Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

Mallory,

Let's cool it a bit. Saying that someone's argument is "just utter smoke and mirrors" is coming on too strong for debate in our environment.

It might be helpful to provide a pointer to a definition that you find helpful and clear. (We can argue about whether the IAB statement would have been better including the definition or a pointer to it, but since the statement has been published, we must focus on the discussion that follows). 

I find https://www.internetsociety.org/resources/doc/2020/fact-sheet-client-side-scanning/ to be helpful both in definitions and reasoned discussion.

Cheers,
Adrian

PS, If someone wants to fix the citation indexes at https://www.iab.org/documents/correspondence-reports-documents/2023-2/iab-statement-on-encryption-and-mandatory-client-side-scanning-of-content/, that would be very welcome

-----Original Message-----
From: Architecture-discuss <architecture-discuss-bounces@ietf.org> On Behalf Of Mallory Knodel
Sent: 18 December 2023 20:17
To: Brian E Carpenter <brian.e.carpenter@gmail.com>; Andrew Campling <andrew.campling@419.consulting>; George Michaelson <ggm@algebras.org>
Cc: iab@iab.org; architecture-discuss@ietf.org; S Moonesamy <sm+ietf@elandsys.com>
Subject: Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

Hi,

On 12/18/23 2:22 PM, Brian E Carpenter wrote:
> Andrew,
>
> On 18-Dec-23 23:43, Andrew Campling wrote:
>
> ...
>> Reflecting further on the IAB statement, I do believe that the lack 
>> of inclusion of a clear definition of client-side scanning within the 
>> IAB's statement is problematic. I suspect that the real issue relates 
>> to the results of that scanning being shared with a third party 
>> without the knowledge of the user rather than the scanning per se.
>
> The statement is about *mandatory* scanning, which clearly implies 
> that an official third party is involved.
>
> IMHO, it should be my choice whether my email agent is set up to 
> detect occurrences of "Scunthorpe" in incoming email. Alternatively, 
> it should be my choice whether my mail service provider performs that 
> check for me. But none of this is a protocol issue, or a protocol 
> security issue, so however bad one believes the societal harm to be, 
> I'm at a loss to see why it's an IETF issue.
>
I just came back here to address the scanning, too. This line that 
client-side scanning "isn't well defined" or "means too many things" is 
just utter smoke and mirrors. Quite the opposite-- because there are so 
many ways to violate a person's civil liberties by breaking into their 
agents and devices means that *all* of them are to be rejected, early 
and often, despite their inner workings.

-Mallory

> The IAB statement is about the effect of specific government 
> requirements that "undermine end-to-end encryption", and that *is* a 
> protocol security issue, so it's a legitimate topic for the IAB and 
> the IETF.
>
>     Brian
>
> _______________________________________________
> Architecture-discuss mailing list
> Architecture-discuss@ietf.org
> https://www.ietf.org/mailman/listinfo/architecture-discuss

-- 
Mallory Knodel
CTO :: Center for Democracy and Technology
newsletter :: https://internet.exchangepoint.tech

_______________________________________________
Architecture-discuss mailing list
Architecture-discuss@ietf.org
https://www.ietf.org/mailman/listinfo/architecture-discuss