EU Takes Another Small Step Towards Trying To Ban Encryption; New Paper Argues Tech Can Nerd Harder To Backdoor Encryption
from the that's-now-how-any-of-this-works dept
In September, we noted that officials in the EU were continuing an effort to try to ban end-to-end encryption. Of course, that's not how they put it. They say they just want "lawful access" to encrypted content, not recognizing that any such backdoor effectively obliterates the protections of end-to-end encryption. A new "Draft Council Resolution on Encryption" has come out as the EU Council of Ministers continues to drift dangerously towards this ridiculous position.
We've seen documents like this before. It starts out with a preamble insisting that they're not really trying to undermine encryption, even though they absolutely are.
The European Union fully supports the development, implementation and use of strong encryption. Encryption is a necessary means of protecting fundamental rights and the digital security of governments, industry and society. At the same time, the European Union needs to ensure the ability of competent authorities in the area of security and criminal justice, e.g. law enforcement and judicial authorities, to exercise their lawful powers, both online and offline.
Uh huh. That's basically we fully support you having privacy in your own home, except when we need to spy on you at a moment's notice. It's not so comforting when put that way, but it's what they're saying. Then there's a lot of nonsense about how encryption is creating a "challenge" for public safety, even though there is no evidence at all to support this claim. The reality is that law enforcement has access to more data and more tools than ever before in history. That one small fragment of it might sometimes be encrypted, is not an issue. And it's certainly not an issue that requires the wholesale destruction of end-to-end encryption. But, of course, that's not where the EU is coming out on this.
Instead, it concludes with the inevitable "nerd harder" bullshit argument without ever explaining how this can be done (answer: because it cannot be done safely).
Moving forward, the European Union strives to establish an active discussion with the technology industry, while associating research and academia, to ensure the continued implementation and use of strong encryption technology. Competent authorities must be able to access data in a lawful and targeted manner, in full respect of fundamental rights and the data protection regime, while upholding cybersecurity. Technical solutions for gaining access to encrypted data must comply with the principles of legality, transparency, necessity and proportionality.
Since there is no single way of achieving the set goals, governments, industry, research and academia need to work together to strategically create this balance.
This is the same old garbage we've seen before. Technologically illiterate bureaucrats who have no clue at all, insisting that if they just "work together" with the tech industry, some magic golden key will be found. This is not how any of this works. Introducing a backdoor into encryption is introducing a massive, dangerous vulnerability that basically takes the secure walls of a house and rams a giant tank through the side. It's not adding a special key for law enforcement. It's breaking the very foundation of how end-to-end encryption works, and introducing a wide variety of shaky dangerous elements that they insist will never get exploited. But, with encryption, any vulnerability inevitably gets exploited.
Attacking end-to-end encryption in order to deal with the miniscule number of situations where law enforcement is stymied by encryption would, in actuality, put everyone at massive risk of having their data accessed by malicious parties. It's incredibly clueless and incredibly shortsighted.
And it's absolutely stunning that it's coming from the EU. After all, we keep hearing how the EU believes in "privacy" and "data protection" much more than the US. We hear stories about the lessons learned from World War II about how governments can abuse access to the private information on citizens. Indeed, the EU courts recently blew up the EU/US "Privacy Shield" agreement regarding transferring data from the EU to the US because of NSA surveillance efforts that cannot guarantee EU data remains protected.
And then they turn around and want to destroy encryption? Incredible.
At this point, this is nothing more than a draft policy paper from the Council. A lot more needs to happen before this becomes anything resembling a law in the EU. But just the fact that this continues to lurch forward, pushed by ridiculously ignorant bureaucrats is hugely problematic. People in the EU need to speak up loudly about what a mess this is.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: backdoors, encryption, end-to-end encryption, eu, eu council, lawful access
Reader Comments
Subscribe: RSS
View by: Time | Thread
Isn't one of those rights an ability to have a conversation that governments are not party to?
[ link to this | view in chronology ]
Re:
Oh, please. Anytime I hear of various world governments talking about encryption this video comes to mind.
For those that need context: That woman is a government plant meant to ensure compliance with the ruling party's state of mind. Our protagonist has been caught running against her mandate and therefore is tortured as a result. All while trying to convince everyone that the protagonist is at fault, and her mandate is the One True Way.
If that doesn't scream, in HD cinematic clarity, every underlying bit in the "nerd harder" argument I don't know what does.
[ link to this | view in chronology ]
Hmmm
The subtitle reads:
from the that's-now-how-any-of-this-works dept
You put in the wrong word. Any should read all.
[ link to this | view in chronology ]
Re: Hmmm
“any” is correct: there is no part of this that works their way.
[ link to this | view in chronology ]
Someone should sit down with regulators and explain how actual physical backdoors weaken security on homes and businesses, then ask them how they think backdoors for encryption will work any differently. I don’t think they’ve ever thought about the connection too hard and someone needs to educate them before they fuck everything up for the sake of “doing something”.
[ link to this | view in chronology ]
Re:
If you really want to hammer the lesson home insist that if they think that encryption can be 'safely' crippled then they should have no problem using locks on their houses and offices where there is a known master key that the owner pinky-promises they won't sell or allow to be copied.
[ link to this | view in chronology ]
Re: Re:
And then post a picture of the key and/or their address on the internet.
Cause real life isn't like the internet until you have thousands of random people trying to break into your house 24/7/365
[ link to this | view in chronology ]
Re: Re: Re:
What do you mean break in?
Breaking in involves the act of breaking something.
They have a key so they just walk in just like the hotel staff or building managers. Those places don't suffer from theft and assault by people who have access right? Ah dang it, they do don't they.
[ link to this | view in chronology ]
Re: Re: Re: Re:
No worries, the key holder will promise that the key will only be used for lawful access, and could never be used for anything else.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
...and it's not going to be the key holder's responsibility that every organized crime ring and national intelligence agency will be willing to fork over billions of USD and use any dirty trick - from kidnapping to wet work - to obtain such a master key.
Yeah, it's theoretically possible to create such a key. Not to keep it safe.
Once that goes into effect one of two things will happen; Every bank refuses to use the government-approved encryption, or the banks fall in line and the EU pays the price when trust funds and pensions vanish to undisclosed addresses.
Private individuals, of course, will keep using FOSS ciphers and put the EU in the quandary of whether to practice outright censorship and prohibit practicing math without a license...or whether to give up on this dangerous nonsense.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re:
Any system, no matter how perfect, MUST take the human element into account. Otherwise it's just a farce waiting to happen:
https://www.theregister.com/2006/02/06/greece_mobile_snooping_scandal/
https://www.theregist er.com/2007/09/07/ericsson_fine_greek_phonetap/
Unfortunately I can't find the original article that broke down the details of the heist (pity, it was a great read) but it went something like this ...
An unknown party (they were never caught as far as I know) got someone to write a software patch for the legally required lawful intercept system (the system by which wiretaps are performed) in the Ericsson equipment. This system was a tightly guarded secret in Ericsson, no more than a few dozen people had access and knowledge to be able to write the patch. It's not clear whether they used current/former Ericsson staff to write the patch or somehow got their hands on the source code, etc. and wrote the patch without inside knowledge but with a lot of trial and error. Regardless of how they wrote the patch it worked exceptionally well.
They then acquired access credentials for Vodafone Greece control sites to give them access to some core exchange equipment. They then installed the patch, not clear if it was done remotely or whether they actually entered the control room and applied the patch in person. They cleaned up any record of themselves so it's not clear the exact date on which all this happened.
The patch allowed them to invisibly use the lawful intercept system ... no records in the logs, no notice/warning on control center screen, as far as the system was concerned there were no intercepts running. The patch created a clone of the target phone-call in real-time and sent a digital stream of the conversation to one of a number of burner phones.
The entire thing went unnoticed for it's full duration, about a year. It was only discovered after the fact when a legitimate software update was applied and it clashed with the illegal patch causing the update to fail. The sytem in question allowed temporary patches to be loaded, which would then be overwritten by an official update (this allowed operators to remedy an issue without waiting for an official update). The update failed as the code and data it was designed to run against in that part of the system had been altered by the illegal patch.
The investigation into the failed update uncovered the illegal patch and that was when the scale of the heist started to be uncovered.
[ link to this | view in chronology ]
Re: Re: Re: Re: Re: Re:
"Any system, no matter how perfect, MUST take the human element into account. Otherwise it's just a farce waiting to happen:"
Which is why any security relies on not having weak points far more than on having particularly strong ones. The ericsson case is a very clear example here.
And it has to be noted that the "lawful intercept" part of the system is a rather miniscule backdoor as compared to undermining the fundamental encryption governing every online operation.
It is likely to be discovered rather faster than within the year too, because one morning every bank forced to rely on encryption will wake up and find every last one of their accounts drained, including trust and pension funds.
[ link to this | view in chronology ]
Meanwhile in the United States
You can print your own TSA-compliant master keys because a picture of the originals were accidentally leaked and someone went and made a printable set.
And the CD Audio magic data key is sometimes found on t-shirts.
Oh and every form of video copy protection lasts less than six months. Except when they do in which it becomes a major advertising bit that this company's encryption lasted seven months.
But this is like the TOO MANY SECRETS code. (Though in the movie, allegedly the SETEC ASTRONOMY chip could crack public-key encryption which cannot yet be done without full quantum computing). Still. Rival nations will invest billions into getting their own set of the magic keys, and hackers nationwide will pull out all their tricks.
And the US government is notorious for keeping its secrets locked behind shitty security.
[ link to this | view in chronology ]
Re: Meanwhile in the United States
It would make for a wonderful apocalypse movie. The world, led by US and EU insistence, creates a set of master backdoor keys to all encryption and force every corporation to apply it. It leaks within weeks to three intelligence agencies and half a dozen private entities in a frenzy of kidnapping, extortion, and good old-fashioned bribery.
Two weeks later dozens of hackers have themselves a brawl looting every bank in the western world to the ground and the global economy collapses, leaving the protagonists slowly migrating across the US dodging hordes of hungry cannibals, probably led by a withered and creaky Mel Gibson toting a sawed-off shotgun...
[ link to this | view in chronology ]
Re:
The interesting thing with a mandated encryption backdoor, does it really jive with the GDPR?
Say the EU forces a backdoor on the tech-industry, who is liable when a data-breach occurs because of it?
[ link to this | view in chronology ]
Re: Re:
As politicians are never wrong clearly the only responsible party will be the tech companies for not nerding hard enough.
[ link to this | view in chronology ]
No, that's not what that word means at all
Moving forward, the European Union strives to establish an active discussion with the technology industry, while associating research and academia, to ensure the continued implementation and use of strong encryption technology.
Much like when that 'argument' is used in the US there's really only one proper response to that: Liar.
A discussion is a two-way thing, where one side says makes their arguments or statements and the other side makes their arguments/statements, with a healthy back and forth as they try to convince each other and/or share their position with the other person. Those trying to undermine encryption on the other hand are not looking for a discussion or argument as they have shown no interest or willingness to listen to the other side, and instead merely want the other side to simply accept their demands at face value or else.
That's not an argument or discussion, that's an order/ultimatum.
[ link to this | view in chronology ]
nerd harder
... you know, because the "intelligence" backing police/military are already doing the "best" it can.
Too bad there's not enough 'intelligence' to realize that any sort of 'backdoor' is impossible to secure.
I won't ask them to 'police' harder, because that'll lead to the (ab)use of physical force that's already problematic.
[ link to this | view in chronology ]
A darker view
I think not. I do not believe you can reasonably apply Hanlon's Razor here. I think these people, in Europe, in the US, and elsewhere, know exactly what they are proposing. I think they are completely willing to sacrifice our rights, the security of the financial and commercial networks, and anything else that might stand between them and complete authoritarian control. There exist evil people, and many of them find the allure of unlimited power via government to be irresistible.
[ link to this | view in chronology ]
'That is a price we're willing to have you pay.'
If pushes for broken encryption was a new thing that had just come out in the past few months or year then yeah, I could see ignorance being not valid excuse but a believable one. Given this has been going on for years though anyone proposing crippled encryption at this point deserves zero benefit of the doubt, and the default assumption should be exactly what you're saying, that they full well that what they are demanding would be disastrous to the privacy and security of the public and they simple don't care.
[ link to this | view in chronology ]
An alternative view
They know it won't work, but they aren't actually going to push it through. This then lets them scapegoat "Big Tech" for all of their failures.
[ link to this | view in chronology ]
What really needs to happen is anonymous to take up the mantle and share the keys as well as all the personal info for each and every faceless beaurocrat involved in this septic tank of a beaurocracy..
Once someone piddles in their breakfast cereal and shine a light on their faces, maybe then they will either change or be tarred and featherd by the incensed masses.
[ link to this | view in chronology ]
Several years ago, we had encryption that we thought was impenetrable. They called it TLS 1.2.
Then a few researchers found a flaw that didn't even pre-broken crypto in order to get keys, read encrypted messages from entities like Facebook and Cisco.
And here you politicians are, asking us to make encryption WEAKER?
[ link to this | view in chronology ]
At this point, I just want to say...
No! You nerd harder.
When you tell the tech industry how you think a safe backdoor can be facilitated (get specific.) then we'll show you why that will totally fail and embarrass the EU government departments.
[ link to this | view in chronology ]
Why aren't police being told to nerd harder
Why isn't law enforcement getting the same pressure, to nerd harder to detect perpetrators without the benefit of crypto skeleton keys?
Also: It seems there are limits of the EU's interest in privacy. Maybe they want Royalty and aristocrats to have the right to be forgotten but want all the serfs subject to continual monitoring?
As technology advances, we have to stay diligently aware of why we don't turn our nations into surveillance states just because we can.
[ link to this | view in chronology ]
Re: Why aren't police being told to nerd harder
Probably because itt would require more resources (i.e. money) to be given to law enforcement to help them nerd harder. It's much easier to tell "the tech companies" to spend their money to meet the governments' demand.
Also, we can't assume that law enforcement could be arsed.
[ link to this | view in chronology ]
law enforcement could not be arsed
That's essentially the problem here in the states.
But then now we're wondering why we're paying their annual budget.
The answer so far appears to be because they are the ones issued guns.
[ link to this | view in chronology ]
Re: Why aren't police being told to nerd harder
Maybe they want Royalty and aristocrats to have the right to be forgotten but want all the serfs subject to continual monitoring?
I can't help but notice that the preamble's statement that "Encryption is a necessary means of protecting fundamental rights and the digital security of governments, industry and society" seems to suggest that the first two groups exist outside of the third, rather than being subsets of it.
[ link to this | view in chronology ]
Politicians: Nerd Harder
Tech Industry: Listen Harder
[ link to this | view in chronology ]
Re:
'Listen at all' would be an improvement over their current stance.
[ link to this | view in chronology ]
If politicians make laws about tech they should consult experts who represent the public not just members of the police or intelligence services who are constantly pushing
for more surveillance
Thank god trump lost to Biden or we would be facing all apps or websites losing section 230 protection if the use
end to end encryption
The importance of protecting user data is more important
than ever in an age when people work from home
and hospitals and company's are getting hacked every month
Let's say police or the intelligence services have a secret key to view private messages on apps or social media messages how long will it take for russia or China to get the keys to spy on European users.
I think the gdpr mainly applies to company's and public body's who collect data on customers or members of the public,
It do, es nt mean the police cannot collect data or carry out surveillance on criminals
Even if this law comes into force criminals will have the option of using apps from the dark Web or non EU based websites which will have end to end encryption
This will effect human rights organisations who need a truly secure method to message protestors in country's like
Russia chína Turkey etc
As we have seen in the USA some police are currupt and racist against minoritys
and have been know to make up false evidence to get a conviction
[ link to this | view in chronology ]
This is a good illustration of the 'binary-world' fallacy. Biden is not Trump, therefore he approves everything Trump hates, no? No, of course not. The fact is, Biden has already called for section 230 to be revoked completely. There's no evidence he hates the first amendment any less than Trump does.
https://www.nytimes.com/interactive/2020/01/17/opinion/joe-biden-nytimes-interview.html
[ link to this | view in chronology ]
Re:
"This is a good illustration of the 'binary-world' fallacy. Biden is not Trump, therefore he approves everything Trump hates, no? No, of course not. "
Yeah. Trump was as blunt as a hammer and practiced his malice openly. Biden is "better" than trump because of what he isn't - notably he isn't a white supremacist, doesn't actively advocate for the oppression of minorities, and doesn't call for his supporters to exert politically motivated violence if the voters won't support him.
What Biden still is, however, is a creature of the establishment. I don't see anything even remotely enlightened coming from him. He may have to take a hard stance against undermining encryption simply because Barr's managed to link that to republican ideology but when it comes to Free Speech democrats are...not ideal. They're just better than those who hate free speech with a passion.
[ link to this | view in chronology ]
Well, it shouldn't even be called encryption if there is a way to access the data it supposedly protects. It's just another exercise in coding.
[ link to this | view in chronology ]
As I've said before. It's totally possible to split and escrow a key so that everyone whom you've escrowed the key with have to agree that accessing the encrypted message is "lawful". And of course, by selecting appropriate, mutually hostile, escrow agencies (every country in the world plus various NGOs such as Amnesty International, Red Cross, etc.), the chances of any escrowed key being retrieved becomes effectively zero.
The problem then becomes a political problem. So the politicians saying "nerd harder" can be told "politic harder".
[ link to this | view in chronology ]
Zero plus a '10' in front of it perhaps
Assuming that would be one key for all encryption(or even a collection of them) that would not in any way be secure at all as it would be the most valuable bit of information on the planet and individuals, groups and even governments would be all-in on the scavenger hunt to collect all the pieces to the golden key(or simply wait for someone else to do the hard work and swoop in to get a copy), and with those kinds of resources to work with no security would be enough.
To the extent that that solves the 'nerd harder' problem it would merely replace it with a vastly worse one.
[ link to this | view in chronology ]
A MacGuffin too valuable
Yeah, this is essentially the basis for one of those action movies when know one knows why the briefcase is so important but it's worth about $1 trillion USD to any nation that gets it first.
In short, whoever is between that briefcase and the espionage agency of each industrialized nation is toast.
[ link to this | view in chronology ]
Re: A MacGuffin too valuable
one of those action movies when no-one knows why the briefcase is so important
Stupid homophones.
[ link to this | view in chronology ]
Re:
"As I've said before. It's totally possible to split and escrow a key so that everyone whom you've escrowed the key with have to agree that accessing the encrypted message is "lawful"."
Yeah, and that works all the way until someone with enough political authority and/or credibility decides that "for the good of all" someone needs to hold a keyring in good faith.
Or every key held in escrow has been leaked which means all keys become public property after ten years rather than 3.
[ link to this | view in chronology ]
Re: Re:
It also makes it nearly impossible to cycle the key. The issue with keys on the internet is that they should be switched out every so often. The biggest reason being that better keys often come along and that previously "foolproof" key is actually hackable (see TLS 1.0 and 1.1), but second to that is that no key is 100% unbreakable. Its just that a lot of time is needed to crack/bruteforce/guess. If you change it every so often, then you reset the time it takes to crack it (more or less).
[ link to this | view in chronology ]
Re: Re: Re:
...this, to me, sounds like the perfect way to guarantee every encrypted database is suddenly impossible to open by anyone, barring a miracle of global diplomacy.
Major companies have issues with badly synced certificates every damn week and those setups are drop-dead simple compared to the non-euclidean lovecraftian horror straight out of giger's worst nightmares you describe...
[ link to this | view in chronology ]
Ask their military
These clueless bureaucrats should talk to their own military leaders. Ask them how they would feel about having a back door in the encryption used for battle communications systems. Sure, those systems likely use proprietary encryption, which would never be intentionally crippled, but I think it's a useful perspective.
[ link to this | view in chronology ]
Re: Ask their military
"Sure, those systems likely use proprietary encryption, which would never be intentionally crippled..."
At some point those systems will intersect the compromised ones. Invoking Murphy that'll be the Key Escrow handler.
[ link to this | view in chronology ]
The sought `balance' lies at then endpoints of the encrypted transmission.
But these rightwing politicians subconsiously fear the guillotine and that fear drives their desire for control.
[ link to this | view in chronology ]
It's simple, really
The EU just needs to legislate that P = NP, and all will be fine.
[ link to this | view in chronology ]
Re: It's simple, really
Ah, the indiana pi strategy.
[ link to this | view in chronology ]
The plan seems to have taken another half-lurch forwards, sadly.
Machine translation:
[ link to this | view in chronology ]