Government is playing ‘psychic war’ in battle over end-to-end encryption

Client-side scanning 

The Online Safety Bill will give the regulator, Ofcom, powers to require communications companies to install technology, known as client-side scanning (CSS), to analyse messages for child sexual abuse and terrorism content before they are encrypted.

Encrypted messaging companies, including Signal, WhatsApp and Element, have said such a move would fundamentally weaken encryption, leave services open to hacking and make it impossible to offer encrypted messaging services in the UK.

Allan said there were multiple ways that illegal content could come to the attention of the authorities without attacking encryption.

The police and security services already have a range of intrusive surveillance tools regulated under the Regulation of Investigatory Powers Act that can compromise the devices of suspects, alongside powers to require people to grant access to their electronic devices.

The peer urged ministers to be clear about their intentions, and to state directly whether the government plans to impose technical requirements on messaging companies that would mean people in the UK would no longer be able to use truly secure end-to-end encrypted products.

“That is not my preferred option, but it would at least allow for an orderly transition if services choose to withdraw products from the UK market,” he said.

The Lords heard that 40 million people in the UK use private messaging services every day. They include journalists, human rights and democracy activists in repressive regimes, who need to protect the safety of their contacts.

Historical records

Conservative peer Daniel Moylan said it was possible that the Online Safety Bill would allow Ofcom to demand historical records of communications without a warrant or without having to give a basis for doing so.

“I can understand why the security services and so forth want this power, and this is a vehicle to achieve something they have been trying to achieve for a long time. But there is very strong public resistance to it,” he said.

Another peer, Claire Fox, said the security of knowing people can speak without Russia’s president Vladimir Putin or China’s president Xí Jìnpíng listening in or being sent copies of their WhatsApp messages was important.

She said it was not possible to install tools that require surveillance of encrypted content to detect child exploitation and terrorism without undermining encryption. “Just as you cannot be half pregnant, you cannot be half encrypted,” she said.

She said that most abuse of children occurs in their homes, but no one is arguing the state should put CCTV cameras in every home for 24/7 surveillance. There are specialist services that can intervene when they think there is a problem. “I am worried about the possibility of putting a CCTV camera in everyone’s phone,” she said.

Companies ‘intentionally blind’

Labour peer Wilf Stevenson argued that end-to-end encryption “intentionally blinds” technology companies to criminal activity on their services.

The US National Centre for Missing and Exploited Children estimated that more than half of its reports would be lost if end-to-end encryption was implemented [by Facebook].

He said Ofcom would have powers to require companies to use highly accurate accredited technology to detect illegal child exploitation that would minimise the risk that legal content is wrongly reported.

Ofcom would need to publish a warning notice and allow tech companies to make representations and a right of appeal before requiring them to introduce scanning technology.

The regulator cannot require a company to take any action that is not proportionate, including removing or materially weakening encryption, he said.