The Five Eyes governments of the UK, US, Canada, Australia and New Zealand have threatened the tech industry to voluntarily create backdoor access to their systems, or be compelled to by law if they don't.
The move is a final warning to platform
holders such as WhatsApp, Apple and Google who deploy encryption to guarantee user privacy on their services. A statement by the Five Eyes governments says:
Encryption is vital to the digital economy and a secure
cyberspace, and to the protection of personal, commercial and government information ...HOWEVER.. . the increasing use and sophistication of certain encryption designs present challenges for nations in combating serious crimes and threats
to national and global security.
Many of the same means of encryption that are being used to protect personal, commercial and government information are also being used by criminals, including child sex offenders, terrorists and
organized crime groups to frustrate investigations and avoid detection and prosecution.
If the industry does not voluntarily establish lawful access solutions to their products the statement continued, we may pursue technological,
enforcement, legislative or other measures to guarantee entry.
Home Secretary Priti Patel has signed an historic agreement that will enable British law enforcement agencies to directly demand electronic data relating to terrorists, child sexual abusers and other serious criminals from US tech firms.
The world-first UK-US Bilateral Data Access Agreement will dramatically speed up investigations and prosecutions by enabling law enforcement, with appropriate authorisation, to go directly to the tech companies to access data, rather
than through governments, which can take years.
The Agreement was signed with US Attorney General William P. Barr in Washington DC, where the Home Secretary also met security partners to discuss the two countries' ever deeper
cooperation and global leadership on security.
The current process, which see requests for communications data from law enforcement agencies submitted and approved by central governments via Mutual Legal Assistance (MLA), can
often take anywhere from six months to two years. Once in place, the Agreement will see the process reduced to a matter of weeks or even days.
The US will have reciprocal access, under a US court order, to data from UK
communication service providers. The UK has obtained assurances which are in line with the government's continued opposition to the death penalty in all circumstances.
Any request for data must be made under an authorisation in
accordance with the legislation of the country making the request and will be subject to independent oversight or review by a court, judge, magistrate or other independent authority.
The Agreement does not change anything about
the way companies can use encryption and does not stop companies from encrypting data.
It gives effect to the Crime (Overseas Production Orders) Act 2019, which received Royal Assent in February this year and was facilitated by
the CLOUD Act in America, passed last year.
Letter to Mark Zuckerberg asking him not to keep his internet users safe through encrypted messages
The Home Secretary has also published an open letter to
Facebook, co-signed with US Attorney General William P. Barr, Acting US Homeland Security Secretary Kevin McAleenan and Australia's Minister for Home Affairs Peter Dutton, outlining serious concerns with the company's plans to implement end-to-end
encryption across its messaging services. The letter reads:
Dear Mr. Zuckerberg,
We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety and without including a means for lawful access to the
content of communications to protect our citizens.
In your post of 6 March 2019, 'A Privacy-Focused Vision for Social Networking', you acknowledged that "there are real safety concerns to address before we can implement
end-to-end encryption across all our messaging services." You stated that "we have a responsibility to work with law enforcement and to help prevent" the use of Facebook for things like child sexual exploitation, terrorism, and extortion.
We welcome this commitment to consultation. As you know, our governments have engaged with Facebook on this issue, and some of us have written to you to express our views. Unfortunately, Facebook has not committed to address our serious concerns about
the impact its proposals could have on protecting our most vulnerable citizens.
We support strong encryption, which is used by billions of people every day for services such as banking, commerce, and communications. We also
respect promises made by technology companies to protect users' data. Law abiding citizens have a legitimate expectation that their privacy will be protected. However, as your March blog post recognized, we must ensure that technology companies protect
their users and others affected by their users' online activities. Security enhancements to the virtual world should not make us more vulnerable in the physical world. We must find a way to balance the need to secure data with public safety and the need
for law enforcement to access the information they need to safeguard the public, investigate crimes, and prevent future criminal activity. Not doing so hinders our law enforcement agencies' ability to stop criminals and abusers in their tracks.
Companies should not deliberately design their systems to preclude any form of access to content, even for preventing or investigating the most serious crimes. This puts our citizens and societies at risk by severely eroding a
company's ability to detect and respond to illegal content and activity, such as child sexual exploitation and abuse, terrorism, and foreign adversaries' attempts to undermine democratic values and institutions, preventing the prosecution of offenders
and safeguarding of victims. It also impedes law enforcement's ability to investigate these and other serious crimes.
Risks to public safety from Facebook's proposals are exacerbated in the context of a single platform that would
combine inaccessible messaging services with open profiles, providing unique routes for prospective offenders to identify and groom our children.
Facebook currently undertakes significant work to identify and tackle the most
serious illegal content and activity by enforcing your community standards. In 2018, Facebook made 16.8 million reports to the US National Center for Missing & Exploited Children (NCMEC) -- more than 90% of the 18.4 million total reports that year.
As well as child abuse imagery, these referrals include more than 8,000 reports related to attempts by offenders to meet children online and groom or entice them into sharing indecent imagery or meeting in real life. The UK National Crime Agency (NCA)
estimates that, last year, NCMEC reporting from Facebook will have resulted in more than 2,500 arrests by UK law enforcement and almost 3,000 children safeguarded in the UK. Your transparency reports show that Facebook also acted against 26 million
pieces of terrorist content between October 2017 and March 2019. More than 99% of the content Facebook takes action against -- both for child sexual exploitation and terrorism -- is identified by your safety systems, rather than by reports from users.
While these statistics are remarkable, mere numbers cannot capture the significance of the harm to children. To take one example, Facebook sent a priority report to NCMEC, having identified a child who had sent self-produced child
sexual abuse material to an adult male. Facebook located multiple chats between the two that indicated historical and ongoing sexual abuse. When investigators were able to locate and interview the child, she reported that the adult had sexually abused
her hundreds of times over the course of four years, starting when she was 11. He also regularly demanded that she send him sexually explicit imagery of herself. The offender, who had held a position of trust with the child, was sentenced to 18 years in
prison. Without the information from Facebook, abuse of this girl might be continuing to this day.
Our understanding is that much of this activity, which is critical to protecting children and fighting terrorism, will no longer be
possible if Facebook implements its proposals as planned. NCMEC estimates that 70% of Facebook's reporting -- 12 million reports globally -- would be lost. This would significantly increase the risk of child sexual exploitation or other serious harms.
You have said yourself that "we face an inherent tradeoff because we will never find all of the potential harm we do today when our security systems can see the messages themselves". While this trade-off has not been quantified, we are very
concerned that the right balance is not being struck, which would make your platform an unsafe space, including for children.
Equally important to Facebook's own work to act against illegal activity, law enforcement rely on
obtaining the content of communications, under appropriate legal authorisation, to save lives, enable criminals to be brought to justice, and exonerate the innocent.
We therefore call on Facebook and other companies to take the
embed the safety of the public in system designs, thereby enabling you to continue to act against illegal content effectively with no reduction to safety, and facilitating the prosecution of offenders and safeguarding of victims
enable law enforcement to obtain lawful access to content in a readable and usable format
engage in consultation with governments to facilitate this in a way that is substantive and genuinely
influences your design decisions
not implement the proposed changes until you can ensure that the systems you would apply to maintain the safety of your users are fully tested and operational
We are committed to working with you to focus on reasonable proposals that will allow Facebook and our governments to protect your users and the public, while protecting their privacy. Our technical experts are confident that we can
do so while defending cyber security and supporting technological innovation. We will take an open and balanced approach in line with the joint statement of principles signed by the governments of the US, UK, Australia, New Zealand, and Canada in August
2018 and the subsequent communique agreed in July this year .
As you have recognised, it is critical to get this right for the future of the internet. Children's safety and law enforcement's ability to bring criminals to justice
must not be the ultimate cost of Facebook taking forward these proposals.
Rt Hon Priti Patel MP, United Kingdom Secretary of State for the Home Department
Barr, United States Attorney General
Kevin K. McAleenan, United States Secretary of Homeland Security (Acting)
Hon Peter Dutton MP, Australian Minister for Home Affairs
Top law enforcement officials in the United States, United Kingdom, and Australia told Facebook today that they want backdoor access to all encrypted messages sent on all its platforms. In an
open letter , these governments called on Mark Zuckerberg to stop Facebook's
plan to introduce end-to-end encryption on all of the company's messaging products and instead promise that it
will "enable law enforcement to obtain lawful access to content in a readable and usable format."
This is a staggering attempt to undermine the security and privacy of communications tools used by billions of people.
Facebook should not comply. The letter comes in concert with the signing of a new agreement between the US and UK to provide access to allow law enforcement in one jurisdiction to more easily obtain electronic data stored in the other jurisdiction. But
the letter to Facebook goes much further: law enforcement and national security agencies in these three countries are asking for nothing less than access to every conversation that crosses every digital device.
The letter focuses
on the challenges of investigating the most serious crimes committed using digital tools, including child exploitation, but it ignores the severe risks that introducing encryption backdoors would create. Many people--including journalists, human rights
activists, and those at risk of abuse by intimate partners--use encryption to stay safe in the physical world as well as the online one. And encryption is central to preventing criminals and even corporations from spying on our private conversations, and
to ensure that the communications infrastructure we rely on is truly working as intended . What's more, the backdoors
into encrypted communications sought by these governments would be available not just to governments with a supposedly functional rule of law. Facebook and others would face immense pressure to also provide them to authoritarian regimes, who might seek
to spy on dissidents in the name of combatting terrorism or civil unrest, for example.
Haha he thought he was protected by a level 5 lock spell, but every bobby on the street has a level 6 unlock spell, and the bad guys have level 10.
The Government is playing silly games trying to suggest ways that snooping backdoors on people's encrypted messaging could be unlocked by the authorities whilst being magically safe from bad guys especially those armed with banks of Chinese super
The government wants to make backdoors mandatory for messaging and offers a worthless 'promise' that authority figures would need to agree before the police are allowed to use their key to unlock messages.
Andersen Cheng, chief
executive of Post-Quantum, a specialist encryption firm working with Nato and Government agencies, said a virtual key split into five parts - or more - could unlock messages when all five parties agreed and the five key fragments were joined together.
Those five parties could include the tech firm like Facebook, police, security service or GCHQ, an independent privacy advocate or specialist similar to the independent reviewer of terror legislation and the judge authorising the warrant.
Cheng's first company TRL helped set up the secure communications system used by 10 Downing Street to talk with GCHQ, embassies and world leaders, but I bet that system did not include backdoor keys.
The government claims that official access would only be granted where, for example, the police or security service were seeking to investigate communications between suspect parties at a specific time, and where a court ruled it was in the public or
However the government does not address the obvious issue of bad guys getting hold of the keys and letting anyone unlock the messages for a suitable fee. And sometimes those bad guys are armed with the best brute force code cracking
powers in the world.