chatcontrol_dk/en/bigbrother.html

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title>Big Brother Awards 2022 - Bits of Freedom</title>
<link rel="stylesheet" type="text/css" href="../style.css" />
</head>
<body>
<div>
<div id="language_choice">
<a href="../da/"><img src="../img/dansk.svg"
                      alt="dansk sprog"
                      height="28" /></a>
<a href="../en/"><img src="../img/english.svg"
                      alt="english language"
                      height="28" /></a>
<a class="about-link" href="index.html">Back to the start</a>
</div>

<h1>🎉🎉🎉 Ylva Johansson won the Big Brother Award 2022! 🎉🎉🎉</h1>

<p>Ylva was awarded the Big Brother Award at Bits of Freedom 2022.</p>

<p>See the video recording at vimeo: <a href="https://vimeo.com/797366382">https://vimeo.com/797366382</a>
(starting at timestamp 1:37:26)</p>

<p>Below is a transcript with comments<a href="#comments">🗨</a> of the video.
Some parts were difficult to transcribe because of the limited audio quality.
The transcript is not official and the above video should be used as the canonical source.
</p>

<div style="background-color: #DDEEDD; color: #000000;  margin: 10px; padding: 20px;">
<p>
Thank you. Good evening everybody. And it is a bit weird - today is my birthday.
This is the strangest birthday present I've ever had.
It would be rude of me to reject a birthday present.
[inaudible]
</p>

<p>
My proposal is about fighting child sexual abuse.
At a scale and severity of a crime to demand that we act.
Videos and pictures are shared online also with abuse of very young children and babies.
And also with severe violence.
One of the first things I did as a commissioner 3 years ago was launching a strategy against this terrible crime.
Focussing on prevention, on victim support and of course on police cooperation.
My proposal now on the table fights the online aspect of this crime.
This is important not at least in the Netherlands where 40% of child sexual abuse material in the world is hosted<a href="#fourty">🗨</a>.
</p>

<p>
Prevention is at the heart of my proposal, but prevention alone will never be enough unfortunately<a href="#fourty">🗨</a>.
In a recent case the dutch police arrested a man.
He has been raping his baby daughter.
The police could stop these rapes, rescue this little girl and two other children, because the man got detected their views in facebook messenger.
Prevention did not stop these rapes.
A baby cannot say no or call a hotline<a href="#baby_prevention">🗨</a>.
</p>

<p>
My proposal does not introduce detection in online messages.
Companies have been detecting child sexual abuse for more than 10 years in online messaging<a href="#not_introducing">🗨</a>.
Last year they sent 1.5 million reports and reviews from the european union alone.
Containing more than 5 million videos and photos of sexual violence against children<a href="#magnitude">🗨</a>.
[inaudible]
</p>

<p>
One million of these reports, the majority, came from online messages, e-mail and chat.
Every single one could contain the vital clue.
The often only clue that could lead to an investigation that rescues the child<a href="#only_clue">🗨</a>.
Next year, this detection for child sexual abuse in online messages will be forbidden.
Totally in the EU.
Unless there is a specific law that allows it<a href="#expired_law">🗨</a>.
My proposal restricts detection compared to [Ursula von der Leyen?].
But my proposal makes sure that it is not totally stopped.
Allowing detection of the views to continue.
Only when absolutely necessary<a href="#absolutely_necessary">🗨</a>.
</p>

<p>
With new safeguards that are regulating big tech companies right now.
Who, the big companies today detect, when they like, what they like and how they like (more or less).
My proposal will limit the detection in time, in place and by law<a href="#limit_by_law">🗨</a>.
</p>

<p>
The only offer for risk assessment. Only if there is a significant risk of child sexual abuse.
Only of the prevention on mitigative measures that failed or was not enough<a href="#prevention_not_enough">🗨</a>.
Only of through court decisions.
Only with approved technology<a href="#approved_technology">🗨</a>.
Only based on verified indicators of child sexual abuse<a href="#only_verified_abuse">🗨</a>.
Only then they will be allowed to do the detection.
None of these safeguards exist today.
That means we will have new safeguards compared with the current situation with my proposal.
</p>

<p>
But there is one big difference.
Today it is voluntary for the companies to detect.
In my proposal this process will also be obligatory.
When companies are allowed to detect, they also must detect<a href="#allowed_to_detecd">🗨</a>.
And if [???] it only detects the views.
</p>

<p>
It is like a police dog at the airport.
Sniffing for drugs offer high risk price.
Officers open only suspicious packages when the dog barks.
And like police dogs, artifical intelligence must always be subject to human oversight<a href="#dog">🗨</a>.
</p>

<p>
And the new EU center I am proposing will be a stake for and filter reports.
That no false positives reach the police<a href="#no_false_positive_to_police">🗨</a>.
And I will not excempt encrypted services if there is a significant risk of child sexual abuse<a href="#encrypted_services">🗨</a>.
Today, detection for malware is allowed and possible and carried out in encrypted environments<a href="#encrypted_environments">🗨</a>.
This is happening today.
And I think that we must protect our children as least as much as we protect our devices from malware<a href="#malware">🗨</a>.
</p>

<p>
I know you all feel very strongly about this.
You also asked me to withdraw my proposal. I will not do that.
Because if I should, then from next year, all detection in messages that has been happening for 10 years will be forbidden in the EU. Forbbiden in the Netherlands.
Detection will stop. Rapes will continue undetected. And that little baby I told you about: Her father would probably still be raping her<a href="#expired_legislation">🗨</a>.
And what about the crimes will say about the victims? That the victims, of that baby [???] Amsterdam, who confessed to abusing and raping 90 babies and small children.
Eight years later, videos are still out there online.
The worst moment of the child's life shared perpertual.
Drama upon drama<a href="#drama">🗨</a>.
</p>

<p>
The european union is a global leader in protecting online privacy.
I am proud of that.
We should all be proud of that.
</p>

<p>
I also want us to become a global leader in protecting children<a href="#global_leader">🗨</a>.
For one of the worst crimes that we can ever imagine.
I'm proud of our new standards of privacy protection.
But we must also protect the privacy of the victims.
Thank you for listening.
</p>

</div>

<p id="comments">
With all due respect, we shall discuss the arguments put forth.
</p>

<h2 id="fourty">40% of child abuse material is hosted in the Netherlands</h2>

<p>
A possible source for this claim might be
<a href="https://home-affairs.ec.europa.eu/news/increased-amount-child-sexual-abuse-material-detected-europe-2020-04-28_en">
this EU news article
</a> which in turn refers to the
<a href="https://www.iwf.org.uk/about-us/who-we-are/annual-report-2020/">
Internet Watch Foundation report from 2020</a>.
If we assume that these number are realistic:
What is the reason why the Netherlands are such a popular target for this illegal material?
And in which way would chatcontrol even help with this? 
If the source of illegal content is known it is easy to take it down,
especially in a modern country like the Netherlands.
There is no clear justification for the need of chatcontrol based on this.
</p>

<h2 id="prevention">Prevention alone will never be enough to prevent all cases</h2>

<p>
Yes. But that still does not justify spying on pretty much any online conversation and
treating all people who fulfill their human need for personal communication as potential offenders.
The intention is good, but the means are completely overblown.
</p>

<h2 id="baby_prevention">We need chat and social media surveillance to rescue babies</h2>

<p>
By that same logic we could also argue for cameras in every room in every home,
because sexual abuse of babies happens in the offline world and only in some cases is posted online.
Only then we would achieve perfect prevention.
</p>

<h2 id="not_introducing">Chatcontrol does not introduce (new) online surveillance</h2>

<p>
It is true that platform providers have been scanning for illegal content before the chatcontrol proposal was drafted.
It is also understandable that platform providers do not wish to have this abhorrent type of data on their platforms.
And it is reasonable that platform providers detect and delete this data.
However, not all data is shared equally. Data can be shared broadly and in a non-personal manner.
And if a platform provider learns that a certain URL points to illegal content, they can act on it.
</p>

<p>
Chatcontrol however, is a new type of surveillance, that is highly pervasive and
that invades personal online spaces in a way that has not been seen to this extent before.
</p>

<h2 id="magnitude">A lot of sexual abuse material is shared on the internet</h2>

<p>
This is a real problem and it needs to be addressed. But the methods to address it need to be reasonable.
</p>

<h2 id="only_clue">Images that are shared online can be the only clue for sexual abuse</h2>

<p>
This line of thinking is exactly what leads to mass surveillance.
While it is true that real clues can be detected with this method,
it is to be expected that the sheer volume of false positives will make it less likely that the relevant reports are processed.
The authorities who process these reports today <a href="https://www.bitsoffreedom.nl/2022/10/17/sex-crimes-unit-already-overwhelmed-and-eu-lawmakers-will-only-make-it-worse/">are already overwhelmed</a>.
Furthermore, it is likely that the intimate life of millions of innocent people will be violated due to this surveillance.

<p>
An approach that focusses on quality instead of quantity is needed.
</p>

<h2 id="expired_law">Without the updated legislation it will become illegal again to scan user's data</h2>

<p>
Correct. This is because of the
<a href="https://en.wikipedia.org/wiki/EPrivacy_Regulation">ePrivacy Regulation</a>,
which protects digital communications in the EU</a>.
This protection is meaningful and valuable.
Chatcontrol violates the ePrivacy Regulation and that is why the EU commission has issued a
<a href="https://www.europarl.europa.eu/RegData/etudes/STUD/2021/662598/EPRS_STU(2021)662598_EN.pdf">temporary derogation</a>
to legalize Chatcontrol version 1 (i.e. it makes voluntary scanning for CSAM legal in the EU).
Chatcontrol version 2 wants to make this temporary derogation permanent and it wants to make the scanning mandatory.</p>

<p>
Our private communication deserves protection
and it should be respected as an actual private matter that the government may not spy on.
The expiry of the derogation will be a good and reasonable thing,
because our private communication is only the buisiness of the intended recipients.
</p>

<h2 id="absolutely_necessary">Scanning will only happen when absolutely necessary</h2>

<p>
Not quite. Most communication software has the potential to be used by children.
And children today are using it to communicate with friends, family, teachers, trainers and more.
And the same software is used by adults to fulfill their needs to communicate.
Chatcontrol subjects many innocent citizens to surveillance, including the children!
</p>

<p>
Is that really the EU we want our children to grow up in?
An EU where all communication of children is scrutinized?
Children also have a right and need to privacy!
</p>

<h2 id="limit_by_law">The new chatcontrol law is a lot more targeted than its predecessor</h2>

<p>
The chatcontrol law that is currently and temporarily in effect does not define as precisely where the scanning needs to take place,
because scanning is voluntary and service and platform providers can themselves decide if they want to scan.
The new chatcontrol law makes scanning mandatory for a lot of services and platforms.
The new proposal will therefore drastically increase surveillance in the EU.
</p>

<h2 id="prevention_not_enough">Scanning will only happen if mitigations failed or were not enough</h2>

<p>
This scanning will still affect all users of a legally provided service or software, even if it is only abused by a minority of users.
</p>

<h2 id="approved_technology">Scanning happens only with approved technology</h2>

<p>
The fact that this technology is approved by the
"EU centre to prevent and combat child sexual abuse",
does not provide any meaningful assurance.
Similarily, the database of indicates that the EU centre manages, is intransparent by design.
</p>

<h2 id="only_verified_abuse">Detection will only happen based on verified indicators of child sexual abuse</h2>

<p>
This is inaccurate. According to Article 44.1 there are 3 different types of indicators:
<ol>
    <li>Indicators based on previously detected and identified abuse material</li>
    <li>Indicators NOT based on previously detected and identified abuse material.</li>
    <li>Indicators for detecting of illegal child solicitation</li>
</ol>

And these indicators must be used by hosting and communication providers as described in Article 10.1.
</p>

<h2 id="allowed_to_detecd">If companies are allowed to detect, they must detect</h2>

<p>
This forces companies to surveil their customers/users.
Most companies view their customers/users with respect
and are probably not happy about this requirement.
</p>


<h2 id="dog">Chatcontrol is no worse than a police dog at the airport</h2>

<ul>
    <li>The airport is not a private living space.</li>
    <li>The airport is not where the police routinely looks into your private communications.</li>
    <li>The airport is not a place that most people tie their identity and innermost feelings to.</li>
</ul>

<p>
The kind of information that is revealed through chatcontrol is vastly more invasive
than any baggage search at the airport.
</p>

<h2 id="no_false_positive_to_police">No false positive will be passed to the police</h2>

<p>
That is besides the point.
Private conversations should enjoy the respect that they deserve and only be available to the intendended recipients.
That means no mass surveillance and no circumvention of encryption.
</p>

<h2 id="encrypted_services">Encryption will be broken, because it can hide sexual abuse</h2>

<p>
Encryption empowers both good and bad people.
Chatcontrol will effectively disempower good, law-abiding citizens who need safe digital spaces in an ever more connected world.
Chatcontrol will effectively disempower children,
because they can not reasonably grow up in a highly digitalized world,
where every move they make on the internet is being scrutinized.
</p>

<p>
Confidentiality is important to humans.
Both, in the analog and the digital world.
And forcing encryption to be broken or circumvented takes away the option to connect privately to other people we care about.
The European Union prides itself with that people can live, work and travel freely across member states.
But one essential ingredient to supporting this is private communication over long distances.
The internet and encryption make it possible for people from all states of the European Union to stay connected and to strengthen the european identity.
</p>

<h2 id="encrypted_environments">Scanning for malware works also in encrypted environments</h2>

<p>
No, it does not. Malware needs to be unencrypted to be executable.
Encrypted malware looks like random data and can not be reasonably detected.
</p>

<h2 id="malware">Scanning of private content happens already today to fight malware</h2>

<p>
Malware needs to be executable to be harmful.
</p>

<ul>
    <li>Text messages are not executable.</li>
    <li>Pixel-based images like photos do not contain executable code.</li>
    <li>Vector-based images can contain executable code, but are unsuitable for photo-like material</a>
    <li>Videos do not contain executable code.</li>
</ul>

<p>
Malware detection works on a different axis than child abuse detection.
Personal data is therefore rarely processed by a malware scanner.
</p>

<h2 id="expired_legislation">If we do not accept the new proposal, the scanning against child abuse can not continue</h2>

<p>
Yes. And that would be a reasonable outcome.
Investigators have other tools to detect and fight child sexual abuse.
It is technically possible to circumvent the client-side scanning that chatcontrol imposes.
And these methods of circumvention will be adopted by the offenders sooner or later.
Thus, it is mostly innocent citizens who will be subjected to the surveillance of chatcontrol.
Client-side scanning is a terrible idea.
</p>

<h2 id="drama">CSAM will stay on the internet perpetually</h2>

<p>
Unfortunately, yes.
But it is unreasonable to expect chatcontrol to solve this.
</p>

<h2 id="global_leader">We want to become a global leader in protecting children</h2>

<p>
A noble goal.
But mass surveillance is the wrong approach.
</p>

</div>
</body>
</html>