- EU ‘Chat Control’ laws will render encryption useless.
- Law-makers’ motives exemplary yet ill-guided.
As part of its six-month leadership stint at the head of the Council of the European Union, Hungary has reiterated its support for the enactment in European law of so-called ‘Chat Control’. The law, known officially as the Regulation on the Establishment of Rules for Preventing and Combating Sexual abuse of Children, aims to ensure that providers of messaging technology operating in the EU take measures to flag CSAM (child sexual abuse material).
The rolling stewardship of the Council of the European Union (known more informally as the Council of Ministers) allows a degree of policy leadership by each member of the EU in turn, each term lasting six months. Hungary is using its tenure to re-invigorate the progress of the ‘Chat Control’ legislation, a full vote on which was delayed in June of this year. It is thought that 19 of the 27 countries in the EU back the legislation.
A series of amendments to the extant proposed legislation was leaked [PDF] to POLITICO, a news organisation owned by German media group Axel Springer SE. In it, EU legislators provide the detail of how the recently lightly-edited laws retain many of the the gaping holes in the initial proposals. These render its measures impractical to implement and show the law will not achieve the intended purpose, plus, they create an unsafe environment for private data to be exchanged in Europe.
Practicalities of Chat Control
The ‘Chat Control’ legislation would require messaging app companies and providers of secure email services to decrypt messages and examine them for signs of CSAM. In layman’s terms, every company with an end-to-end encrypted message facility would need to install a ‘back door’ into the private conversations of its users.
The problem with ‘back doors’ is that they break the fundamentals of encryption, rendering it of zero value to all users. Encryption should be unbreakable – if it is breakable, it’s not encryption; it’s obfuscation at best, and obfuscation is quite a different beast.
The laws proposed place the onus of implementing this feature on the individual provider, a detail that will “allow for innovation and ensure proportionality and technological neutrality.” Providers of messaging services “should be left a degree of flexibility to design and implement measures tailored to the risk identified and the characteristics of the services they provide.”
The wording means that regardless of the method of encryption, the provider has to break its own technology. Any insurmountable encryption that might be deployed cannot be used in the EU, so technological innovation is not only discouraged but is illegal to code into any platform without rendering said code pointless.
Positives and negatives of the EU’s Chat Control law
The ‘Chat Control’ legislation’s contents are promisingly well-considered in parts, stating, “The measures taken should be targeted, carefully balanced and proportionate, so as to avoid any undue negative consequences for those who use the services for lawful purposes.”
Unfortunately, the biggest negative consequence of the introduction of a ‘back door’ renders any solution unviable for every user, including those with lawful purposes. If there is a method of decrypting traffic to check for CASM, then all data is effectively decryptable and so at significant risk: open to exploitation by bad actors, nation states, malignant domestic security services and, in time, anyone capable of downloading and running publicly-available software.
In part, the ‘Chat Control’ legislation reveals weaknesses that are likely to have been introduced as concessions to opposed EU member states or lobbyists. Communications used for “national security purposes” are exempt from examination, for example, as are “interpersonal communications services that are not available to the general public and the use of which is […] restricted to persons involved in the activities of a particular company, organisation, body or authority.”
Those terms create a broad definition of any organisation, including those comprising of more than one individual citizen. For instance, two people involved in illicit activity can create an encrypted network and, given that the network isn’t open to anyone else, might be immune from oversight.
There are two common tropes around governmental involvement in anything technological. The first is the deep lack of understanding of the subject in question. This explains the expectation that encryption systems can be somehow partially disassembled on demand without destroying the edifice that encryption creates.
The second is that whenever data security compromise is raised, it’s often under the guise of child protection. While the aims of those who are determined to bring an end to the online presence of CASM are unquestionably laudable, it’s physically impossible, unfortunately, to impose an emotionally-derived edict on the immutable laws of maths (encryption) and expect effective results.
As Chief Engineer ‘Scotty’ in the original Star Trek TV series famously said, “Ye cannae change the laws of physics!” Lawmakers at all levels of government should pay heed.
Unified Communications is a two-day event taking place in California, London, and Amsterdam that delves into the future of workplace collaboration in a digital world. The comprehensive event is co-located with Digital Transformation Week, IoT Tech Expo, Edge Computing Expo, Intelligent Automation, AI & Big Data Expo, and Cyber Security & Cloud Expo.
Explore other upcoming enterprise technology events and webinars powered by TechForge here.
