[drdebug]

The wording in the current draft seems to indicate that it applies to "providers of hosting services and providers of publicly available interpersonal communications services". So unless this includes ISPs, I wonder if that means a decentralized P2P service is not covered.

[uyzstvqs]

Not applicable, nor enforceable. If this were to pass then the next Signal will be P2P. There are already some good protocols like Tox.

Ironically the pervs will still be using WhatsApp, and just put their CSAM in a password-protected zip file before sending.

[cryptonym]

You should scan on the device before it goes on the network. P2P networking or not, the app should include a scanner.

Even if you use an open-source clone without scanner, your contacts most likely will use an app with builtin scanner. Your communications will be scanned on their end.

At that point I'm wondering why we don't also open and scan regular mail at the post office before delivery.

[efreak]

> At that point I'm wondering why we don't also open and scan regular mail at the post office before delivery.

We do open and scan some percentage of regular mail at the post office. It's difficult to find exact sources because the USPS only seems to easily admit to doing it for postage reasons, but it's fairly well known that they search for drugs, bombs, etc. Mail is subject to X-ray scanning and being opened under suspicion of a variety of things happening. When they can't open it themselves, they're also allowed to request permission from the recipient (you can refuse, but then they can go to a judge).

[cryptonym]

X-Raying import of goods is one thing. What I'm thinking about is more opening letters to read writings and check pictures, without explicit permission nor judge involved.

[tekknik]

This is exactly what parent is describing. If you’re on a suspicious person list, or happen to cross paths with one, your mail is likely going to be scanned. I can’t find the source now, but also once read the NSA can intercept a package, modify the contents and send it’s on its way without even a delay in the tracking.

[jcul]

I also wonder how it applies to Matrix, which is encrypted and technically decentralized.

However most users will be using the matrix.org homeserver, which makes it effectively centralized. Though I can still create my own homeserver that talks to matrix.org.

Would matrix.org be forced to offer scanning / a backdoor on the homeserver? Or would they be forced to add something to the official apps, which is pretty ineffective as there are many client apps.

All in all this proposal seems like a complete mess.

[tekknik]

Reading the text, they will require the operators of the server to provide the filtering and would be liable if they didn’t.