The Dutch government released a memo about their stance on #ChatControl
The cabinet is worried about the impact of these measures on fundamental rights, and is not convinced the new "compromise" fix that.
> ... the Cabinet believes that there is currently insufficient clarity about the impact of the proposed measures. The Cabinet's concerns about the protection of fundamental rights at stake, particularly in the area of privacy and the confidentiality of correspondence and telecommunications, and the security of the digital domain have not been sufficiently addressed at this time.
So that's good.
> The cabinet has therefore decided to refrain from taking a position and to actively make this known. The Netherlands will therefore be counted among the countries that do not support the general orientation.
This seems different to me than a no vote, which could be problematic? cc Patrick Breyer (npub1j97…50h9)
There seem to be multiple shades of "no" in EU politics which is thoroughly confusing.
The memo goes into more detail about why they're not happy with the proposal:
> Only with regard to the detection of already known material can such an order be executed in a proportionate manner (via hashing technology). Because the government does not support measures that make end-to-end encryption impossible, the only way in which this order can be executed for end-to-end encrypted services is via client-side scanning. The previous government explicitly communicated with the House that it saw this as an option.
I've said before that I consider the previous Minster of Justice Yeşilgöz a threat to democracy and this confirms that.
The letter continues to explain the new administration initially wanted to continue this positive attitude towards client-side scanning. However it seems the intelligence service AIVD intervened:
> Last week, following a new advice from the AIVD, the position regarding the compromise proposal was reviewed. The AIVD warns that ‘introducing a scan application on every mobile phone with an associated infrastructure of management systems results in an extremely extensive and complex system. This complex system also has access to a large number of mobile devices and the personal data on them. This ultimately results in a situation in which the AIVD considers the risks to digital resilience to be too great.’
"digital resilience" is roughly defined as (different government website):
> the digital resilience of government, companies and social organisations. This concerns the ability to reduce risks to an acceptable level by means of a collection of measures to prevent cyber incidents and, when cyber incidents have occurred, to detect them, limit damage and make recovery easier
The memo continues:
> If a detection order is imposed on a service provider that uses end-to-end encryption, the AIVD estimates that detecting child pornography material through client-side scanning poses too great a security risk to the digital resilience of the Netherlands.
> What is clear is that the security risks mentioned by the AIVD with regard to client-side scanning mean that it is very questionable whether the infringement of fundamental rights can be justified, because with regard to this method there is no proportionate measure.
Quotes are Google translated. ht Bert Hubert NL 🇺🇦🇪🇺 (npub1xtm…lxd5)
https://berthub.eu/tkconv/get/2024D35955
provoost / Sjors Provoost
npub1s6…dwk4c
2024-10-01 09:33:43
Author Public Key
npub1s6z7hmmx2vud66f3utxd70qem8cwtggx0jgc7gh8pqwz2k8cltuqrdwk4cPublished at
2024-10-01 09:33:43Event JSON
{
"id": "37083a0931cde2cc45fc7d2c7bcc215b1dcbc44d498964a1eaccf505e86f66fc",
"pubkey": "8685ebef665338dd6931e2ccdf3c19d9f0e5a1067c918f22e7081c2558f8faf8",
"created_at": 1727775223,
"kind": 1,
"tags": [
[
"t",
"chatcontrol"
],
[
"p",
"917cf31a6b06cc7694faf866db91417e3194e0463af3db8182af1c2594c709c5",
"",
"mention"
],
[
"p",
"32f72df50e001d8e4fb0394563f5edee9766862d839fe41648630737186b8fc0",
"",
"mention"
],
[
"client",
"noStrudel",
"31990:266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5:1686066542546"
]
],
"content": "The Dutch government released a memo about their stance on #ChatControl\n\nThe cabinet is worried about the impact of these measures on fundamental rights, and is not convinced the new \"compromise\" fix that.\n\n\u003e ... the Cabinet believes that there is currently insufficient clarity about the impact of the proposed measures. The Cabinet's concerns about the protection of fundamental rights at stake, particularly in the area of privacy and the confidentiality of correspondence and telecommunications, and the security of the digital domain have not been sufficiently addressed at this time.\n\nSo that's good.\n\n\u003e The cabinet has therefore decided to refrain from taking a position and to actively make this known. The Netherlands will therefore be counted among the countries that do not support the general orientation.\n\nThis seems different to me than a no vote, which could be problematic? cc nostr:npub1j970xxntqmx8d986lpndhy2p0ccefczx8teahqvz4uwzt9x8p8zs7j50h9 \n\nThere seem to be multiple shades of \"no\" in EU politics which is thoroughly confusing. \n\nThe memo goes into more detail about why they're not happy with the proposal:\n\n\u003e Only with regard to the detection of already known material can such an order be executed in a proportionate manner (via hashing technology). Because the government does not support measures that make end-to-end encryption impossible, the only way in which this order can be executed for end-to-end encrypted services is via client-side scanning. The previous government explicitly communicated with the House that it saw this as an option.\n\nI've said before that I consider the previous Minster of Justice Yeşilgöz a threat to democracy and this confirms that.\n\nThe letter continues to explain the new administration initially wanted to continue this positive attitude towards client-side scanning. However it seems the intelligence service AIVD intervened:\n\n\u003e Last week, following a new advice from the AIVD, the position regarding the compromise proposal was reviewed. The AIVD warns that ‘introducing a scan application on every mobile phone with an associated infrastructure of management systems results in an extremely extensive and complex system. This complex system also has access to a large number of mobile devices and the personal data on them. This ultimately results in a situation in which the AIVD considers the risks to digital resilience to be too great.’\n\n\"digital resilience\" is roughly defined as (different government website):\n \n\u003e the digital resilience of government, companies and social organisations. This concerns the ability to reduce risks to an acceptable level by means of a collection of measures to prevent cyber incidents and, when cyber incidents have occurred, to detect them, limit damage and make recovery easier\n\nThe memo continues:\n\n\u003e If a detection order is imposed on a service provider that uses end-to-end encryption, the AIVD estimates that detecting child pornography material through client-side scanning poses too great a security risk to the digital resilience of the Netherlands.\n\n\u003e What is clear is that the security risks mentioned by the AIVD with regard to client-side scanning mean that it is very questionable whether the infringement of fundamental rights can be justified, because with regard to this method there is no proportionate measure.\n\nQuotes are Google translated. ht nostr:npub1xtmjmagwqqwcunas89zk8a0da6tkdp3dsw07g9jgvvrnwxrt3lqqrplxd5 \n\nhttps://berthub.eu/tkconv/get/2024D35955",
"sig": "91fae5917de62ba84e30ee72e06396724a72f4be6eee81bfdfc7cf2ada2738eea07996439ad6fd5763aac70fa8149e74e6876556c861a334263ec0695368b61b"
}