detail ;-)

Also, this discussion seems to indicate that at least some people are 
unsatisfied with the statement.  I think we should view that as an 
opportunity.  What needs to be further teased out and what should the 
venue for that teasing be?  Here?  A separate mailing list?  PEARG?  
HRPC?  And how could the conversation best be facilitated?

Eliot