Holistic privacy: How to remove the target on encryption's back

Encryp­tion, encryp­tion, encryp­tion. When it comes to the digi­tal world, encryp­tion is the number one tool we’ve got for protec­ting people’s secu­rity and privacy. If you had to pick a singu­lar cyber­se­cu­rity thing which was the most impor­tant, it would be encryp­tion. Without encryp­tion, the entire inter­net would catch on fire and we’d be left with a pile of ashes contai­ning everyt­hing from your texts to your grandma, to your bank pass­word, or even top secret govern­ment memos.

Losing—or weake­ning—encryp­tion would be a catas­trophe — and that’s why so many good people fight tooth and nail to protect it. Howe­ver, as the fiery debate over tech (and how to regu­late it) rages on — the focus on encryp­tion is star­ting to get really intense. And with that inten­sity, it’s star­ting to feel like other aspects of secu­rity and privacy aren’t getting the atten­tion they deserve. Things like meta­data, data storage, and digi­tal iden­ti­ties also have enor­mous privacy and secu­rity impli­ca­ti­ons, but they’re often left out of the discus­sion when talking about regu­la­tion and tech­ni­cal designs.

Instead, regu­la­tors focus their efforts on trying to weaken or ban encryp­tion: it’s all about back­do­ors, lawful access, and wanting access to things which are, well, impos­si­ble to provide access to (that’s the whole point of end-to-end encryp­tion, after all). When it’s only about encryp­tion, the conver­sa­tion about tech—w­hich is often extre­mely complex—­lo­ses nuance. Don’t get me wrong, encryp­tion has to be a core part of any discus­sion about privacy and secu­rity, it’s just not the only thing that matters. The conver­sa­tion about whet­her somet­hing is (or isn’t) private does not begin and end with 'is it encryp­ted?'. Sure, if it’s not encryp­ted, that’s a big red flag. But if it is encryp­ted, does that imme­di­a­tely equal privacy?

Is What­sApp private?

We pick on What­sApp a lot around here, but the reality is they’re just a really good repre­sen­ta­tion of a lot of the issues that matter to us. We’ve discus­sed the concept of privacy-washing before – the vari­ous ways that tech­no­logy compa­nies will try to convince users that their plat­form is private (because they know people care about privacy) while they’re selling their data for profit behind the scenes.

What­sApp is end-to-end encryp­ted — they even have a full imple­men­ta­tion of the lauded Signal proto­col. A huge tick for What­sApp. What­sApp is also owned by Meta, the lite­ral super­vi­llain of inter­net privacy. On its own, that is enough to raise an eyebrow but not neces­sa­rily condemn the entire appli­ca­tion. Howe­ver, last year What­sApp intro­du­ced some very contro­ver­sial privacy policy chan­ges which caused a heap of people to ditch the plat­form. For a lot of people, those privacy policy chan­ges felt like a smoking gun which proved what they alre­ady suspec­ted: being owned by Meta did (or at least, could) compro­mise What­sApp and jeopar­dise their privacy. 

This isn’t just theo­re­ti­cal, either — accor­ding to this ProPu­blica arti­cle, U.S. law enfor­ce­ment have utili­sed What­sApp meta­data to put multi­ple people in jail — inclu­ding Trea­sury Depart­ment whist­le­blo­wer Nata­lie Edwards. There are ways that encryp­ted plat­forms can be under­mi­ned through things like exploi­ting meta­data — and Meta (heh) is alre­ady playing this very dange­rous (and very dirty) game.

What­sApp is the perfect exam­ple of why there are other things that we need to consi­der when talking about privacy. It uses the exact same encryp­tion as Signal, but is it as private as Signal? Obvi­ously not. But, because of the extreme focus on encryp­tion, a lot of people might think that What­sApp is as good as it gets when it comes to app privacy — it’s end-to-end encryp­ted, after all. Other people might realise that What­sApp has issues, but they’re not really sure what they are. All of this confu­sion and misun­ders­tan­ding ends up making it harder for people to find and use the apps that really offer the protec­ti­ons they want, as well as leading regu­la­tors to beli­eve that encryp­tion is the root cause of all of their problems.

Regu­la­tors need educa­tors

We cannot compro­mise on encryp­tion. I was recently asked by a policy­ma­ker what I, as some­one working on secure tech, thought would be a 'propor­ti­o­nal limi­ta­tion on encryp­ti­on’ given the goals of law enfor­ce­ment agen­cies and nati­o­nal secu­rity and inte­lli­gence agen­cies. I don’t think they liked my answer — no limi­ta­tion on encryp­tion. Any weake­ning of encryp­tion is too much, there is no way to compro­mise encryp­tion 'a little bit’. It’s either secure, or it isn’t. There simply is no middle ground that can be found here — and this is the cause of a lot of angst and tension between tech­no­logy-makers and tech­no­logy-regu­la­tors.

At the moment, there are two kinds of maker-regu­la­tor discus­si­ons that feel common. The first invol­ves regu­la­tors wanting to find some kind of encryp­tion compro­mise when none exists — the compro­mise they’re looking for can’t involve encryp­tion at all, but will need to focus on other aspects of tech. The other is more hostile, where regu­la­tors have alre­ady deci­ded that encryp­tion is the ulti­mate enemy and attempt to squish it without even invi­ting the tech-makers to the discus­sion.

Obvi­ously both have their problems — and both seem to be rooted in a lack of tech­no­lo­gi­cal unders­tan­ding from the people making regu­la­tory deci­si­ons. I recently heard an anec­dote from one of my colle­a­gues in the digi­tal rights space, wherein a law enfor­ce­ment offi­cial spea­king at a confe­rence was lamen­ting how impos­si­ble the process of crime-solving had become due to encryp­ted messa­ging. Upon further discus­sion, it was reve­a­led that the Fort Knox of messa­ging they were refer­ring to was… Messen­ger. Encryp­tion wasn’t the issue at all, but it still copped the blame thanks to years of anti-encryp­tion rheto­ric.

Encryp­tion isn’t going anyw­here

Despite the nume­rous attempts from govern­ments, lawma­kers, and regu­la­tors around the world — encryp­tion isn’t going anyw­here. Encryp­tion is here to stay — and no matter how hard they may try, they will never convince us that it is in people’s best inter­est to get rid of encryp­tion.

With that in mind, our conver­sa­ti­ons around tech need to start assu­ming that encryp­tion is a funda­men­tal part of safety, secu­rity, and privacy instead of trying to figure out how it can be remo­ved, weake­ned, or banned. With this shift, we can hope to see the merry-go-round of attemp­ted encryp­tion regu­la­ti­on—w­hich is achi­e­ving nothing—finally stop.