EU Data Protection Official Says Revised Privacy Laws Should Ban Backdooring Encryption
from the sounds-like-a-plan dept
The EU's "Cookie Law" is a complete joke and waste of time. An attempt to regulate privacy in the EU, all it's really served to do is annoy millions of internet users with little pop up notices about cookie practices that everyone just clicks through to get to the content they want to read. The EU at least recognizes some of the problems with the law and is working on a rewrite... and apparently there's an interesting element that may be included in it: banning encryption backdoors. That's via a new report from European Data Protection Supervisor (EDPS) Giovanni Buttarelli, who was put in charge of reviewing the EU's ePrivacy Directive to make it comply with the new General Data Protection Regulation (GDPR) that is set to go into effect in May of 2018. The key bit:The new rules should also clearly allow users to use end-to-end encryption (without 'backdoors') to protect their electronic communications.To be clear, this actually seems like it may go too far. There are plenty of situations where it seems completely reasonable for law enforcement to use other means to figure out ways to decrypt encrypted communications. Arguing that it should be completely outlawed seems a bit extreme. But blocking backdoors does seem like a good idea. The report also says that the use of end-to-end encryption should be encouraged to the point of being mandated in some cases:
Decryption, reverse engineering or monitoring of communications protected by encryption should be prohibited.
In addition, the use of end-to-end encryption should also be encouraged and when necessary, mandated, in accordance with the principle of data protection by design.
In addition, the use of end-to-end encryption should also be encouraged and when necessary, mandated, in accordance with the principle of data protection by design. In this context the EDPS also recommends that the Commission consider measures to encourage development of technical standards on encryption, also in support of the revised security requirements in the GDPR.Conceptually, this sounds good, but the implementation matters. Mandating encryption seems to be going a bit far. While I tend to think it makes sense for much more widespread use of encryption, it's not clear why the government needs to get involved here at all. And that includes in the development of such standards. In fact, as we've seen in the past, when the government gets involved in creating encryption standards, that seems to be where the intelligence community can slip in their backdoors.
The EDPS further recommends that the new legal instrument for ePrivacy specifically prohibit encryption providers, communications service providers and all other organisations (at all levels of the supply chain) from allowing or facilitating 'back-doors'.
Still, this is certainly an interesting development. Of course, it would also conflict with the UK's Snooper's Charter ("Investigatory Powers Act") which mandates backdoors for encryption. Though, to be fair, by the time the new rules go into practice, perhaps the UK will no longer be a part of the EU.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: backdoors, data protection, encryption, eprivacy directive, eu, gdpr, privacy
Reader Comments
Subscribe: RSS
View by: Time | Thread
I guess that's good news for people who live in the United King- oh, right...
[ link to this | view in chronology ]
First they are already delaying the official "WE QUIT" message until the end of the year. From that point on it takes at least two years before they can actually leave, those two years are considered the absolute minimum needed to untangle the UK from the EU. Both parties can ask the other to extend this point until the end of time.
Then there is a second cruder option (but seeing the history of how the EU and it's different national governments have acted when a referendum went against the EU it should be taken seriously) and that is to ignore the referendum since it is only an advisory to the government. The biggest losers if the UK does leave, the financial industry, has already demanded that this happens (in case people are wondering how influential the financial industry is, it is mainly centered in what amounts to an independent city state in London with a special representative called the Remembrancer, also on a few occasions Tech dirt has made fun of the keystone cops that is the police force of this patch of land.)
[ link to this | view in chronology ]
Re:
Oh, kind of like copyright extensions.
[ link to this | view in chronology ]
Re: Re:
As per Article 50, paragraph 3: It requires unanimous agreement to extend.
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
That would certainly go too far and lead to the same idiotic situation you've got in the US where it becomes illegal to break copy protection just because it is copy protection, even if it's something hideously basic like a rot13 cipher, but gets federal protection "just because"...
[ link to this | view in chronology ]
Response to: Anonymous Coward on Jul 27th, 2016 @ 12:56am
Basically you could get into troubles for having found a backdoor in a non-open protocol (because this requires to "reverse-engineer the encryption")
[ link to this | view in chronology ]
Governments *should* get involved in mandating encryption
[ link to this | view in chronology ]
The reason encryption should be mandated
There are two ways to argue here: Those knowledgable should protect everyone else by advising the represantives and getting them to legally mandate what is neccessary, even if the majority of the population does not care. I can already hear the cries of "nanny state!".
The other way is to protect yourself, to continue to evangelize to the masses and fail to get any real change. We will continue to live in a world were governments, corporations and criminals alike will with ever more ease acquire and collect ever more private data on everyone but a small minority. The negative effects of this will be borne by everyone - even the few security conscious who did protect themselves.
[ link to this | view in chronology ]
Re: The reason encryption should be mandated
[ link to this | view in chronology ]
And the Government is free to try to decrypt it via whatever methods available. I do think they go too far in mandating encryption anywhere other than public services that demand it (ie: banking, Govt stuff). It should be an option for everybody else.
[ link to this | view in chronology ]
Re:
Happy with online commerce unencrypted? Happy with private health information unencrypted? Neither of these are public services in the sense that how they happen is mandated by govt. Making providers financially liable won't erase the damage potentially done by hacked & leaked information. If users want to send unencrypted messages/chats/files that is one thing, but online search histories, memberships, purchases and so on is something else. Those are the things the EU is concerned about before nannying everyone to encrypt every chat msg.
[ link to this | view in chronology ]
Re: Re:
Especially if the provider is a corporation whereby profits are privatized while losses are socialized.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
They have to have something to negotiate with.
For most of us, it makes sense to just ask for what is needed, but for politicians, they have not figured that out yet. So it makes sense they would demand the world first and then negotiate to something more reasonable. It really is the only way not to get the shaft from the start unfortunately.
[ link to this | view in chronology ]
Mike, don't forget
[ link to this | view in chronology ]
[ link to this | view in chronology ]