{"id":342128,"date":"2017-05-28T00:00:41","date_gmt":"2017-05-27T16:00:41","guid":{"rendered":"http:\/\/techcrunch.com\/?p=1495150"},"modified":"2017-05-28T00:00:41","modified_gmt":"2017-05-27T16:00:41","slug":"could-the-uk-be-about-to-break-end-to-end-encryption","status":"publish","type":"post","link":"https:\/\/people.utm.my\/asmawisham\/could-the-uk-be-about-to-break-end-to-end-encryption\/","title":{"rendered":"Could the UK be about to break end-to-end encryption?"},"content":{"rendered":"

Once again there are indications the UK government\u00a0intends to use the law to lean on\u00a0encryption. A report in The Sun<\/a>\u00a0this week quoted a Conservative\u00a0minister saying that should the government be re-elected, which polls suggest it will, it will move quickly to compel social media\u00a0firms to hand over decrypted data.<\/p>\n

The paper quoted an unnamed government minister saying: \u201cThe social media companies have been laughing in our faces for too long\u201d,\u00a0and suggested\u00a0that all tech companies with more than\u00a010,000 users will\u00a0face having to significantly adapt their technology to comply with the decryption law.<\/p>\n

The relevant Statutory Instrument, to enable UK government agencies to obtain warranted access to decrypted data from communications service providers, currently sitting\u00a0in draft form<\/a>, will be voted\u00a0through parliament within weeks of a new government taking office after the June 8 general election, according to the report.<\/p>\n

As is typically the case when strong encryption comes back under political pressure in the modern\u00a0Internet age, this leaked hint of an impending \u2018crack down\u2019 on tech firms came hard on the heels of another terrorist attack in the UK \u2014 after a suicide bomber blew himself up at a concert in Manchester on Monday evening. The underlying argument is that intelligence agencies need the power to be able to break encryption to combat\u00a0terrorism.<\/p>\n

Strong encryption,\u00a0cryptic answers<\/strong><\/h2>\n

The problem \u2014 as always in this recurring data access\u00a0vs strong encryption story \u2014 is that companies that\u00a0use end-to-end encryption to safeguard user data are not able to hand over information in a readable form as they do not hold\u00a0the encryption keys to be able to decrypt it.<\/p>\n

So the question remains\u00a0how can\u00a0the government compel companies to hand over information\u00a0they don\u2019t have access to?<\/p>\n

Will it do so by outlawing the use of end-to-end encryption? Or by forcing companies to build in backdoors \u2014 thereby breaking strong encryption in secret? The latter\u00a0would arguably be worse since government\u00a0would be opening app users up to potential security vulnerabilities without letting them\u00a0know their security is being compromised.<\/p>\n

The UK government has been rubbing\u00a0around this issue for years. At the back end of last year it passed the Investigatory Powers Act, which threw up questions about the looming legal\u00a0implications for\u00a0encrypted communications in the UK\u00a0\u2014 owing to a provision\u00a0that states communications service providers may\u00a0be required to \u201cremove electronic protection of data\u201d.<\/p>\n

It\u2019s those powers that ministers are apparently intending to draw on\u00a0to break social media firms\u2019 use of strong encryption.<\/p>\n

During the scrutiny process of the IP bill\u00a0last year, ministers led a merry dance around the implications of the\u00a0\u201celectronic protection\u201d removal\u00a0clause for e2e encryption<\/a>. The best interpretation of which was that\u00a0the government was trying to frame a law that\u00a0encouraged\u00a0tech platforms to eschew the use of strong\u00a0encryption in order not to risk falling outside the scope of an unclear law.<\/p>\n

\u201cHe seems to be implying that providers can only provide encryption which can be broken and therefore can\u2019t be end-to-end encryption,\u201d was\u00a0Lord Strasburger\u2019s assessment of the government response to questions on the topic last\u00a0July.<\/p>\n

No clarity has emerged since then. The situation is still\u00a0ongoing fuzziness<\/a>\u00a0about the legality of\u00a0e2e encryption in the UK. To break or not to break, that is the question?<\/p>\n

Arguably, as Strasburger suggested, this\u00a0is strategic; intentional obfuscation on the part of the UK government \u2014\u00a0to spread FUD as a strategy to try to discourage use of a technology their intelligence agencies view as a barrier to their work.<\/p>\n

But the problem for the government is that use of e2e encryption has been growing<\/a>\u00a0in recent years as awareness of both privacy risks and cyber security threats\u00a0have stepped up,\u00a0thanks to\u00a0data breach scandal after data breach scandal, as well as revelations of the extent of government agencies\u2019 surveillance programs\u00a0following the 2013 Snowden disclosures.<\/p>\n

Not holding encryption keys allows tech firms\u00a0to step outside the\u00a0controversy related to\u00a0digital snooping and to bolster the security cred of their services. Yet, as a result, popular services that have championed strong encryption are\u00a0increasingly finding themselves in\u00a0the crosshairs of government agencies. Be it the Facebook Messenger app, or Facebook\u2019s WhatsApp messaging platform, or Apple\u2019s iOS and iMessage.<\/p>\n

After another terror attack in London in March<\/a>, UK Home Secretary Amber Rudd was quick to point the finger of blame at social media firms \u2014 saying they should not provide \u201ca secret place for terrorists to communicate with each other\u201d, and asserting:\u00a0\u201cWe need to make sure that our intelligence services have the ability to get into situations like encrypted WhatsApp.\u201d<\/p>\n

Of course she did not explain how<\/em> intelligence agencies intended to \u201cget into\u201d encrypted WhatsApp. And that earlier political pressure\u00a0on encryption\u00a0morphed into calls\u00a0for social media firms\u00a0to be more proactive about removing terrorist content from their public channels<\/a>. At least publicly. Discussions held vis-a-vis\u00a0encryption were not made public.<\/p>\n

But again, if the latest reporting is to be believed, Rudd is intent on breaking strong encryption after all.<\/p>\n

Exceptional access, unacceptable risk\u00a0<\/strong><\/h2>\n

It\u2019s worth revisiting\u00a0Keys Under Doormats<\/a><\/em>; aka the paper written by a group of\u00a0storied security researchers back in 2015, re-examining the notion of\u00a0so-called \u201cexceptional access\u201d for security agencies to encryption systems \u2014 at a time when debate\u00a0had also been re-ignited by politicians calling for \u2018no safe spaces for terrorists\u2019.<\/p>\n

The report examined whether it is \u201ctechnically and operationally feasible to meet law enforcement\u2019s call for exceptional access without causing large-scale security vulnerabilities\u201d \u2014 posing the question of whether it\u2019s\u00a0possible to build in such exceptional access without creating unacceptable risk?<\/p>\n

Their\u00a0conclusion was\u00a0clear: exceptional access without unacceptable risk\u00a0is not possible, they wrote. Nor is it clear it would even be feasible\u00a0given how the\u00a0services in question criss-cross international borders.<\/p>\n

Here\u2019s one key paragraph from the paper<\/a>:<\/p>\n

\n

Designing exceptional access into today\u2019s information services and applications will give rise to a range of critical security risks. First, major efforts that the industry is making to improve security will be undermined and reversed. Providing access over any period of time to thousands of law enforcement agencies will necessarily increase the risk that intruders will hijack the exceptional access mechanisms. If law enforcement needs to look backwards at encrypted data for one year, then one year\u2019s worth of data will be put at risk. If law enforcement wants to assure itself real time access to communications streams, then intruders will have an easier time getting access in real time, too. This is a trade-off space in which law enforcement cannot be guaranteed access without creating serious risk that criminal intruders will gain the same access. Second, the challenge of guaranteeing access to multiple law enforcement agencies in multiple countries is enormously complex. It is likely to be prohibitively expensive and also an intractable foreign affairs problem.<\/p>\n<\/blockquote>\n

They further concluded:<\/p>\n

\n

From a public policy perspective, there is an argument for giving law enforcement the best possible tools to investigate crime, subject to due process and the rule of law. But a careful scientific analysis of the likely impact of such demands must distinguish what might be desirable from what is technically possible. In this regard, a proposal to regulate encryption and guarantee law enforcement access centrally feels rather like a proposal to require that all airplanes can be controlled from the ground. While this might be desirable in the case of a hijacking or a suicidal pilot, a clear-eyed assessment of how one could design such a capability reveals enormous technical and operational complexity, international scope, large costs, and massive risks \u2014 so much so that such proposals, though occasionally made, are not really taken seriously.<\/p>\n<\/blockquote>\n

One thing the paper did\u00a0not consider is that much politicking can be\u00a0primarily intended as a\u00a0theatre of influence for winning\u00a0votes from spectators.<\/p>\n