Leaked Government Document Shows Spain Wants To Ban End-to-End Encryption (wired.com) 76
An anonymous reader quotes a report from Wired: Spain has advocated banning encryption for hundreds of millions of people within the European Union, according to a leaked document obtained by WIRED that reveals strong support among EU member states for proposals to scan private messages for illegal content. The document, a European Council survey of member countries' views on encryption regulation, offered officials' behind-the-scenes opinions on how to craft a highly controversial law to stop the spread of child sexual abuse material (CSAM) in Europe. The proposed law would require tech companies to scan their platforms, including users' private messages, to find illegal material. However, the proposal from Ylva Johansson, the EU commissioner in charge of home affairs, has drawn ire from cryptographers, technologists, and privacy advocates for its potential impact on end-to-end encryption.
For years, EU states have debated whether end-to-end encrypted communication platforms, such as WhatsApp and Signal, should be protected as a way for Europeans to exercise a fundamental right to privacy -- or weakened to keep criminals from being able to communicate outside the reach of law enforcement. Experts who reviewed the document at WIRED's request say it provides important insight into which EU countries plan to support a proposal that threatens to reshape encryption and the future of online privacy. Of the 20 EU countries represented in the document leaked to WIRED, the majority said they are in favor of some form of scanning of encrypted messages, with Spain's position emerging as the most extreme. "Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption," Spanish representatives said in the document. The source of the document declined to comment and requested anonymity because they were not authorized to share it.
In its response, Spain said it is "imperative that we have access to the data" and suggests that it should be possible for encrypted communications to be decrypted. Spain's interior minister, Fernando Grande-Marlaska, has been outspoken about what he considers the threat posted by encryption. When reached for comment about the leaked document, Daniel Campos de Diego, a spokesperson for Spain's Ministry of Interior, says the country's position on this matter is widely known and has been publicly disseminated on several occasions. Edging close to Spain, Poland advocated in the leaked document for mechanisms through which encryption could be lifted by court order and for parents to have the power to decrypt children's communications. Several other countries say they would give law enforcement access to people's encrypted messages and communications. "Cyprus, Hungary, and Spain very clearly see this law as their opportunity to get inside encryption to undermine encrypted communications, and that to me is huge," says Ella Jakubowska, a senior policy advisor at European Digital Rights (EDRI) who reviewed the document. "They are seeing this law is going far beyond what DG home is claiming that it's there for."
For years, EU states have debated whether end-to-end encrypted communication platforms, such as WhatsApp and Signal, should be protected as a way for Europeans to exercise a fundamental right to privacy -- or weakened to keep criminals from being able to communicate outside the reach of law enforcement. Experts who reviewed the document at WIRED's request say it provides important insight into which EU countries plan to support a proposal that threatens to reshape encryption and the future of online privacy. Of the 20 EU countries represented in the document leaked to WIRED, the majority said they are in favor of some form of scanning of encrypted messages, with Spain's position emerging as the most extreme. "Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption," Spanish representatives said in the document. The source of the document declined to comment and requested anonymity because they were not authorized to share it.
In its response, Spain said it is "imperative that we have access to the data" and suggests that it should be possible for encrypted communications to be decrypted. Spain's interior minister, Fernando Grande-Marlaska, has been outspoken about what he considers the threat posted by encryption. When reached for comment about the leaked document, Daniel Campos de Diego, a spokesperson for Spain's Ministry of Interior, says the country's position on this matter is widely known and has been publicly disseminated on several occasions. Edging close to Spain, Poland advocated in the leaked document for mechanisms through which encryption could be lifted by court order and for parents to have the power to decrypt children's communications. Several other countries say they would give law enforcement access to people's encrypted messages and communications. "Cyprus, Hungary, and Spain very clearly see this law as their opportunity to get inside encryption to undermine encrypted communications, and that to me is huge," says Ella Jakubowska, a senior policy advisor at European Digital Rights (EDRI) who reviewed the document. "They are seeing this law is going far beyond what DG home is claiming that it's there for."
It doesn't work (Score:5, Insightful)
> Spain said it is "imperative that we have access to the data" and suggests that it should be possible for encrypted communications to be decrypted.
They can be - by the intended recipient. The moment you install a backdoor for an 'official' interception, in reality you've just made encryption worse than useless... since it provides no security and adds overhead to the messaging process.
Either encryption is legal or it isn't. Technologically, there is no viable middle ground. Once a backdoor exists, access will eventually be available to all.
Re:It doesn't work (Score:4, Informative)
It's not "legal". The ISPs will be ordered to drop encrypted packets if they can't be read.. Europe is still a facsist continent. Americans still have a 1st Amendment, made toothless as it is by corrupt courts and judges, at least it's still on the books
Prove that a string of random data is encrypted. Whoops. That was a randomly chosen packet out of the middle of a zip archive that I was downloading. And now you've broken the ability to distribute software over the Internet.
Re:It doesn't work (Score:4, Insightful)
> Prove that a string of random data is encrypted
Which is another issue - high level compression, high level encryption look a lot alike, and data errors all look an awful lot alike.
But steganography and code books are established and undetectable communication methods that can be embedded in things that look perfectly innocent.
Banning encryption is, ultimately, just a way to oppress the common law-abiding citizen while the criminals will have work-arounds in place before needed so they don't even have to slow down.
Re:It doesn't work (Score:4, Interesting)
Does not work. The crpto-jini is out of the bottle and there is no way to get it back in. The only thing you can detect with low reliability is high-volume encrypted data. Like, say, an interbank transfer or an insurance doing an encrypted backup. And that is only if no attempt at stealth has been made.
There is no way to keep modern society working without secure encryption. That ship has sailed a long time ago. There are also tons of people that can code modern encryption from scratch if needed. And everybody has the libraries on their digital devices.
Re: (Score:1)
Nonsense. You forget that even the mighty NSA already had data stolen by criminals. And you want governments to be able to decrypt banking traffic in the net? Do you _want_ the world to burn?
You also failed to understand that you cannot detect encrypted data with any reliability in most cases. No, you _cannot_ "just" pass any traffic they cannot decrypt. Decryption attempts on network layer are things that take hours to days. You have single-digit microseconds in packet routing and that already slows things
Re: (Score:2)
You also failed to understand that you cannot detect encrypted data with any reliability in most cases.
LOL, what? No, SSL handshake is very easy to detect, any sensible firewall can do that. They can just mandate that ISPs drop any SSL handshakes which do not go through govt SSL proxy.
You think encryption means SSL? Now I know you have no clue. SSL is one (of many) options for connection encryption. It is not used for _data_ encryption and you can, of course, send encrypted data without SSL and no connection encryption. Or you can use a different connection encryption. Or you can use packet encryption. Or you can use partial packet or data encryption.
Re: (Score:2)
You also failed to understand that you cannot detect encrypted data with any reliability in most cases.
LOL, what? No, SSL handshake is very easy to detect, any sensible firewall can do that. They can just mandate that ISPs drop any SSL handshakes which do not go through govt SSL proxy.
You think encryption means SSL? Now I know you have no clue. SSL is one (of many) options for connection encryption.
No shit Sherlock. But it's 99% of what is used in practice.
Nope. SSL isn't even generally supported anymore. TLS replaced it. SSL has been deprecated for almost a decade (2015 for the last version).
Besides, this isn't about encryption between you and a website. This is about end-to-end encryption, where data is encrypted in flight from one user to another without the website ever having access to the decrypted data. Exactly 0% of end-to-end encryption involves TLS. In fact, end-to-end encryption means that even if you strip off TLS entirely, the communication
Re: (Score:2)
No, you _cannot_ "just" pass any traffic they cannot decrypt. Decryption attempts on network layer are things that take hours to days. You have single-digit microseconds in packet routing and that already slows things down. Unless you want _all_ software that uses the network to be rewritten in a major way?
Nah, they will just do what the NSA does, copy all traffic at various backbone interconnects and store them. And hopefully break any encryption offline.
Wonder how many DCs they will have to build to store everything for crunching on later. Didn't the NSA build a DC in Utah, for an estimated cost of 1.5B? Wonder how many others they have.
Probably will be a combination of the known PRISM, ECHELON systems that are known of.
On another topic, does that mean all web traffic will be illegal soon / backdoored? Sinc
Re: (Score:2)
Not even the NSA stores "all" data. If they did, the a major part of the worldwide industry would have to produce disks or tapes exclusively for that. Internet traffic volume is _huge_ .
In actual reality, they used to do keyword matching, but that does not work anymore with encryption everywhere. Instead they now select a tiny portion of the traffic for storage based on source and destination addresses and other factors.
Re: (Score:2)
Much good it'll do when ISP just won't pass any traffic they can't decrypt.
Did you miss the earlier discussion talking about identifying that something is encrypted? Would you be able to tell if an encrypted message was embedded in this comment? If so, how did you find it?
Re: (Score:2)
Did you miss my point that whatever steganographic scheme you come up with will never be supported by your bank, your online shop, your granny, your email provider, your instant messaging app, and anyone else who's not your nerd friend?
Did you miss the fact that the people who actually use crypto for nefarious purposes aren't using it to communicate with their banks or their grannies?
Re: (Score:2)
iPhone encryption was unbreakable - until it was broken by court order, your government did not respect your encryption rights first ...
Re:It doesn't work (Score:4, Interesting)
It's not "legal". The ISPs will be ordered to drop encrypted packets if they can't be read.
Cannot be done. There is too much random data critically needed in non-encrypted traffic.
Europe is still a facsist continent. Americans still have a 1st Amendment, made toothless as it is by corrupt courts and judges, at least it's still on the books
Oh? Have you heard, say, of the GDPR?
It is true that there are some fascists in Europe and some have managed to get into high positions. The same is true for the US.
Re: (Score:2)
Re:It doesn't work (Score:4, Interesting)
The reality is crooks don't NEED end-to-end encryption just like the police don't NEED to break it.. but everyone wants the job (cops and robbers alike) to be "easy".. no code words, no crafty phrased expressions, no winks and nods, the crooks just want to speak plain (ie: Jimmy, Kill Bill on the 14th of October) and the bad guys (aka: the police) just want to push a button to find said "crook" so they can arrest/convict (see sentence above) and not "Jimmy, Bill seems hungry, order him a large Pizza next month" (which is what they have been doing for I don't know.. EVER.. (face to face, on the phone, in dark allies, via post cards, via letters, hell via pigeon)). But what governments want an "early warning" when their citizens are growing discontent and a way to crack down without seeming like they are targeting people (to the outside).. ie: Oh, I have not heard from Mary in a long time.. yeah.. because she got a job "out of country". Its the modern gestapo but easier because it doesn't require men in jack boots, just requires a little keyword search, and a quiet disappearance before "Mary" becomes a person of interest to others.
Re:It doesn't work (Score:5, Insightful)
Give these dumbfucks exactly what they're asking for. No more online banking. No more online shopping. No more SSL/SSH. No more online security period. This is what it will take to finally get old fossils out of the business of regulating things they have absolutely zero understanding of.
Re: (Score:2)
This is what it will take to finally get old fossils out of the business of regulating things they have absolutely zero understanding of.
No it won't. These old fossils are democratically elected by people on the premise that they are solving specific problems. You get rid of them, another will take their place... saner at first only to eventually water down to the same political pandering to their base as all those who come before them, at the mercy of voters who don't have the nuance to understand that you can't have secure banking if you outlaw security.
The population is too dumb, and ultimately they bring politicians down to their level.
Re: (Score:1)
These old fossils are democratically elected by people on the premise that they are solving specific problems.
They were not democratically elected.
A number of countries voted against the European Constitution during the referenda. France voted against with a 10% margin, and The Netherlands voted against with a 23% margin (reference [wikipedia.org]).
However, a few months later, it was nevertheless adopted [europa.eu].
The EUSSR is a bunch of undemocratic dictators. Even funnier is that privacy is oh-so-important when it comes to extracting a billion dollars from American companies, but a danger to everyone when it comes to encryption. Rig
Re: It doesn't work (Score:2)
Re: (Score:3)
Indeed. But surveillance-fascists do not care about that. They think they are the ones to finally lead the human race into light where everybody will be forced in line by as much violence as needed. Individual freedoms just get in the way of general forced enlightenment.
Of course, from every indication from history, smart human beings do not really work well under those conditions and they are critically needed for society to flourish.
Re: (Score:2)
Holy shit! Well said.
Re: (Score:3)
There is a viable backdoor. GCHQ suggested it years ago. The app is modified to allow a law enforcement operative to join an encrypted chat, but not notify members of that chat that there is a new party listening in. Access would only be for accounts with a valid certificate, to prevent hackers using the same mechanism.
The main risk is that one of the certificates leaks, although it could be revoked. After that, potential bugs in the app that cause non-law enforcement users not to be listed as members of th
Re: (Score:2)
There are too many apps and software and platforms which support end to end encryption. And some of them are open source, like Signal.
You going to ban a big chunk of the internet if they refuse to implement backdoors? I will not miss Facebook (they do have messenger which is used for communication, not to mention instagram, whatsapp, etc) but I think there may be some people who will notice if Meta's or Google's or Microsoft's and so many other's services are suddenly missing.
If the companies refuse to impl
Re: (Score:2)
China does ban large parts of the internet, including Signal. It's clearly possible.
Re: (Score:2)
Yeah but the people in China didn't really have access to FB and all the other sites / apps / services in the first place, so many may not be aware that such things exist, or may have heard that they exist but never had a chance to access them, and those that use VPNs and such, they are very much aware that such access can be removed anytime.
If you try that with a population which already had access to particular services/apps/websites for many years, the population knows exactly what they are missing and w
Re: (Score:2)
It will be interesting to see what happens with the TikTok ban. Will people accept it, or will they find ways around it?
Blockading The Pirate Bay wasn't very effective.
Re: (Score:2)
The other issue is who is the target of the encryption.
If we're talking people worthy of such risk that they're willing to get rid of privacy, then this law is not going to do it as those types can and probably will make their own private app. Heck, I think the EU made this easier forcing Apple to allow side-loading. Criminal organization, terrorist groups, child porn rings... should all have the resources. It's not really complex to get a very basic E2E encrypted system going.
So by in large, adding back-do
Re: (Score:2)
as those types can and probably will make their own private app.
If you can't roll your own from scratch, you could use a scripting language and the OpenSSL library to roll your own. I would recommend C rather than a scripting language, but C is a step too far for most.
ObMP (Score:5, Funny)
Nobody expects the Spanish Inquisition
Re: (Score:2)
Re: ObMP (Score:2)
Monty Python link that nobody expects (Score:2)
Go ahead Spain! (Score:2)
I have a better proposal (Score:4, Insightful)
Send all politicians to jail right now, let the police storm into all their possessions and check each and every bank account they (and any person related to them, be them family, friends, etc.) might have any connection.
If any illegality is found (black money, stolen goods, undeclared jewels/works of art/etc.), remove their nationality and send them to GULAG.
If they are "honest", then, we can talk about any law removing privacy. Just talk, not passing it.
Re: (Score:2)
If this were done by lottery to 5% of sitting politicians during any given term of office... wow, that'd be a hell of a thing to see.
I'm entirely in favour of extreme mandatory transparency by the people holding the levers of power. If you can't handle it, you're not fit for office and almost certainly working more to line your own pockets than to serve the best interests of the population.
Re: (Score:1)
But MY tribal leader (politician) is better than their tribal leader!!! Crimes are okay because the other side are worse and we must stop them!
Re: (Score:1)
Totalitarian Governments kill their own people, and are the greatest threat to everyone.
And yet, people don't know history and keep voting for more government. See Endless Wars (now in Ukraine) for confirmation.
Re: (Score:2)
Holy shit, Stalin is that you? I thought you were dead.
No thanks. I don't want to live in a world what that is done to anyone, let alone democratically elected representatives.
Re: (Score:2)
Nope, I'm not Stalin. I'm DEMOcracy, you know, like the DEMO (population), cracy (power) that the population of Iceland, you know, they did what I wrote (with the exception of GULAG, which they have their own version).
So, nope, not Stalin. Maybe you're a neo-anarchist? One of those that "everything is allowed even shitting in the populace"?
Clear Path (Score:1)
If the government and all politicians are able to go without encryption for five years, then maybe it could be considered... otherwise I would say that's a hard no.
I would be very sad to see the people of Spain accept this.
Re: (Score:2)
It doesn't make any difference if government and politicians don't use it for some period. Encryption has obvious value. WTF is wrong with you?
otherwise I would say that's a hard no.
Your clearly uninformed opinion doesn't matter.
Pointless (Score:1)
Things like this always strike me as an attempted power-grab by politicians. No doubt at least some of them would misuse laws like this to keep tabs on their opposition among other abuses of power.
In short: no good will come of something like this. Also, it flies in the face of all the privacy protect
It wont help (Score:2)
When encryption is illegal, only criminals will have encryption.
Think of the poor poor children (Score:2)
Even if they banned E2E, the fact is that with modern computers stegographic images are trivial to create and trivial to decode. Pointless and insulting.
Just Spain? (Score:2)
I'm pretty sure every government wants to be able to see everything, not just Spain.
Re: (Score:2)
I bet they do, unless of course its other people or countries seeing their stuff.
We should check the politicians emails... (Score:2)
If they're really interested in successfully prosecuting criminal organisations, including child abuse rings, it would appear that law enforcement crack a lot of cases through penetrating criminals' encrypted communications in one way or another. Why would they want to give up those opportunities by outright banning E2EE or telling criminals that they're being monitored?
Re:We should check the politicians emails... (Score:5, Informative)
It's a ploy (Score:2)
Sorry, while I think the banner of ending child pornography, exploitation, and pedophilia is noble. Attempting to eliminate it by destroying cryptography is a red herring. Governments have other tools at their disposal to fight crime, they should exhaust all of those including more severe penalties for those who abuse children; that also means teens under the age of consent.
The sad thing is we have governments who want to break encryption b/c "think of the children," also let traffikers and their ilk off th [go.com]
Leaked document? (Score:5, Funny)
Why didn't they encrypt it?
Ban shipping everything and anything then (Score:2)
More illegal material and substances go through the USPS than any other venue in the entire world. You want any type of drug, porn, etc, it comes hand delivered by your friendly postal delivery person.
Against the Spanish Constituation (Score:1)
Title 1, Article 18, Section 3:
"Se garantiza el secreto de las comunicaciones y, en especial, de las postales, telegrÃficas y telefÃnicas, salvo resoluciÃn judicial."
Roughly translated to:
"the communication secrecy must be guaranteed, specially on letters, telegrams and phone calls unless there is judical resolution"
Source: https://www.senado.es/web/cono... [senado.es]
Regardless, Spain is not the only country considering measures like that. Just read the linked document: https://www.senado.es/web/cono... [senado.es]
Different attribution in Spanish media (Score:2)
That's funny, because Government-friendly media such as El País indicate that it's "the EU" [elpais.com] (not Spain) who wants to ban end-to-end encryption. The "EU" is always "someone else", and they omit that it's Spain who is currently advocating for this law within the EU, because it is clearly very dangerous. Oh, and "Think of the children!"
Canada.... (Score:2)
Please don't give Trudeau any ideas. I'm sure he'd be all over this if he knew what encryption was.
Practical Barriers (Score:2)
Return to fascism? (Score:2)
The proposed legislation probably isn't a sign of a fascist shift in Spain, although it might be [ccbcnes.org]. And if passed, it could help pave the way for closet fascists to restore the "glory days" of Franco.
The legislation is dangerous by definition, because it limits citizens' freedom to communicate without government spying. It also sets a dangerous precedent. I really hope Spanish citizens reject it loudly and forcefully.
Re: (Score:2)
a little bit late for that (Score:2)
good Luck getting the world to comply with your dumb idea, Spain