State Hacking An Option To Overcome Encryption, IGF Hears

The days of unfettered access to internet content are over, Riana Pfefferkorn of the Stanford Center for Internet and Society told government representatives during a panel dedicated to state interference in encryption, organised by Brazil’s registry Nic.br and CGI.br at the 12^th Internet Governance Forum this week in Geneva. “Governments have to adapt,” the cryptography researcher said. A concern is, though, that governments will adapt by either lashing out to get backdoors in code, weaken encryption or legalize state hacking.

Government representatives from the United Kingdom, the Netherlands, Brazil and also the United States all vowed to favour strong encryption to protect confidentiality, security and privacy. But they also claimed that access for enforcement and intelligence reasons is still necessary.

“Our ministers would find it irresponsible to give up the fight about it,” said Elinor Buxton, from the UK Ministry of Foreign Affairs. While she underlined that backdoors are not part of the UK strategy, the “going around” was an option for end-to-end encrypted content besides relying on the provisions in the investigatory powers act. The act allows subpoenaing providers for as much cleartext data as they could possibly provide them technically.

Seth Bouvier from the Office of the Coordinator for Cyber Issues at the US State Department stated that encryption flared up several times over the last few years in the US, “but we have a new administration now and they’re not putting anything out,” referring to proposals on encryption regulation. “The US government shares the interests in strong encryption for the same reasons, for cybersecurity, for protecting human rights and for protecting our own government information,” he said.

End-to-end encrypted platforms nevertheless are at risk of “being used by terrorists and criminals,” he said.

Nina Leemhuis Janssen, speaking for the Dutch, underlined that a regulation on encryption including backdoor obligations had been decided against in her country after a lengthy consultation. But, she said, “the Netherlands is experiencing serious problems in law enforcement and intelligence gathering due to encryption” and is looking for other means to get to the data.

Government hacking is clearly on the rise, stated Estelle Masse from the digital rights group Access Now. “This has proven implications for human rights,” she said, one issue being that in “the race to gather data, we often qualify very quickly all of the data evidence even before there had been access and can be qualified [classified] as such.”

The biggest worry of technologists with potential weakening of encryption on the other hand is that “weak encryption is worse than no encryption,” as Demi Getschko from Nic.br said. Users would then be exposed to unexpected and unknown risks. One British researcher attending the session challenged the governmental positions, stating: “Without strong encryption, there can‘t be secure artificial intelligence.” One should just think about the hacked self-driving truck on the road, she warned.

With states getting more and more in the hacking business, Sunil Abraham from the Center for Internet and Society in Bangalore, India, made also two positive recommendations: to require government officers to use encryption themselves and to invest heavily in mathematics.

 

Image Credits: Monika Ermert