Germany Must Stand Firmly Against Client-Side Scanning in Chat Control [pdf]

> Deep down, Client Side Scanning that's what both want.

Let's be absolutely real the CDU wants complete government access to all private communications on demand with essentially endless retention. They just aren't allowed yet.

Take a guess from which political party is Zensursula.

SPD has been firmly pro surveillance since Schily

> Otherwise, PGP might become cool

People need convenient access to PGP. If their App Store removes all PGP apps then they might have to upload their privatekey to a PWA. And then no one's any better off.

If the everyman is forced to choose between being surveilled or using PGP, I reckon I know what he'd choose regardless.

How would PGP help in the long run? If client side scanning is mandated for everything then the natural place for it to wind up is in the OS. Once your OS is scanning all the things, your privacy is finished - pretty good or otherwise.

PGP will never ever see mass adoption. It's too complicated and nothing will fix that. If chat control succeeds, a handful of nerds might be able to protect their comms, but mass encryption as we have it today will be dead. I like how nobody can read my chats with my mom or my landlord and would prefer it stays that way. The average user simply does not care enough to jump through a single additional hoop.

"or I bet that there will be new ways to chat without mass surveillance."

In a way I am fatalistic about it now/see the good in the bad. If this really comes one day, it will be a great push for decentraliced anonymous communication networks again.

Politicians to reach out to in Germany, with a template email:

poststelle@bmi.bund.de, poststelle@bmjv.bund.de, info@bmds.bund.de, baerbel.bas@bundestag.de, lars.klingbeil@bundestag.de, friedrich.merz@bundestag.de, landesleitung@csu-bayern.de, fraktion@cducsu.de, matthias.miersch@bundestag.de, sebastian.fiedler@bundestag.de, alexander.throm@bundestag.de, johannes.schaetzl@bundestag.de, ralph.brinkhaus@bundestag.de

Sehr geehrte Damen und Herren,

ich wende mich heute an Sie, um meine große Sorge über die geplante Einführung der sogenannten „Chatkontrolle“ auszudrücken.

Die flächendeckende Überwachung privater Kommunikation stellt einen massiven Eingriff in unsere Grundrechte dar. Sie gefährdet die Privatsphäre aller Bürgerinnen und Bürger und untergräbt zentrale Prinzipien eines demokratischen Rechtsstaates. Der Schutz der Vertraulichkeit von Kommunikation ist ein unverzichtbarer Bestandteil unserer freiheitlichen Gesellschaft.

Zudem zeigen zahlreiche Expertinnen und Experten auf, dass das flächendeckende Scannen privater Nachrichten zur Bekämpfung von Kindesmissbrauchsdarstellungen nicht wirksam ist. Stattdessen schwächt eine solche Maßnahme die Sicherheit digitaler Kommunikation insgesamt und schafft gefährliche Überwachungsinfrastrukturen, die leicht missbraucht werden können.

Ich bitte Sie daher eindringlich, sich bei der entsprechenden Abstimmung klar gegen die Einführung der Chatkontrolle auszusprechen und sich für den Schutz der Bürgerrechte und der Privatsphäre einzusetzen.

Mit freundlichen Grüßen

German speaking here: People here in Germany do not want to think about just how bad our constitution really is designed. We only get free speech lte, There's no fruit of the poisonous tree doctrine leading to constant prosecutorial overreach and illegal searches[0] that are later ruled illegal but with on effect and our public prosecutors are so much lacking in independence that they aren't allowed to issue european arrest warrants [1]. But I've heard people tell me with complete conviction how great our constitution is. I can't even bother arguing about it anymore.

[0] And they brag about it on 60 minutes https://www.youtube.com/watch?v=-bMzFDpfDwc [1] https://curia.europa.eu/jcms/upload/docs/application/pdf/201...

I don't think those issues are necessarily interconnected. If I have understood it correctly, many Germans view both hateful propaganda and surveillance as tools of dictators.

Surveillance of private communications obviously has a chilling effect on free speech as well, but freedom from surveillance does not imply a freedom to openly spread hate speech in public.

You make those networks illegal to use. Just using them would be illegal, regardless of the contents of your communications.

I wouldn't trust Matrix for my personal security:

https://soatok.blog/2024/08/14/security-issues-in-matrixs-ol...

https://web.archive.org/web/20240606031827/https://gist.gith...

Moxie hasn't worked at Signal for a while now

Pursue criminal action against the people making apps or providing servers for decentralized/federated networks.

don't forget that you're dealing with the state so "we'll kidnap and/or murder you" is a legitimate option as a response to undesired behavior. at least, they think it's legitimate, and they think that thinking otherwise is undesirable behavior, which leads to a bit of a catch 182...

Encryption is defined as "the process of converting information or data into a code, especially to prevent unauthorized access."

What you describe is the same thing just not cryptographic.

That's just an insecure form of encryption

> I wonder if we can make a chat app that doesn't use encryption but hides your messages inside random words.

This technique is called "chaffing and winnowing": https://en.wikipedia.org/wiki/Chaffing_and_winnowing

> The solution should be saved locally on your device.

Installed as a signed app...?

Format-Transforming Encryption (FTE) is what you're looking for--it ensures the resulting message isn't vulnerable to cryptanalysis techniques while enabling encoding of a message in arbitrary formats [0], including a blog post or text message. The authors of the source use it specifically to hide messages in semantically-correct network protocol packets, but it applies just as well to text.

[0] - https://dl.acm.org/doi/pdf/10.1145/2508859.2516657

There isn't a technology solution for this. The solution is to realize the value Switzerland lost with Proton moving out of Switzerland, and what Germany could lose if Wire had to make a similar decision regarding their home in Germany. There's considerable value to having real effective security. These nations stand to lose that value.

The letter also says “October 3, 2025” instead of “3 October 2025”. ;)

(https://commission.europa.eu/system/files/2023-11/styleguide...)

But anyway, if they truly wanted to address the letter to Germans, they should be providing a German-language version in the first place.

It’s a malicious attack, right now thousands of printers around Brussels are stuck with the message “PC Load Letter”.

For some more recent crimes against society and humanity, I'd also compare it to Stasi. Plenty of people alive today who lived with that.

Around 1 in 30 people was secretly telling on their neighbors. After unification, it was presented as a dark chapter in German history that had finally come to an end. People would get to look into their own "file" to see what and how much had been written about their daily activities. I was a bit young at the time, but I do remember frequent discussions on TV about how to move on from this, and how to make sure it doesn't happen again.

And now we're talking about reading everyone's private messages on a scale that would be the Stasi's wet dream.

I wonder - if the Stasi had been presented as a legitimate way to fight CSAM - would that have been okay?

Stasiware is more appropriate. Stasi (Staatssicherheit) was the administration in charge of spying each citizen of east Germany. It runs until 1989. So more people remember the opening of the archives in the 1990ies.

Besides that this is likely a criminal offense in Germany[1] we tried it 16 years ago with "Zensursula" and you can see how that turned out.

[1] §86a StGB "Use of symbols of unconstitutional organizations" applies also to words, not just symbols in the strict sense. It is also enforced in broad coarse strokes for example on the usage of the swastika inside a red prohibition circle (the one with a diagonal bar).

EDIT: Looking back at my comment, I realize it might come across as too negative. If you think shaming politicians is the right way to protest this, go for it.

I just believe convincing politicians that the spirit they summon may easily slip from their control and turn against them is a more likely successful angle.

The name was coined by a former MEP Patrick Breyer, one of the most important opponent of the law. EU's other proposal for mandating backdoors into devices is however from a group officially called "EU Going Dark" tho (you thought Chat Control was the only thing coming?).

https://netzpolitik.org/2024/going-dark-eu-states-push-for-a...

It’s the critics who named it Chat Control. The official name is Regulation to Prevent and Combat Child Sexual Abuse (Child Sexual Abuse Regulation, or CSAR). Let’s hope there will be enough Brutuses.

If terrorism is defined as using violence or threats to intimidate a population for political or ideological ends, then “Chat Control” qualifies in substance.

Violence doesn’t have to leave blood. Psychological and coercive violence is recognised in domestic law (see coercive control offences) and by the WHO. It causes measurable harm to bodies and minds.

The aim is intimidation. The whole purpose is to make people too scared to speak freely. That is intimidation of a population, by design.

It is ideological. The ideology is mass control - keeping people compliant by stripping them of private spaces to think, talk, and dissent.

The only reason it’s not “terrorism” on paper is because states write definitions that exempt themselves. But in plain terms, the act is indistinguishable in effect from terrorism: deliberate fear, coercion, and the destruction of free will.

You can argue legality if you like, but the substance matches the textbook definition.

These people should be arrested.

It's definitely not an EU only thing. China, Russia and such have been doing this for years. There have been attempts to introduce it in US (EARN IT Act) as well, and the current regime there might very well end up doing that. Australia has also been pretty authoritarian what it comes to this kind of things.

I thought Apple already voluntary implemented it on their devices?

“Apple cannot access your data.”

Chat Control doesn't prohibit you from using whatever encryption you want, it mandates that your phone snitch on any plaintext that it has access to.

> No, not only Germany should stand firmly against this bullshit Brussels tries to push but ALL member states should be

For the umpteenth time, this isn't an EU initiated agenda. This is certain groups from certain member states pushing this *hard*.

Focus your anger at the correct targets.

Could they, though? Signal is marketing themselves as the privacy alternative. If chat control passes, you can’t make the same guarantees as they are.

Don’t get me wrong, I am happy they are doing what they are doing. But for signal, selling out is not really an alternative.