Impact of Global Proposals Regarding Surveillance Duties on Secure Communication End-to-End
In recent discussions, the UK Online Safety Bill, the US EARN IT Act, and the EU CSAM (Child Sexual Abuse Material) proposal have sparked controversy due to their potential impacts on user privacy. Policymakers have proposed imposing monitoring obligations on Internet intermediaries, despite concerns that these measures could undermine users' privacy and security.
The core issue lies in the monitoring obligations and the proposed elimination or weakening of end-to-end encryption (E2EE). These laws require platforms to actively detect and remove illegal content, such as child sexual abuse material, terrorism content, and misinformation. To fulfill these obligations, platforms may be forced to implement intrusive tools, like automated content scanning or age verification systems, which could potentially expose private user data to platforms or government authorities.
One of the most contentious aspects of these proposals is the threat to E2EE, a security technology that ensures only communicating users can read messages. Proposals like the US EARN IT Act encourage mandatory backdoors or escrow keys to scan for illegal content, potentially compromising the confidentiality and security of all users’ communications.
The erosion of user privacy and the threats to anonymity are further exacerbated by regulations requiring identity verification, such as age assurance. For example, the UK Online Safety Act demands platforms to identify illegal content proactively, leading to increased surveillance and data collection on user activities. This could potentially undermine the privacy and safety of users who rely on anonymity, as seen in concerns raised by the Wikimedia Foundation.
Moreover, these mandatory surveillance and data-sharing regimes may extend beyond child safety and illegal content removal to broader data collection, regulatory oversight, or law enforcement use. This raises significant concerns about misuse or abuse of personal data and the potential for overreach and function creep.
In light of these potential risks, a recent report suggests that the potential privacy concerns are significant enough for policymakers to reconsider these proposals. The report concludes that the potential risks to privacy outweigh the benefits of the proposed online safety measures. As a result, the statement suggests that the proposals, as they stand, should not be pursued.
References: [1] https://edri.org/uk-online-safety-bill-transparency-and-data-access-provisions-pose-privacy-risks/ [2] https://www.eff.org/deeplinks/2021/03/uk-online-safety-bill-threatens-privacy-and-security-users [3] https://www.eff.org/deeplinks/2021/03/uk-online-safety-bill-threatens-privacy-and-security-users [4] https://www.eff.org/deeplinks/2021/03/us-earn-it-act-threatens-encryption-and-privacy-internet-users
- Policymakers should reassess the UK Online Safety Bill, the US EARN IT Act, and the EU CSAM proposal, as the potential risks to privacy, due to monitoring obligations, elimination of end-to-end encryption, and data-sharing regimes, may outweigh their benefits.
- AI-driven tools, like automated content scanning, age verification systems, and identity verification, pose privacy concerns, as they can potentially expose private user data to platforms or government authorities.
- Innovations in technology, particularly in cybersecurity and AI, must be carefully balanced with user privacy considerations, to ensure confidentiality, security, and anonymity are not compromised while addressing issues like child sexual abuse material, terrorism content, and misinformation online.
