2

End to end encryption is a security measure in which the sender of a message encrypts the message in a way that only the intended recipient is able to decrypt it. This was first popularised by the software Pretty Good Privacy, the format of which is now defined in the OpenPGP standard, has in recent years been implemented in messaging systems such as whatsapp.

Suggestions to implement this technology more widely are meeting some resistance. An example of the oposition is discussed by the BBC:

The UK government and a coalition of charities are urging the British public to put pressure on Facebook not to introduce end-to-end encryption (E2EE) on its Messenger service.

The system is beloved by privacy-minded people as the data is safe from everyone. Even the messaging company is unable to decipher the data you send.

But authorities dislike it as they have no way of reading the messages, looking at the pictures or listening to the calls, even if they suspect criminal activity.

However Section 49 of the Regulation of Investigatory Powers Act 2000 appears to be focused on exactly this problem, and is designed to provide exactly this right, and defined the procedure that must be followed in such cases.

Is this a correct reading of the act? Was it designed to allow the police to access end to end encrypted communication? Does in allow police access to whatsapp messages if they follow the defined procedure? Would it allow access to facebook messenger communications if such encryption was implemented in this software?

Improve this question
5
  • The answer boils down to the applicable definition of "protected information".
    – Greendrake
    Commented Jan 20, 2022 at 13:15
  • The police will not be able to wire tap communications if E2EE is properly implemented. This is not a legal restriction, this is a physical restriction imposed on everyone due to mathematics. No law passed by a legislature can allow the police to inspect a document burnt to ash as no human law can compel such document to be reconstituted.
    – xngtng
    Commented Jan 20, 2022 at 13:33
  • @xngtng Yes, certainly. However my reading is that this is exactly the problem that was considered by the elected representatives, and the solution provided is to follow the procedure laid out to get access to this data. Greendrake seems to indicate it is not certain that this actually solves the problem.
    – User65535
    Commented Jan 20, 2022 at 13:38
  • @User65535 It is not wiretapping any more if you issue a notice to the parties whose communication is being intercepted. Of course, the devices can be seized as evidence and then yes key disclosure can be compelled if necessary; but smart criminals would delete the existence of messages and stupid criminals would leave the messages decrypted on the device.
    – xngtng
    Commented Jan 20, 2022 at 13:42
  • If you use XMPP (Jabber) protocol with the Off the Record (OTR) encryption plugin, once a session ends you cannot retrieve the key to decrypt any of the end-to-end encrypted messages due to a feature called Perfect Forward Secrecy. In the example I just provided, it is absolutely impossible to decrypt end-to-end encrypted messages.
    – questioner
    Commented May 27, 2022 at 15:18

1 Answer 1

Reset to default
1

Is this a correct reading of the act? Was it designed to allow the police to access end to end encrypted communication?

That is rather narrow and misfocused interpretation.

S 49 talks about "protected information" which is defined in s 56(1):

“protected information” means any electronic data which, without the key to the data—

(a) cannot, or cannot readily, be accessed, or

(b) cannot, or cannot readily, be put into an intelligible form;

Information transmitted in end-to-end encrypted messages indeed falls under that definition. But so do any encrypted files, hard drives, USB sticks, discs etc.

But, applying s 49 to end-to-end encrypted messages is actually much more difficult than to the other examples. This is because:

  1. The encrypted messages need to come into the possession of a designated official as described in s 49(1). This can only be done by sniffing/capturing the encrypted traffic by a man in the middle. (On the end devices this information will already be decrypted, so, technically, it will no longer fall under the definition.)
  2. A properly implemented end-to-end encryption will not necessitate any person to know the key. Rather, just the device itself knows it, and only temporary. It will often be rotated/renewed. So, there will be just no person to give a disclosure notice under s 49 to.

Conversely, encrypted hard drives etc. fall under s 49 perfectly. There will always be someone knowing (where to get) the key, and that key will not expire. This will also apply to the end devices that have received (and, so, decrypted) end-to-end encrypted messages — where the devices themselves are now protected by some key known to the owner.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .