Oops, our logs and all redundant backups were mistakenly deleted and securely overwritten.

By whom? Ooops, our login database had mysteriously corrupted and wiped by our agentic AI.

Here's 300PB of code and training data for the ai.

Hope that helps.

Now, can we have a little peek at your personal computing devices?

How does this interact with gpdr? It seems at odds.

How do we persuade our elected politicians to stop trying to speedrun authoritarianism and fascism?

Crucially, the document reveals that EU governments see metadata – specifically traffic and location history – as the most vital tool for law enforcement.

Ah, yes. Store data at the risk of it being hacked or used by companies in order to protect the people from themselves.

I'm at a loss as to what to do should Mullvad fall to this shit. I could try something self hostable but I'm really not that skilled with that kind of thing. 

Any suggestions?

A self hosted vpn on a vps droplet would have the same issue as a vpn provider, no? They'd (the vps provider) would have logs of the adresses you've connected to etc.

Companies are going to hate it when they're not allowed to have remote connections for their directors and IT departments.

There's not enough protest against steady loss of privacy.

If you take away the privacy from a privacy service you're literally destroying it. So just ban VPNs directly fucktards. Or is that too obvious?

I'll say it again, we have to start pushing in the opposite direction. Some examples:

• Make it a basic right to not have any data about you collected unless strictly necessary for the service delivered.
• Forbid data brokers and any other attempts to combine data from different sources.
• Criminalize data leaks. Financial or medical malpractice can land people in prison or cause them to lose jobs. So should privacy/data malpractice. Note: negligence is a form of malpractice. It should not be possible to get away with a slap on the wrist kind of fine after a major data breach.
• Use the most extreme examples and statistics. Cambridge analytica was at the basis of a major attack on democracy using data from Facebook etc. Both Facebook, Cambridge analytica and benefitting parties should be held accountable in such a case.

Key notes and some thoughts:

1. "It is emphasized that national legislation on storing and access to retained traffic and location data for the purpose of safeguarding national security should be exempt from future EU legislation, regardless of which national authority requests access."

2. "Some Member States highlight the fact that it would be important to bear in mind the recommendations of the High level Group regarding the enforcement of sanctions against electronic and other communications service providers which do not comply with requirements regarding the retention and provision of data."

3. "Some Member States stress that access rules at EU level should not interfere with national rules on the admissibility of data."

4. One could argue the opposite. One could argue that the admissibility of any data that are subject to disclosure should be subjectable to a negative protection test regarding their admissibility, in accordance to proportionality and procedural safeguards, therefore by instituting exclusionary rules. Those exclusionary rules of data subject to disclosure, should be the subject of harmonization. This is the best way to protect fundamental rights, while reducing impediments to investigations. Any data retention obligation should be only be the competence of members states (by national laws). It would be those laws that should be the subject of future litigation in terms of their validity and compliance with the EU primary law, and of the general principles (of EU law). "Therefore argue that a new EU data retention regime should not rely on a literal application of those rulings to individual cases, but rather on an assessment of the principle of proportionality in line with the CJEU’s general guidelines as they result from the application of the Charter (CFREU), combined with appropriate mechanisms for oversight by independent bodies or judicial authorities to ensure full protection of fundamental rights." We have seen how certain competent authorities duck replying - courts per CFREU, the treaties and the general principles of EU law, courts must reply, otherwise they are not courts.

5. "Member States consider that EU legislation should not define the concept of ’serious crime‘ " This is an interesting take that allows any member state crime to be defined as serious.

6. "Member States consider that targeted data retention would be insufficient to achieve a good outcome for the investigations, since law enforcement authorities will not always know in advance by whom, when, and where a crime is going to be committed."

7. "Member States also mention the importance of aligning future data retention rules with existing ... regulation in the field of consumer protection." So we break consent for supposedly crime investigation purposes but we also want it applied in civil actions. Using the power to compel under criminal law for civil actions, that's something

8. "Some Member States and the EU Counter-terrorism coordinator agree that over-the-top (OTT) services should be subject to retention obligations due to their dominance in communications "

9. "Most Member States express general support for future legislation to have the broadest possible scope of application"

10. "Other Member States point out that the system should be based on general retention combined with robust access safeguards." So back to the wording of the old directive in essence.

11. So they want what they had in the past. They are talking about subjecting correspondence that is transported through technological means, to a "mandatory" retention obligation, yet no one seems to even assess the implications for software developers in regards to their freedom speech in terms of writing software and the conscientious objections they might have with a measure of a broadest scope of application (indiscriminate). There isn't any assessment either regarding the (compelled) self-incrimination part, which is instituted by such regime, because any party to a correspondence would be compelled under criminal law, to forcibly disclose and make available self incriminating correspondence, even in civil proceedings.

What do they consider to be a VPN provider? Anyone who sells access to exit nodes? Because I can’t see how they could require point to point VPN logging, nor requiring logging be baked into VPN software with no way to disable it.