Re: Big brains
What do you mean, "logically impossible"?
The legislation seems to be drafted to oblige service providers to be able to carry out various duties of care. Essentially this boils down to service providers being obliged to be able to read and process user content in order to exercise those duties of care. The point being made by detractors is that a service where the service provider has that capability is inherently less secure.
It's worth exploring that.
E2EE encryption relies on both the correct design and the correct implementation of a service specification (featuring a bunch of cryptographic techniques). As an end user of the service - WhatsApp, Signals, Apple, whatever - one is assuming that the service provider has control of the specification, that the specification is good, and that the client software you download from the app store correctly implements it.
That last part - that the client software is correct - is interesting, because it's correctness is completely and totally dependent on the service provider having a secret signing key for the application that only they know. There is a single private encryption key they hold that is used by the app store software to say, "this genuinely comes from Meta", or similar. Plus, the software developers ultimately have secure login credentials that allow them to access the company's software / build system. Obviously, if any of that is compromised in anyway whatsoever, then it becomes possible either for somone else to ship an altered client that you (as the end consumer of the service) cannot tell is not genuine, or it becomes possible for someone to corrupt the genuine client software directly by logging in and editing the service provider's source code (though it depends on what review processes the service provider's dev team uses, but ultimately it depends on login credentials being secure).
So, really, from an end consumer's point of view, E2EE is something of a fig leaf; you are trusting the service provider to have successfully defended all its private signing keys, and all its developers' login credentials. Which, logically, is exactly the same thing as trusting the service provider with an encryption key for your messages.
So far as I'm concerned, practicably there is no such thing as E2EE. Unless you review the specification, the source code, and build / install your own client software, you are trusting someone else defending the secrets that are used to guard your message content. Whilst service providers like Apple, Meta and Signal claim to be providing a superior level of security for end users, they're not providing anyone with perfect "Neither we or anyone else can ever read your stuff" E2EE services. If they fuck up, your content is exposed. If they have already fucked up and don't know it, your content is already exposed. And it's not like there's no precedents for fuck ups on that scale - secure keys seem to get stolen all the time (Microsoft just recently, RSA in the past, etc).
And besides that, if Mark Zuckerberg, or Tim Cook, decided they wanted to read new content (= monetise it), all they have to do is direct their developers to make it so.
How does this change the debate?
Looked at that way, the E2EE service providers look a bit dodgy. They encourage users to think that they're getting something "superior", when that's obviously not provably the case; it's marketing hype. It's pretty good hype, but it's busted should they ever turn out to have been compromised at source. They could provide an equally secure service where they do guard an encryption key for users' content (which is no different to protecting other secrets like dev's login credentials and signing keys), That's exactly what BlackBerry did to for consumer BlackBerry Messenger.
The reasons why such service providers wouldn't want to seem mostly to do with money, costs. It can't be about revenue. For Signal, which is free to use, the company is obviously in need for some route to monetisation / long term funding and makes no money from people using it. If people stopped using Signal because they had acquiesced to the Online Safety Bill, it makes zero difference to their bottom line and probably zero difference to their (already not very good) prospects of funding it long term. Similarly for WhatsApp, which FaceBook bought largely to prevent someone else buying it; they wouldn't lose $1 of revenue if they stopped running WhatsApp completely tomorrow. WhatsApp used to charge a fee in the old days, but not under Zuck's ownership. Apple make a ton of cash selling phones, though I doubt that the E2EE figures highly in people's purchasing decisions. Certainly, iMessage is not E2EE'd; it interacts with SMS.
Obviously, if they did acquiesce to the Bill's provision, there would be the costs of actually coming good on the duties of care of content. Policing content (as understood by Facebook as is, Twitter as was) is not cheap and hard to do. Having to do it for a service that brings in zero revenue is going to hurt. Claiming that "it's impossible without hurting security" is one way trying to not become responsilble for those costs, but as discussed above it's basically a specious excuse (in that that they're not actually providing true, guaranteed, cast-iron E2EE in the first place - not in the way they'd like you to believe they are).
This is probably what's at the core of the companies' dislike of the bill - the costs of compliance, rather than the loss of revenue if they are seen to have "caved in".
It's interesting to compare their position to that of telephony service providers. Telcos are not responsible for the policing of what's said on the telephone; the police are. Almost all countries have a legal intercept obligation on telcos, but I'm pretty sure there isn't a country on the planet that has obliged the telcos to listen in and police the content of conversations (the opposite, in fact). Of course, in most normal countries there's a lot of law / warrants / just cause / judges signatures that has to be in place before a tap can be activated. None of this seems to be financially burdensome for the telcos. It's also seemingly uncontroversial in most western democracies; just an established part of life.
One wonders if service providers like WhatsApp / Signal / Apple will ever settle down to the same kind of arrangement (which is basically where BlackBerry Messenger was). Doing so would at least define the costs of content policing as $0 / £0, the same as their policing costs today.
I note that Wikipedia has objected to the age-check requirements. In this, I think they're justified (at least to a large extent). If a child goes into a public library, it's not like there's a section that they're barred from. Public libraries had / have encyclopedia. Wikipedia is - content-wise - very encyclopedic.
There is an aspect that Wikipedia allows people to edit it, but this is done (effectively) in public. There is the point that it could be a vector for bullying - i.e. someone creates a page about a specific person solely for the purposes of bullying them - but that's still done "in public" and is not in the sole control of the bully. It's so far and away removed from exchange of criminal content via communications services like WhatsApp, Signal that it seems hardly worthwhile embroiling Wikipedia (and things like it) in the OSB.