Rather than talking about encryption, Interpol should be espousing the benefits of local investigation and intervention based on mandatory reporting.
Removing child abuse content from the Internet is a digital issue. Protecting children from harm is a meatspace issue, and exponentially more important (but also more difficult and fraught with subjectivity).
That said: banning encryption is not the answer to this.
It's almost always the victim's parent/caretaker or other close relation-- but they always "seem totally normal" so nobody wants to believe it's happening and will excuse or look past all sorts of shitty behavior that, if it were performed by some random, would elicit disgust and antipathy and cause them to be run out of town.
I'm currently dealing with an abuse case. The family is uncooperative because they don't believe the evidence presented, and the victim has been coached into protecting the perpetrator. So the abuse will continue.
Is it? From a quick search, I cannot find any academic papers that support this claim. However, I see some news articles that claim this.
https://www.tandfonline.com/doi/abs/10.1080/0735648X.2011.63...
https://journals.sagepub.com/doi/abs/10.1177/104398621140589...
This paper mentions "turnover intentions", which seems broadly defined in the methodologies.
That, unfortunately, is no longer an option. Pedophile rings including the content producers have realized long ago that going international gives them an extra layer of protection.
The digital is an after-effect of the physical.
The digital can definitely be a pre-cursor and active element in the physical.
This debate is about proportionality. How many children can live a marginally better live by giving up strong encryption and privacy worldwide? Because with the exception of the few cases in countries with a strong and well-functioning legal system, the abuse doesn't stop when the on-line orders stop coming in. How many activists and oppressed minorities will lose out (livelihoods and/or lives) by doing this?
And even then, you're not addressing the real problem with this anti-encryption stance: how are you going to prevent the bad guys from using encryption? Encryption is here, right now, and it exists as a mathematical fact. Introduce a government (incidentally, which?) backdoor in WhatsApp or whichever major platform, and you catch some low-hanging fruit, until they wise up and use the vetted tools without a backdoor that already exist to hide their activities. This significantly impacts the proportionality balance.
If you want to prevent child abuse, investing in education, welfare, economic equality, respect for basic human rights, and boots-on-the-ground police capacity will net you a vastly better return on investment.
I'm all for people having access to encryption, I'm also for stamping out these criminals. The two are not mutually exclusive.
> The two are not mutually exclusive.
There we agree. But politicians worldwide do keep turning this into a 'think-of-the-children' fight. Only this month the Dutch minister of justice and security came up with exactly that argument for forcing Facebook to include a backdoor in WhatsApp — a plea indubitably neatly prompted by his colleagues in the US (cf. attorney general Barr's position on this topic).
This is where you're wrong. Child porn is a substantial market, estimated to be in the billions of $ per year. It's a disproportionate amount compared to 'regular' porn because of the criminal element and the risks involved, just like illegal drugs are far more expensive than legal ones (in most parts of the world, anyway).
Politicians abusing this to push their own agenda's are effectively also abusing these children... it's a fucked up world, that's for sure.
And child abuse has always been around, unfortunately. Much of it probably goes unrecorded. Indeed, we only became aware of how bad the problem really was in the 1980s, due to the very fact that media of it was now being created and exchanged.
Have a read.
https://www.rappler.com/nation/191219-philippines-top-global...
"The Philippines has become a top global source of child pornography with around 80% of Filipino kids at risk of online sexual abuse or bullying, a global Unicef report said Tuesday, December 12."
That's the definition of bullshit. What is the actual claim here? 80% at risk (so maybe nothing happened). Of what? Well, possibly "bullying". How is that related to child pornography?
Ignoring the fact that the so-called "at risk" numbers are a favourite way to inflate the danger, because you have very wide latitude to make that number up, this claim is particularly incoherent.
I can't even, in this article, find a solid claim that child abuse is a particularly wide-spread problem in the Philippines; never mind any evidence for such a claim.
And what does this Unicef report say?
> and the Phillipines being problematic in this respect is something that is not exactly a secret
Terms like "problematic" are excellent for persuasion, as they exclude any quantitative component as they invoke fear.
> I'm sure if you dig around a bit you'll find lots of corroboration for that datum.
Like the fear mongering article you linked?
Look, I'm not advocating for the abuse of children, but when I'm being encouraged to worry about something, I prefer the warnings to have some basis in fact.
For one thing, it puts you in the position of defining what incidence of child abuse is low enough to be somehow acceptable. Is the Internet helping one person to abuse a child? Any normal person would say that even one is unacceptable.
For another thing, it can easily make you look like an unserious fool because the people you're arguing with--law enforcement--are going to know way more than you do about the actual incidence of these particular crimes. They are privy to every ongoing investigation, and are generally not legally permitted to tell you about them.
We don't need to doubt the good faith of law enforcement--at least on this issue of child abuse--to advocate against encryption backdoors.
Encryption backdoors are a bad idea because they can be later abused or hacked, causing untold harm.
And we get to use strong encryption for the same reason we get to deny the government placing cameras in our houses. We get strong encryption for the same reason we get to be considered innocent until proven guilty. Efficacy or efficiency for law enforcement is not enough, and should not be enough, to supersede our rights to privacy, expression, assembly, etc.
What does "unacceptable" even mean? How much do these normal people think society be willing to invest to prevent that one instance of abuse?
For an extreme example: it's probably below the $10 trillion cost of completely shutting down the global internet.
What would you consider a fact? A half dozen links to such content?
Really, I'm not sure what you are getting at here, there is plenty of evidence for this stuff being real and being sourced from a limited number of countries if you want to argue the opposite then I'm perfectly ok with that. But that Unicef report is there for you to read and if that does not convince you likely nothing will.
Just like NL has a - justified - bad reputation for hosting a lot of this content so the Philippines have - unfortunately - a bad reputation for being on the producing end. For a while it was Thailand, then the Thai really cracked down on the sex tourists and the child porn production and so the producers shifted to another location.
Well, one link would be a start. And to consider something a fact, I'd generally want to see some evidence. When I'm told something is a fact but there is no evidence to support the assertion, or if the evidence turns out to be an estimate with questionable methodology methodology (say, 1 In 5 College Women Are Sexually Assaulted), then I tend to lower my opinion on the honesty of the individual or person involved.
> But that Unicef report is there for you to read and if that does not convince you likely nothing will.
It is?
> For a while it was Thailand, then the Thai really cracked down on the sex tourists and the child porn production and so the producers shifted to another location.
I don't follow Thailand terribly closely, but I'd be interested to know details about this, particularly how they know child porn producers were there but left.
The meaningful question to ask is what's going on in those countries, that makes abuse so much more likely to occur there? It can't just be weak government, the Philippines aren't generally known for having weak or ineffective government.
That seems ridiculously high unless it's millionares being charged $500k a pop. Got a source on that?
Right, so by using Hacker News you're falling afoul of your own rules.
> You can't hide the existence of the message.
You totally can: properly encrypted data is indistinguishable from random noise.
The random noise IS the point. you cannot hide its very existence, and a government agent might not want to believe you if you said that it's just random data.
This is how cures become worse than the disease. Life isn't black and white, nor do things tend to be doable without gratuitous unintended consequences.
Encryption is not, nor has it ever been the be all end all to child predation. Effective investigation techniques have been the issue, and awareness have been the problem, because of the ephemerality of any distribution system once its existence is outed to hostiles in the non-pedophilia community at large.
If you want to take these people down, you have to map the logistics. If you want to map the logistics, you have to consume content; once you have the content, you need to analyze the crap out of it for every possible clue you can about how and where it was made in order to try to make some reasonable guesses about how the production industry works, then you have to double down and go deep to figure out what these production rings look like, whether they know each other, and how do they work. I'm talking picking apart the audio for environmental noise that might clue you in, or developing profiles of certain quirks of equipment. Analyzing the medium of exchange to see if you can exploit the financial traceability aspect, etc... All of which can also be sanitized once the opponent knows you look for it by the way. Proper OPSEC on their part will leave as few breadcrumbs as possible for you to find, and the closer you get to the heart of the op, the more heinous the infiltration will likely get.
All of that has zilch to do with e2e encryption. That's all meatspace work. Ugly work, but work that'll need to happen nevertheless.
And HTTPS?
> Generally though, there are many techniques known to be able to hide messages in data using steganographic techniques. None are, by definition, obvious when users employ standard applications, but some can be detected by specialist tools. Others, however, are resistant to detection - or rather it is not possible to reliably distinguish data containing a hidden message from data containing just noise -
You cant hide the existence of the data. You can pretend that it's just random bits. But they are still here, and an opponent can see them.
Is this actually taking place at a non-negligible scale?
So yes, that is happening at a non-negligible scale. In fact it is happening at a scale that is incredible (to me, at least).
The figures I'd want are not consumers or producers but numbers of children. A child being abused 1000 times is obviously awful but its not as bad as 1000 being abused once.
Obvious to you. The problem with this sort of reasoning is that children are not mathematical objects. It is also the sort of reasoning that ultimately leads to the rest of society deciding that us tech people are incapable of setting things up in such a way that abuse potential is minimized. Then you get reactive stuff like this article.
Maybe I've gone the wrong direction, but I'm almost convinced now that it may actually be worse to make public statements linking encryption to child abuse because it potentially paints backdoors as a solution in the minds of the non-technical folks, and potentially makes child abuse closer to appearing to be a "solved problem" and distracts further from progress towards a real solution.
I'm aware now (thanks to you and some others who have horrid coalface experience) that the digital realm is indeed more of a problem than I'd considered. I can't bring myself to accept, however, that mandated encryption backdoors are worth the attention they're being given by law enforcement for the purposes they're trying to align it with.
Some people just lack humanity.
So children weren't harmed before 1995? Of course a police state makes it easier for them but who will watch the watchers? I want one of these people to give me 24/7 access to their unlocked phone. I promise to not share the information with anyone.
It seems like we have better tools to fight some of these things. How about huge whistle blower rewards (millions) with lifetime witness relocation packages for people who come forward? There are lots of people who are adjacent to lots of these crimes but to come forward would mean threats, loss of income, loss of housing and more. If we made it easy and safe for them with the promise of a new life in a better situation, I think we'd see lots of these crimes go away.
Wait, what? We have a saying in the actions and decisions of our governments (context: EU and US)?
No we don't. We don't live in direct democracies. If Interpol or any police force wants to ban encryption and if that benefits who ever is in government, then that ban will come. Thus: that ban will come. (Western) governments have been eyeing bans and bypasses of encryption for decades. This is nothing new. What we as citizens think of that is completely irrelevant. Unless the majority of the population would really care about encryption and it would influence the 4-yearly vote-thing (elections). Which is not the case.
Every Western country has had headlines in their news papers in the past months about their politicians -all of a sudden and all at the same time- wanting to pass laws to allow them to bypass encryption (pressured by the US?). Just in case it would influence the 4-yearly voting thing. The synchronized timing of the publications to me is shocking but not really surprising anymore. Manufacturing consent.
the online kiddy porn and terrorism is really getting out of hand like right about now. Never been worse. Let's all ban encryption quickly and save the world from all child abuse
We're trying to form a voting bloc in my community to turn the local government upside down. If similar movements happened in other communities around the U.S. the legislature would be very different.
At the same time I try to convince people outside of that country of what should be their political number 1 priority (in my humble opinion); political decisions through popular vote.
In general, there is plenty of hard proof that public advocacy works in the U.S. See the entire environmental and union movements, for example.
Feigning helplessness in the face of corruption is not as insightful or clever as you think, and contrary to what you might think, works to suppress citizen engagement rather than spur it. "You have no power" is what your opponents want you to think. What are you helping them convince people it's true?
The reality is that citizens absolutely have the ability to affect their governments, and should make it clear that mandating encryption backdoors is not acceptable policy.
I always thought the NSA gave up on its Clipper Chip initiative not because people complained, but rather because of a handful of people with the right skills or the right kind of influence engaged in civil disobedience.
Specifically, Phil Zimmermann wrote PGP and published its source code (under no-commercial-use terms, which at that time were not frowned upon as strongly as they are these days) and enough people demonstrated a resolve to keep the source code on the internet -- by continuing to host it even after being threatened by the US government -- to convince the NSA that it would never persuade enough manufacturers to adopt the Clipper Chip.
Netscape's decision to design and implement SSL and include it in the most popular browser of the day probably had a lot to do with it, too.
You are contradicting yourself. Effectively you're saying unless a majority of people agree with you then it is non-democratic. As parent poster said we have the responsibility: it is to communicate this argument to people and also to be part of our own government.
No, I'm not. My point is that we (citizens) are not in charge of government. It's misleading to claim that we are.
It doesn't matter whether "the people" are for or against encryption. It's irrelevant for political decision making (unless popular opinion on encryption threatens to influence elections, which right now it doesn't and probably won't ever).
> it is to communicate this argument to people and also to be part of our own government.
"We" (as in the majority of citizens) can't be part of our government. "We" can't even significantly influence government at all other than through elections. Popular political influence through elections only works for very limited very broad subjects that happen to be in fashion by the time an election takes place. Subjects unlike relatively specific things such as encryption.
> we have the responsibility
With the above in mind I don't agree. At all. You could try to explain the point of the parent poster to 1000's of people and convince them to agree. This would be a tremendous task and would politically change: nothing. At all.
You could also try to convince them of the opposite. And this would also have 0 political effect.
Even if everybody on HN did it. Even if everyone on here had the exact same opinion, arguments and same amazing sales skills.
Personally at present I think representative democracy is working, but that people are very dishonest about what they really want.
This seems to me like an uncharitable interpretation of what he said. If one part of it "works", then saying it doesn't work at all is a false statement. The correct question is, to what degree does democracy "work", in 2019 - I believe the year is an important component of the question, because most people's conception of democracy is abstract theory, and disregards the increasing complexity of the world.
> In which case what is there to talk about here?
The degree to which democracy "works".
What do you mean by "works"? A violent dictatorship with a genocide here and there works perfectly fine, depending on your definition of "works".
> In which case what is there to talk about here?
Priorities. Should the priority be to discuss the importance of encryption. Or should the priority be to discuss the importance of means to influence decisions about encryption?
> You should be out attending to the business of revolution, not yakking on forums about incremental change right?
You mean literally losing a hand or an eye as a yellow vest? Or something like that? Nah. Meh, thanks. Not the best option I would say.
> Personally at present I think representative democracy is working,
Yeah. Again. I agree that it's "working". But without a definition of "working" or a benchmark that's an information-less statement.
> but that people are very dishonest about what they really want.
And you have hope that this will change?
People can't know what they want, if they aren't honestly informed about what's going on around them.
Tell that to the Hong Kong protesters.
We're talking people losing their hand(s), eye(s) or dying here.
Same for the Barcelona protests (non yellow vests).
You'll have to search quite a bit to find articles on those if you live in "the West", but yeah they do happen.
On topic: if only Macron and Winnie the Pooh could somehow circumvent the encryption of those pesky protesters...
Individual rights were never won or kept by lying down.
I'm more afraid of direct democracy than anything. I basically think I'll be dead within a few months of that emerging. Authoritarianism is my next greatest fear.
Any substantiation? My fear is the exact opposite (anything decided by "not us" is "not for us").
That’s what the govs always try to imply. The reality is, the minimally sophisticated “bad guys” will still use encrypted means and now we can imagine who’s really affected by this condemnation.
Banning direct wrongs are done because the thing being banned is wrong. The effectiveness of the ban doesn't matter (unless maybe one can show that banning the wrong actually increases the rate at it happens, but that is different from failing to significantly enough decrease the rate).
Indirect wrongs are things that aren't wrong but which we ban in order to stop something that is wrong. If there is no effect banning it, then it isn't justified to have a ban. If I want to ban cheese to reduce murder, is it justified? No, because banning cheese will no effect on the murder rate.
It seems everyone is so eager to paint the other side as objectively wrong / motivated by bad intentions, when in reality I don't believe this is an objectively right answer. As a society we have to decide how much freedom and security we want at this moment in time.
(1) https://www.npr.org/2015/03/02/390245038/ben-franklins-famou...
https://www.theatlantic.com/science/archive/2017/03/h3ll0-mr...
What I mean is if companies are required to build in law enforcement backdoors, we could see X benefit (ie some % reduction in certain types of crime) and Y damage (some reduction in technical security, some reduction in govt accountability, etc).
Personally, I place a lot of value on the Y damage, so I don't think the tradeoff is worth it. But those are just my values, and I think it's possible / reasonable to have different values that change the balance.
The problem isn't that it's algebraic though. There are no back doors, once governments have it then all your freedom to communicate against them is broken. I don't know why anyone would look at the likes of world leaders such as Xi, Putin, KJI and Trump and think this is a good idea in any way.
In Europe we have many examples of human trafficking where officials had problems to investigate because of political reasons and other problems, mainly understaffed law enforcement.
Every police force asks for more powers, every interior ministry wants more surveillance.
Even with decryption tools, I don't see how traffickers would suddenly not be able to obfuscate their communications.
What becomes very easy is to crack down on dissent though. And being able to communicate with others without any listeners is a security requirement. So freedom and security aren't orthogonal at all.
It's also important to remember that not every nation will have the same set of values on this and that as the world becomes more international you're relationship with other world governments becomes more M * N.
Imagine a world without encryption where the Saudi government had our access logs and decided to share what porn we were looking up. Or for something closer to the real world, imagine the CCP leveraging their influence to cut off services to anyone sharing Winnie the Pooh pictures.
That's fine, they can make the trade-off. I mean they can give up their own freedom for whatever security that gets them. What many people want is to make the same trade-off for others.
It has nothing to do with safety; it is not a debate about “how much safety do we purchase with reduced privacy”.
It’s just as firearms rights have nothing to do with hunting, or a militia.
Plenty of non-technical people think that they can have their cake and eat it by giving a backdoor to "the government". Which government though? The one of Burkina Faso? The fact is that backdoored encryption is broken encryption.
For companies, they would have to change their business model that is not relying on trade secret, I would even argue that not having to spend time, money or effort to protect trade secret is a benefit.
An important point to make, is that it is not given that citizens are in charge of government.
I might trust my current government to uphold democracy - but that does not mean I trust every future government to do the same and I need laws in place for restricting their rights, not mine.
A police officer's job is only easy in a police state.
As much as I want this statement to be true, I feel like it is less and less the case in todays society. Correct me if I am wrong.
And let's not forget that both [should] work for the people.
Source? I'd like to know if that's even true, how could they possibly filter and follow up on every lead their software finds?
The NSA and other agencies are facing problems with having too much data:
https://www.zdnet.com/article/nsa-whistleblower-overwhelmed-...
I would argue these days that it is far better to be able to reconstruct a conversation and prove someone said something. In case things go wrong, we have to have a way to establish truth, and prove things, so we can have fairness in outcomes.
Now, if we have governments that punish people for being dissidents or engaging in victimless crimes, the answer is to fix the government and the laws, and not to sneak around. That’s like making slavery better for those few people who happened to have nice masters (or encryption).
So, what’s the upshot? We need more immutability and also work hard to make governments not punish people for victimless crimes.
PS: freedom of speech should refer to actual speech of humans, not the unregulated ability of organizations to provide megaphones (whether Twitter or network TV). I think these are harmful for society, and I would be happier if every statement in science, news, politics, history etc. would be peer reviewed and battle it out in some wiki site before the general public sees it. Unless they want to press the Talk page to see the battle going on behind the scenes, regular people should see the article AFTER multiple sides have battled it out. I see the current megaphones controlled by Sinclair or Twitter or Newspapers or Network TV a lot more harmful and dividing our society.
It would be nice if someone “fixed” some governments (and some crimes as a side quest), but 1) condemning privacy only makes this harder than de-facto almost impossible. 2) “prove someone said something” is not how our earth-wide culture works. We are basically based on the fact that conversations are private to some extent.
Did you find yourself in a situation when your opponent knows your every step and thought and you don’t? Play any game that way and see where it goes.
>We need more immutability and also work hard to make governments not punish people for victimless crimes.
That’s cool, but something hints me you’re not living in one of these countries where hard work is required. Swap with one of its citizens, make a change, then we talk.
Would any government agree to unilaterally do this? I think the biggest danger will come not from the other governments but from losing the ability to be bribed and do unaccountable things.
There are some points in the GP though. Ideally we should try to fix the government and the laws for who can't, but even people in countries blessed enough to be able to try don't try enough.
I'd love to have that capability. What matters is who controls it. If everything about me was constantly recorded but I was the person that decides if and when make some of this information available to other people (and initally to whom) then it would be great and I think that's our future that marries our progressing tech with our freedoms.
If I can be coerced to reveal information about myself or it can be revealed at the whim of government, judge or a corporation, then it's a dystopian nightmare which we see some people are trying to create for example by coercing people to reveal their passwords or unlock their devices.
There's of course some grey area like public places where privacy does not apply. Your thoughts there are private but the rest is not yours. We have pretty much worked out what's private and what's public in physical space. As for digital space I think things I do on my local machine or on another machine that I control then it's private. Once I do something on someone elses machine it stops being private.
However, when you engage with another party and make promises, and then break them, the other party should have a way to prove what you said in a dispute. I think the default mode should not be “off the record”. Because most parties aren’t savvy enough to demand that you go “on the record” right before you talk. Instead, you can ask to go “off the record” so that will be the alert that none of your promises will matter during that period.
If being “on the record” is the default for all conversations, that’s what I’m talking about. The concept of “privacy” still applies to non-participants in the interaction.
The main question is, can we extend this expectation to other interactions not just conversations online? What if one of the participants had been carrying tiny body cameras and microphones, which has become more and more feasible to do?
You know how many rape crimes could be solved? Or police altercations? Imagine if everyone KNEW they were being recorded.
What if the cameras were not on the person’s body, but in the room? Surely we wouldn’t know, so the laws have to allow for it. But suppose we COULD legislate what these cameras did. One is to outlaw all cameras. The other is what if the video footage was always encrypted and it would require two keys:
1) M of N of the participants
2) a judge saying this is an active dispute / trial
It is in the interest of both parties to unlock the video once there is a court case, to help resolve what happened. Refusing to do so may be seen as an admission of guilt. The main reason for 1) is to allow people the option to be presumed guilty / held in contempt of court but not reveal the evidence against them. The problem is that they may be protecting some mob boss etc. so we may have to relax the condition 1) to just one of the parties. But recording entrapment still won’t be legal in two-party states.
I think most of us would still use it. To record our lives so you can review or share the good parts or prove something you said, heard or seen. It's already happening with phones (they just don't record all the time but that's mostly to technical limitations) and I think people today would love to be able to get easy, legal access to footage containing them from other sources.
You might as well be saying that instead of having democracy and elections, the answer is to fix the government and the laws.
You are putting the cart before the horse here: Sufficiently powerful individuals are the precondition for fixing the government and the laws. And that doesn't change once all the governments and laws are fixed: Criminals will continue to try and corrupt the government and the law. If you have too much power concentrated in one spot, be it a dictator or surveillance agencies, that is the spot that criminals will try to manipulate/use to their advantage, and only sufficient independent real power of individuals (that is: power that can not be made to disappear by a simple decision of someone trying to subvert the system) can possibly keep that in check.
The dream of the benevolent dictator, in some form or an other, seems to be irresistible--but if we want human rights to stay, we have to overcome that urge. Benevolent dictators are not a thing, and every attempt to build one so far has led to disaster.
We already have, to a large extent. The post office. Printing and letters patent and many kinds of licenses. Many kinds of clerks. And so on.
The post office is obviously not a central component of the government, it simply was operated by the government in the past because it was useful to have as a basic service to serve the economy.
We can automate safety nets and payouts using technology, and calculate the consumer price index.
We could have direct democracy or each person could select their delegate.
We can start on a local community level.
I began talking about recording interactions, though, being potentially a very good thing.
Of course it would be easier for the police to catch bad guys if they had full-text search access to all conversations and content, worldwide. That doesn’t mean it is a good idea. They’re asking for something to make their job easier... can’t blame them for trying, and of course who doesn’t want to catch people who harm children?
But it’s not their responsibility to account for negative side effects. That’s our responsibility, as citizens who are in charge of our governments. And we have to remember that governments and police can hurt children too. Look at what the border police in the U.S. are doing right now. And when it comes to fighting that sort of thing, encrypted comms are essential for political organizing.
This is on top of the obvious and many benefits of encryption in protecting us all from crime.