Is the EU Planning To Ban End-To-End Encryption?

End of End-to-End Encryption

A new document, supposedly originating from the German Presidency’s office, calls for a bypass of end-to-end encryption within the EU. While the document praises the importance of encryption for security and liberty, it also warns of criminal exploitation. Indeed, the document could lead to the end of end-to-end encryption for chat applications such as Signal and WhatsApp. Dated Nov 6, 2020, it comes in the wake of a terrorist attack in Vienna that left four dead. The resolution draft, obtained by news site ORF.at, underlines the amount of crime committed with internet encryption, stating:

“For competent authorities, access to electronic evidence is not only essential to conduct successful investigations and thereby bring criminals to justice, but also to protect victims and help ensure security.”

It does not call for a total end to encryption, however. The aim of any legislation, the draft says, should strike a balance between crime-fighting and citizens’ privacy:

“Competent authorities must be able to access data in a lawful and targeted manner, in full respect of fundamental rights and the data protection regime, while upholding cybersecurity.”

The EU’s Legal Big Tech

The document, which is a council resolution and could be made law after being processed in written form, lays out a direction for future legislation. It suggests that the EU work with Big Tech and Academia to find methods of finding otherwise encrypted information. An article of the resolution emphasizes the need for a legal framework. Any government acquisition of data should take into account transparency, necessity, and proportionality, it says. It doesn’t, though, say who gets to approve these stipulations. Some critics argue about the futility of such a statement. A venture capitalist and researcher, Benedict Evans, said that finding a bypass of encryption that can be done without compromising security is like asking General Motors to develop a gasoline that doesn’t burn.

Asking tech companies to create 'secure encryption that the police can read' is like asking General Motors to invent gasoline that doesn't burn. You can ask, sure. But you can't have it.

— Benedict Evans (@benedictevans) November 9, 2020

What is End-to-End Encryption

End to End encryption is, in theory, very secure. By working with numbers extremely difficult for computers to calculate, encrypted data can be sent over third-party servers privately. In essence, the receiver has the only key to open the message, and the sender sends a locked box.

A government would need a master key to open this box. Famously, the US government programs of surveillance revealed by Edward Snowden used a master key. This allowed the US to decrypt any message or data it wanted. Big tech companies have since rescinded their backdoor master keys. However, agencies have asked tech companies to provide a new backdoor. This new resolution fits in line with that memo. Since a 2018 memo from the “Five Eyes” major allied intelligence, suspicions abound involving governments holding master keys. This specific EU draft does not call for any specific master key nor a ban. However, The European Commission told BeInCrypto:

“On the validity of the document we have no comment to make as this is not a Commission document. On encryption more generally we will do our best to get back to you shortly…”

Regulators in the EU trying to ban mathematics🤦🏻‍♂️ https://t.co/dgyiZhMNK8

— Riccardo Spagni (@fluffypony) November 9, 2020

Next Steps

While ORF.at suggested this document was a way to create an end-to-end encryption backdoor for governments, others disagree. TechCrunch argued that the document only really calls for more discussion. The draft should be presented to the European Parliament soon. Assuming there are no objections by Nov 12, 2020, the Presidency will bring it forward to COSI (Standing Committee on Operational Cooperation on Internal Security) on Nov 19, 2020. Later, it will be reviewed by COREPER (Committee of the Permanent Representatives of the Governments of the Member States to the European Union), followed by adoption by the Council. If this document is indeed authentic, it suggests the EU may push for a way to bypass encryption.