"The UK's Online Safety Bill isn't about safety or privacy, it's both."
These were the words Stephen Almond, Director of Technology and Innovation at the Information Commissioner's Office (ICO), used to describe the controversial proposed legislation during a talk at the annual IAPP's conference in London on March 9th.
"What happens when private messages are being asked to be monitored?" was the question raised immediately after by Monica Horten, Policy Manager at UK-based digital campaigning organization Open Rights Group. She continued by pointing out how breaking into encryption would practically mean "compromising people's privacy."
Tension between public safety and user privacy has been dominating the debate around the new legislation trying to make the internet a safer place, especially for children.
Signal has threatened to quit UK if the Bill becomes law in its current form, while WhatsApp said it would rather face a ban than weaken its security.
Even worse, the UK isn't the only country where end-to-end encryption is under attack.
The European Union is trying to regulate something similar with the so-called Chat Control law, which requires encrypted messaging apps to allow authorities to scan private chats for material related to child abuse or terrorism.
We talked to some of the companies behind some of the most popular encrypted software, like VPN services and secure email providers, to understand what's at stake for the security of their users online. Here's what they said.
By definition, encryption is the process of scrambling data into an unreadable form in order to protect it from unauthorized access. This means that no one, even the provider itself, can see what users send to each other.
It then sounds like an oxymoron the proposal of "scanning private encrypted messages," de-facto annulling what this technology aims to do in the first place.
The reality is that governments have long been seeing encryption as an obstacle to law enforcement investigations.
The idea of a "responsible encryption (opens in new tab)" is something that was coined by US deputy attorney general Rod Rosenstein in 2017. What this means is that using encrypted private chats is OK, but authorities should be able to access those to fight back crime and terrorism - for everyone's sake, of course.
Now, the threats against encryption seem to be as real as never before.
According to the providers behind encrypted services, undermining such a technology isn't going to make the internet safer. Quite the opposite, actually.
"If you don't have encryption, you cannot have privacy when you speak to someone using a device," said Jan Jonsson, CEO at Mullvad, one of the most secure VPN providers on the market. "It's an essential part."
Short for Virtual Private Network, VPNs are based on encryption to secure people's connections and all their data leaving a device. And, even though such a software isn't yet the target of these regulations, Jonsson thinks they could potentially become in the future.
All the providers we talked to also believe that undermining encryption will consequently compromise the values upon which worldwide democracies are based on.
This could ultimately make the lives of citizens more unsafe, building up the base for a blanket mass surveillance society.
"It's overwhelming how politicians in the in the 21st century still think that we need to have the Crypto Wars, still need to break encryption and still haven't understood how important the right to privacy is for a democracy," the founder of encrypted email provider Tutanota, Matthias Pfau, told TechRadar.
Jonsson from Mullvad also argued that a lack of privacy could end up halting the process of development in a democratic country - as much offline as it is online.
"If you have the right to privacy in your home, you should also have the possibility to have a private room on the Internet," he said. "It doesn't make any sense to have two different views and laws between online and offline. It isn't going to work.
"There are only two reasons to promote such laws. Either politicians don't know what they are doing, or that's just an excuse to monitor the whole population."
Another point critics have been stressing is the degree of effectiveness of such a system in practical terms.Providers repeatedly pointed out the concrete possibility for criminals to find ways around this.
"It's like trying to put a genie back in its bottle," Matthew Hodgson, CEO and CTO at UK-based secure communications company Element, told TechRadar. "You cannot try to legislate encryption and, if you do, it will just make life miserable and unsafe for your citizens. Meanwhile, everybody else will just ignore it and keep using encryption anyway via an illegal app."
Put it simply, bad actors will always find a way to break the rules.
Those engaging in illegal activities online will find a way to keep doing so, and commentators are also warning of the danger of creating a backdoor into encrypted communication.
On this point, Pfau from Tutanota said: "We have to keep in mind that aggressors are becoming more and more competent, especially given the threats from Russia and China. If we break the encryption in countries like the UK, then we will open the doors for these aggressors and there will be no means to defend our digital life."
That's something Hodgson is particularly worried about, too.
Element is a company providing decentralized encrypted communication systems to organizations seeking to run their own alternatives to Signal, Slack or other mainstream services. Due to its highly customizable and secure software, it's especially popular among governmental bodies including the Ministry of Defense in Ukraine.
"You've basically done the work for the enemy. They can just break into the moderation system, or they can pay off one of the moderators, and suddenly they have access to all of this incredibly sensitive information that otherwise they would never have been able to get," he said.
"This is the key example of why undermining the encryption in order to chase the bad guys actually gives the bad guys a really good route for going attacking the good guys."
Even worse than individual exploiting backdoor into encryption for their own gain, authoritarian countries around the world could draw inspiration from the UK and the EU for developing a similar system.
And, even if we want to believe the benevolent intentions of Western democracies, who's going to vouch for Iranian, Russian or Chinese authorities on the matter?
"It's an incredibly destructive, dangerous piece of technology," said Hodgson. "Not only does it search for child abuse and terrorism, but perhaps it couldalso look for ethnic traits. And, before you know it, you've created a system for racial profiling or worse.
"So, even if the UK's intentions are benign, the precedent it sets and the technology it uses will absolutely be used for controlling populations and enabling human rights abuses of the worst possible kind."
Being that the risk of compromising encryption seems to overcome the benefits, experts believe that other solutions might be more doable instead - especially around child abuse.
Either politicians don't know what they are doing, or that's just an excuse to monitor the whole population.
For instance, Jonsson from Mullvad believe that investing in more police officers and teachers trained to cope with these incidents would create a better environment for both persecuting perpetrators and supporting victims.
Also, being that in the UK the numbers of child abuse perpetrators have increased dramatically (opens in new tab), Hodgson from Element believes that the problem should be address at its roots, instead of finding additional ways to investigate.
"The solution is not to go and put a CCTV camera in everyone's bedroom in case they do something illegal," he said. "I would argue that you can still do a lot of infiltration and frankly education, because it's clearly a social problem. What you don't do is blanket surveillance."
While were waiting to see how the Online Safety Bill saga will end up, providers are getting ready to face the worse.
Signal said it would leave the UK if it was required to undermine encryption. Other services like WhatsApp and Tutanota are opting for a different route instead: waiting for the government to block their service for not obeying with the new law.
"By not complying, we want to force the UK government to actively block access to the service if they want to go through with it," said Pfau, arguing that many services are likely to take a similar stance.
"In the end, the UK will need to put up a firewall, just like China, to make sure that their citizens can't have secure communication."
Outside the Great Britain, Mullvad is investing money and energy to raise awareness around the risks of the EU Chat Control.
The VPN provider sent over 300 emails to politicians and journalists. Last week, it put up banners in Stockholm airport so that politicians could see it right after they landed before voting on the regulation. Other posters have been spreading around the streets of both Stockholm and Guttenberg, too.
"Mullvad is usually a very silent company. This is probably the first time we really got mad enough to speak out," said Jonsson. He doesn't exclude extending the campaign to other European countries as well if needed.
A more positive take comes from Andy Yen, Proton's founder and CEO behind both the encrypted ProtonMail and Proton VPN, who claimed to be confident that following further debates "these proposals will probably become moderated."
"If you look at the latest version of the Online Safety Bill, it's already significantly improved from the first version. This is why I think that more effort on the public policy side can yield results. That's something we watch carefully," he said.
"We're not going to compromise encryption, and being based in Switzerland gives us a little bit of extra protection to continue defending encryption, even in the face of such threats."
Read this article:
Encryption is under attack, and the Online Safety Bill isn't the only culprit - TechRadar
- WhatsApp overhauling status tab with encrypted Snapchat Stories-like feature - 9 to 5 Mac [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- GOP demands inquiry into EPA use of encrypted messaging apps - CNET [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- Encryption Apps Help White House Staffers Leakand Maybe Break the Law - WIRED [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- World Wide Web Creator Calls for Internet Decentralization & Encryption - The Data Center Journal [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- What It Means to Have an 'Adult' Conversation on Encryption - Pacific Standard [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- Confide in me! Encryption app leaks sensitive info from Washington DC - SC Magazine UK [Last Updated On: February 21st, 2017] [Originally Added On: February 21st, 2017]
- Gmail v7.2 Prepares to Add Support for S/MIME Enhanced Encryption - XDA Developers (blog) [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Top 6 Data Encryption Solutions - The Merkle [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Your Guide to the Encryption Debate - Consumer Reports - ConsumerReports.org [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Google helps put aging SHA-1 encryption out to pasture - Engadget [Last Updated On: February 26th, 2017] [Originally Added On: February 26th, 2017]
- Decipher your Encryption Challenges - Infosecurity Magazine [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- How the Politics of Encryption Affects Government Adoption - Freedom to Tinker [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- How Encryption Makes Your Sensitive Cloud-Based Data an Asset, Not a Liability - Security Intelligence (blog) [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- Set up VMware VM Encryption for hypervisor-level security - TechTarget [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- How The Media Are Using Encryption Tools To Collect Anonymous Tips - NPR [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- Encryption patent that roiled Newegg is dead on appeal | Ars Technica - Ars Technica [Last Updated On: February 28th, 2017] [Originally Added On: February 28th, 2017]
- Research proposes 'full-journey' email encryption - The Stack [Last Updated On: March 1st, 2017] [Originally Added On: March 1st, 2017]
- Database-as-a-service platform introduces encryption-at-rest - BetaNews [Last Updated On: March 1st, 2017] [Originally Added On: March 1st, 2017]
- Encrypted Messaging Service 'Signal' Adds Video Call Option - Top Tech News [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- Germany, France lobby hard for terror-busting encryption backdoors ... - The Register [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- How to Send Encrypted Nudes, a Guide for the Discerning Lover - Inverse [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- Ironclad Encryption Corporation Announces New Ticker Symbol OTCQB: IRNC - Yahoo Finance [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- The Best Email Encryption Software of 2017 | Top Ten Reviews [Last Updated On: March 2nd, 2017] [Originally Added On: March 2nd, 2017]
- No, you shouldn't delete Signal or other encrypted apps - TechCrunch [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Best encryption software: Top 5 - Computer Business Review [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Encryption Backdoors, Vault 7, and the Jurassic Park Rule of Internet Security - Just Security [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- That Encrypted Chat App the White House Liked? Full of Holes - WIRED [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- What the CIA WikiLeaks Dump Tells Us: Encryption Works - New York Times [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Snake-Oil Alert Encryption Does Not Prevent Mass-Snooping - Center for Research on Globalization [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Customer Letter - Apple [Last Updated On: March 11th, 2017] [Originally Added On: March 11th, 2017]
- Don't Let WikiLeaks Scare You Off of Signal and Other Encrypted Chat Apps - WIRED [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- BT to offer customers encryption service for data - Capacity Media (registration) [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- Encryption - technet.microsoft.com [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- Use FileVault to encrypt the startup disk on ... - Apple Support [Last Updated On: March 12th, 2017] [Originally Added On: March 12th, 2017]
- Viber launches secret chats to go beyond encryption - SlashGear [Last Updated On: March 13th, 2017] [Originally Added On: March 13th, 2017]
- Zix wins 5-vendor email encryption shootout - Network World [Last Updated On: March 13th, 2017] [Originally Added On: March 13th, 2017]
- A lesson from the CIA WikiLeaks dump: Encryption works - The Seattle Times [Last Updated On: March 13th, 2017] [Originally Added On: March 13th, 2017]
- What the CIA WikiLeaks Dump Tells Us: Encryption Works - NewsFactor Network [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Panicked Secret Service Says It Lost Encrypted Laptop But It's Fine, Everything's Fine - Gizmodo [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Google Cloud adds new customer-supplied encryption key partners ... - ZDNet [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Preseeding Full Disk Encryption - Linux Journal [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- Bypassing encryption: 'Lawful hacking' is the next frontier of law enforcement technology - Boston Business Journal [Last Updated On: March 18th, 2017] [Originally Added On: March 18th, 2017]
- SecurityBrief NZ - Gemalto introduces on-prem encryption key solution for 'highly regulated' organisations - SecurityBrief NZ [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- 'Always Be Concerned': US Court Slaps Down Fifth Amendment Defense of Encryption - Sputnik International [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- Quantum Key System Uses Unbreakable Light-Based Encryption to Secure Data - Photonics.com [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- Wikileaks Only Told You Half The Story -- Why Encryption Matters More Than Ever - Forbes [Last Updated On: March 21st, 2017] [Originally Added On: March 21st, 2017]
- EPA Sued For Withholding Info On Encrypted Text Messages | The ... - Daily Caller [Last Updated On: March 22nd, 2017] [Originally Added On: March 22nd, 2017]
- Opinion Data encryption efforts ramp up in face of growing security threats - Information Management [Last Updated On: March 22nd, 2017] [Originally Added On: March 22nd, 2017]
- Bypassing encryption: Lawful hacking is the next frontier of law enforcement technology - Salon [Last Updated On: March 22nd, 2017] [Originally Added On: March 22nd, 2017]
- NeuVector Announces Container Visualization, Encryption, and Security Solution for NGINX Plus - DABCC.com [Last Updated On: March 23rd, 2017] [Originally Added On: March 23rd, 2017]
- Is encryption one of the required HIPAA implementation specifications? - TechTarget [Last Updated On: March 23rd, 2017] [Originally Added On: March 23rd, 2017]
- Paper Spells Out Tech, Legal Options for Encryption Workarounds - Threatpost [Last Updated On: March 23rd, 2017] [Originally Added On: March 23rd, 2017]
- Encryption debate needs to be nuanced, says FBI's Comey - TechTarget [Last Updated On: March 25th, 2017] [Originally Added On: March 25th, 2017]
- Comey Renews Debate Over Encryption - 550 KTSA [Last Updated On: March 25th, 2017] [Originally Added On: March 25th, 2017]
- UK minister says encryption on messaging services is unacceptable - Reuters [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- The why and how of encrypting files on your Android smartphone - Phoenix Sun [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- UK targets WhatsApp encryption after London attack - Yahoo News [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- Critical flaw alert! Stop using JSON encryption | InfoWorld - InfoWorld [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- SecureMyEmail is email encryption for everyone - TechRepublic - TechRepublic [Last Updated On: March 28th, 2017] [Originally Added On: March 28th, 2017]
- Apple iOS 10.3 will introduce encryption which makes it MORE difficult for cops and spooks to crack into ISIS nuts ... - The Sun [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- How to Analyze An Encryption Access Proposal - Freedom to Tinker [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- Questions for the FBI on Encryption Mandates - Freedom to Tinker [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- Justice Department anti-terror chief keeps pressing on encryption - Politico (blog) [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- UK government can force encryption removal, but fears losing, experts say - The Guardian [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- Encryption FAQs [Last Updated On: March 29th, 2017] [Originally Added On: March 29th, 2017]
- Why isn't US military email protected by standard encryption tech? - Naked Security [Last Updated On: April 9th, 2017] [Originally Added On: April 9th, 2017]
- How have ARM TrustZone flaws affected Android encryption? - TechTarget [Last Updated On: April 9th, 2017] [Originally Added On: April 9th, 2017]
- Keeping the enterprise secure in the age of mass encryption - Information Age [Last Updated On: April 9th, 2017] [Originally Added On: April 9th, 2017]
- Lack of encryption led to Dallas siren hack - WFAA [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- Internet Society tells G20 nations: The web must be fully encrypted - The Register [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- Make Encryption Ubiquitous, Says Internet Society - Infosecurity ... - Infosecurity Magazine [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- Can we encrypt the web while giving governments a backdoor to snoop? - SC Magazine UK [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- Why we need to encrypt everything - InfoWorld [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- Hacked Dallas sirens get extra encryption to fend off future attacks - Computerworld [Last Updated On: April 12th, 2017] [Originally Added On: April 12th, 2017]
- SHA-1 Encryption Has Been Broken: Now What? - Forbes [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- Hewlett Packard Enterprise touts encryption tool for federal clients - The Hill [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- Encryption on the Rise in Age of Cloud - Infosecurity Magazine - Infosecurity Magazine [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- Lawmaker Pushes Bill That Requires Encryption by Pennsylvania State Employees - Government Technology [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- Disk encryption - Wikipedia [Last Updated On: April 14th, 2017] [Originally Added On: April 14th, 2017]
- The apps to use if you want to keep your messages private - Recode [Last Updated On: April 15th, 2017] [Originally Added On: April 15th, 2017]