Legislation
6 piecesIn this section
pages
Android prefers vibecoders over open-source developers
Legislation · 5 min · p. —
The political use of operating systems
Legislation · 7 min · p. —
Everything about Chat Control
Legislation · 18 min · p. —
Trump cuts funding to FOSS projects
Legislation · 5 min · p. —France wants backdoors in end-to-end encryption
Four days ago, Tuta, the providers of an end-to-end encrypted email service, published a blogpost titled: "France is about to pass the worst surveillance law in the EU. We must stop them now!".
According to them, this French law would allow the government - amongst other things - to have backdoors on all end-to-end encrypted services, remotely activate the microphones and cameras, and tighten up censoring content.
This sounds pretty bad. To see where their claims are born from, let's take a step back to November 2023.
Due to an (alleged) rise in drug trafficking in France, a commission was created by the initiative of the right-wing Les Républicains group. In May 2024, they submitted a report named: "A necessary leap forward: getting France out of the drug trafficking trap".
The rapporteur and president of this commission (respectively, Étienne Blanc from Les Républicains and Jérôme Durain from Socialiste, Écologiste et Républicain) decided, a few months later, to propose a similarly named law following the recommendations of the commission.
This bill currently includes 24 articles, all written in French, a language I sadly do not understand. A few of them are what you would expect given this context, such as the creation of a national anti-narcotics prosecutor's office or strengthening the anti-drug office (Ofast).
This bill is worked upon by a specific commission, which concluded its work with a report on the 22nd of January 2025, a couple of weeks ago.
A few days after that, an amendment was proposed to the law, which added one more article; I quote from its "Subject matter":
This amendment introduces platforms to implement the necessary technical measures to enable intelligence services to access the intelligible content of correspondence and data transiting through the platforms.
This is the amendment that Tuta found to be deeply concerning. This amendment forces encrypted messaging apps to decrypt any message at the government's request within 72 hours; to enforce this requirement, it introduces a 1.5M€ or 2% of company income fine.
Indeed, the Senate voted on the new bill from the 28th of January to the 4th of February, and the amendment made it to be article 8(a) of the bill.
The current French law already requires criptology services to provide the government with access to messages with 72 hours, but until the law also had the following sentence: "Authorized agents may ask the aforementioned service providers to implement these agreements themselves within seventy-two hours, unless they demonstrate that they are unable to meet these requests". The bill completely deletes this part, making the request effectively mandatory.
Instead, the sentence "They cannot make any contractual or technical arguments that would hinder them" is added. It's not easy to read through the legal jargon here, especially in French, but this does seem to justify Tuta's worries.
Tuta argues that creating government backdoors for end-to-end encrypted services would also break European data protection laws like the GDPR:
The GDPR pass the control over personal data back to the people by forcing companies to protect personal data, possibly also with end-to-end encryption. Furthermore, Germany’s IT Security Act mandates that critical infrastructure (including IT systems) must be protected from cyber threats and unauthorized access, and Germany’s Telecommunications Act (TKG) regulates the security of communication services and data.
They also quote the following statement of the European Data Protection Supervisor:
Encryption, or the encoding of messages in such a way that only intended recipients can understand them, is one of the main tools to guarantee the security of our information. It is recognised as necessary for the digital economy and for the protection of fundamental rights, such as privacy and free speech.
Tuta is not the only company worried about such a development. Signal, the end-to-end encrypted messaging app, has very recently stated that they will refuse to operate in any country which requires backdoors on their encryption. This means that Signal might soon be unreachable for anyone living in France, but also Sweden and the UK, who are passing similar laws.
However, this is just article 8(a) of the bill. Though this amendment constituted what prompted Tuta to speak out, they mention that the whole "war on drugs" law is full of worrying changes.
To do this, they quote a website called La Quadrature du Net. They seem to be an organization that "promotes and depends fundamental freedoms in the digital world", placing itself as quite left-wing and opposing, as an example, AI.
According to them, the "Narcotrafic" law would also allow for "remote activation of connected objects"; they say,
This law provides for a new escalation in surveillance by continuing the legalization of spyware (such as NSO-Pegasus or Paragon). It thus authorizes the police to remotely activate the microphones and cameras of fixed and mobile connected devices, such as computers or telephones, to spy on people.
The law also "significantly strengthens the organized crime regime"; the scope of the offenses covered by this regime has "steadily over the years, affecting more people and situations". They claim that, in the past, the organized crime regime was used to pursue an activist fighting against the construction of administrative detention centers, but I found it hard to verify this claim.
They also claim that it would expand the use of "black boxes" to analyze the data of all our communications and exchanges and that it would tighten up their policy of censoring content on the Internet by extending it to publications related to the use and sale of drugs.
Even though I was able to track down the specific changes that prompted the initial Tuta post, going through all 24 of the bill's articles to find the specific changes that La Quadrature du Net is talking about is beyond my skills; as such, I am quite disappointed that they did not bother to make any specific link to the bill's text, which would've allowed us to more easily verify their claims.
As a result, please take all of La Quadrature du Net's words with a grain of salt; however, the requirement of adding a backdoor to all end-to-end encrypted communication is indeed a reality, and a worrying one.
The bill was approved in the Senate with a large majority, including both the left and the right-wing votes. However, it still has to be approved in the National Assembly, and they can still amend it. Thus, Tuta and La Quadrature recommend calling your Assembly representatives if you live in France to let them know that you won't vote for them if they vote for this law.
I briefly mentioned this already, but it's worth noting that this law does not just fall from a coconut tree: similar attacks towards end-to-end encryption are ongoing in the UK and Sweden. Quoting bleepingcomputer.com,
Last week, Apple decided to pull its iCloud end-to-end encryption feature, Advanced Data Protection (ADP), from the UK following a secret order from the government demanding the creation of a backdoor to access user data. A similar law proposed in Sweden is poised to grant law enforcement agencies access to users' message history from apps like Signal. However, Signal's President Meredith Whittaker said in a recent interview that this law would force them to pull their service out of the country.
Will Google have to divest Chrome?
Just one hour ago - at the time of writing this, at least - news broke that China has announced retaliation against President Trump's imposed tariffs by launching an antitrust investigation on Google. The exact quote of the China government - according to, uh, Google Translate - is
Because Google was suspected of violating the Anti-Monopoly Law of the People's Republic of China, the State Administration for Market Regulation launched an investigation into Google in accordance with the law.
Indeed, investigating Google for antitrust lately seems like stealing candies from a child. In 2018, the European Union fined them about 5 billion dollars, the largest antitrust fine ever issued, though Google has decided to appeal that decision. According to the European Commission, the violations were that Google required manufacturers to pre-install Google Search and Chrome, prevented them from running competing operating systems based on the Android Open Source Project, and gave financial incentives to those who would only preinstall Google Search on their devices.
The year after that, the EU issued another 2 billion dollars fine due to "abusive practices in online advertising". Again, Google appealed the decision. This time around, the reasoning is that Google required partners to exclusively use AdSense, display a minimum amount of Google ads above any competitor's, and more.
As you very well know, Google has issued some changes to address these fines. As an example, in 2019 they said they would ask users for their preferred browser of choice upon first setup, to further comply with EU's decision. However, the biggest antitrust headache that Google is going through - the one we're focusing on today - is related to the US itself.
In September 2023, a trial began between the United States and Google concerning monopolies. Google, who probably wanted to avoid as much attention as possible, managed to obtain that this trial would be held behind closed doors, claiming that trade secrets could be released to the public, otherwise. However, we do know that the ruling of this trial states:
After having carefully considered and weighed the witness testimony and evidence, the court reaches the following conclusion: Google is a monopolist, and it has acted as one to maintain its monopoly.
According to the judge, Amit Mehta, Google has violated section 2 of the Sherman Act. The DOJ's proposed solution is to divest them of their browser, Chrome. Additionally, they also left the door open to potentially force them to sell the Android operating system as well.
Let's go step by step, and see what the DOJ wants to achieve.
Yes, divesting Chrome is one of their strongest suggestions, and the idea is to separate the most popular browser from the most popular search engine, to make sure that Google does not use the former as a gatekeeping platform to funnel users into their search.
Google would also have to part ways with Chromium, the Open Source base upon which Chrome is built. Keep in mind that this project is meant to be a bit more community-driven, though - as I'll mention later - the vast majority of work done on it is by Google. It's not entirely clear who would drive the project forward if they had to stop working on it.
Generally speaking, Google would have to avoid offering Google Search as the out-of-the-box tool on any of its devices, something somewhat similar to what the Digital Markets Act proposes - if you don't know what that is, I have an entire video about it, by the way.
Another significant proposal from the DOJ is to publish Google Search rankings and query data to competitors. This would allow them to very quickly increase in quality, allowing for much more of a fair fight between them -- that is, if you consider "fair" to force Google to publish that data at all.
Finally, there would be a ban on having search deals with browsers to make sure that they use Google Search; again, you can see the patterns that are building up. This suggestion would be particularly significant for the Open Source world, as you will see later. All of this was an extreme summary of the proposals, but you can read more about them in the linked The Verge's article.
The reaction to this proposal, on Google's side, was pretty strong. They released an article titled: "DOJ’s staggering proposal would hurt consumers and America’s global technological leadership", and the language that they use is extremely telling. I have to read you an extract:
As just one example, DOJ’s proposal would literally require us to install not one but two separate choice screens before you could access Google Search on a Pixel phone you bought.
I don't know if you fully grasp the gravity of the situation. Two entire choice screens. Two. I'll keep reading.
And the design of those choice screens would have to be approved by the Technical Committee. And that’s just a small part of it. We wish we were making this up.
This extreme proposal would:Endanger the security and privacy of millions of Americans, and undermine the quality of products people love, by forcing the sale of Chrome and potentially Android.Hurt innovative services, like Mozilla’s Firefox, whose businesses depend on charging Google for Search placement.Deliberately hobble people’s ability to access Google Search.
Yadda yadda. It is worth noting that Google must be very well aware of the risk of being considered a browser monopoly, especially since they pay around half a billion dollars to Mozilla to, formally, make sure that it uses Google search under the hood, but, informally, to try to escape from monopolistic accusations. Though, that didn't work.
Note that this sentence could also indirectly hurt Mozilla. Another part of the DOJ proposal was to stop this funding, since it technically was - is - a financial incentive to a competitor to keep using Google's search engine. As a result, Mozilla could be losing its main source of income here. Just a few weeks later, the Mozilla Foundation laid off 30% of its staff, by the way.
This is why it should not come as a shock to you that Mozilla is trying to help out Google. They don't want the DOJ remedies to go through. They have published a lengthy article, titled "Proposed contractual remedies in United States v. Google threaten vital role of independent browsers", where they point out that the revenue of "critical browser competitors" would be jeopardized. I do admire this article because it tries hard to frame this whole discussion to be about the freedom of choice of the user, saying that Google Search is only a default because it's the best search engine out there... but it's about money. They don't want to lose 80% of their revenue, understandably.
Google has the same deal with Apple as well; they pay them 20 billion dollars to make sure that they use Google Search out of the box. This deal would also have to be rescinded if the DOJ proposal would be accepted.
Though, to be clear - differently from what is sometimes reported - these are suggestions of the DOJ to the court made after Google was found guilty, so the exact measures that will be imposed to the company are not yet decided. This is a central point: it is now in the best interest of Google to put them in the shiniest possible light, to try their best to avoid something as drastic as losing their browser.
On the 20th of December, Google published a follow-up blog post called "Our remedies proposal in DOJ’s search distribution case". Similarly to how the DOJ suggested their remedies - such as divesting Chrome - Google is doing the same. Their proposals are the following:
Firstly, they think browsers should have the freedom to make deals with search engines. They point out that Mozilla relies entirely on that deal, and that browsers have found Google's to be the best search engine out there anyway.
However, they will now offer more flexibility in those agreements. It would allow for different search engine defaults on different devices, and the ability to switch to a different one every 12 months. Browser-wise, that's it. I'm not sure whether this is enough to avoid the monopoly accusations.
Android-wise, they will provide more flexibility to manufacturers in preloading multiple search engines. Again, that's it. That said, they claim that
we believe that [these changes] fully address the Court’s findings, and do so without putting Americans’ privacy and security at risk or harming America’s global technology leadership.
Please note how the two products that were suggested to be divested, Chrome and Android, are both open source-ish. To be exact, Google maintains the Chromium and Android Open Source Project, which are fully open source, but then it takes those, changes them, and ships them as proprietary software; the Android that you get on a Pixel nowadays hardly looks like the AOSP project, and the latter - by itself - is almost unusable; Linux Tech Tips made a video about this topic, recently.
Thus, what Google would love to happen is for more folks to join the Chromium and AOSP project, but especially Chromium. Throughout the years, they have been the source of roughly 94% of all the commits made to the project, and they are the de-facto owners of the project.
If they managed to make Chromium just a bit more independent, with possibly more companies contributing to it, though still retaining its control, that could help them tremendously in their antitrust cases. And, since the stakes are really high here - Google is an advertisement company, and Chrome is core piece of that business - they have a lot of money to invest in this project.
Enter the Linux Foundation.
On the 22nd of January, they announced the "Supporters of Chromium-Based Browsers". The goal is, and I quote,
fund open development and enhance projects within the Chromium ecosystem, ensuring broad support and sustainability for open source contributions that will drive technological advancement.
I have to say, it's pretty funny to see the Linux Foundation say that they want to work to "expand adoption" of Chromium-based browsers. "Expand adoption"? Of the most common web technology out there, by far?
It's worth noting, though, that the Linux Foundation also hosts and, I believe, funds the development of Servo. The project, previously worked on by Mozilla, aim to implement a new and independent browser engine; so, they do seem to be doing genuinely good work on that side; assuming that this new Friends of Chromium Fanclub won't change their efforts on Servo.
Anyhow, the Supporters of Chromium-Based Browsers is supported by Google - obviously - Meta, Microsoft, and Opera. It "will provide a neutral space where industry leaders, academia, developers, and the broader open source community can work together", and it "follows an open governance model".
So, will this be enough? When will we know which remedies will be taken, and whether the court will divest Chrome? That will be decided by a two-week trial in April, and it seems pretty clear that Google is trying its best to get to that trial in the best possible position. That said, there's a very big factor that we have not considered so far, and it goes by the name of Trump. As you probably know, if you did not live under a rock, the administration over the US has changed since this story began, and it is somewhat unclear how the new one will handle antitrust regulations. Quoting the Jacobin,
GOP presidents have in recent decades typically embraced extreme free-market ideologies that see antitrust regulation as baleful government interference in the economy. But it should be remembered that most of the present cases against big online platforms like Google, Facebook, and Amazon actually originated in Donald Trump’s first term.
Ultimately, given Trump's apparent interest in making Big Tech submit to him, the change in administration could be good news for Chrome; it certainly increases the chances that this ends in nothing done. I'm not exactly sure whether I would even want the US to divest Chrome, to be honest.
Anyhow – I believe that is everything I had to tell you. See you tomorrow, then!
Help us break even
We only run on donations. We have a goal of reaching 300 subscriptions, which would allow us to hire staff.
If you subscribe, you'll gain access to a few members-only pieces, though we aim to keep most of our content free for all.
no ads · no trackers · cancel whenever