The european union moves closer to an encryption ban

[Hydrogen]

The European Union (EU) is inching closer to formally ending the use of end-to-end encryption by web platforms such as Signal and WhatsApp, following a spate of Islamist terror attacks in Austria and France.

In a draft resolution document leaked to Austrian TV network ORF, which can be read in full here, the EU said it recognised the value of encryption as a “necessary means of protecting fundamental rights”, but at the same time “competent authorities in the area of security and criminal justice” needed to be able to exercise their lawful powers in the course of their work.

Previous European Council conclusions delivered at the beginning of October declared that the bloc planned to “leverage its tools and regulatory powers to help shape global rules and standards”, and that funds from its Recovery and Resilience Facility are to be used to enhance the EU’s ability to protect against cyber threats, to provide for a secure comms environment – possibly through quantum encryption – and, crucially, “to ensure access to data for judicial and law enforcement processes”.

The document states: “Law enforcement is increasingly dependent on access to electronic evidence to effectively fight terrorism, organised crime, child sexual abuse (particularly its online aspects), as well as a variety of cyber-enabled crimes. For competent authorities, access to electronic evidence is not only essential to conduct successful investigations and thereby bring criminals to justice, but also to protect victims and help ensure security.

“The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitisation and in protection of fundamental rights and should be promoted and developed.

“Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organised crimes and terrorism, including in the digital world, are extremely important. Any actions taken have to balance these interests carefully.”

ORF’s reporting noted the similarity in some of the document’s wording to the October 2020 statement from the Anglophone Five Eyes surveillance alliance, notably around enabling law enforcement access to content in a readable and usable format where authorisation is lawfully issued.

Subject to the receipt of further comments and wording suggestions by midday on Thursday 12 November, the revised text of the resolution is set to be presented to the Council Working Group on Cooperation in the National Security Sector on 19 November and then to the Council of Permanent Representatives of the EU Member States.

ProPrivacy’s Ray Walsh described the move as a massive threat to data privacy and a disappointing change given that the EU has previously been, by and large, in favour of privacy for European citizens.

“Providing backdoors into people’s messages creates ongoing access for government agencies to everyone’s private messages, without reducing the ability for criminals to send encrypted messages via other covert means on the dark web,” said Walsh.

“Removing strong encryption from consumer-facing platforms is detrimental to large numbers of people, including journalists, human right activists, and even the politicians themselves who are rushing through this legislation.”

Competent cyber security authorities are largely now in agreement that the contention that strong encryption technology can co-exist with purposely built backdoors is completely contrary to the principles of cryptography – secure encryption means that only those who control data can access it, and attempting to change this introduces cyber security vulnerabilities.

“Robust encryption relies on the secure transmission of data between two parties using keys that are only known to them,” said Walsh. “Removing strong end-to-end encryption creates vulnerabilities that can be exploited not just by EU government agencies, but also by anybody – including hackers, cyber criminals and state-sanctioned operatives from foreign governments – with the technical ability to discover that purposefully created backdoor.”

https://www.computerweekly.com/news/252491755/EU-moves-closer-to-encryption-ban-after-Austria-France-attacks

....



It appears we have a controversial topic developing here. Similar proposals were made in the united states last year, after law enforcement had difficulty accessing iphones containing evidence in criminal investigations. Now it appears the european union is making a similar push. It represents a sharp contrast to previous EU promises to protect end user privacy and data.

I expect some in china will enthusiastically celebrate this move. While others may complain it opens the door to more explosive and destructive leaks than anything Julian Assange and wikileaks published.

[Upgrade00]

This is indeed a controversial topic and in my opinion, its disadvantages far outweighs the advantages.
Privacy and data protection is a fundamental right and tampering with these, through creating a back door or completely breaking the encryption would have lots of consequences and as mentioned in the article; would not really solve the problem as malicious users would simply avoid such platforms and look for more covert meant of sending messages.

Trusting the government to go through private information assumes the position that the system is incorruptible which unfortunately is not the case, and in the wrong hands such back door can be heavily exploited. (Wrong hands also includes hackers who would be able to navigate this back door)

I expect some in china will enthusiastically celebrate this move. While others may complain it opens the door to more explosive and destructive leaks than anything Julian Assange and wikileaks published.

True, dictatorship like rulers would favour such a development.
In my topic about Rising tensions between Nations I discussed the face off between the U.S and China with the United States accusing the Chinese government of storing user data using apps which operates from China leading to bans on such apps. In a situation where user data is fully accessible by the government under the guise of 'security threat' it could greatly increase tensions and spying by countries on each other.

[oHnK]

This is the most controversial form of policy this year, a very strange policy, to break the chain of terrorists, instead removing everyone's privacy rights and removing everyone's privacy security.  Isn't it that the benefits are much lower than the bad effects.  Isn't this like giving an entrance to thieves to take everything in their favor.  Obviously this is detrimental to everyone even in the name of common fundamental interests.  The risk is higher than the benefit received is not strange to apply.  Whether breaking the chain of terrorists can only be done with this policy, no other ways, what's the use of detectives in their country.

[gantez]

think this policy should not be continued.

I think this is going to be a fight against the blockchain. It should be discontinued. The EU should support the blockchain technology to grow and not to take up policies that will make their citizens limited in the use of digital currency.

[Ucy]

“Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organised crimes and terrorism, including in the digital world, are extremely important. Any actions taken have to balance these interests carefully.”

....

I think this can be solve pretty well on a well decentralized/shared network with verified but masked/hidden personal identities . Everyone should control his/her encryption keys for their private/sensitive data on the networks... when a serious crime is committed by a network member, he/she loses the encryption right and the private data can be accessed by security agencies. The security agencies activities on the network should be immutable though, for future references.
So,  encryption should be guaranteed for all members of the network as long as they are innocent or committed no serious crime.

[Fesatmas]

This is the most controversial form of policy this year, a very strange policy, to break the chain of terrorists, instead removing everyone's privacy rights and removing everyone's privacy security.  Isn't it that the benefits are much lower than the bad effects.  Isn't this like giving an entrance to thieves to take everything in their favor.  Obviously this is detrimental to everyone even in the name of common fundamental interests.  The risk is higher than the benefit received is not strange to apply.  Whether breaking the chain of terrorists can only be done with this policy, no other ways, what's the use of detectives in their country.

in my understanding this happens because the security of the country's system is threatened, and therefore the European Union is taking quite serious action. It is an improvement that there are some things that should be protected by the state. indeed on the other hand this incident cannot be accepted easily. Of course if I as a citizen of the European Union will feel disturbed, where my freedom and privacy rights are limited. However, if this reason becomes a reference in the interests of national security so as not to be easily deceived, in my opinion it is fine. And if the situation is no longer threatened, as it is now, the government must immediately end restrictions on the privacy of its citizens.

[Ucy]

Trusting the government to go through private information assumes the position that the system is incorruptible which unfortunately is not the case, and in the wrong hands such back door can be heavily exploited. (Wrong hands also includes hackers who would be able to navigate this back door)

This is part of the reasons I really can't trust any network without immutablity, transparency, clear rules, open consensus, data ownership by their owners... no matter how decentralized it is. Your data (or your peers data/communication with you) could be altered, you could be framed for anything and wouldn't be able to do much about it without strong evidence

[Husires]

Putting back doors on phones is a threat to privacy, especially since those who control this data are not subject to legal accountability or do so after a court decision.
Decryption agencies can collaborate with those companies or break it with brute force, but this requires more resources that those parties are not willing to pay.
Why is there no binding decision for companies to comply with all judgments issued by the judiciary regarding access to data?

[Oshosondy]

The governments as perfect as they think they are, they have not yet curtail the money laundering and terrorism with their KYC, AML and CTF terms and policies, with how perfect they are, criminals still make use of their fiats for criminalized purposes. Now, they want to end privacy finally in a way it will be possible for hackers to steal peoples information easily, this people is moving to the world where there will be no privacy, and the more they do it, the more the corrupt people are bypassing and succeeding in their malicious ways.

[wxa7115]

It appears we have a controversial topic developing here. Similar proposals were made in the united states last year, after law enforcement had difficulty accessing iphones containing evidence in criminal investigations. Now it appears the european union is making a similar push. It represents a sharp contrast to previous EU promises to protect end user privacy and data.

I expect some in china will enthusiastically celebrate this move. While others may complain it opens the door to more explosive and destructive leaks than anything Julian Assange and wikileaks published.

We have known that for a long time this was coming, governments simply are not going to tolerate that their citizens do anything without them finding out about it, they are Big Brother and they are not going to allow you to hold any secrets from them.

And while I think it is inevitable that at some point this is passed and people will take their ‘I have nothing to hide' attitude once again they have no way to stop people from using the tools already in place for anyone that is decided to maintain their privacy, the cat is out of the bag and there is no way around it but it seems they want to try, so let them as they will fail anyway.

[The Sceptical Chymist]

“Providing backdoors into people’s messages creates ongoing access for government agencies to everyone’s private messages, without reducing the ability for criminals to send encrypted messages via other covert means on the dark web,” said Walsh.

This is precisely the argument I'd have against what they're trying to do--criminals are not going to stop their activities, and the net result is going to be a decrease in freedom and privacy for everyone with no significant improvement as far as catching criminals. 

This shit drives me nuts--governments want more and more power in the name of fighting [insert moral panic issue here], and the public takes it in the ass while the criminals find other ways of conducting their nefarious business.  I'd like to think something like this would never happen in the US, but I'm not that naive.  They've already been caught spying on citizens illegally, so I wouldn't put anything past them.

Thanks for posting this, OP.

[dothebeats]

They are trying to disrupt the right to privacy of the majority of the people just because they can't do their job cutting the bad guys at its source. Even if they are to implement this sort of authoritarian decree on the EU, terrorist networks will always find its way and collaborate with each other as long as the ones pulling the strings are still out and about. They are just checking to see whether people will permit the government into spying on them and using terrorists activities as justification to such suggestion. What happened to the long years of fighting jihadists, extremists, and terrorists in the Middle East? It's as if those groups are getting stronger as days go by and even if the West and co. pulverize them with countless air strikes and bombing raids.

Friends of the governments with interests on certain sectors may even use this as a form of spying on their competitors, thus leading to more scandals, more leaks, and more meltdowns which could further affect the shape of our global economy and sociopolitical relations that have long been bleak due to differing takes on several sensitive issues.

[BTCappu]

Sometimes we can’t really blame these people for the actions they take, because they are doing these things for safety purposes. It’s just like the issue we are having with Bitcoin when people say that Bitcoin can be used for money laundering and for funding all these terrorist attacks just like the one we have seen happen sometime around these last few months.

All these things are very good, encryption and crypto and all those work of technology, it’s being done to keep us all safe, but at the same time there are evil people who are exploiting these good things for their evil plans and now the government will be forced to look for a means to take these privileges off so that they can be able to know when things are going wrong.

[wxa7115]

“Providing backdoors into people’s messages creates ongoing access for government agencies to everyone’s private messages, without reducing the ability for criminals to send encrypted messages via other covert means on the dark web,” said Walsh.

This is precisely the argument I'd have against what they're trying to do--criminals are not going to stop their activities, and the net result is going to be a decrease in freedom and privacy for everyone with no significant improvement as far as catching criminals. 

This shit drives me nuts--governments want more and more power in the name of fighting [insert moral panic issue here], and the public takes it in the ass while the criminals find other ways of conducting their nefarious business.  I'd like to think something like this would never happen in the US, but I'm not that naive.  They've already been caught spying on citizens illegally, so I wouldn't put anything past them.

Thanks for posting this, OP.

For a long time it has become obvious to me this is nothing but an excuse since it is difficult to believe politicians are as obtuse as they will have to be to believe this is going to curb criminal activity especially from those that run international criminal operations, because even if they were to somehow successfully ban every single software that could be used to hold encrypted communications and erase them out of every single corner of the Internet what it is stopping those criminal operations to develop their own software by hiring a few engineers?

So it seems to me they really want to know every single thing on the lives of their citizens and capturing some criminals is just a bonus  for them.

[DrG]

The governments want to have increasing knowledge and access to everybody's information and activities while at the same time the technology is there to show where they spend money but your average citizen can't even find the budget for their city without googling for hours because the politicians make the information as obtuse as possible. I think it is quite apparent that the criminals are running the show.

[davis196]

Some stupid clerks in the European Union think that they could stop terrorism by spying on everything.
Not going to happen...
The terrorists can simply use platforms,which aren't located in the EU to continue their communication.
I assume that this is just a proposal,so the chance of accepting such encryption ban isn't big,also this encryption ban is going to cover only the messaging platforms,that are using encryption,so the cryptocurrency industry isn't going to be affected.We don't have to worry about Bitcoin,but it sucks that our online privacy might be reduced.

[DrG]

Some stupid clerks in the European Union think that they could stop terrorism by spying on everything.
Not going to happen...
The terrorists can simply use platforms,which aren't located in the EU to continue their communication.
I assume that this is just a proposal,so the chance of accepting such encryption ban isn't big,also this encryption ban is going to cover only the messaging platforms,that are using encryption,so the cryptocurrency industry isn't going to be affected.We don't have to worry about Bitcoin,but it sucks that our online privacy might be reduced.

As with all bans and prohibitions the only ones that will follow the rules are those who feel they have something to lose when doing something criminal - ie regular people and companies. Criminals are by definition people who disregard the laws and what you will see is an increased recruitment of programmers and IT people into the criminal world. All those wonderful gun bans in large democrat cities in the US do such a wonderful job of preventing handgun crime 

[amishmanish]

Going down this path of ensuring that Govt agencies can access records of terrorist conversations will quickly make them realize that it is trivial for anybody to bypass the law if they want to. The next thing you know they'll be criminalizing all and any forms of encryption except those sanctioned by the government.
While the argument about "Spate of Islamic attacks" can help rally support for such a act from the unsuspecting populace, this is ultimately a tyrannical step. The leaders in EU should instead check their stupid politics which involves letting refugees pour in on one hand and then demonize their religion owing to geo-political upheavals. The solution to terrorism is peace measures, not a police state and fortification of the internet.

[el kaka22]

There are two options for companies like whatsapp to continue with this. Either they will cooperate and they will face no problems from the authorities at all but will face a huge backlash from the userbase and that userbase could move to some other company that doesn't share their information. Or they could not share and they will face some trouble with the governments and could even face legal action to ban it from a whole nation or even a continent in this case.

I wouldn't know what to do but I wouldn't take governments against myself, userbase could be angry but I could at least keep them calm for a while or just continue with ones who accept the situation and say goodbye to others, whereas if I face governments that really doesn't have a plan B scenario.

[Dorodha]

The reason the European Union is moving closer to an encryption ban is because politicians once called the European Union an enemy of trade and on the other hand they are going to the European Union a few days later to make peace, seek help and make agreements with Europe on their country's export trade. Since the beginning of the new year there has been a practice of its duality with China. Now there is a new monopoly with the countries of the European Union. He did not hesitate to express a negative attitude towards trade and European trade policy. China's negative attitude has been reflected in the imposition of new tariffs on various products.