EU seeks to outlaw 'backdoors' in new data privacy proposals
|
Version 1 of 4. The European Union is considering banning the implementation of so-called “backdoors” that allow the reading of encrypted messaging, a move that would place it in conflict with the UK government’s desire to have access to all secure communications. The draft report by the European parliament’s committee on civil liberties, justice and home affairs says the data protection regulations have not kept pace with advances in technology and that amendments to the 2002 regulation on privacy and electronic communications (ePrivacy) are required. Part of the amendments, proposed by the European Commission in January and now reviewed by the European parliament, look to deal with so-called over-the-top (OTT) services. The services replicate the functionality of traditional communications systems, such as landline telephones, but aren’t not regulated in the same way and so are not affording similar protections. For example, the UK government has repeatedly called for ways to gain access to encrypted communications such as the end-to-end encryption (E2EE) used by Signal and WhatsApp, which prevents the interception of private messages. The EU draft proposal categorically rules out such measures. It says: “The providers of electronic communications services shall ensure that there is sufficient protection in place against unauthorised access or alterations to the electronic communications data, and that the confidentiality and safety of the transmission are also guaranteed by the nature of the means of transmission used, or by state-of-the-art end-to-end encryption of the electronic communications data. “Furthermore, when encryption of electronic communications data is used, decryption, reverse engineering or monitoring of such communications shall be prohibited.” In the wake of terror attacks across the UK earlier this year the home secretary, Amber Rudd, backed by Downing Street, repeatedly called for access to messages sent via communications services that use E2EE. The issue was repeated in the Conservative manifesto. Europe’s draft amendments specifically ban such attempts by government: “Member states shall not impose any obligations on electronic communications service providers that would result in the weakening of the security and encryption of their networks and services.” How the impending Brexit negotiations will impact legislation such as the IPA is currently unclear. By the time amendments are made to the ePrivacy directive, the UK is likely to have completed the Brexit process. The new proposed amendments are part of sweeping changes regarding digital communications and privacy kicked off by the new, tougher general data protection regulation (GDPR), which is due to come into force in 2018, as well as the legislation around the single digital market. The ePrivacy directive change proposals seek to bring the 2002 law in line with the newer GDPR and attempt to keep pace with technological development. They also cover the tracking of users for advertising, the collection of metadata and behavioural data, an the explicit consent required to do so. The amendments will have to journey through a multi-stage process including approval by the European parliament and European council before becoming law, but they were welcomed by privacy and security experts. Lukasz Olejnik, an independent security and privacy technology researcher said the amendments “significantly improve security and privacy properties” of the EU’s regulations and that they were “a step in a great direction”. “The end-to-end aspect is additionally of interest due to the worldwide campaign of weakening cryptography and introducing backdoors. Such voices are in the USA, Australia, Germany, France and UK. These last points put ePrivacy on a potential collision course with the supposedly imminent regulations negatively affecting cybersecurity and privacy,” Olejnik said. The proposed ePrivacy amendments come at a time when the EU is suggesting it might seek to give law enforcement the power to directly access cloud storage to retrieve electronic evidence. Part of a three-option proposal that will form the basis of future legislative reform for what EU Justice Commissioner Vera Jourova said was “an extraordinary measure for extraordinary threats”, the EU is seeking to speed up the process of evidence collection in the wake of terror attacks cross Europe. Backdoor access to WhatsApp? Rudd’s call suggests a hazy grasp of encryption |