Re: [arch-d] [EXTERNAL] Re: IAB Statement on Encryption and Mandatory Client-side Scanning of Content

[Tommy Jensen <[e-mail]>]

Hey Vittorio,

I’m not saying you don’t have a valid product design gripe (noting that Windows also employs executable signing checks), but I think it’s a false equivalency to compare that to mandated client-side scanning. Following ekr’s example of gaining clarity, for the context of my response, let’s assume “mandated client-side scanning” means “a third party to the customer/platform relationship is coercing the platform (second party) into scanning communicated content before transmission.”

An important distinction here is that client-side scanning, when mandated by a sovereign authority of some kind, cannot be opted out of by the user (first party), and sometimes isn’t even disclosed to the user. In contrast, operating systems blocking the execution of programs which are not recognized provides both: active notice (the popup you described, Windows does something similar) and opt out. You may find the opt out painful, but that’s again a product design gripe, not a policy concern.

As an example, should the UK mandate client-side scanning of end-to-end encrypted content such as Signal messages, will I have the ability to click through any flow to opt out? If not, then these are not equivalent comparisons. Additionally, the equivalent of content scanning in your example is not legal or political in nature; nobody will end up falsely accused of a heinous crime when they download a random executable from the Internet based on the kind of feature you’re describing, but that absolutely can happen with content scanning [0].

Thanks,
Tommy

[0] https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html

From: Architecture-discuss <[e-mail]> On Behalf Of Vittorio Bertola
Sent: Tuesday, December 19, 2023 1:14 AM
To: Eric Rescorla <[e-mail]>
Cc: Andrew Campling <[e-mail]>; [e-mail]; [e-mail]
Subject: [EXTERNAL] Re: [arch-d] IAB Statement on Encryption and Mandatory Client-side Scanning of Content


Il 18/12/2023 23:14 CET Eric Rescorla <[e-mail]<mailto:[e-mail]>> ha scritto:

ISTM that this is an example of a setting in which we have a term of art which is used in a way somewhat different from its literal meaning.

Specifically, it is very common right now to have clients of various kinds scan for material that the recipient doesn't want to receive, such as in the case of spam filtering, virus scanning, or Apple's sensitive content warning [0]. In many if not most of those cases, the operator of the device opted into or at least actively wants that kind of scanning. I think we can agree that this type of scanning works to some extent and isn't incompatible with open source or open protocols. This is, of course, scanning that happens on the client, and I believe it's what Brian is referring to.

What the IAB statement is referring to is something different, which is to say scanning which is imposed upon the operator of the device whether they want it or not, and is designed to stop the operator from sending and receiving certain classes of content.
Great! So, could the IAB please tell Apple to stop preventing me from running on my MacBook Pro executables that didn't go through their app store or vetting process? A few days ago I tried to run "rar" via command line after getting it via Homebrew, and my laptop simply refused to do so because rar's developer isn't a friend of Apple, and in the end I had to go through a seven click process at the third level of the computer's settings just to be able to run rar. I never asked for this check, but apparently there is no way, not even a cumbersome one, to disable it permanently.

Somehow, however, this kind of client-side scanning and blocking of content "imposed upon the operator of the device whether they want it or not" does not seem to be a problem for the IAB, but blocking CSAM is.

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail]<mailto:[e-mail]>
Office @ Via Treviso 12, 10144 Torino, Italy