EU Takes Another Small Step Towards Trying To Ban Encryption; New Paper Argues Tech Can Nerd Harder To Backdoor Encryption

(Mis)Uses of Technology

from the that's-now-how-any-of-this-works dept

In September, we noted that officials in the EU were continuing an effort to try to ban end-to-end encryption. Of course, that’s not how they put it. They say they just want “lawful access” to encrypted content, not recognizing that any such backdoor effectively obliterates the protections of end-to-end encryption. A new “Draft Council Resolution on Encryption” has come out as the EU Council of Ministers continues to drift dangerously towards this ridiculous position.

We’ve seen documents like this before. It starts out with a preamble insisting that they’re not really trying to undermine encryption, even though they absolutely are.

The European Union fully supports the development, implementation and use of strong encryption. Encryption is a necessary means of protecting fundamental rights and the digital security of governments, industry and society. At the same time, the European Union needs to ensure the ability of competent authorities in the area of security and criminal justice, e.g. law enforcement and judicial authorities, to exercise their lawful powers, both online and offline.

Uh huh. That’s basically we fully support you having privacy in your own home, except when we need to spy on you at a moment’s notice. It’s not so comforting when put that way, but it’s what they’re saying. Then there’s a lot of nonsense about how encryption is creating a “challenge” for public safety, even though there is no evidence at all to support this claim. The reality is that law enforcement has access to more data and more tools than ever before in history. That one small fragment of it might sometimes be encrypted, is not an issue. And it’s certainly not an issue that requires the wholesale destruction of end-to-end encryption. But, of course, that’s not where the EU is coming out on this.

Instead, it concludes with the inevitable “nerd harder” bullshit argument without ever explaining how this can be done (answer: because it cannot be done safely).

Moving forward, the European Union strives to establish an active discussion with the technology industry, while associating research and academia, to ensure the continued implementation and use of strong encryption technology. Competent authorities must be able to access data in a lawful and targeted manner, in full respect of fundamental rights and the data protection regime, while upholding cybersecurity. Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality.

Since there is no single way of achieving the set goals, governments, industry, research and academia need to work together to strategically create this balance.

This is the same old garbage we’ve seen before. Technologically illiterate bureaucrats who have no clue at all, insisting that if they just “work together” with the tech industry, some magic golden key will be found. This is not how any of this works. Introducing a backdoor into encryption is introducing a massive, dangerous vulnerability that basically takes the secure walls of a house and rams a giant tank through the side. It’s not adding a special key for law enforcement. It’s breaking the very foundation of how end-to-end encryption works, and introducing a wide variety of shaky dangerous elements that they insist will never get exploited. But, with encryption, any vulnerability inevitably gets exploited.

Attacking end-to-end encryption in order to deal with the miniscule number of situations where law enforcement is stymied by encryption would, in actuality, put everyone at massive risk of having their data accessed by malicious parties. It’s incredibly clueless and incredibly shortsighted.

And it’s absolutely stunning that it’s coming from the EU. After all, we keep hearing how the EU believes in “privacy” and “data protection” much more than the US. We hear stories about the lessons learned from World War II about how governments can abuse access to the private information on citizens. Indeed, the EU courts recently blew up the EU/US “Privacy Shield” agreement regarding transferring data from the EU to the US because of NSA surveillance efforts that cannot guarantee EU data remains protected.

And then they turn around and want to destroy encryption? Incredible.

At this point, this is nothing more than a draft policy paper from the Council. A lot more needs to happen before this becomes anything resembling a law in the EU. But just the fact that this continues to lurch forward, pushed by ridiculously ignorant bureaucrats is hugely problematic. People in the EU need to speak up loudly about what a mess this is.

Filed Under: backdoors, encryption, end-to-end encryption, eu, eu council, lawful access