Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Mallory Knodel <[e-mail]>]

Hi,

On 12/18/23 2:22 PM, Brian E Carpenter wrote:
> Andrew,
>
> On 18-Dec-23 23:43, Andrew Campling wrote:
>
> ...
>> Reflecting further on the IAB statement, I do believe that the lack 
>> of inclusion of a clear definition of client-side scanning within the 
>> IAB's statement is problematic. I suspect that the real issue relates 
>> to the results of that scanning being shared with a third party 
>> without the knowledge of the user rather than the scanning per se.
>
> The statement is about *mandatory* scanning, which clearly implies 
> that an official third party is involved.
>
> IMHO, it should be my choice whether my email agent is set up to 
> detect occurrences of "Scunthorpe" in incoming email. Alternatively, 
> it should be my choice whether my mail service provider performs that 
> check for me. But none of this is a protocol issue, or a protocol 
> security issue, so however bad one believes the societal harm to be, 
> I'm at a loss to see why it's an IETF issue.
>
I just came back here to address the scanning, too. This line that 
client-side scanning "isn't well defined" or "means too many things" is 
just utter smoke and mirrors. Quite the opposite-- because there are so 
many ways to violate a person's civil liberties by breaking into their 
agents and devices means that *all* of them are to be rejected, early 
and often, despite their inner workings.

-Mallory

> The IAB statement is about the effect of specific government 
> requirements that "undermine end-to-end encryption", and that *is* a 
> protocol security issue, so it's a legitimate topic for the IAB and 
> the IETF.
>
>     Brian
>
> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss

-- 
Mallory Knodel
CTO :: Center for Democracy and Technology
newsletter :: https://internet.exchangepoint.tech