Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Andrew Campling <[e-mail]>]

> At 03:12 AM 18-12-2023, S Moonesamy <[e-mail]> wrote:

> Andrew, are you arguing for anything in existing or future protocols which would permit third party intercept?

George
To answer your question directly, given that the IAB document acknowledges the societal harms caused by, or magnified by, the Internet, I would like to know whether it intends to produce a further statement or document that addresses that issue.  That is what prompted by earlier post on this topic to the list.  

You highlight the potential trade-offs between individual privacy and law enforcement [we should probably note that privacy is a qualified rather than absolute right in many (most?) jurisdictions].  The IAB's "Management Techniques in Encrypted Networks" (M-TEN) workshop considered some of the issues posed by encryption for network management purposes.  In particular, I note that the Red Rover position paper [1] considered the potential for privacy-preserving content filtering as did the one on zero knowledge middleboxes [2].  


Reflecting further on the IAB statement, I do believe that the lack of inclusion of a clear definition of client-side scanning within the IAB's statement is problematic.  I suspect that the real issue relates to the results of that scanning being shared with a third party without the knowledge of the user rather than the scanning per se.  If that is the case, this principle has already been largely addressed by RFC2084, albeit that document focuses on wiretapping rather than on-device scanning.  It should be quite simple for an update of the RFC to address this issue too.

If however the IAB is against the concept of client-side scanning itself, rather than just the reporting of the results of that scanning to a third party without the knowledge of the user, then this needs a proper explanation.  It would be a surprising position for the IAB to take of course as it would essentially suggest that it is against, for example, the detection of malware.  Hence an updated statement would be beneficial that includes a definition of client-side scanning and clarity on the specific aspect(s) of that practice that are objectionable to the IAB.


More generally, I hope that sufficient time will be allocated during the IETF 119 meeting for a discussion about this statement and the various technical, policy and societal issues that it raises, ideally beyond what would be possible as one of several slots within the regular IAB Open meeting.   


Andrew


[1] https://www.ietf.org/ietf-ftp/slides/slides-mtenws-paper-red-rover-a-collaborative-approach-to-content-filtering-pauly-barnes-00.pdf 

[2] https://www.ietf.org/archive/id/draft-iab-m-ten-workshop-00.html#GRUBBS 


-----Original Message-----
From: George Michaelson <[e-mail]> 
Sent: Monday, December 18, 2023 3:12 AM
To: Andrew Campling <[e-mail]>
Cc: [e-mail]; [e-mail]; S Moonesamy <[e-mail]>
Subject: Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

Andrew, are you arguing for anything in existing or future protocols which would permit third party intercept? Because at the core, thats the only modification which can address what I believe you are concerned about, in this context: if end to end encryption coupled with source and destination masking combines to make it infeasible to understand what is said between two parties or who they really are, there is no forseeable mechanism in protocols which is going to protect against knowing parties using these protocols to conduct illegal activity.

I think it becomes political to suggest we should of our own volition, design systems which address the problem when our primary drive for other reasons has been to design systems which deliberately create the problem. You're arguing for a reversal of intent, if I read this right. There is nothing wrong in advocating for this. But, I think it should be overt, not implicit. I believe you advocate for a significant change in both posture and technology at large. If I am remembering correctly you are based in the UK and argue from a British perspective with British laws which are now on the book in the UK, similar ones emerging in the EU, and probably coming to Australia shortly. So, there clearly is a wider political agenda to legislate in this space.

This is not for one minute to suggest there is no problem, or that it shouldn't be addressed. The concern here, is that to me it appears infeasible to design systems which do what you want, and still do what everyone else wants in their normal daily discourses and use of the
internet: You can't be both (anonymous and private) and (subject to review of your content and who you communicate with) at the same time.
In effect, either the act of using encryption has to be contextually criminalised, or we have to accept limits to how private we can be, all the time.

Do you have any specific concrete suggestion of a privacy and anonymity preserving design of systems, which is going to permit the authorities to confirm no criminal activity is taking place? Because nobody else does, that I can see. And most non-protocol changes would be fundamental changes in law, such as a removal of a presumption of innocence if parties refuse to decode communications which are frankly, extremely concerning. Bear in mind that the IETF legally is incorporated in one political economy but as participants we span many. There are differing views of the laws, primacy of one law over another law, rights and responsibilities.
Which means you are in effect beginning to argue for an end to the right (wrong word, used loosely) to privacy, and anonymity. If I am wrong, please can you explain what it is you seek?

Because of how I wrote previously I want to be clear I am not seeking to objectify you, or paint you "wrong" on this. I am trying to understand what specifically you think is going to happen. And if I say "you are concerned about" I do not mean to imply nobody else is concerned, or there is no concern here, or that doing nothing has no consequences.

Abhorrent crimes of all kinds are being committed. These crimes also use the roads, electricity supply, water, sewage, the legal system at large, digital cameras, lots of infrastructure devices and utility functions are brought to bear indirectly in the commisioning of crimes. The unique property we have in this, is that we designed systems which include methods of masking identity and content, where the others are simply volts, or pressure, or things on devices which can be siezed and examined under warrant. In the case of encrypted communications, you can't do that, and still have the value inherent in their encryption. At least, thats how I understand it.

cheers

-George

On Mon, Dec 18, 2023 at 10:45 AM Andrew Campling <[e-mail]> wrote:
>
> At 8:08 PM 16-12-2023, S Moonesamy <[e-mail]> wrote:
>
> > I would like to commend the members of the IAB for acknowledging the concern about societal harms.
>
> The document states that "The IAB shares concerns about societal harms through the distribution of illegal content and criminal action on the Internet and recognizes the need to protect Internet users from such threats".  Whilst the document rules out the use of client-side scanning (a definition of which could usefully be added), it does not go on to indicate how the IAB recommends Internet users should be protected from such threats; is there a plan to produce a separate document that addresses this important issue?
>
>
> Andrew
>
>
> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss