Law – Urrús

22/12/202029/12/2020

some companies care about child safety and some…..

……and so it has come to pass. The ePrivacy directive kicked in on the 20^th of December. This means two things – people have more privacy, a good thing and children are less safe online, not a good thing.

As explained in previous posts the ePrivacy directive coming into full force on the 20^th of December means that companies who were voluntarily scanning for Child Sexual Abuse Material (CSAM) and patterns of Grooming could interpret the change as making their scanning activities illegal.

There is an active effort to bring in a regulatory framework that will cover these voluntary actions but this will take time and so a temporary derogation for a small number of articles was requested. It is still under consideration by the EU Parliament, the EU Commission and the EU Council.

In the meantime, some companies have stood up and declared they not stop these efforts to keep children online while the political process continues. These companies are Microsoft, Google, Linkedin, YUBO and ROBLOX. Well done to all of you.

Other companies have not stood up. We don’t know what they are doing because apart from Facebook they are saying nothing.

Facebook has declared that they will switch off scanning. In a post on their blog they use a lot of language to basically say that they are choosing privacy over child safety. This is a disappointing and strange decision given that they have been to the forefront of voluntary actions in the past. At least they told us. What of other companies? The big ones?

The political process continues, here is what you can do:

Talk to your local representatives and MEPs – list here .

and if you work for or use companies who provide online services other than those listed above, ask them stopping or continuing?

13/12/202013/12/2020

time is running out…..

There is 7 days to go until the ePrivacy regulation comes into force in the EU. It actually passed in 2018 but member countries were given 2 years to prepare and so it “goes live” on 20^th of December 2020. [1] A temporary derogation applied for by the Commision has passed committe stage and now must get a reading in the plenary before being the subject of a trilogue. Is all this possible in 7 days?

Because it’s a regulation rather than a directive, it effectively supersedes existing law in member countries and therefore any laws passed locally since 2002 to meet the ePrivacy directive are effectively repealed.

The regulation, aimed at companies providing communication services in the EU, seeks to guarantee privacy through ensuring no interference or tracking of communications for marketing or other purposes.

One of the key unintended consequences of this regulation is that voluntary actions by the same companies to find, remove and report Child Sexual Abuse Material (CSAM) or Grooming activities on their networks will stop because companies cannot risk that they will be seen as illegal.

These voluntary actions are hard fought chips in the self-regulation wall that activists and advocates, even within the companies themselves, have achieved. Stopping them in this manner is ridiculous and reduces the safeguarding opportunities for children being actively harmed. Companies scan for CSAM with advanced technologies to ensure the privacy of their users in the same way they find, remove and report SPAM and malware. Comparisons to someone at the post office opening every letter “IRL” are facetious and unhelpful.

Child abuse communication, whether grooming or CSAM, universally happens in private and the only people who know about it are the child and the abuser. When the abuser shares the material there is an increased chance that it will be found, removed and reported to the police who can then take action to make the child safe. There are very few other ways for people to find out about the abuse and help the child.

In an effort to avoid this unintended consequence the EU Commission has put a temporary derogation before EU lawmakers to stay just two articles within the regulation that will allow the voluntary actions to continue in the area of child abuse online only until they can get the law needed in place. This temporary derogation has passed the committee stage and now will get its first reading in the EU Parliament then move into a formal “trilogue” or interinstitutional talks.

The question is when? The EU Parliament meets next week in plenary. Will they do the first reading then? When will the Trilogue meeting take place? How long will it take? Will they have this finalised and passed (without too much dilution) by 20^th of December?

I certainly hope so.

Here is what you can do:

Sign the petition

Talk to your local representatives and MEPs – list here .

Support your local InHope Hotline

Read more and see the supporting evidence of what stops if this derogation fails to pass here.

[1] It’s full name is actually “Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)” and it repeals the ePrivacy Directive of 2002.

07/12/202010/12/2020

LIBE committee passes derogation

So today the LIBE committee voted overwhelmingly to allow the derogation to proceed to the plenary. The vote 53 votes in favour and 9 against, 2 abstentions.

The derogation will now go for a vote to the European Parliament at the plenary sessions during the week of 14th to 17^th of December 2020. Having passed the LIBE committee, the derogation should be accepted by the parliament without too much drama. However, it must then be discussed in the trilogue which may mean that it gets watered down. There needs to be strong representation for child safety as you can be sure there will be strong representation from the privacy side of the house.

Once that happens the real work begins to put in place the legislation that will provide the framework for finding, reporting and removing CSAM and grooming from networks. That work will take many years.

The LIBE committee press release is here.

04/12/202004/12/2020

on voluntary actions to combat child sexual abuse

Companies exist to make money for their shareholders and it’s important to remember that when we discuss what they do to deal with anything bad that happens on their network. That includes Facebook, Google, Twitter et al.

They have grown in a low-regulation environment, which was encouraged by governments all over the world. So dealing with the dark-side of social media and the human condition was always going to be a hard sell to their boards as it costs money and is the antithesis of profit making. See line one of this post.

Unlike the EU, the USA brought in regulation relating to the online facilitation of child sexual abuse through a law stating that when a company is aware of Child Sexual Abuse Material and Grooming on their network they will report it to NCMEC.

NCMEC processes these reports and sends the “cybertips” to law enforcement all over the world for action. These cybertips have saved lives and helped remove countless children from harm all over the world.

So, how does a company become aware of CSAM or grooming on their network? Users reports, sure, but in most cases they are actively scanning their systems for evidence of it in the same way they do for viruses or malware. There are “voluntary actions”.

When the ePrivacy directive comes into force on the 21^st of December of this year those “voluntary actions will stop – dead.

The EU commission wants to bring in a law similar to the US law and the procedure to report (EU Style NCMEC) and so has applied for a limited temporary derogation from a number of articles (5 (1) and 6) in the ePrivacy directive that will maintain the status quo until new law can be drafted.

This derogation is currently under consideration at the European Parliament. If it passes, the status quo remains while the EU Commission prepares regulation in the form of law for 2021/22. If it fails, the voluntary action by these companies stop and there will be less children saved or removed from dangerous situations.

Here’s what you can do, as soon as possible:

Sign the petition

the derogation – a summary

This is an explainer the derogation being sought by the European Commision to Articles 5(1) and 6 of the ePrivacy Directive about to be updated by the Electronic Communication Code. It’s a little technical and lawyerly but then all good legislation is. This is my understanding of it and is subject to change since I’m not a lawyer.

The ePrivacy directive was issued in 2002 and with GDPR needed updating and this happened in 2018 as the European Electronic Communication Code. It is a directive and all member countries must transpose it – make it law in their countries. Failure to do this can result in legal action.

Now, countries had two years to transpose it and so all of the provisions of the EECC kick in on the 21^st December 2020. Definitions of electronic communications services and privacy will change and will include what are called “number-independent interpersonal communications services”. This will include webmail, messaging services and IP telephony. Essentially, therefore companies (such as Facebook, Google, Microsoft et al. who are now doing voluntary actions to find, report and remove Child Sexual Abuse Material and to find Groomers within their networks would run the risk of exposure to prosecution if they continued.

The derogation is simply a legal request to stay articles 5(1) and 6 of the ePrivacy for a short period while the commission gets a legal framework into place to allow companies to continue scanning for CSAM and Grooming activity. In other words, it’s asking tha tthe status quo remain in place for activities aimed at

The discussions as to whether the derogation will be allowed is ongoing and this is why we need to act now.

As already stated, if the derogation is not accepted or is watered down, there is a major risk that all efforts currently being made to find, report and remove CSAM and Grooming stop.

Here is what you can do to help:

Sign the petition

children’s rights always second to ideology and profit

We all know the damage sexual abuse does to children. This is self-evident. We also know that from a victim perspective to have been abused is one thing but to have images or movies of that abuse circulated online is quite another and an extra burden to carry through life. Grooming too is an abhorrent crime that abuses trust, love, and confidence in other human beings and becomes something that stops a child’s development and sets it off on another path, mostly negitive. Both of these crimes have been hugely amplified by ICT and technology in general. As Mary Aiken said “Human behaviour is often amplified and accelerated online, by what I believe to be an almost predictable mathematical multiplier, a “cyber effect”, arguably the E = mc2 of this century.”[1]

Some companies take voluntary action on their networks to find, report and remove Child Sexual Abuse Material and Grooming activity. What they find is staggering. They scan using strong algorithms, hash and other signatures and false positives are possible but rare – just like SPAM, virus or malware scanning. When they find something they are oblidged to report it (in the USA).

However, all this voluntary action is threatened by the fact that the EU Parliament and more specifically the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) is considering whether to allow a derogation to certain provisions of the ePrivacy Directive due to come into force on the 21^st of December. The temporary derogation has been applied for by the European Commission to allow them to propose a more permanent solution via legislation in Q4 2021.

If this derogation fails to go through or is watered down in a wishy-washy way it will have a significant impact on the ability of law enforcement and civil society to fight online child sexual abuse and once again we will see that children’s rights are sacrificed on the twin altars of ideology and profit.

I will post some more short explanatory posts on this issue in the coming days but in the meantime you can act by contacting your MEPs, your local reps and by signing the petition placed here by the NCMEC. If this derogation fails, we all fail.

Sign the petition