EU inches closer to ban on end-to-end encryption

Leaked document suggests EU wants "balance" between robust security and ease of access for law enforcement

Someone holding a smartphone with the WhatsApp logo displayed on screen

The Council of the European Union appears to have a near-completed resolution that would propose a ban on the use of end-to-end encryption on off-the-shelf apps such as WhatsApp and Signal, according to a leaked document.

The memo, dated 6 November and addressed to representatives from EU member states, reveals that strong encryption remains a priority for lawmakers but that the availability of end-to-end encryption has made it overly difficult for law enforcement to conduct investigations.

It adds that a coordinated approach between lawmakers, companies, and academia is required to come up with an alternative that serves all parties – effectively banning the use of any security that fully encrypts data at every stage of its transmission.

The document appears to be a draft resolution from a meeting held on 3 November between members of the Justice and Home Affairs Council, titled ‘Security through encryption and security despite encryption’. Resolutions of this kind are not legally binding, but it may be used in the future to inform new legislation.

Its existence doesn’t come as a complete surprise given that earlier document using the same title, leaked in September and circulated by Statewatch, made it clear that the topic had been discussed in numerous council meetings since 2016.

In the November document, the EU makes it clear that it stands firmly behind the notion of ‘strong encryption’ as a means of protecting the data and rights of individuals, but that end-to-end encryption makes it too easy for criminals to evade justice.

Concerns have also been raised about the increasing number of consumer applications that are using this technology by default, including Facebook, WhatsApp, Singal.

“Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights and should be promoted and developed,” the document states, however, there are “instances where encryption renders analysis of the content of communications in the framework of access to electronic evidence extremely challenging or practically impossible despite the fact that the access to such data would be lawful.”

“Independently of the technological environment of the day, it is therefore essential to preserve the powers of competent authorities in the area of security and criminal justice through lawful access to carry out their tasks, as prescribed and authorised by law.”

It’s argued that, moving forward, the EU hopes to “establish an active discussion” with the tech industry in order to create a “balance” between maintaining the principles of strong encryption and allowing authorities to access data in a lawful manner.

The proposals in the document, alongside any revisions, are expected to be presented for endorsement on 19 November, with further representations on 25 November and adoption by the Council shortly thereafter.

Digital privacy groups have consistently argued that it’s impossible to create a secure corridor that law enforcement agencies can use to access encrypted data without that corridor being inevitably exploited by cyber criminals.

The idea of scrapping end-to-end encryption has long been on the agenda for the EU, although the stance appears to have hardened in recent years. As recently as 2017 the EU was in fact considering forcing all communication providers to use end-to-end encryption, despite the UK at the time showing strong opposition to the technology.

“A European Union move to ban encryption from messaging platforms like WhatsApp and Signal would be a massive threat to data privacy as we know it. It is a disappointing change in approach from the EU which has previously been pro-privacy for European citizens,” said Ray Walsh, digital privacy expert at ProPrivacy.

“Security experts understand that the EU government’s contention that ‘strong encryption technology’ can coexist with purposefully designed backdoors is contrary to the principles of robust cryptography.”

He added that “not only is breaking encryption is a threat to national security, but the ability to communicate privately is a vital part of any free society”.

In October, the Five Eyes intelligence alliance of the US, UK, Australia, New Zealand, and Canada urged technology manufacturers of all stripes to include security backdoors by design in all products.

“While encryption is vital and privacy and cyber security must be protected, that should not come at the expense of wholly precluding law enforcement, and the tech industry itself, from being able to act against the most serious illegal content and activity online,” the alliance said at the time.

The US is also mulling the idea of introducing the EARN IT Act, bi-partisan legislation that some claim has the potential to undermine end-to-end encryption by giving powers to the Attorney General to dictate how internet companies handle encryption across their services.

Featured Resources

Four cyber security essentials that your board of directors wants to know

The insights to help you deliver what they need

Download now

Data: A resource much too valuable to leave unprotected

Protect your data to protect your company

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

Recommended

Sopra Steria cyber attack costs to hit €50 million
Security

Sopra Steria cyber attack costs to hit €50 million

26 Nov 2020
Sophos warns customers of potential data leak
Security

Sophos warns customers of potential data leak

26 Nov 2020
Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron
Security

Weekly threat roundup: VMware, GitHub, Facebook, and MobileIron

26 Nov 2020
Egregor ransomware could take up where Maze left off
Security

Egregor ransomware could take up where Maze left off

26 Nov 2020

Most Popular

macOS Big Sur is bricking some older MacBooks
operating systems

macOS Big Sur is bricking some older MacBooks

16 Nov 2020
Cisco acquires container security startup Banzai Cloud
Security

Cisco acquires container security startup Banzai Cloud

18 Nov 2020
350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020