UK Politicians Getting Serious About Ending End-To-End Encryption
Last week we noted that there was some fairly mixed up pressure mounting on UK politicians to block encryption from some confused charities which (falsely) thought that ending encryption would somehow protect children. We also noted that many of the politicians pushing to end encryption... were using encrypted messaging themselves in an effort to dodge public records requests.
And now more news is coming that the UK government is getting serious about ending encryption. UK Home Secretary Priti Patel -- who has been pushing to end encryption for a while now -- seems to be using the misguided statement from the charity mentioned above, the National Society for the Prevention of Cruelty to Children (NSPCC), as an excuse to bring about the end of true end-to-end encryption in the UK:
Patel will headline an April 19 roundtable organised by the National Society for the Prevention of Cruelty to Children (NSPCC), according to a draft invitation seen by WIRED. The event is set to be deeply critical of the encryption standard, which makes it harder for investigators and technology companies to monitor communications between people and detect child grooming or illicit content, including terror or child abuse imagery.
And then it will just be more nonsense:
During the event, the NSPCC will unveil a report on end-to-end encryption by PA Consulting, a UK firm that has advised the UK’s Department for Digital Culture Media and Sport (DCMS) on the forthcoming Online Safety regulation. An early draft of the report, seen by WIRED, says that increased usage of end-to-end encryption would protect adults’ privacy at the expense of children’s safety, and that any strategy adopted by technology companies to mitigate the effect of end-to-end encryption will “almost certainly be less effective than the current ability to scan for harmful content.”
The report also suggests that the government devise regulation “expressly targeting encryption”, in order to prevent technology companies from “engineer[ing] away” their ability to police illegal communications. It recommends that the upcoming Online Safety Bill – which will impose a duty of care on online platforms – make it compulsory for tech companies to share data about online child abuse, as opposed to voluntary.
As has become common with these things the language here is presented in a manner that pretends it's not the end of end-to-end encryption. They say things like "companies just need to provide law enforcement a way in" or that they will have a "duty of care to share data," ignoring that the only way to do this is not to use end-to-end encryption, but to completely break it in a way that makes everyone -- including children -- much more vulnerable.
Pushing back against this nonsense, the Open Rights Group (ORG) in the UK has called this out for what it obviously is: the UK's plan to kill end-to-end encryption.
If, as the Wired piece suggests, Government is inclined to compel Facebook to break encryption, then this will send a strong message to all of us – regardless of what messaging service we choose to use – about our rights to privacy and freedom from surveillance. It will send an equally strong message to companies providing communication platforms in the UK, whether large or small, about what they can expect from the UK government in the years to come.
The circulation of child abuse images, and the uses of tools by criminals, absolutely need to be addressed. However there are many options to deal with this effectively, ranging from targeted cracking of devices through to infiltration of groups, and at scale, the use of metadata analysis to find malicious actors; this latter technique is already employed by WhatsApp and many other companies relating to abusive material. While Government does need to ensure these methods work, it is far from obvious that equipment interference, and the acquisition of bulk communications data, are the only reasonable means to deliver its aims.
We have known for many years that it was not a matter of if, but when, the UK government and Home Office would seek to restrict the use of encryption. Their intentions have been publicly stated for quite some time, alongside similar gestures by other countries in the Five Eyes surveillance alliance.
The Wired piece also highlights a fear that the UK government might try to enforce all this in secret -- using a secret order (the equivalent of an NSL here in the states) to force the companies to break encryption while gagging them from talking about it. ORG is, quite reasonably, raising the alarm on that possibility too:
A company which is subject to a TCN is legally barred not only from discussing the specifics of the notice, but from disclosing whether the notice exists at all. Any employee of a company subject to a TCN who disclosed that one existed would be subjected to criminal penalties for breaking a gagging order. The powers also appear to apply to the use of “warrant canaries”.
Because of that, we do not know how many TCNs have been applied to date under the Investigatory Powers Act, we do not know whether they have proven effective, and we do not know when they were suspended. TCNs are applied under a level of secrecy which, legally, cannot even be reported. The only thing you will ever learn about the insinuation that a TCN exists is in the annual reports of the Investigatory Powers Commissioner’s Office, who can only discuss the fact that they exercised oversight over one. No further details can be disclosed.
Quite simply, this means that if a TCN were to be applied, any private message exchanged on Facebook/WhatsApp could be subject to monitoring and surveillance, with no notice, recourse, or transparency, and the company would be legally barred from disclosing the fact that the surveillance exists.
As ORG requests, Parliament needs to demand transparency and accountability regarding what the Home Office is doing with regard to encryption, as it impacts the privacy and safety of everyone -- including those anti-encryption politicians who are still using encryption.