European Law Enforcement Say Breaking Encryption Disproportionate, Backdoors Dangerous
In an unexpected move the European Police Office (EUROPOL) and the European Network and Information Security Agency (ENISA) have issued a joint statement setting out their views on encryption and police hacking. The agencies have come out against breaking encryption, which is a welcome development in the heated public debate on privacy and encryption.
The statement, the first joint communication from the agencies responsible for coordinating police and cybersecurity cooperation in Europe, calls on European legislators to clarify the rules around law enforcement access to encrypted communications. It advocates for greater oversight of intrusive powers and calls for police intrusion to be proportionate to the crime being investigated. It also makes clear that breaking “cryptographic mechanisms’ is not a proportionate way of accessing the content of a suspect’s communication: recognising that the negative societal consequences of breaking encryption far outweigh the benefits of access to a communication.
It also makes clear that breaking “cryptographic mechanisms’ is not a proportionate way of accessing the content of a suspect’s communication.
The publication comes at a critical moment in both the UK and US encryption debate. As the US considers whether it should adopt the ‘Stopping Mass Hacking Act’ or the widely denounced ‘Compliance with Court Orders Act’, the ‘Investigatory Powers Bill’ looks set to grant the UK government unprecedented power to make companies assist with both hacking and decryption. In both counties, law enforcement agencies have tended to support anti-encryption measures while failing to fully grasp the consequences.
It is significant that the European law enforcement statement takes a different line. It asserts that the growing threat to cybersecurity from organised crime, as well as the threat to privacy from automated data analysis, means that ‘technical protection’ of communications is no longer optional but ‘mandatory’. Backdoors, described in the document as ‘Solutions that intentionally weaken technical protection mechanisms to support law enforcement’ areconsidered to ’intrinsically weaken the protection against criminals’ and are not endorsed.
This is a welcome statement as it recognises that police activity should focus on means of gathering information other than attempting to break encryption. However, we do remain concerned that European agencies, although stepping back from attempts break encryption themselves, still intend to, ‘collect and share best practices to circumvent encryption’.
British Public Oppose Secret Surveillance Powers and Want Strong Protections for Encrypted Communications
CDT released nationally representative polling data revealing that a the British public are broadly concerned about the security, privacy, and free speech consequences of allowing law enforcement to access encrypted communications.
Responding to the EU-US Negotiations on Reciprocal Data Exchanges for Border Procedures
CDT Europe, together with 29 other civil society organisations and academics, sent an open joint letter to the Council of the EU regarding the worrying direction taken by the European Commission in the EU-US border negotiations with the U.S. government.
Open Joint Letter on a Public Reassessment of the EU-US Adequacy Decision
On 29 June, the US Supreme Court ruled that US President Trump can remove the leaders of independent agencies and commissions, overturning nearly 90 years of precedent limiting executive power. This decision raises serious questions about one of the key safeguards underpinning the EU-US Data Privacy Framework adopted in 2023: independent supervision.
Return of Mass Scanning of Private Communications through Undemocratic Procedure
CDT Europe responds to the European Parliament's vote to revive the interim derogation from the ePrivacy Directive, commonly known as “Chat Control 1.0”, which provides the legal basis for the voluntary, indiscriminate scanning of private communications for known and new Child Sexual Abuse Material (CSAM), and for the solicitation of children.
