Re: [EXT] IAB Statement on Encryption and Mandatory Client-side Scanning of Content

["lgl island-resort.com" <lgl@xxxxxxxxxxxxxxxxx>]

On Dec 20, 2023, at 1:57 AM, Vittorio Bertola <vittorio.bertola=40open-xchange.com@xxxxxxxxxxxxxx> wrote:

And on top of that, the PGP lawsuit in the US in the 90’s already showed that opensource code is the equivalent of free speech, so making opensource illegal constitutes making freedom of speech illegal.

This has somewhat changed in Europe with the recent law on mandatory security requirements for software (the Cyber Resilience Act - a completely different one from the CSAM regulation that prompted the IAB statement). We argued with the Commission that software is free speech and thus its publishing cannot be subject to (too many) constraints, but the Commission's line is that now software is an industrial product, not an _expression_ of thought, and as such can be restricted and arbitrarily regulated.

 

It would be interesting to challenge that in court and see if the European Court of Justice would uphold the "software as free speech" principle, but I don't know if anyone will bring the case.

Is publishing plans for a nuclear weapon free speech? Seems so. Why is this OK? Because it’s still really hard to build a nuclear weapon.

Working on Internet security, I’ve asked myself why we need such a high bar, when locks on common doors are so poor. The answer is scale. You can attack a million computers from 10,000 miles away much easier than 1 million common doors.

Published SW can just run. There’s no difficult building as for nuclear weapons. It is a product that can directly do something, not just speech. I can see that the much easier use of SW for malfeasance motivates putting SW in a class different from free speech. This may be necessary to maintain safety in our world, particularly with AI. I can see why the Commission Vittorio mentions has classified it as industrial product.

Disclaimer — if you put me in charge of some decision here, I don’t know what I’d do. I also see the value of open source and the difficulty of restricting it.

LL