Five Eyes Countries Band Together To Complain About Facebook And End-To-End Encryption

from the breaking-Messenger-will-leave-criminals-with-only-dozens-of-secure-options dept

The world’s law enforcement agencies are back at it, advocating for the demise of end-to-end encryption. The last time they all got together like this, they were complaining to Facebook for thinking about adding encryption to its Messenger service.

Because Facebook does so well reporting child porn to the proper authorities, the proper authorities have gathered to decry its decision to encrypt this service, claiming it would result in a lot of unobserved child porn being passed between users. With Facebook unable to eavesdrop on messages, the images and videos can be shared unnoticed.

And, again, the international law enforcement community is asking for weaker encryption… and namechecking Facebook as the cause of and potential solution to all the world’s child porn problems. The new “international statement” opens up with a united declaration that everyone loves encryption, before getting to the long list of “buts.”

We, the undersigned, support strong encryption, which plays a crucial role in protecting personal data, privacy, intellectual property, trade secrets and cyber security. It also serves a vital purpose in repressive states to protect journalists, human rights defenders and other vulnerable people, as stated in the 2017 resolution of the UN Human Rights Council. Encryption is an existential anchor of trust in the digital world and we do not support counter-productive and dangerous approaches that would materially weaken or limit security systems.

Of course, that last sentence is a lie. At best, it’s completely disingenuous. Almost immediately following this assertion that the undersigned have no intention or pursuing counterproductive/dangerous approaches, the Five Eyes crew (along with India and Japan) lists the counterproductive/dangerous ways they’d like encryption to be broken.

Particular implementations of encryption technology, however, pose significant challenges to public safety, including to highly vulnerable members of our societies like sexually exploited children. We urge industry to address our serious concerns where encryption is applied in a way that wholly precludes any legal access to content. We call on technology companies to work with governments to take the following steps, focused on reasonable, technically feasible solutions:

  • Embed the safety of the public in system designs, thereby enabling companies to act against illegal content and activity effectively with no reduction to safety, and facilitating the investigation and prosecution of offences and safeguarding the vulnerable;

  • Enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight; and

  • Engage in consultation with governments and other stakeholders to facilitate legal access in a way that is substantive and genuinely influences design decisions.

I’m not sure what sort of “strong encryption” can handle all of these weak spots being introduced without turning into something easily misused, but these government reps are pretty sure people at these companies will come up with something. These governments have convinced themselves they’re “stakeholders” in private conversations between citizens that are facilitated by services like Facebook’s Messenger.

And that’s what this is about. The statement cites Facebook’s success in handling child porn while trying to use that against it.

In 2018, Facebook Messenger was responsible for nearly 12 million of the 18.4 million worldwide reports of CSAM [child sexual abuse material to the US National Center for Missing and Exploited Children (NCMEC)]. These reports risk disappearing if end-to-end encryption is implemented by default, since current tools used to detect CSAM [child sexual abuse material] do not work in end-to-end encrypted environments.”

If this is true, then there’s nothing else that can be done. Weakened encryption that allows Facebook to intercept users’ messages does nothing for the millions of Facebook users who’ve never trafficked in illegal content. The company can either give users security and privacy, or it can give these governments what they want. There’s no middle ground that’s going to accommodate both groups.

And this push against Facebook is working. These statements were converted into news articles claiming Facebook is “responsible” for 94% of all reported child porn. But that wording suggests Facebook is the problem, rather than its users. Facebook made 94% of the reports, showing once again it’s been doing what it can to combat the problem.

Its decision to offer encryption to Messenger users isn’t being made lightly. It’s aware of the downside. But it’s also aware of the threat posed to its users by a number of malicious entities, which include authoritarian governments and state-sponsored hackers. If it wants to protect its millions of innocent users, it has to offer the same shelter to criminals using the service. That’s how it goes. The middle ground governments think the private sector should nerd towards simply doesn’t exist.

Filed Under: , , , , , , , , , ,
Companies: facebook

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Five Eyes Countries Band Together To Complain About Facebook And End-To-End Encryption”

Subscribe: RSS Leave a comment
36 Comments
This comment has been deemed insightful by the community.
aerinai (profile) says:

Localized, hashed CSAM Check?

So, the government demands that they resolve this issue ‘their way’, but there are other avenues Facebook could use to combat this very specific problem. one of which would be any photo uploaded could be hashed on the local device before upload to determine if it is probable CSAM. If it is found to be suspicious, a copy of the image could be uploaded to an FB server for further evaluation. You could add a ToS notice about this feature and still not break the encrypted communications channel.

Just one of the infinite number of possibilities that doesn’t require backdoors to encrypted communications.

Anonymous Hero says:

Re: Localized, hashed CSAM Check?

This isn’t easily done.

Anything that runs on the client-side is under complete control of the client device. I can make any client-side code behave however I want.

Relying on client-side checks is equivalent to asking users to report themselves to law enforcement if they upload child porn. You’ll catch some of the dumb criminals, but that’s about it.

Anonymous Coward says:

Re: Re: Localized, hashed CSAM Check?

Relying on client-side checks is equivalent to asking users to report themselves to law enforcement if they break DRM. You’ll catch some of the dumb criminals, but that’s about it.

Same problem, different game. Relying on remote attestation is a broken security model, no matter how or for what it’s implemented for. Nonetheless, we still have idiots everywhere who’ve convinced themselves that requiring criminals to announce their presence to their enemies is the best solution. This just in: Criminals intentionally don’t follow laws. In other news: Politicians in five different countries have signed agreements mandating by law that water be dry so that they don’t have to hire people to mop up the wet parts.

vadim (profile) says:

Backdoor backblow

I wonder if the governements wordlwide will force manufacturers to install backdoors, wouldn’t that undermine the reliability of evidence collected using backdoor tech.
Given the fact that encryption usually oovides not only the confidentiality but integrity of the data too,
the accused can claim that given the fact that device is insecure 3rd party is able to tamper with the device(or communication) content.

This comment has been deemed insightful by the community.
Anonymous Coward says:

Re: Re: Re: Backdoor backblow

Encryption and signing are different things. Encryption is used to protect the contents, while signing is used to verify the source. While sometimes they use the same encryption technique, mostly they use different techniques. For instance all the certificates that your browser rely on are plain text, with signing used to verify signer, because everybody going to the same site sees the same certificate, so there is little point in encrypting the contents, but ensuring that it was verified by the signer is critically important.

fenny says:

Re: Re: Backdoor backblow

what’s to stop someone from writing their own cipher?

like seriously, ciphers don’t appear out of thin air, they’re developed by people, plenty of whom are willing to publish to individuals. at that point, it’s criminalizing people for downloading software. not even pirating software, just downloading it.

hell, what’s to stop someone from doing a man-in-the-middle attack (what the police do to catch the distribution of child porn), catching a bunch of weakly encrypted data, then decrypting it through all the deliberate holes that the government requires to steal the information? once the holes are known, someone will find a way to automate it, then the holes create even more day-0s

the best ciphers are open-source for a reason

Anonymous Coward says:

Re: Re: Re: Backdoor backblow

Two points, anybody can write an insecure cypher, while it takes an expert with peer review of their work to write a secure cypher, and even them mistakes happen. While the best cyphers are open source, they are also written and validated by a small community of PdD’s who specialize in cyphers, and who are capable of reviewing each others work, and want other mathematicians to look at their work. They are all aware that they do not know all maths, or even who to ask for possible means of attack on a cypher.

This comment has been deemed insightful by the community.
Scary Devil Monastery (profile) says:

Re: Backdoor backblow

"I wonder if the governements wordlwide will force manufacturers to install backdoors, wouldn’t that undermine the reliability of evidence collected using backdoor tech."

Well, yes, because once you have a skeleton key which opens that backdoor, every criminal organization and foreign power in the world will have it as well.

In other words if the FBI tries to cast a dragnet for drugs, gun running and CP they will instantly find evidence of such in the computers of every US politician the mob, russia and/or china do not like.

Meanwhile the leaked key will have been included in half a dozen ransomware trojans making the rounds so expect any device provided with said backdoor to be bricked anyway. This, in a nutshell, is why even China isn’t inserting hardware backdoors in the hardware over which they have control – they know that rather than gain a weapon they’d have it held to their own throats by any joker able to wrap a trojan around a certificate key.

Scary Devil Monastery (profile) says:

Re: Re: Re: Backdoor backblow

"… and who will try to use this thing full of holes for anything other than laughs."

Everyone who thinks "government knows best" which, unfortunately, tends to include law enforcement, medical services and the military.

Hanlon’s Razor is the only reason I don’t tend to accuse village idiots in politics for working for foreign powers when they start demanding we weaken publicly available strong encryption.

This comment has been deemed insightful by the community.
That One Guy (profile) says:

'I don't get it, why is no-one returning our calls?'

From Apple to Backpage and now on to Facebook, various law enforcement agencies around the world seem damn determined to send one very clear message: Working with law enforcement can and will be used against you the second it’s beneficial for them. Whether it’s helping catch sex traffickers or providing access to data in an attempt to catch criminals, if a company decides to go above and beyond in providing more help than they have to it seems law enforcement just can’t help themselves and demand everything.

If companies are hesitant to help law enforcement and/or spy agencies part of that is almost certainly because they realize just how dangerous the requested help would be both to them and the public, but at this point I can’t help but suspect that part of that hesitation might stem from the knowledge that if they help once they’ll be facing demands for even more help(both in frequency and what’s involved) down the line.

ECA (profile) says:

Who told Politicians they knew anything..

"Enable law enforcement access to content in a readable and usable format where an authorisation<interesting word> is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight; and"

Who told them that they knew/know anything about Encryption?
REALLY!!

Whats stopping the Person from encrypting Before they send it? Which the Politicians would Bitch about to FB.

ALSO,
Monkey see Monkey do.
WHY do they get the idea that Crooks/thieves/Child molesters/and all the BAD people are a larger group then <1%?
Or are they counting themselves?

This comment has been deemed insightful by the community.
flynginn (profile) says:

Everything in the US seems to be a "war". The war on crime, the war on drugs, the war on terrorism, the war on child sex abuse. Each war provides an excuse based on overwhelming public interest to remove or weaken constitutional rights and protections. None of these wars will ever end, so the effect on rights is permanent. In all these wars the citizen is both victim and enemy. Did you smoke a joint in high school? Then of course you accept random stop and search and the seizure of assets for no particular reason. Did you ever shoplift? Then you know how important it is to throw people in prison for years for non-violent crimes. Did you ever read Playboy? Then you know how vital it is that law enforcement has total access to all your digital media at all times. Because anyone could be one. And no policing power is too extreme to deal with it. We certainly wouldn’t want judges and lawyers and, well, law itself, getting in the way.

Because of the self-Streisanding all of this causes the alphabet agencies, it should be obvious that only exceptionally thick perverts would rely on commercial communication encryption. Why bother, when old-fashioned tradecraft is more secure. But that isn’t the real aim anyway, is it? And the question remains; it’s easy to start a war, but how do you stop it?

Anonymous Coward says:

Re: Re:

And the question remains; it’s easy to start a war, but how do you stop it?

Simple: One side must either surrender or be destroyed.

Considering the public is both victim and enemy of their government, but the government is far fewer in number, it’s easy to see which side will win in a fight to the death. The real question is which method will the public choose to end the war.

This comment has been deemed insightful by the community.
Scary Devil Monastery (profile) says:

Re: Re:

"Everything in the US seems to be a "war". The war on crime, the war on drugs, the war on terrorism, the war on child sex abuse. Each war provides an excuse based on overwhelming public interest to remove or weaken constitutional rights and protections."

…because all the US politicians pine for the good old days when they had a war against the USSR and communism, with one Big Scary Bad they could unite the country against and drown all questions in. Then the USSR collapsed and those same US politicians now had to invent a new Big Scary Bad they could use for the same effect. Enter "think of the children", anti-drug scaremongering, and "They are coming to bomb YOUR house next!".

Fear is an awesome drug for a politician. It stops people from thinking. Citizens in fear never question, making any inconvenient queries about self-serving corruption and ineptitude magically go away. Fear is the bucket of water you pour on that wicked witch called vox populi to make them all shut up and stay in line.

And the US body politic has been hooked on it since right after WW2 when they discovered just how versatile it was to just be able to invoke the Big Scary Bad and find the voices of dissent silencing at once.

Scary Devil Monastery (profile) says:

Re: Government First

"I’d love to see someone create a backdoored communication system for law enforcement, and then challenge them to use it."

I’m not sure the strategy of "dropping a nuke exclusively on the police precinct" is a desirable choice.

But sure, if you magically could accomplish this using the same magic you try to advocate when it comes to "Free speech only for some" then be my guest.

Me, I hope for law enforcement to use the same standard of encryption everyone else has access to, more or less as it is now, because that gets me security without having to violate the laws of mathematics.

fenny says:

Backdoor backblow

what’s to stop someone from writing their own cipher?

like seriously, ciphers don’t appear out of thin air, they’re developed by people, plenty of whom are willing to publish to individuals. at that point, it’s criminalizing people for downloading software. not even pirating software, just downloading it.

hell, what’s to stop someone from doing a man-in-the-middle attack (what the police do to catch the distribution of child porn), catching a bunch of weakly encrypted data, then decrypting it through all the deliberate holes that the government requires to steal the information? once the holes are known, someone will find a way to automate it, then the holes create even more day-0s

the best ciphers are open-source for a reason

Scary Devil Monastery (profile) says:

Re: Re:

"Isn’t it unsettling how much law enforcement craves access to child porn?"

I wish I could give this a "lol" vote, but given how often police officers have been exposed carrying some CP "homework" home on a USB stick, I’d be inclined to say that this is just one more damn good reason as to why we should continually verify our trust in our watchmen.

And that’s in europe. In the US I could instead make a joke that by the statistics it appears US officers of the law get their jollies covered by murdering at will. It sticks a bit in the throat, but a ratio of a thousand police shootings in the US to every police shooting in europe speaks quite loudly.

Rishjoy (user link) says:

how to tell if a vietnamese woman likes you

Defection of former Tory MP has ‘calmed nerves’ these jostling for PM to quit

The defection of an old Tory MP to Labour has "Calmed nerves" these jostling for Boris Johnson to resign, As a Cabinet minister insisted the pm was safe in his job for now.

efficient MP for Brigg and Goole Andrew Percy said Christian Wakeford (Bury towards the south) Announcing he was joining the Labour Party minutes before Prime Minister’s questions about Wednesday had focused the minds of those becoming impatient with Mr Johnson.

"I think it is right that there’s a proper investigation going on that will establish the facts and that the Prime Minister will come back to Parliament and properly respond,

Mr Javid denied that the announcement on Wednesday of the lifting of Plan B Covid rules in England was about "Saving our skin" Of the prime minister.

He had been holding talks with backbench MPs to shore up support and avoid the 54 letters being sent to Sir Graham Brady, The chairman of the 1922 panel of Conservatives, That are necessary to trigger a vote of no confidence.

With Mr Wakeford facing anger from former friends on the Tory benches, Some suspected he had momentarily galvanised support for Mr Johnson ahead of Ms Gray’s report, Which is now expected monday.

"The way we now cope with this is to get the facts out, Get them up for grabs so we can all reach a judgment ourselves, Mr Javid proclaimed.

"The pm, He has said himself he has taken already full job for anything that’s happened in Downing Street and he will come to Parliament once the report is published and answer any question that is put to him and that is the right way forward,

Boris manley (remain), Then Foreign Secretary and now pm, And David Davis that urged Boris Johnson to resign (Gareth Fuller/PA)

But he clarified that, If Mr Johnson was found to have broken the law, He would need to go.

"The Ministerial Code is [url=https://www.bestbrides.net/meet-hot-viet-girl-the-sexiest-influencers-to-follow-in-vietnam/%5Dhot viet girls[/url] a simple fact that.

"If any minister from the prime minister down breaks the law, Of course they shouldn’t continue to serve as a minister, he was quoted saying.
[—-]

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...