Five Eyes Lack Foresight: Misguided Efforts to Weaken Encryption Place Everyone at Risk

You’ve heard this one before: law enforcement authorities, citing concerns that their ability to lawfully access individuals’ electronic data and communications is ‘going dark’, are seeking to compel companies to build exploits into their own products and services to enable the production of user data on-demand. These efforts run smack into the enduring technical consensus that there is no way to build such exceptional access mechanisms, commonly known as ‘backdoors,’ into encrypted devices and communications for use by law enforcement that would also be reliably off-limit to criminals, foreign adversaries, and other malicious actors.

The underlying technical realities and contours of the encryption debate have not fundamentally changed since the 1990s when an early attempt at mandating encryption backdoors, the ‘Clipper Chip’ key-escrow system endorsed by the Clinton Administration, was abandoned after being shown to carry major security vulnerabilities. Unfortunately, the security and safety of individuals, businesses, and critical infrastructure remains at risk of governments’ pursuit of encryption backdoors. Law enforcement authorities launched the most recent offensive in the long running ‘Crypto Wars’ saga in August 2018 when members of the ‘Five Eyes’ intelligence sharing network issued a communiqué directly opposing strong encryption. In the statement, law enforcement authorities of the United States, United Kingdom, Australia, New Zealand, and Canada resolved that “we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.”

Since releasing the communiqué, the signatory nations have embarked on a series of concerning efforts to undermine strong encryption through both legislation and political pressure. The most recent example originated when Facebook announced that it would build end-to-end encryption protections into its popular Messenger service to meet shifting consumer expectations and demands for greater privacy and security in their communications. In response, justice ministers of the United States, United Kingdom, and Australia issued an open letter arguing that Facebook and other companies should not implement end-to-end encryption into their services unless they “[e]nable law enforcement to obtain lawful access to content in a readable and usable format.” 

These officials are motivated by their mission of investigating and preventing criminal activity, which can be frustrated by the use of encryption tools. However, this position represents a failure to fully consider the serious costs to security, safety, and economic prosperity that would result from undermining encryption or the myriad of currently available investigatory tools that do not require undermining strong encryption. It is illuminating that many law enforcement officials, upon leaving the government, have taken broader, more positive views on the proliferation of ubiquitous strong encryption. Most recently, former FBI General Counsel Jim Baker announced a shift in his thinking on encryption, arguing that “public safety officials need to take a different approach to encryption as a way to more effectively thwart our adversaries, protect the American people and uphold the Constitution in light of the existential cybersecurity threat that society faces.”

DisCo has addressed the limits to the arguments against the proliferation of strong, ubiquitous encryption before. However, given the invigorated push from law enforcement agencies to pressure companies into weakening the security of their products, this post will highlight five reasons why compelling encryption backdoors would be counterproductive, leave individuals, companies, and governments at greater risk, and undermine U.S. economic competitiveness.

1. 1. Encryption backdoors weaken security for everyone

Complexity is the enemy of security. The creation of new protocols to unlock otherwise encrypted devices and services, whether held by companies or the government, would instantly become a highly sought-after asset. Given recent security breaches that revealed the personal information of federal government employees and NSA hacking tools, the notion that the government would be the only entity that ever knows the location of the proverbial ‘key under the doormat’ for breaking encryption is highly dubious. Furthermore, in an era where security breaches are becoming more frequent and costly, companies are investing huge resources in making the data security of their products as strong as possible. Asking companies to, at the same time, intentionally weaken their own products is counterintuitive at best and inviting disaster at worst. Given that companies, lawmakers, and the nation’s critical infrastructure all rely on commercially available encrypted products and services, every sector of society would be put at greater risk by mandated encryption backdoors. 

2. Encryption backdoors will not prevent criminals from using strong encryption

Strong encryption relies on mathematics and it is impossible to legislate math out of existence. Any legal mandate enacted by the United States, even in conjunction with Five Eyes members, would only apply to software and devices subject to those jurisdictions. There is no law that can prevent criminals from using encryption technologies developed in foreign countries or otherwise available through open source projects. If encryption backdoors in popular consumer products are compelled, criminals intent on using strong encryption services would simply be able to switch to different products and services featuring strong encryption. They would not have far to look: some of the most popular encrypted messaging services are already headquartered outside Five Eyes jurisdictions. Products and services featuring strong encryption are always going to be available to those who want to use them. Therefore, the question that policymakers must consider is not whether or not strong encryption should exist, but whether or not they want to make it harder for law-abiding citizens to receive the privacy and security benefits of strong encryption.

3. There are better opportunities for empowering law enforcement to combat crime

Law enforcement frequently argues that backdoors are necessary to fight crime in the digital era, but this is based on a narrow view and should be subject to scrutiny. First, the FBI has repeatedly and dramatically inflated the numbers of devices they have not been able to access due to encryption. Furthermore, new data streams such as cell site location information, communications metadata, and big data dossiers provide more investigatory and surveillance tools for law enforcement activities than ever before. Rather than ‘going dark,’ law enforcement is enjoying a “Golden Age of Surveillance.” Finally, a 2018 report from the Center for Strategic and International Studies concluded that encryption is not the largest blocker for law enforcement’s access to digital evidence and suggested that there would be more to gain from shifting the focus to increasing funding, training for existing tools, and for greater collaboration between law enforcement and private enterprise. Given these factors and opportunities, it is a disservice to hardworking law enforcement officials to say that, their efforts notwithstanding, public safety nevertheless requires putting ordinary people at risk by undermining encryption.

4. Backdoors would disproportionately harm those most at risk in society

The creation of mandatory encryption backdoors would subject companies to instant pressure from oppressive regimes demanding that companies grant them the same entry to encrypted communications and devices as provided to the U.S. and its allies. In 2016, the government of Brazil arrested a Facebook executive in a dispute stemming from a court’s demand for the production of encrypted messaging information. If companies are forced to build encryption backdoors, this type of pressure from foreign governments will significantly multiply. Not all companies could be expected to indefinitely resist such tactics or have the resources to distinguish between an influx of potentially human rights abusing decryption requests. The result would be increased exposure of, and harm to journalists’ sources, persecuted religious groups, and LGBT individuals who rely on strong encryption to stay safe the world over.

5. Backdoors would weaken the competitiveness of the U.S. technology sector

Strong encryption powers the digital economy. In order for consumers to feel confident conducting business online, they must have trust that their messages, contact information, and payment details will be kept private. Increasingly, privacy and security are becoming competitive advantages to the U.S. tech sector as consumers are seeking products with strong privacy and security features. The Five Eyes’ goals for encryption backdoors would put domestic technology companies at a serious competitive disadvantage. Many consumers will choose to purchase and use secure products over a competitor that contains a government-mandated security weakness. This is no small worry, concerns about the security of American software businesses that resulted from the 2013 Snowden revelations are estimated to have cost the cloud computing sector up to $35 billion dollars in revenue, largely in foreign markets. The economic fallout for the U.S. tech sector of compelled encryption backdoors could be even more severe.

Conclusion:

Law enforcement has repeatedly called for a balanced approach to the values of privacy and security to create encryption backdoors that would provide exceptional access to what the U.S. Department of Justice recently called “lawless spaces.” However, for almost three decades society has, through its lawmakers, repeatedly considered these values and conducted this  balancing. The issue has consistently been resolved in favor of protecting strong encryption and the myriad of significant privacy and security benefits that it provides. Encrypted devices and services are not “lawless spaces”: the law applies, it is just not the law that some law enforcement officials might want to see. Companies will continue to cooperate with law enforcement to produce available information in response to valid legal requests. Rather than creating new vulnerabilities by undermining strong encryption, policymakers, law enforcement, the business community, and civil society should explore methods to strengthen this cooperation to combat the serious criminal threats that society faces today.