UK minister fails to reassure tech companies over encryption risk

Government denies U-turn

The authorities, nevertheless, denied it had made a U-turn on the invoice, which went via the Lords with none adjustments to the “spy clause” – part 122 – which provides Ofcom powers to require expertise companies to use “accredited technology” to monitor the contents of encrypted messages.

“As has always been the case, as a last resort, on a case-by-case basis and only when stringent privacy safeguards have been met,” a spokesperson mentioned.

“[The bill] will enable Ofcom to direct companies to either use, or make best efforts to develop or source, technology to identify and remove illegal child sexual abuse content – which we know can be developed.”

Government assurances fall quick

Signal president Meredith Whittaker described the announcement as a “win” for expertise companies.

Writing on X, previously Twitter, she mentioned the clause might genuinely imperil Signal’s potential to function within the UK, and that the federal government’s obvious concession was “much better than nothing”. “From here people can keep pushing with a hard-won admission in hand,” she added.

Others have been extra pessimistic. Andy Yen, founder and CEO of encrypted electronic mail service Proton, mentioned the federal government fell “well short of providing the legal assurances that businesses need to continue operating and investing in the UK”.

“As it stands, the bill still permits the imposition of a legally binding obligation to ban end-to-end encryption in the UK, undermining citizens’ fundamental rights to privacy, and leaves the government defining what is ‘technically feasible’,” he mentioned.

Head of WhatsApp Will Cathcart wrote in a publish on X that powers within the invoice to mandate tech companies to scan encrypted messages continued to pose a risk to privateness.

“The fact remains that scanning everyone’s messages would destroy privacy as we know it,” he mentioned. “That was as true last year as it is today. @WhatsApp will never break our encryption and remains vigilant against threats to do so.”

And Paul Holland, CEO of encrypted mail service Beyond Encryption, mentioned the federal government had admitted there isn’t a present expertise that may not essentially break encrypted messaging companies. “It was abundantly clear to all those with knowledge of encryption that the government’s proposals were unworkable and the Online Safety Bill put them on a collision course with encrypted messaging services,” he mentioned.

 Controversial and draconian powers

James Baker, marketing campaign supervisor for the Open Rights Group, which campaigns for privateness and free speech within the UK, mentioned that regardless of the federal government’s assurances, it had saved “controversial and draconian” powers within the invoice.

“The fact they are making last-minute statements to placate industry further demonstrates that the bill is an ill-thought-through legislative mess that Ofcom will now be expected to sort out,” he advised Computer Weekly.

“The government should make it clear to Parliament what it actually intends to happen with this policy, and Parliament should ask the Lords to look again at the inadequate safeguards that have been put in place around the use of these powers.”

Changes over Section 122 essential

Barbora Bukovská, senior director for legislation and coverage at Article 19, which helps freedom of expression, mentioned it was “absolutely crucial” to add particular reassurances to the invoice to commit Ofcom not to apply Section 122 in a means that might undermine end-to-end encryption.

“Without it, the prospect of the government compelling companies to surveil private messages is not off the table,” she mentioned. “At the same time, we have the concrete commitment from the government that the powers won’t be used until it’s ‘technically feasible’ – and will be holding them to account for that,” she added.

Rasha Abdul Rahim, director of Amnesty Tech, mentioned the “spy clause” could lead on to the non-public sector being mandated to perform mass surveillance of personal digital communications.

“It would leave everybody in the UK – including human rights organisations and activists – vulnerable to malicious hacking attacks and targeted surveillance campaigns,” she mentioned. “It also sets a dangerous precedent. It remains undeniably true that it’s not possible to create a technological system that can scan the contents of private electronic communication while preserving the right to privacy.”

Speaking within the House of Lords yesterday, Labour peer Kenneth Morgan mentioned that by handing over duty for encryption to Ofcom mixed with potential intervention from the courts, the federal government had created an undemocratic course of.

“The fact of the matter is, everybody knows that you cannot do what Ofcom is empowered by this bill to do without breaching end-to-end encryption,” he mentioned. “It’s as simple as that.”

Client-side scanning

Ofcom is predicted to mandate expertise often known as client-side scanning to examine the contents of communications despatched by safe messaging companies and cell phones earlier than they’re encrypted.

This would require communications service suppliers to set up software program able to analysing messages and to ship experiences again both to a authorities company or a expertise supplier.

Another scanning expertise into account, homomorphic encryption, makes it attainable to carry out calculations on encrypted knowledge to determine its content material.