393 lines
17 KiB
HTML
393 lines
17 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8" />
|
|
<title>Big Brother Awards 2022 - Bits of Freedom</title>
|
|
<link rel="stylesheet" type="text/css" href="../style.css" />
|
|
</head>
|
|
<body>
|
|
<div>
|
|
<div id="language_choice">
|
|
<a href="../da/"><img src="../img/dansk.svg"
|
|
alt="dansk sprog"
|
|
height="28" /></a>
|
|
<a href="../en/"><img src="../img/english.svg"
|
|
alt="english language"
|
|
height="28" /></a>
|
|
<a class="about-link" href="index.html">Back to the start</a>
|
|
</div>
|
|
|
|
<h1>🎉🎉🎉 Ylva Johansson won the Big Brother Award 2022! 🎉🎉🎉</h1>
|
|
|
|
<p>Ylva was awarded the Big Brother Award at Bits of Freedom 2022.</p>
|
|
|
|
<p>See the video recording at vimeo: <a href="https://vimeo.com/797366382">https://vimeo.com/797366382</a>
|
|
(starting at timestamp 1:37:26)</p>
|
|
|
|
<p>Below is a transcript with comments<a href="#comments">🗨</a> of the video.
|
|
Some parts were difficult to transcribe because of the limited audio quality.
|
|
The transcript is not official and the above video should be used as the canonical source.
|
|
</p>
|
|
|
|
<div style="background-color: #DDEEDD; color: #000000; margin: 10px; padding: 20px;">
|
|
<p>
|
|
Thank you. Good evening everybody. And it is a bit weird - today is my birthday.
|
|
This is the strangest birthday present I've ever had.
|
|
It would be rude of me to reject a birthday present.
|
|
[inaudible]
|
|
</p>
|
|
|
|
<p>
|
|
My proposal is about fighting child sexual abuse.
|
|
At a scale and severity of a crime to demand that we act.
|
|
Videos and pictures are shared online also with abuse of very young children and babies.
|
|
And also with severe violence.
|
|
One of the first things I did as a commissioner 3 years ago was launching a strategy against this terrible crime.
|
|
Focussing on prevention, on victim support and of course on police cooperation.
|
|
My proposal now on the table fights the online aspect of this crime.
|
|
This is important not at least in the Netherlands where 40% of child sexual abuse material in the world is hosted<a href="#fourty">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
Prevention is at the heart of my proposal, but prevention alone will never be enough unfortunately<a href="#fourty">🗨</a>.
|
|
In a recent case the dutch police arrested a man.
|
|
He has been raping his baby daughter.
|
|
The police could stop these rapes, rescue this little girl and two other children, because the man got detected their views in facebook messenger.
|
|
Prevention did not stop these rapes.
|
|
A baby cannot say no or call a hotline<a href="#baby_prevention">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
My proposal does not introduce detection in online messages.
|
|
Companies have been detecting child sexual abuse for more than 10 years in online messaging<a href="#not_introducing">🗨</a>.
|
|
Last year they sent 1.5 million reports and reviews from the european union alone.
|
|
Containing more than 5 million videos and photos of sexual violence against children<a href="#magnitude">🗨</a>.
|
|
[inaudible]
|
|
</p>
|
|
|
|
<p>
|
|
One million of these reports, the majority, came from online messages, e-mail and chat.
|
|
Every single one could contain the vital clue.
|
|
The often only clue that could lead to an investigation that rescues the child<a href="#only_clue">🗨</a>.
|
|
Next year, this detection for child sexual abuse in online messages will be forbidden.
|
|
Totally in the EU.
|
|
Unless there is a specific law that allows it<a href="#expired_law">🗨</a>.
|
|
My proposal restricts detection compared to [Ursula von der Leyen?].
|
|
But my proposal makes sure that it is not totally stopped.
|
|
Allowing detection of the views to continue.
|
|
Only when absolutely necessary<a href="#absolutely_necessary">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
With new safeguards that are regulating big tech companies right now.
|
|
Who, the big companies today detect, when they like, what they like and how they like (more or less).
|
|
My proposal will limit the detection in time, in place and by law<a href="#limit_by_law">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The only offer for risk assessment. Only if there is a significant risk of child sexual abuse.
|
|
Only of the prevention on mitigative measures that failed or was not enough<a href="#prevention_not_enough">🗨</a>.
|
|
Only of through court decisions.
|
|
Only with approved technology<a href="#approved_technology">🗨</a>.
|
|
Only based on verified indicators of child sexual abuse<a href="#only_verified_abuse">🗨</a>.
|
|
Only then they will be allowed to do the detection.
|
|
None of these safeguards exist today.
|
|
That means we will have new safeguards compared with the current situation with my proposal.
|
|
</p>
|
|
|
|
<p>
|
|
But there is one big difference.
|
|
Today it is voluntary for the companies to detect.
|
|
In my proposal this process will also be obligatory.
|
|
When companies are allowed to detect, they also must detect<a href="#allowed_to_detecd">🗨</a>.
|
|
And if [???] it only detects the views.
|
|
</p>
|
|
|
|
<p>
|
|
It is like a police dog at the airport.
|
|
Sniffing for drugs offer high risk price.
|
|
Officers open only suspicious packages when the dog barks.
|
|
And like police dogs, artifical intelligence must always be subject to human oversight<a href="#dog">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
And the new EU center I am proposing will be a stake for and filter reports.
|
|
That no false positives reach the police<a href="#no_false_positive_to_police">🗨</a>.
|
|
And I will not excempt encrypted services if there is a significant risk of child sexual abuse<a href="#encrypted_services">🗨</a>.
|
|
Today, detection for malware is allowed and possible and carried out in encrypted environments<a href="#encrypted_environments">🗨</a>.
|
|
This is happening today.
|
|
And I think that we must protect our children as least as much as we protect our devices from malware<a href="#malware">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
I know you all feel very strongly about this.
|
|
You also asked me to withdraw my proposal. I will not do that.
|
|
Because if I should, then from next year, all detection in messages that has been happening for 10 years will be forbidden in the EU. Forbbiden in the Netherlands.
|
|
Detection will stop. Rapes will continue undetected. And that little baby I told you about: Her father would probably still be raping her<a href="#expired_legislation">🗨</a>.
|
|
And what about the crimes will say about the victims? That the victims, of that baby [???] Amsterdam, who confessed to abusing and raping 90 babies and small children.
|
|
Eight years later, videos are still out there online.
|
|
The worst moment of the child's life shared perpertual.
|
|
Drama upon drama<a href="#drama">🗨</a>.
|
|
</p>
|
|
|
|
<p>
|
|
The european union is a global leader in protecting online privacy.
|
|
I am proud of that.
|
|
We should all be proud of that.
|
|
</p>
|
|
|
|
<p>
|
|
I also want us to become a global leader in protecting children<a href="#global_leader">🗨</a>.
|
|
For one of the worst crimes that we can ever imagine.
|
|
I'm proud of our new standards of privacy protection.
|
|
But we must also protect the privacy of the victims.
|
|
Thank you for listening.
|
|
</p>
|
|
|
|
</div>
|
|
|
|
<p id="comments">
|
|
With all due respect, we shall discuss the arguments put forth.
|
|
</p>
|
|
|
|
<h2 id="fourty">40% of child abuse material is hosted in the Netherlands</h2>
|
|
|
|
<p>
|
|
A possible source for this claim might be
|
|
<a href="https://home-affairs.ec.europa.eu/news/increased-amount-child-sexual-abuse-material-detected-europe-2020-04-28_en">
|
|
this EU news article
|
|
</a> which in turn refers to the
|
|
<a href="https://www.iwf.org.uk/about-us/who-we-are/annual-report-2020/">
|
|
Internet Watch Foundation report from 2020</a>.
|
|
If we assume that these number are realistic:
|
|
What is the reason why the Netherlands are such a popular target for this illegal material?
|
|
And in which way would chatcontrol even help with this?
|
|
If the source of illegal content is known it is easy to take it down,
|
|
especially in a modern country like the Netherlands.
|
|
There is no clear justification for the need of chatcontrol based on this.
|
|
</p>
|
|
|
|
<h2 id="prevention">Prevention alone will never be enough to prevent all cases</h2>
|
|
|
|
<p>
|
|
Yes. But that still does not justify spying on pretty much any online conversation and
|
|
treating all people who fulfill their human need for personal communication as potential offenders.
|
|
The intention is good, but the means are completely overblown.
|
|
</p>
|
|
|
|
<h2 id="baby_prevention">We need chat and social media surveillance to rescue babies</h2>
|
|
|
|
<p>
|
|
By that same logic we could also argue for cameras in every room in every home,
|
|
because sexual abuse of babies happens in the offline world and only in some cases is posted online.
|
|
Only then we would achieve perfect prevention.
|
|
</p>
|
|
|
|
<h2 id="not_introducing">Chatcontrol does not introduce (new) online surveillance</h2>
|
|
|
|
<p>
|
|
It is true that platform providers have been scanning for illegal content before the chatcontrol proposal was drafted.
|
|
It is also understandable that platform providers do not wish to have this abhorrent type of data on their platforms.
|
|
And it is reasonable that platform providers detect and delete this data.
|
|
However, not all data is shared equally. Data can be shared broadly and in a non-personal manner.
|
|
And if a platform provider learns that a certain URL points to illegal content, they can act on it.
|
|
</p>
|
|
|
|
<p>
|
|
Chatcontrol however, is a new type of surveillance, that is highly pervasive and
|
|
that invades personal online spaces in a way that has not been seen to this extent before.
|
|
</p>
|
|
|
|
<h2 id="magnitude">A lot of sexual abuse material is shared on the internet</h2>
|
|
|
|
<p>
|
|
This is a real problem and it needs to be addressed. But the methods to address it need to be reasonable.
|
|
</p>
|
|
|
|
<h2 id="only_clue">Images that are shared online can be the only clue for sexual abuse</h2>
|
|
|
|
<p>
|
|
This line of thinking is exactly what leads to mass surveillance.
|
|
While it is true that real clues can be detected with this method,
|
|
it is to be expected that the sheer volume of false positives will make it less likely that the relevant reports are processed.
|
|
The authorities who process these reports today <a href="https://www.bitsoffreedom.nl/2022/10/17/sex-crimes-unit-already-overwhelmed-and-eu-lawmakers-will-only-make-it-worse/">are already overwhelmed</a>.
|
|
Furthermore, it is likely that the intimate life of millions of innocent people will be violated due to this surveillance.
|
|
|
|
<p>
|
|
An approach that focusses on quality instead of quantity is needed.
|
|
</p>
|
|
|
|
<h2 id="expired_law">Without the updated legislation it will become illegal again to scan user's data</h2>
|
|
|
|
<p>
|
|
Correct. This is because of the
|
|
<a href="https://en.wikipedia.org/wiki/EPrivacy_Regulation">ePrivacy Regulation</a>,
|
|
which protects digital communications in the EU</a>.
|
|
This protection is meaningful and valuable.
|
|
Chatcontrol violates the ePrivacy Regulation and that is why the EU commission has issued a
|
|
<a href="https://www.europarl.europa.eu/RegData/etudes/STUD/2021/662598/EPRS_STU(2021)662598_EN.pdf">temporary derogation</a>
|
|
to legalize Chatcontrol version 1 (i.e. it makes voluntary scanning for CSAM legal in the EU).
|
|
Chatcontrol version 2 wants to make this temporary derogation permanent and it wants to make the scanning mandatory.</p>
|
|
|
|
<p>
|
|
Our private communication deserves protection
|
|
and it should be respected as an actual private matter that the government may not spy on.
|
|
The expiry of the derogation will be a good and reasonable thing,
|
|
because our private communication is only the buisiness of the intended recipients.
|
|
</p>
|
|
|
|
<h2 id="absolutely_necessary">Scanning will only happen when absolutely necessary</h2>
|
|
|
|
<p>
|
|
Not quite. Most communication software has the potential to be used by children.
|
|
And children today are using it to communicate with friends, family, teachers, trainers and more.
|
|
And the same software is used by adults to fulfill their needs to communicate.
|
|
Chatcontrol subjects many innocent citizens to surveillance, including the children!
|
|
</p>
|
|
|
|
<p>
|
|
Is that really the EU we want our children to grow up in?
|
|
An EU where all communication of children is scrutinized?
|
|
Children also have a right and need to privacy!
|
|
</p>
|
|
|
|
<h2 id="limit_by_law">The new chatcontrol law is a lot more targeted than its predecessor</h2>
|
|
|
|
<p>
|
|
The chatcontrol law that is currently and temporarily in effect does not define as precisely where the scanning needs to take place,
|
|
because scanning is voluntary and service and platform providers can themselves decide if they want to scan.
|
|
The new chatcontrol law makes scanning mandatory for a lot of services and platforms.
|
|
The new proposal will therefore drastically increase surveillance in the EU.
|
|
</p>
|
|
|
|
<h2 id="prevention_not_enough">Scanning will only happen if mitigations failed or were not enough</h2>
|
|
|
|
<p>
|
|
This scanning will still affect all users of a legally provided service or software, even if it is only abused by a minority of users.
|
|
</p>
|
|
|
|
<h2 id="approved_technology">Scanning happens only with approved technology</h2>
|
|
|
|
<p>
|
|
The fact that this technology is approved by the
|
|
"EU centre to prevent and combat child sexual abuse",
|
|
does not provide any meaningful assurance.
|
|
Similarily, the database of indicates that the EU centre manages, is intransparent by design.
|
|
</p>
|
|
|
|
<h2 id="only_verified_abuse">Detection will only happen based on verified indicators of child sexual abuse</h2>
|
|
|
|
<p>
|
|
This is inaccurate. According to Article 44.1 there are 3 different types of indicators:
|
|
<ol>
|
|
<li>Indicators based on previously detected and identified abuse material</li>
|
|
<li>Indicators NOT based on previously detected and identified abuse material.</li>
|
|
<li>Indicators for detecting of illegal child solicitation</li>
|
|
</ol>
|
|
|
|
And these indicators must be used by hosting and communication providers as described in Article 10.1.
|
|
</p>
|
|
|
|
<h2 id="allowed_to_detecd">If companies are allowed to detect, they must detect</h2>
|
|
|
|
<p>
|
|
This forces companies to surveil their customers/users.
|
|
Most companies view their customers/users with respect
|
|
and are probably not happy about this requirement.
|
|
</p>
|
|
|
|
|
|
<h2 id="dog">Chatcontrol is no worse than a police dog at the airport</h2>
|
|
|
|
<ul>
|
|
<li>The airport is not a private living space.</li>
|
|
<li>The airport is not where the police routinely looks into your private communications.</li>
|
|
<li>The airport is not a place that most people tie their identity and innermost feelings to.</li>
|
|
</ul>
|
|
|
|
<p>
|
|
The kind of information that is revealed through chatcontrol is vastly more invasive
|
|
than any baggage search at the airport.
|
|
</p>
|
|
|
|
<h2 id="no_false_positive_to_police">No false positive will be passed to the police</h2>
|
|
|
|
<p>
|
|
That is besides the point.
|
|
Private conversations should enjoy the respect that they deserve and only be available to the intendended recipients.
|
|
That means no mass surveillance and no circumvention of encryption.
|
|
</p>
|
|
|
|
<h2 id="encrypted_services">Encryption will be broken, because it can hide sexual abuse</h2>
|
|
|
|
<p>
|
|
Encryption empowers both good and bad people.
|
|
Chatcontrol will effectively disempower good, law-abiding citizens who need safe digital spaces in an ever more connected world.
|
|
Chatcontrol will effectively disempower children,
|
|
because they can not reasonably grow up in a highly digitalized world,
|
|
where every move they make on the internet is being scrutinized.
|
|
</p>
|
|
|
|
<p>
|
|
Confidentiality is important to humans.
|
|
Both, in the analog and the digital world.
|
|
And forcing encryption to be broken or circumvented takes away the option to connect privately to other people we care about.
|
|
The European Union prides itself with that people can live, work and travel freely across member states.
|
|
But one essential ingredient to supporting this is private communication over long distances.
|
|
The internet and encryption make it possible for people from all states of the European Union to stay connected and to strengthen the european identity.
|
|
</p>
|
|
|
|
<h2 id="encrypted_environments">Scanning for malware works also in encrypted environments</h2>
|
|
|
|
<p>
|
|
No, it does not. Malware needs to be unencrypted to be executable.
|
|
Encrypted malware looks like random data and can not be reasonably detected.
|
|
</p>
|
|
|
|
<h2 id="malware">Scanning of private content happens already today to fight malware</h2>
|
|
|
|
<p>
|
|
Malware needs to be executable to be harmful.
|
|
</p>
|
|
|
|
<ul>
|
|
<li>Text messages are not executable.</li>
|
|
<li>Pixel-based images like photos do not contain executable code.</li>
|
|
<li>Vector-based images can contain executable code, but are unsuitable for photo-like material</a>
|
|
<li>Videos do not contain executable code.</li>
|
|
</ul>
|
|
|
|
<p>
|
|
Malware detection works on a different axis than child abuse detection.
|
|
Personal data is therefore rarely processed by a malware scanner.
|
|
</p>
|
|
|
|
<h2 id="expired_legislation">If we do not accept the new proposal, the scanning against child abuse can not continue</h2>
|
|
|
|
<p>
|
|
Yes. And that would be a reasonable outcome.
|
|
Investigators have other tools to detect and fight child sexual abuse.
|
|
It is technically possible to circumvent the client-side scanning that chatcontrol imposes.
|
|
And these methods of circumvention will be adopted by the offenders sooner or later.
|
|
Thus, it is mostly innocent citizens who will be subjected to the surveillance of chatcontrol.
|
|
Client-side scanning is a terrible idea.
|
|
</p>
|
|
|
|
<h2 id="drama">CSAM will stay on the internet perpetually</h2>
|
|
|
|
<p>
|
|
Unfortunately, yes.
|
|
But it is unreasonable to expect chatcontrol to solve this.
|
|
</p>
|
|
|
|
<h2 id="global_leader">We want to become a global leader in protecting children</h2>
|
|
|
|
<p>
|
|
A noble goal.
|
|
But mass surveillance is the wrong approach.
|
|
</p>
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|