Tech firms warn snooper's charter could end strong encryption in Britain
|
Version 0 of 1. Major technology firms are concerned that the British government is attempting to ban strong encryption with the Investigatory Powers Bill, despite its assurances to the contrary. A number of companies, both large and small, have expressed their fears to the Guardian that one particular clause of the proposed legislation gives the government the power to force them to weaken their systems, in order to enable the bulk collection aspects of the bill. Section 189 of the bill, titled “Maintenance of technical capability”, allows the secretary of state to issue orders to companies “relating to the removal of electronic protection applied … to any communications or data”. The only limits on the power of the Secretary of State to do so are a requirement that they consult with an advisory board beforehand, and that any specific obligation must be “reasonable” and “practicable”. The technical capability notice can even be issued to people outside the UK, and require them to do, or not to do, things outside the UK. Antony Walker, the deputy chief executive of techUK, the industry body for the UK’s tech sector, warned that “much will depend on the interpretation of what is reasonable”. On 30 October, before the draft bill was revealed, Theresa May told the BBC’s Andrew Marr that “encryption is important for people to be able to keep themselves safe when they are dealing with these modern communications in the digital age”, leading many technology firms to assume that their encryption tools would not be under attack. Upon release of the bill, some thought they were safe due to language which specifically targets “telecommunications operators”. At least one major technology firm mistakenly thought that the clause did not apply to them as a result of the phrasing. In fact, the legislation defines such an operator as any firm that provides telecommunications services, or provides services that use the telecommunications network, sweeping so-called “over-the-top” services such as messaging apps, under its purview. Specifically threatened by the technical capability notices are any firm that provides “end-to-end” encryption to its customers. This form of encryption allows a message sent between two individuals to be protected in such a way that no one other than the sender and recipient can read it. Even the company that facilitates the communication cannot decipher messages encrypted in this way. End-to-end encryption is offered by Apple, as part of its iMessage serivce, by Facebook through its WhatsApp subsidiary, and by a number of other messaging apps including Line, Telegram and Signal. For communications with end-to-end encryption enabled, bulk surveillance is difficult, since only the metadata around the communications can be read without the encryption key. As a result, the UK government could decide to issue a technical capability order requiring the communications firms to disable their end-to-end encryption, or replace it with a weaker form of encryption, which would leave the communications facilitator able to read messages sent using its service. The only defence the firms would have would be to argue such an order is not “reasonable”. The powers in section 189 mirror similar powers in Ripa, an earlier piece of legislation which governed investigatory powers. However, Ripa’s equivalent orders only affected traditional internet service providers. Since the orders come with a gag attached, it is impossible to know whether, or how often, they have been used. Preston Byrne, the general counsel for blockchain-based startup Eris Industries, said that “this legislation will not address the problem it’s designed to solve. Terrorists will go dark using off-the-shelf software like GPG and Tor, at the same time as ordinary people and businesses are placed in serious jeopardy because all of their own data is stored somewhere in a way which can be compromised. “Businesses already fail to secure user data today, as seen by the TalkTalk hack. The same applies to governments, as we saw with the US Office of Personnel Management hack where data on every American government worker with a security clearance was stolen by hackers widely believed to be state-sponsored. “Nothing in this bill ensures the security of that data, either. Instead it turns every business providing telecommunications in or to the United Kingdom into an attack vector. The best way to guarantee the safety of user data is for it to not exist. Our national security will be significantly enhanced if we store less data, not more, and increase the use of strong cryptography, rather than reducing it.” Eris Industries was formerly based in the UK, but moved to Connecticut, US, after the general election. The company’s move was prompted by the Prime Minster’s first suggestion that his government would ban end-to-end encryption. |