[1] https://www.bundesrat.de/SharedDocs/drucksachen/2019/0001-01...
A few highlights:
- Instead of "providing an internet-based service", the crime is now "facilitating access to an internet-based service".
- It is no longer a requirement that access to the service be restricted.
- The law now applies to all crimes, rather than just the specific crimes that were listed before.
I'm confused by the fact that the document you linked to is labeled "recommendation". The recommended changes are indeed much, much broader than the original draft and have me worried. However, I must admit that I do not know if these recommendations are changes that will be applied unconditionally or not. I am not familiar enough with the procedures within the Bundesrat.
Does that include cafes that provide internet access to customers?
Otherwise they would outlaw bitcoin scramblers also, which is mostly used for illegal, not privacy purposes.
What is bonkers is now the recommendation of the lead legal council and some committee on internal affairs to broaden the wording to "facilitating access" which could be interpretated as anything, and thus will not pass any critical review by law. Those guys just need to be fired.
Der Entwurf zielt darauf, das Betreiben von auf die Förderung illegaler Zwecke ausgerichteten Plattformen unabhängig von dem Nachweis der Beteiligung an einzelnen konkreten Handelsgeschäften unter Strafe zu stellen.
My translation:
The draft aims to penalize the operation of platforms directed at supporting illegal activities, independent of proof of participation in individual specific trades.
I.e. the law is drafted to close a loophole where you can open a black market site, lovingly curate illegal goods into categories and offer your escrow services to potential customers, but you can only be prosecuted once the police can find someone who actually used your service. Instead, they'd prefer to be able to shut it down beforehand.
All in all, I'm not too worried that the law will be passed in a form that outlaws operating Tor nodes.
The point is that the law says any Tor onion service market is illegal, by definition.
And it's obviously only a first step before outlawing anonymization for the general public, including a ban on encryption.
The whole point of legal jargon is to say things in an airtight way. You cannot summarize legal jargon without removing the airtight-ness—lawyers really do use as few words as they can manage to get a concept across (in a loophole-less manner), so removing any single word further usually reintroduces a loophole. This implies that there is no point whatsoever in trying to poke holes in a law you only understand through summary, since it is vanishingly unlikely that the holes that appear in the summary appear in the law. You have to read the actual text.
But at least in the United States, very many of the sentences in our laws end with weasel phrases like "or similar uses" and "or other software" and "or related activity", which is exactly where the problem arises, and where interested parties are inserting their own special loopholes. And sure, we hope that these loopholes get hammered out in the courts in our favor some years later -- that is, if there happens to be a good and willing samaritan that is more "invested" in taking the issue to court to try for an outcome which is favorable for the public versus one favorable to corporations or the police or the wealthy. But I'll just go ahead and continue supporting the option where the stupid law isn't created in the first place. Even if that means the police don't get their bogey man running a dark market.
(Admittedly, some are not. But law written by teams of legislators with centuries of combined legal experience—and passed through dozens of third-party QC checks + redraftings before being submitted for consideration—usually does not have this problem. Or, if it does, then usually it is an "out-of-context problem" nobody could see coming—an interpretation that wouldn't have even made sense to consider at time of drafting—and the first time anyone hits the relevant snag, we get some equally-good lawyers [e.g. the US Supreme Court, for US-Constitution out-of-context problems] in a room to re-interpret the law.)
Again, read the text. Is there "generic language" or "a loophole" you could find with ten minutes' close scrutiny, that can't be explained away as "fully pinned down in meaning by case-law" by an average civil lawyer from that country? I doubt it. But might it somehow allow for the trampling of your civil liberties anyway, for reasons that only become clear when you know all the case-law required to macro-expand the law out to its fullest reading, and the totality of the body of law and statute of the relevant country, and the case-laws of their individual interactions? Maybe.
I think, I am smart when it comes to web and software, but I know little about electricity or cooking or 1000 other things. The people, you call smart, proposed to place stop-signs in the web - which sounds good and familiar to general public, but stupid to people who knows how web works. It is not enough to be smart.
Whether the effect they want is a sensible effect—that has nothing to do with whether they're clever.
A person with a genie in a bottle is normally just "doomed", because genies exploit loopholes. If the person is an experienced, clever lawyer, though, then they're not doomed; they're actually quite powerful. That doesn't mean they'll use their wishes to accomplish anything good for the world, or even good for them personally. They're still a regular, irrational human being with irrational desires—desires for status among their peers, for adoration and worship by the public, for renown and legacy. Etc.
I'm pretty sure that the people who proposed to "place stop-signs in the web" knew what they were doing, and knew what it would accomplish, and wanted to accomplish exactly what the law-as-drafted would accomplish if signed into law. "But it would just make everything worse!" Not for them. Not for their voter-base, at least from the perspective of voting for them again. Not for their lobbyists. Etc. It might make the Internet work objectively worse—but whoever said that politics was about making things better? Regulation mostly serves to make various processes more inefficient and to give those processes higher barriers-to-entry—in a way that makes them safer, or less prone to abuse, or whatever else. Politicians are always thinking in that mode: "something might get worse, but it's a compromise for everyone else—some good, some bad—and a win for me personally!"
Clarification: "money forgery" would refer to counterfeiting, where I might print up a bunch of notes that look like $100 bills and spend them as if the government had printed them. "Money laundering" would refer to disguising the origins of some money, where I might report a pile of cash that came from illicit drug sales as cash receipts from the convenience store I conveniently (see) happen to own.
It's hard for me to imagine how you'd use Tor to forge money, although I guess it might be involved in your scheme to hack into your bank and increase the value of your account(s) there. What kind of money-related acts are enumerated?
I think the list covers trading in counterfeit money as well. This is something that you can totally do over the internet.
But see the reply linking to the newer recommendation document. This one recommends to remove the restriction to a set list of crimes and is generally much looser.
Yeah right. That’s what they always say these laws will be used for, but they always end up being used for much broader purposes.
And who's to determine what the purpose was? The creator of a new technology has no way to force a particular use for their creation. One can invent the cooking knife to help with all sorts of cutting tasks in cooking, and now they'll be held responsible if people decide to use those knives for murder? That's silly.
"The street finds its own uses for things."
https://en.wikipedia.org/wiki/Burning_Chrome
One can invent the cooking knife to help with all sorts of cutting tasks in cooking, and now they'll be held responsible if people decide to use those knives for murder? That's silly.
That's the problem with outlawing tools and tech instead of directly going after evil people. One ends up inconveniencing, penalizing, or even making criminals out of law abiding people, while the criminals just keep on circumventing.
Hey, all Internet kiddie porn is distributed using networks and computers. Time to outlaw those! Think that's silly? I don't think we're that far away from outlawing human driven cars. There are probably tons of people in government and law enforcement who would be all for it. If we're not careful, we might end up in a world only consisting of locked down DRM-laden devices. Oh hey, we're not that far away from that either!
It will be a great day when human drivers are banned. Humans can't handle driving, and they cause 40,000 deaths per year in the US alone. Computers will be able to do this far better.
But your analogy isn't very good. Assuming we have driverless cars in the future that really are extremely reliable and safe, then I don't see what argument you can possibly make to allow human drivers, other than "I like driving". The interest of public safety clearly overrules your interest in being in control of your own car like in the "old days", just like the interest in public safety prevents you from flying your private airplane in controlled airspace without proper radio equipment, transponder, ATC clearance, etc.
However, all kinds of valid arguments can be made against a DRM-laden internet with devices you don't control. There's tons of things people simply wouldn't be able to do (such as write their own software) in such a world. The actual harm caused by the present state of things really isn't very much, if anything (can it be quantified?), the proposed solution doesn't really seem like it'll fix the supposed problems (they had drugs and stuff before the internet after all), and the proposed solution would impose giant costs on society. By contrast, driverless cars (at least the hypothetical ones assumed above) would fix a big problem, and would have very few downsides I can see.
Sure!...if we all actually owned our machines and the government wasn't using the mechanisms through large corporations to spy on us and control us. The thing is, many people in the government and large corporations are going to try and do just that, because it is in their short term interest to do so.
Assuming we have driverless cars in the future that really are extremely reliable and safe, then I don't see what argument you can possibly make to allow human drivers, other than "I like driving".
"I like driving," should be enough. Maybe there should be certain regions where you can still do it, but busy city highways would be restricted. In any case, it's not so much driverless cars that are the problem, so much as cars that are controlled by powerful organizations with interests that aren't the individual and individual autonomy and freedom of movement being taken away in a practical sense.
The actual harm caused by the present state of things really isn't very much, if anything (can it be quantified?)
This is how tyranny generally goes. At first, the Soviets were bright eyed and idealistic about the project of building a new society. Heck, even Germany in the late 1930's was like this, with progressives in the USA singing the praises of the "progressive" policies and energy of the new regime.
By contrast, driverless cars (at least the hypothetical ones assumed above) would fix a big problem, and would have very few downsides I can see.
No disagreement, again. The question is, will this eventually be implemented in a way where everyone is going to report in to Big Brother and ask permission to take a trip?
Why not? Let them drive like they want. At least until the crash/accident is imminent. Then the car takes over and prevents harm...
I don't know about that. Human driven cars provide police an excuse to stop and question almost anyone they want, as well as lots of revenue from traffic tickets.
Your argument does apply to some other objects though.
While that's perhaps an interesting question in the general case, for Tor, we know the purpose was to protect US covert intelligence communications overseas, which is very much about enabling illegal (by local law) activity.
And actually, purpose requirements in law are not uncommon and, in systems with meaningful proof requirements that benefit they accused, since they provide additional facts which must be established by evidence before punishment can be imposed.
Made all the more problematic by the question of whose purpose should be used. It's a piece of open source software with multiple contributors, one of which may or may not be the node operator. So whose purpose do we use? The US Navy? The EFF? The node operator? They may each have a different purpose.
> And actually, purpose requirements in law are not uncommon and, in systems with meaningful proof requirements that benefit they accused, since they provide additional facts which must be established by evidence before punishment can be imposed.
Purpose requirements are typically sentence intensifiers for things that are already illegal. Illegal entry is trespass but illegal entry with intent to commit a separate crime is burglary.
The problem here is that the other requirements are completely normal behavior and it's the purpose requirement which is doing all the work. If you take it away you don't have a sensible prohibition on something wrong which the purpose requirement only makes harder to prove, you have a nonsense law that prohibits ordinary upstanding behavior. In other words, without the purpose requirement there would not sensibly be any law against this to begin with, and that is what would really benefit the accused.
Says who? According to the torproject.org homepage[1], the purpose is:
> [to help] you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.
That includes stuff like preventing your ISP from knowing private personal details like how one was fired, or is secretly gay, or likes to write or draw porn, etc.
Also, if you own a big business and you just bought a supplier to eliminate the costs of a middle-man, you might also want to keep that confidential from your competitors for whatever business strategy you have.
The US Naval Research Lab that developed onion routing, patented it, implemented it in the form of Tor, and released it under a free license, which is how the outside-of-government (though founded by some of the same people who had developed the tech and implementation at the USNRL) Tor project was able to build on it.
Edit: On further reading the distinction is the TECH behind tor was created for that purpose, TOR itself was created for what it says on the tin.
While it's possible that Tor's stated mission was a smokescreen, I think it's much more probable that it as created just as its creators said, as part of information assurance (i.e. allow dissidents and journalists to get information out of repressive regimes).
https://www.onion-router.net/Sponsors.html
...states the early generations were created by Navy R&D. The purpose was protecting U.S. government assets with widespread use providing a smokescreen for them, letting them get lost in the crowd. It also took funding from Navy CHACS, which does high-assurance security. The CIA also wanted to protect foreign dissidents in their efforts to change regimes. So, it was getting funding from State Department or a CIA front last time I checked that works on stuff like that. Majority of its funding. It would probably go into legacy mode with layoffs if U.S. military and intelligence stopped using it. They'd have no need to pay the developers' salaries.
So, anyone telling you it was designed for something other than supporting U.S. military and intelligence operations is either ignorant of its history or lying to you. That said, it did evolve to help all kinds of people who have nothing to do with such operations. I always give out the "Who Uses Tor?" page for people wondering about legitimate uses for online anonymity. It's an awesome page.
https://www.torproject.org/about/torusers.html.en
EDIT to add CHACS Accomplishments since they brag on what they achieved with Tor:
Similar to the Internet.
Even so, that's just as much facilitating illegal (under local law) activities as protecting US overseas intelligence activity is, and actually overlaps substantially with protecting US overseas intelligence activity. (US intelligence assets often being dissidents, if not always overtly so.)
? It's also used by journalists in countries where browsing for certain kind of information can get you in trouble. Intent is what matters here.
To stick to your analogy, unless you market your knives as "murder knives" you are good.
I'm writing this as a German developer who's involved with the cjdns project, which matches "accessibility is restricted due to specific, technical precautionary measures" but obviously not "purpose is to allow or encourage specific illegal actions".
On the flipside, common sense would state that maybe 8chan shouldn't exist.
It's not exactly a knife, but German weapons law does have an intent-based loophole: If you want to carry pepper spray to defend yourself against rapists, you need a lesser weapon's license. If you want to carry pepper spray to defend yourself against animals, you don't need any license. If you get attacked by a rapist, and it just so happens you have anti-animal pepper spray, then of course you can use it for self-defense.
Terrorists for a while used email accounts where they'd write drafts, share username and password and read those drafts.
Obviously email isn't "for" terrorism but they used it .... but exactly where that line is is confusing.
If I provide a privacy focused service, it stands to reason criminals would like that ... I don't like it, but that's just me saying that, but is that "purpose"?
What I have seen people try to make Facebook more accountable for is the under-the-table handling of data of their users, but that's not users making a malicious use of Facebook.
The same way prosecutors argue about motives and intent. Not exactly breaking new legal ground here.
> The creator of a new technology has no way to force a particular use for their creation.
This law addresses internet-based services specifically.
> That's silly.
There is a discussion about this law to be had, but it doesn't include your transparent strawmen.
That's technically what youtube and liveleak do in Germany.
See the changes relative to the original draft here: https://www.internet-strafrecht.com/wp-content/plugins/downl...
Elites need equal prosecution under law!
that's what the Zeit article says, too: the worst interpretation is, yes it will be made illegal. another, more benevolent reading is that there should be harder punishments for providing a concrete platform for illegal activities.
so how can you make a draft that is so vague? make no mistake, this is not incompetency. as per Zeit, and I agree, this is intentional to scare those who run the browser/a node.
also, consider Günter Krings' proposal to make the entire 'dark web' illegal. his reasoning: that an open democracy has no need for such a structure. so, because germany is an 'open democracy', he thinks germany can abolish the open internet altogether?
eidt: word.
Because democracies can never become totalitarian states.
Kring doesn’t seem to have a firm grasp of the lessons of history.
Therefore, the law already allows websites or services to be shut down if their primary purpose is to enable illegal behavior. The Silk Road is a perfect example of this. They were basically and eBay for drugs and other things. While they didn't actually possess or sell the drugs themselves, no one anywhere considered the site to be legal.
I did some quick searching and found this: https://www.dw.com/en/german-authorities-target-illegal-file...
That shows that Germany can already prosecute nefarious sites which may even have legitimate purposes (i.e. "file sharing") but are used predominantly for illegal purposes. Thus, the need for this saw seems suspect.
I honestly fail to see the larger point of that legislation, if a platform is as clearly targeted towards the crimes specified in the proposal it should already be covered by a plethora of German and EU wide law.
Alas a small word on the legislative procedure. This is "only" a draft of a proposal of the Bundesrat (what in most states is called the Senate). The 'Bundesrat' has no legislative authority, so in essence this is a paper that 'calls the Bundestag (House of representatives)' to initiate a legislative procedure -- on itself it is pretty meaningless but has the chance to become a problem.
The chance is pretty good, given their recent track record.
the problem with wide legislation is that it's got a chilling effect.
Would bitcoin or crypto currency be targeted? it's a fully anonmyous payment system which could circumvent anti-money laundering laws, and be used to conduct illegal activities.
I think platforms should never be charged as illegal. Only acts that are illegal should be charged, and the platform where it takes place should be deemed a neutral utility or carrier.
Who knows what's going to be illegal tomorrow? Who knows if a fascist gov't comes into power, and starts targeting specific groups, using such laws?
Is the purpose of this infrastructure to facilitate all this criminality? Certainly not the sole purpose. Perhaps it was purposely build in a way that would allow scale and prevent censorship which enables many forms of criminality which a different architecture would have suppressed.
Typically the law is written quite differently. If there is a uncoincidental legal purpose, then infrastructure must be legal. Because many times the purpose of a specific technical measure can serve both a legal purpose and a criminal one. To ask merely of a technical measure serves a criminal purpose without regard to a greater purpose is to criminalize any censorship resistant network.
There's two vastly different talking points here, a) the Tor network and similar tech that could get caught in legalese crossfire and b) specific websites that utilize the above. I agree on your sentiment that a) should never be outlawed but the German text seems rather specifically worded to address b). Please be assured that I'm not trying arguing that these people have enough technical understanding to not make it unnecessarily broad and throw a) under the bus as well.
I believe my main point still stands, b) is the equivalent of me opening a corner shop advertised as "illegal arms deals" and pretty much legislated enough.
Based on my understanding of Czech law (which is alike German law, but not that much), the point lies in process issues. Having specific laws allows the government (meaning the executive branch) to form law enforcement units, establish government offices dedicated to the issue etc.
So does this mean that they will forbid email encryption as well?
- internet based service / check
- accessibility restricted by technical measures / check
- purpose is to allow just about anything, including illegal actions / check
Sounds like a well drafted law.
It is, if you consider selective enforcement.
That's the exact opposite of a well drafted law.
Good laws are clear, straightforward, and apply to citizens in equal measure. If you can't know if you are following the law or not, you might as well not have law and instead rely completely on arbitrary judgements.
This could cover even encrypted messaging services like WhatsApp or Telegram and would certainly conflict with the pretty privacy laws Germany has.
If this is the case then by the wording clearer we'd know what exactly is being targeted. The current principle behind the proposed text would make even a taxi driver responsible for assisting a criminal by transporting them anonymously.
Diff from the initial proposal: https://www.internet-strafrecht.com/wp-content/plugins/downl...
You know how kids used to pass paper notes in class? Well, yesterday I learned that kids still do this. Except now they do it through the comments and review section on Google Docs. Shared Google Docs that they are supposedly taking notes on for class, or collaborating on an assignment. And if a teacher or parent comes by, they hit "resolve all", and everything disappears.
Purpose is mutable.
I assume the "Greens" and the "Liberals" are opposing the law, but do it out of pure opportunism. Because, as the past teaches us, if they'd be in a coalition with one of the major parties, they would be for such a law.
The Liberals at least opposed data retention (Vorratsdatenspeicherung) when in coalition with the CDU. They are appalling in other ways.
It is tragic, because people who are more libertarian now vote for an alternative that isn't necessarily better.
But as long as (forced subscription) state television propaganda works, I guess everything is perfect.
They hear about darknets only on TV when they are mentioned in context of cybercrimes.
So they are making it illegal trying to hide your illegal activity?
How very useful. Not redundant at all.
Yes there is illicit usage of this in crime world (even though some small portion can be morally justifiable, most is not), but there should be at least a discussion about pros and cons if we want to call ourselves a just and fair society (which I realize is not what everybody craves for, but I hope vast majority does).
The purpose of tor is not that, which makes it a weird clause. Perhaps something like "knowingly facilitates illegal activity" would fit, still not great wording, writing legislation is hard.
>"accessibility is restricted due to specific, technical precautionary measures"
Maybe it's a translation issue but having years of reading legal-technical documentation I can't quite parse this: all access to computer services are technical and specific, so far just leaves 'precautionary' to carry any meaning -- who is taking what precautions in setting up tor exit-nodes [in the view of this phrasing?].
They refer in particular to the Tor network and its abuse by serious crime, but how I read this law, you could apply it for all kind of things. For instance if somebody runs an encrypted IRC channel or email service. This is yet another attack on freedom in Germany thanks to the Christian Democratic Union.
EDIT: The original law draft can be found here:
https://www.bundesrat.de/SharedDocs/TO/975/erl/10.pdf?__blob...