In A Speech Any Autocrat Would Love, French President Macron Insists The Internet Must Be Regulated

from the hate(d)-speech dept

Props to French President Emmanuel Macron, who had a busy week last week, what with the observance of the World War I armistice centennial, the Paris Peace Forum, the Internet Governance Forum (IGF), and various other related events. All drew attendees and attention from around the world to his capital city, and all required his participation in some significant way, including through the delivery of several speeches that each surely required substantial preparation to deliver so capably. Techdirt has already covered a few minor aspects of the IGF speech: the announcement that France would embed officials with Facebook, and reference to the "Paris Call." But in terms of the major substance of the speech, there are few compliments that can be paid.

At best it was the sort of speech that someone completely new to tech policy might have come up with. Someone who, upon finding an imperfect situation, presumes that they are the first to notice the issue. And then takes it upon themselves to heroically step in to address the problem, despite the fact that their proposed "solution" reflects an incomplete understanding of the matter.

There are a number of ways this incomplete understanding infected his speech and undermined the quality of his recommendation. There was, for instance, his erroneous declaration that the Internet today is too much about content distributors not enough about content creators. This declaration alone suggests a very poor understanding of all the myriad ways people all over the world use the Internet to create and then disseminate their expressive works themselves. In and of itself it calls into question whether his overall suggestion is capable of being adequately protective of all this expression.

Because it appears not, and not just because of this limited understanding of how the Internet is used. It also ignores the critical countervailing concerns that have long deemed his proposed "fix" to be an unacceptable one. Because the "cure" he proposed — greater regulation of the Internet — is a dangerous one that would destroy all that he purports to want to protect.

We were off to a bad start with his initial skewering of net neutrality, a topic slated to be dealt with head-on by EU regulators next year. To summarize his general view on the subject: sure, we don't want certain ideas to be marginalized. We should defend people's access to the Internet, he said, but not always. He interprets the term "neutrality" to mean that all ideas have to be treated equally, but, in his view, some ideas are more equal than others. And this is what so offends him: net neutrality allows those who do not share "our values" to spread their ideas too.

This appeal to "values" was a recurring reference that underpinned his speech. Thanks to the Internet, Macron said, we saw an upsurge in democracy (i.e. Tahrir Square). Now, however, he complained, the Internet is being deployed by fringe elements to work against those democratic values. As he put it, in the name of liberty we are allowing the enemies of liberty to speak, and this, Macron insisted, needs to end through the imposition of regulation on the Internet and its actors.

Of course it's not that the values he champions are bad: liberal democracy and personal liberty are certainly worth defending. And he's right to recognize that the Internet can be a valuable tool for advancing those values. He's also right to observe that some use the Internet to advance contrary values. But any autocrat can make the very same argument about how regulation of expressive technology is necessary to preserve a society's "values," and nearly all do.

There is nothing magical about any particular set of values that makes regulation designed to enforce them better than regulation designed to suppress them. Regulation that gives someone the power to decide which values are the good ones and which are the bad is regulation that gives someone the power to suppress any values, including the ones you prefer. Indeed, that's the very point of the very values he champions, to ensure that no one gets that power. You simply can't create that power and expect it not to be used badly.

At some level Macron understands this problem. In the same speech he lamented the autocratic approach of "China Cyberspace" as being a poor choice for the Internet's future, and yet that's exactly the future he invites as he calls for the Internet to be as tightly controlled by his preferred regulators as China would want it to be by its own.

But Macron fears that the only other choice to the regulatory solution he proposes is "California Cyberspace," where California-based companies instead are the de facto regulators of the Internet.

Again, though, Macron misapprehends the current situation, in at least two significant ways. First, part of his objection to the Internet being "regulated" by California companies is that he didn't vote for them, and thus he fears that he has no way to ensure that they act in a way that he considers sufficient to protect the values he prefers. But installing governments, even elected EU governments, as regulators of the Internet provides no guarantee that these values will be any better protected. France itself has members of the far right making increased inroads into government, as does Germany. The democratically-elected government in Poland is busy attacking its independent judiciary for not being nationalistic enough, while Hungary's is currently attempting to ban protest. Just the day before Macron told the world how poisonous nationalism is, and yet the regulation he prescribes would give nationalists in governments the tools to cement their alternative values.

The other significant misapprehension upon which his proposal is based is that "California Cyberspace" is a lawless zone. But not all law must say no; the laws that have allowed the Internet to thrive in California and beyond have been laws that have said yes to innovation and expression and worked to protect them from interference, including Section 230, the First Amendment, and even, to a degree, the DMCA. All of these sorts of legal structures are what enable the actual protection of all those very same liberty values Macron says he wants to foster.

But that's not the sort of regulatory approach Macron proposes. He wants one that will say no to technology — and, importantly, the expression facilitated by this technology — when he believes technology should say no to expression. In his mind this is a modest proposal, one that simply calls for regulation by international consensus via organizations like the IGF. He said this was to help transcend the "rifts" caused by different nations' regulatory approaches. But given that next year's IGF has been scheduled over Thanksgiving week, thereby shutting out many of the American participants who would prefer to observe one of the most significant holidays in the American calendar with their family, as is traditional, rather than on their own, working to save the Internet a continent away, it hardly seems like international pluralism is really high on the IGF agenda.

Instead it seems that the goal is to empower his own government with the ability to decide for the world what the Internet can be used for. While his call for this regulatory crackdown may be packaged up in language touting freedom, democracy, equality, and international cooperation, it is still the cry of the censor keen for the power to refuse others' expression.

Filed Under: emmanuel macron, eu, europe, france, free speech, regulation

Facebook Allowing French Censors To Embed With The Company, And Maybe That's A Good Thing?

from the this-should-be-interesting dept

While much of the attention around French President Emmanuel Macron's speech at the Internet Governance Forum (IGF) on Monday was focused on the so-called "Paris Call" agreement on cybersecurity, it was also an occasion for the French President to announce a plan to effectively embed regulators with Facebook to learn how to better censor the platform:

The French president announced on Monday a six-month partnership with Facebook aimed at figuring out how the European country should police hate speech on the social network.

As part of the cooperation — the first time that Facebook has teamed up with national politicians to hammer out such a contentious issue — both sides plan to meet regularly between now and May, when the European election is due to be held. They will focus on how the French government and Facebook can work together to remove harmful content from across the digital platform, without specifying the outcome of their work or if it would result in binding regulation.

Facebook's press people have pushed back on the claim that this is a program to "embed" government censors within Facebook, saying it's more just about showing them how Facebook manages content moderation:

It's a pilot program of a more structured engagement with the French government so that both sides can better understand the other's challenges in dealing with the issue of hate speech online. The program will allow a team of regulators, chosen by the Elysee, to familiarize [itself] with the tools and processes set up by Facebook to fight against hate speech. The working group will not be based in one location but will travel to different Facebook facilities around the world, with likely visits to Dublin and California. The purpose of this program is to enable regulators to better understand Facebook's tools and policies to combat hate speech and, for Facebook, to better understand the needs of regulators.

While many people may have the instinctual reaction that having government regulators coming in to see how to "better" censor speech on your platform is inherently a problem, one hopes that the end result of this is influencing things in the other direction. A bad outcome would be French regulators deciding that this experience gives them enough info to craft impossible regulations to wave digital magic wands and "make the bad stuff disappear." But a more optimistic argument would be that it gives these French regulators a chance to get some first hand knowledge of (1) how seriously Facebook takes this issue (don't laugh, because the company absolutely does take this issue seriously now, even if it didn't in the past) and (2) just how impossible it is to do a particularly good job at it (even as Facebook has gotten much better in the past year).

So while I'm always a little concerned about the idea of having government regulators come into a company when the upfront stated objective is about more content moderation demands, it certainly would be beneficial for French officials not to be so incredibly ignorant about how content moderation at scale truly works, and why the easy solutions they always seem to propose won't help (and could make problems significantly worse).

Filed Under: censorship, content moderation, embedding, france, hate speech, regulations
Companies: facebook

The US Refusing To Sign 'The Paris Call' Is Not As Big A Deal As Everyone Is Making It Out To Be

from the this-is-a-pointless-document dept

On Monday, a bunch of countries and companies officially announced and signed "The Paris Call," or more officially, "the Paris Call for Trust and Security in Cyberspace." It's getting a fair bit of press coverage, with a lot of that coverage playing up the decision of the US not to sign the agreement, even as all of the EU countries and most of the major tech companies, including Google, Facebook, Microsoft, Cisco and many many more signed on.

But, most of those news stories don't actually explain what's in the agreement, beyond vague hand-waving around "creating international norms" concerning "cyberspace." And the reports have been all over the place. Some talk about preventing election hacking while others talk about fighting both "online censorship and hate speech." Of course, that's fascinating, because most of the ways that countries (especially in the EU) have gone about fighting "hate speech" is through outright censorship. So I'm not quite sure how they propose to fight both of those at the same time...

Indeed, if the Paris Call really did require such silly contradictory things it would be good not to sign it. But, the reality is that it's good not to sign it because it appears to be a mostly meaningless document of fluff. You can read the whole thing here, where it seems to just include a bunch of silly platitudes that most people already agree with and mean next to nothing. For example:

We reaffirm our support to an open, secure, stable, accessible and peaceful cyberspace, which has become an integral component of life in all its social, economic, cultural and political aspects.

We also reaffirm that international law, including the United Nations Charter in its entirety, international humanitarian law and customary international law is applicable to the use of information and communication technologies (ICT) by States.

I mean, great. But so what? The "measures" the agreement seeks to implement are almost equally as meaningless. Here's the entire list:

• Prevent and recover from malicious cyber activities that threaten or cause significant, indiscriminate or systemic harm to individuals and critical infrastructure;
• Prevent activity that intentionally and substantially damages the general availability or integrity of the public core of the Internet;
• Strengthen our capacity to prevent malign interference by foreign actors aimed at undermining electoral processes through malicious cyber activities;
• Prevent ICT-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sector;
• Develop ways to prevent the proliferation of malicious ICT tools and practices intended to cause harm;
• Strengthen the security of digital processes, products and services, throughout their lifecycle and supply chain;
• Support efforts to strengthen an advanced cyber hygiene for all actors;
• Take steps to prevent non-State actors, including the private sector, from hacking-back, for their own purposes or those of other non-State actors;
• Promote the widespread acceptance and implementation of international norms of responsible behavior as well as confidence-building measures in cyberspace.

I mean, sure? Some of that is meaningless. Some of that is silly. Some of it is obvious. But none of it actually matters because it's not binding. Could this lead to something that matters? Perhaps. But it seems silly to condemn the US for failing to sign onto a meaningless document of platitudes and meaningless fluff, rather than anything substantial. There's no problem with those who did choose to sign on, but it's hard to see how this is a meaningful document, rather than just an agreement among signatories to make them all feel like they've done something.

Filed Under: cybersecurity, eu, france, internet, internet regulation, paris call, security, us

French Cop Arrested For Selling Sensitive Law Enforcement Info On The Dark Web

from the all-the-best-jobs-are-the-inside-ones dept

The problem with giving law enforcement access to so many databases full of personal info and so many tech tools to fight crime is that, inevitably, these will be abused. This isn't a law enforcement problem, per se. It's a people problem. When the job demands the best people but still needs to maintain minimum staffing levels, things like this happen:

A French police officer has been charged and arrested last week for selling confidential data on the dark web in exchange for Bitcoin.

[...]

French authorities also say the officer advertised a service to track the location of mobile devices based on a supplied phone number. He advertised the system as a way to track spouses or members of competing criminal gangs. Investigators believe Haurus was using the French police resources designed with the intention to track criminals for this service.

He also advertised a service that told buyers if they were tracked by French police and what information officers had on them.

The discovery of the officer's misconduct came to light after French police shut down a dark web market. That there was a cop selling cop stuff to criminals on the dark web is inevitable. If it wasn't this investigation, any of the dozens of others happening around the world would have uncovered a law enforcement officer doing bad things. Two of the federal agents involved in the Silk Road investigation ended up being charged with money laundering and wire fraud after they stole Bitcoin and issued fake subpoenas to further their own criminal ends.

Again, it's a people problem -- one that's present anywhere people are given power and access not present in most jobs. The problem is government agencies, in particular, tend not to hold their own employees accountable and work hard to thwart their oversight. The more brazen examples of government malfeasance are enabled by the dozens of smaller infractions that go unpunished until they're the subject of a lawsuit or government investigation.

More to the point, this is exactly why no government agency -- not to mention the private companies involved -- should be allowed to utilize encryption backdoors, as the EFF's Director of Cybersecurity, Eva Galperin, pointed out on Twitter. It's not just about the hundreds of malicious hackers who will see an inviting, new attack vector. It's that no one -- public or private sector -- can be completely trusted to never expose or misuse these avenues of access. And since that's a fact of life, sometimes the best solution is to remove the temptation.

Filed Under: backdoors, dark web, encryption, france, police, police database

French Pirates Are Increasingly Buying Through Legal Options

from the c'est-la-vie dept

Do you guys remember Hadopi? This French version of a law designed to kick copyright infringers off of the internet essentially ended in 2016, after all kinds of reports showed the program to be an inefficient, unreasonably harsh failure that actually resulted in more infringement rather than less. Well, this travesty probably seems altogether silly here in 2018, given that Hadopi largely targeted filesharing infringement, while the majority of "piracy" these days takes the form of streaming content online rather than downloading it. Those enforcing Hadopi have no real way to track that kind of "piracy", making the whole thing useless.

But the French government appears to want to see if it can repeat its mistakes all over again, with reports that it will institute a streaming site blacklist, which will be every bit as effective as Hadopi. Making all of this especially odd is that it comes at a time when so-called pirates in France are increasingly turning to legal offerings and spending gobs of money on them.

A new report published by consultancy firm EY reveals that the number of French pirates has dropped by 8%, from 11.6 million in 2016, to 10.6 million last year. The remaining pirates also downloaded and streamed less infringing content than the year before, with consumption dipping 4%.

In fact, it appears that pirates are increasingly “going legal.” This doesn’t mean that they have quit their copyright infringing habits completely, but they are more likely to pay for access too. In the span of a year, the number of pirates without a video on demand subscription dropped by nearly 30%. The result is that more than half of all pirates also pay for a legal movie streaming service now.

The reasons why someone might simultaneously pirate content and pay for it through legit services have been covered here many times in the past. It ends up coming down to some combination of content-availability, not wanting to work through the silos content-providers have erected around what customers want, and reasonable pricing models for that content. What data like this ultimately shows is that so-called pirates are perfectly willing to pay for content if its offered to them in a convenient and reasonable way with few mental transactions needed. You know, how all of commerce works.

And, yet, for some reason the French government has decided to try to censor streaming sites -- which it is guaranteed to do badly -- in the face of this optimistic data. Instead, it should be working with content producers and streaming providers alike to make that content as widely available as possible.

“Netflix has managed to reel in pirate consumers who weren’t signed up with a legal service before. In 2017, there were 20% more pirate consumers paying for a Netflix subscription than the year before,” EY’s report states.

This suggests that the main goal of movie studios and other content providers is to make sure that their work is widely available on legal streaming platforms. Ideally, without any delays and at a reasonable price.

Giving the customer what they want, how they want it, at reasonable prices. What a completely novel and hard to grasp idea.

Filed Under: copyright, france, hadopi, infringement, legal options, piracy

France Testing Out Special Encrypted Messenger For Gov't Officials As It Still Seeks To Backdoor Everyone Else's Encryption

from the roll-yer-own dept

The French government has been pushing for a stupid "backdoors" policy in encryption for quite some time. A couple years ago, following various terrorist attacks, there was talk of requiring backdoors to encrypted communications, and there was even a bill proposed that would jail execs who refused to decrypt data. Current President Emmanuel Macron has come out in favor of backdoors as well, even as he's a heavy user of Telegram (which isn't considered particularly secure encryption in the first place).

But now, the French government is apparently moving forward with its own, homegrown, encrypted messaging system, out of a fear that other -- non-French -- encrypted messaging apps will be forced into providing backdoors to their own systems:

The French government is building its own encrypted messenger service to ease fears that foreign entities could spy on private conversations between top officials, the digital ministry said on Monday.

None of the world’s major encrypted messaging apps, including Facebook’s WhatsApp and Telegram - a favorite of President Emmanuel Macron - are based in France, raising the risk of data breaches at servers outside the country.

There are a number of silly things here. First off, the fact that they're doing this should make it clear why it's been so stupid to have the government itself calling for backdoors. Clearly, the French government understands the risks involved, or it wouldn't be doing this in the first place. The message it seems to be sending is that keeping messages and communications secure is important... but only for government officials. For the peasants? Let them eat insecure messages, I guess.

Second, there should be questions about how well this will be implemented. The report does note that they're using "free-to-use code found on the Internet," which (hopefully?) means they're basing it on Open Whisper Systems' encrypted messaging code, which is freely available and is generally considered the gold standard (Update: actually it's based on Riot/Matrix and apparently the plan is to open source it -- which is good). However, doing encrypted messaging well is... difficult. It's the kind of thing that lots of people -- even experts -- get wrong. Rolling your own can often get messy, and you have to bet that a government rolling its own encryption for government officials to use is going to be a clear target for nation-state level hackers to try to break in. That's not to say it can't be done, but there are a lot of tradeoffs here, and I'm not sure that the best encryption is going to come from a government employee.

Also, the report suggests that this technology "could be eventually made available to all citizens," which would certainly be interesting, but would seem to contradict with all of those reports and statements about demanding backdoored encryption. Given how often the French government (and the President) have asked for backdoors, would any French citizen ever feel particularly secure using an "encrypted" messaging system offered up by that same French government?

Filed Under: backdoors, emmanuel macron, encryption, france