Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Phillip Hallam-Baker <[e-mail]>]

This is an important discussion. But I get the feeling that a core problem
both here and among the policy makers is the notion that opponents of
regulating use of cryptography don't understand the uses made of strong
encryption by terrorist groups to evade intercept capability.

When I was 18, I woke to the news that the Provisional IRA had attempted to
assassinate my cousin along with other members of the British cabinet. Some
years late, I learned that my MP, Peter Morrison had been arrested on more
than one occasion for offenses committed in a children's home. Instead of
prosecuting him, he was made party vice chairman so they could 'keep an eye
on him'. Meanwhile in the US, well known politicians of both parties
eagerly sought the endorsement of Gerry Adams, the leader of the PIRA and
attended numerous fundraisers to buy bullets and bombs knowing full well
that they were building their political careers on the murder of civilians.

I have been a consistent advocate for effective measures to oppose the use
of violence to effect political ends. Stopping the terrorists getting
access to guns, bullets and the means to make bombs has a proven record of
being effective. I have absolutely no sympathy for the position that means
of communication must be regulated while access to instruments of death
must be entirely unfettered.

When I met Tim Berners-Lee in 1992 and he showed me the Web, I joined the
project because I saw it as a continuation of the work done across Eastern
Europe during the cold war. The Soviet Union had just collapsed because the
weight of free expression was too much for the corrupt dictatorship to bear.

Several people have made the argument that governments aren't interested in
these issues. Which comes as a surprise to those of us who know what 'HM
Cabinet Office' means on a name badge. If certain people found a certain
presentation in Singapore incomprehensible, it was because they weren't the
intended audience. I was telling certain people that I was fed up of
certain criminal parties being allowed to act with impunity so that our own
illegals don't end up having a hard time. If the actions of certain parties
are so flagrant and obvious that someone like myself who does not have a
clearance can see what they are up to, something is up. One of those
individuals has since been arrested and served time, the other has not but
the FBI officer who I understand to have been heading the counter-intel
desk in charge of that case has just received four years for taking bribes
from a foreign operative.

So in case it's not obvious, I am doing the same here. HMG doesn't have the
travel budget post-Brexit but they can afford to subscribe to a mailing
list or five hundred. So let me make the case with CLARITY.


To be effective, the IAB case must stick closely to its established field
of expertise. There is an established form for such submissions.

1) Statement of authority: Who is speaking and why do they have it.
2) Describe the argument being disputed
3) Introduce evidence
4) Demonstrate that the disputed argument is flawed

It has been asserted by the proponents of client side scanning that this
technology can be deployed in an effective form without impact on the right
of freedom of expression. It is not the IAB that has brought up human
rights, the technology proponents did when they attempted their prebuttal.

The point I would begin with is that the Internet is an international
infrastructure that by design lacks a central point of control. To be
viable, any technical proposal must work for every user of the Internet
regardless of which country they are a citizen of, which country they
reside in or which country they currently happen to be visiting.

If an intercept capability were to be deployed for use by Western
governments, the same capabilities would have to be shared with foreign
governments and those intercept capabilities could not be limited to
intercepting communications by their own citizens, residents or even
communications originating or passing through their territory.

The problem of abusing intercept capabilities is not limited to the likes
of corrupt FBI officers such as McGonigal. The PRC uses the term
'Information Terrorism' to refer to what we in the West call 'freedom of
expression'.

Client side scanning is a form of constrained intercept. To be effective,
the scanning application must disclose metadata and results of analyzing
content data to an external party. If HMG is successful in forcing
deployment of client-side scanning to deter content it finds objectionable,
dictatorships will demand scanning to deter content they find
objectionable. Resisting such demands from convenient dictatorships is
likely to prove even more challenging.

To be effective against the targeted groups, any form of intercept,
including client-side scanning must be pervasive or the targeted
groups will simply switch to an infrastructure that is not subject to the
requirements. Thus a proposal limited to the largest platform providers
must inevitably be expanded to apply to every provider or the entire point
is lost.

My own end-to-end secure messaging technology allows anyone to become a
service provider and for users to choose their service provider and to
change that choice at any time. It is thus straightforward for a UK citizen
to make use of a service provider in Argentina, they can even be their own
service provider if they choose.

As with many naive security mechanisms, client side scanning is a
technology that requires the constant addition of epicycles to save the
appearances. Like Brexit it only sounds like a great idea when condensed to
a slogan to fit on the side of bus.