Government efforts to access private communications are nothing new. In decades past, such attempts at prying were often justified on national security grounds.
However, policymakers today point to child safety and disinformation as reasons to limit privacy protections. Established democracies are often leading this charge, inadvertently paving the way for the world’s autocrats.
Yet people around the world are not taking these policies lying down. They speak out, using events such as Global Encryption Day to highlight the importance of privacy and security, not just for themselves, but for their communities and societies.
As vociferous opposition continues to stymie government efforts to expand surveillance powers, it has become clear that public pressure works.
Encryption, which scrambles digital data so that it can be read only by someone with the means to decode it, has become ubiquitous, because it keeps information confidential and secure while authenticating the identity of the person with whom one is communicating.
Today, billions of people use encryption to send digital messages and e-mails, transfer money, load Web sites and protect their data. The gold standard in security is “end-to-end” encryption (E2EE), as only the participants have access to the data — not even the service provider can decipher it.
Despite its immense value and global appeal, encryption is under threat worldwide. It is used by law-abiding citizens to protect themselves, but also by bad actors to hide their malicious activities. For this reason, law enforcement authorities oppose encryption designs, especially E2EE, that prevent them from accessing data.
Yet even after decades of research, there is still no known way to grant law enforcement access without undermining encryption’s privacy and security features. The makers of encrypted devices and services have therefore resisted calls to build in “backdoor” government access, which would make all of their users more vulnerable.
The harmful online activities that concern police do not happen only in encrypted spaces. Hate speech, disinformation and other objectionable content remain a pernicious problem on social-media platforms and other sites, motivating a worldwide legislative push to force tech companies to improve their services.
For example, the British Parliament recently passed the Online Safety Bill after several turbulent years during which pressure from civil society changed its scope significantly. The final version focuses mainly on the removal of illegal content and mitigating risks to children.
Yet the bill still has serious flaws. For example, Parliament failed to include language safeguarding encryption. Moreover, the law gives the British Office of Communications (Ofcom), which regulates information exchange, the authority to compel social media platforms and messaging services to mass scan their users’ files and communications for evidence of child sexual abuse.
No one contests that fighting child exploitation is immensely important, but Ofcom’s power covers E2EE messaging services, which by definition cannot be accessed by service providers. Thus, the only way these services could comply with an Ofcom order is by making fundamental changes to their encryption design.
In other words, the bill gives Ofcom the power to force service providers to undermine their own encryption. Apple, Meta and Signal have all promised to pull their E2EE apps from the UK rather than comply with any government order to diminish their users’ privacy and security.
In response, Ofcom has publicly vowed not to use its new authority, at least for now.
It did so with good reason: Important bodies have concluded that scanning technologies are not sufficiently accurate, would limit fundamental rights and would likely fail the proportionality test — the disadvantages would outweigh the advantages.
Furthermore, criminals could easily circumvent these controls by encrypting content using a separate application. Ofcom would be wise to tread carefully, lest it risk the privacy and security of Internet users for the sake of unproven and potentially ineffective technologies.
Ofcom’s (supposed) forbearance recalls Australian authorities’ conduct since the passage of a contentious 2018 law granting new governmental powers to compel communications providers to add backdoor access to their products. Civil society and cybersecurity experts raised alarms about the law’s dangers for privacy and security, and legislators said the bill was flawed, but it passed anyway.
Five years later, not a single compulsory notice has been issued. This might reflect a deliberate choice: Exercising such a power risks political blowback. Wield the sword too enthusiastically and it might be taken away; better to keep it sheathed in favor of other, less controversial tools.
Then again, government forbearance might also indicate that the controversial new power was unnecessary in the first place.
Public scrutiny of government powers keeps them in check. That is how a democracy is meant to work. In promising not to use its new tool, Ofcom appears to have grasped that the government’s legitimacy is at stake.
However, as the UK bill inspires similar legislation in other countries, some of which are less democratic and have a track record of weaponizing digital technologies against their citizens, this nuance is likely to be lost.
The first test will come in the EU, where legislators are fighting over a draft regulation to expand tech companies’ child safety obligations. Like the British bill, the proposed Child Sex Abuse Regulation (CSAR) has already gone through numerous revisions, as member states lock horns over protecting E2EE.
Derisively called “chat control,” the draft CSAR has been widely decried for potentially forcing European service providers to scan all public and private communications, which would amount to an illegal general monitoring obligation.
Recent reporting stoked these concerns by revealing that the European Union Agency for Law Enforcement Cooperation, requested unlimited access to and use of the data produced beyond the purposes identified in the regulation; it appears to have no intention of restraining itself.
Continued public pressure is necessary to push for reform of “the most criticized draft EU law of all time.”
If government surveillance is a concern in an established democratic entity such as the EU, what hope is there for beleaguered democracies such as Turkey, India and Brazil, much less autocracies?
Fortunately, the public movement in support of encryption is growing, with advocacy groups such as the Global Encryption Coalition leading the charge.
By engaging with civil society, technologists and the public, governments can design regulations that respect privacy, data security and freedom of expression while helping to protect users from harm. Doing so is the only way to make sure that the Internet works for everyone.
Riana Pfefferkorn is a research scholar at the Stanford Internet Observatory. Callum Voge is sirector of Government Affairs and Advocacy at the Internet Society.
Copyright: Project Syndicate
In the event of a war with China, Taiwan has some surprisingly tough defenses that could make it as difficult to tackle as a porcupine: A shoreline dotted with swamps, rocks and concrete barriers; conscription for all adult men; highways and airports that are built to double as hardened combat facilities. This porcupine has a soft underbelly, though, and the war in Iran is exposing it: energy. About 39,000 ships dock at Taiwan’s ports each year, more than the 30,000 that transit the Strait of Hormuz. About one-fifth of their inbound tonnage is coal, oil, refined fuels and liquefied natural gas (LNG),
On Monday, the day before Chinese Nationalist Party (KMT) Chairwoman Cheng Li-wun (鄭麗文) departed on her visit to China, the party released a promotional video titled “Only with peace can we ‘lie flat’” to highlight its desire to have peace across the Taiwan Strait. However, its use of the expression “lie flat” (tang ping, 躺平) drew sarcastic comments, with critics saying it sounded as if the party was “bowing down” to the Chinese Communist Party (CCP). Amid the controversy over the opposition parties blocking proposed defense budgets, Cheng departed for China after receiving an invitation from the CCP, with a meeting with
Chinese Nationalist Party (KMT) Chairwoman Cheng Li-wun (鄭麗文) is leading a delegation to China through Sunday. She is expected to meet with Chinese President Xi Jinping (習近平) in Beijing tomorrow. That date coincides with the anniversary of the signing of the Taiwan Relations Act (TRA), which marked a cornerstone of Taiwan-US relations. Staging their meeting on this date makes it clear that the Chinese Communist Party (CCP) intends to challenge the US and demonstrate its “authority” over Taiwan. Since the US severed official diplomatic relations with Taiwan in 1979, it has relied on the TRA as a legal basis for all
To counter the CCP’s escalating threats, Taiwan must build a national consensus and demonstrate the capability and the will to fight. The Chinese Communist Party (CCP) often leans on a seductive mantra to soften its threats, such as “Chinese do not kill Chinese.” The slogan is designed to frame territorial conquest (annexation) as a domestic family matter. A look at the historical ledger reveals a different truth. For the CCP, being labeled “family” has never been a guarantee of safety; it has been the primary prerequisite for state-sanctioned slaughter. From the forced starvation of 150,000 civilians at the Siege of Changchun
RSS