7 ms·

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate inter

For a better understanding: The Court held (in the circumstances of this case) that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. The law in question specifically obligated messengers such as Telegram to hand over communications alongside the "information necessary to decrypt electronic messages if they were encrypted". To come to that conclusion, it referred to the wide-scale impact such a weakening of E2E through backdoors would have and referred to "calls for alternative 'solutions to decryption without weakening the protective mechanisms, both in legislation and through continuous technical evolution.'" Looking at the cited material, these include traditional policing, undercover operations, metadata analysis, international police cooperation, live forensics on seized devices, guessing or obtaining private keys held by parties to the communication, using vulnerabilities in the target’s software or sending an implant to targeted devices. While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. (It should be noted that, although the backdooring of E2E was considered to go beyond how the right to privacy may legitimately be restricted, the right to privacy is a so-called derogable right, i.e. a government can, upon declaration of a state of emergency, derogate from the right insofar that is necessary to address an emergency "threatening the life of the nation" (Art 15 ECHR)) Relevant paragraphs are paras 76-80 here: https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854%22] https://hudoc.echr.coe.int/eng/#{%22itemid%22:[%22001-230854...}

Aachen 3y ago
> The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. *when no adequate safeguards against abuse are in place Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neither is very specific about what it means)
- Quanttek 3y ago
  Yes, that is very true. The Court generally does not oppose surveillance measures in general, as long as adequate safeguards are in place. However, I read the relevant paragraphs (paras 76-79) to be quite a strong rejection of any statutory obligation that would effectively require the installation of a backdoor undermining E2EE. The criticism of a lack of adequate safeguards and the risk of abuse is more focused on other aspects of the law. That also becomes clear in the key paragraph 80: "The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored _without adequate safeguards against abuse_ and the _requirement to decrypt encrypted communications_, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society" The Court does not qualify the requirement to decrypt E2EE communications with the same safeguards requirements. That of course does not exclude the possibility of the Court finding that a more narrowly-construed law is not in violation. But the Court clearly signals its skepticism towards any "requirement that providers of such services weaken the encryption mechanism for all users" (para 79).
  - bondarchuk 3y ago
    Yes, this was a problem all along with arguments against surveillance (/encryption weakening) based on "it can be abused by bad actors" - it implies that one would be ok with surveillance if it could not be abused by bad actors. While it's tempting to use such arguments (it looks like they had effect in this case at least) it remains necessary to emphasize the true reasons one takes a stand against surveillance e.g. authoritarian overreach or a fundamental right to privacy.
    - Karellen 3y ago
      Do you think that phone taps and mail-opening warrants, issued by judges, based on evidence submitted to the court that such warrants are appropriately targetted and based on existing evidence and reasonable suspicion, are intrinsically "authoritarian overreach"?
iamthirsty 3y ago
> the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. The UK wants to leave the ECHR[0], so they might be able to get around it — unfortunately. — [0]: https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-leaving-echr https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-l...
- stranded22 3y ago
  The UK DOES NOT WANT TO LEAVE THE ECHR. Select people in the government want to, not the whole of UK.
  - noir_lord 3y ago
    To tack onto this I don't think most people in the UK understand what the ECHR does and why leaving the EU didn't alter our obligations under the ECHR. The media carries a lot of responsibility for that but not all of it - nearly every person in the UK carries a little box with access to a huge chunk of the sum total of all human knowledge, they just choose to not to use it. If that sounds elitist or arrogant it's because I've about reached my limit with ignorant people refusing to understand the world is messy and complex.
    - robertlagrant 3y ago
      It doesn't sound elitist or arrogant - quite the opposite. It just assumes that people know what's true and what's not up front, and know when the media is telling them the truth. Their little box doesn't only tell them true things.
  - tailspin2019 3y ago
    Good clarification. Personally I just hope we can remove those “select people” from office before they can actually carry out their plan.
    - ein0p 3y ago
M2Ys4U 3y ago
>While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. It's worth noting that UK courts can't overturn Acts of Parliament. The best they can do is issue a declaration of incompatibility, which enables ministers to use secondary legislation to correct any defect rather than having to go through the process of passing another act (if they have the political will to do so...). Having said that, a lot of how the Online Safety Act tries to get things done is through secondary legislation and statutory codes and guidelines; these all can be quashed by the courts (unless the Act constrains the way the other instruments are made in such a way that it'd be illegal not to make an infringing instrument) so it'll be interesting to see how that plays out.
- seanw444 3y ago
  > It's worth noting that UK courts can't overturn Acts of Parliament. Interesting. I didn't know this, and as an American, it seems quite odd. Decisions by the parliament are treated as immutable there? Here, if a bill passed by Congress is deemed unconstitutional, it can be struck down by the Supreme Court.
  - arethuza 3y ago
    They aren't immutable, but they can only be changed by Parliament: "the courts cannot overrule its legislation and no Parliament can pass laws that future Parliaments cannot change. Parliamentary sovereignty is the most important part of the UK constitution" https://www.parliament.uk/about/how/role/sovereignty/ https://www.parliament.uk/about/how/role/sovereignty/
  - denton-scratch 3y ago
    The only constitution that the UK has consists of Acts of Parliament. So I don't know why it should seem odd; the US courts can't strike clauses of the US Constitution, and the UK courts can't strike Acts. Amusingly, the UK government is currently trying to pass an Act to the effect that black is equivalent to white, i.e. that Rwanda is a safe country to which asylum seekers can be sent. This is analogous to the State of Indiana trying to legislate that the value of Pi shall be 3.2. You can't legislate a fact.
martingxx 3y ago
The UK government almost seem to be deliberately passing multiple pieces of legislation that they know will be overturned due to ECHR, because they believe such rulings would strengthen their argument for withdrawing from the convention.
TheRealPomax 3y ago
Perhaps a dumb question, but why would the EU courts be able to overturn laws in the UK now that the UK is not part of the EU anymore?
- AAAAaccountAAAA 3y ago
  ECHR is not an EU court, but a separate entity, having for long had many non-EU member states.
- shortsunblack 3y ago
  ECtHR is not an EU court. UK is part of Council of Europe, which also includes Russia. Being member of Council of Europe entails mandatory treaty law of ECHR.
sandworm101 3y ago
>> information necessary to decrypt electronic messages if they were encrypted That reminds me of Lavabit, which I once used as my primary email. In response to demands for decryption information, Lavabit handed over their private keys. On paper. Typed out. Possibly with a typo somewhere on page 6, or 12. https://thenextweb.com/news/you-wont-believe-what-email-provider-lavabit-did-to-avoid-giving-the-us-government-its-data https://thenextweb.com/news/you-wont-believe-what-email-prov...

Aachen 3y ago

> The Court held that a legal obligation to decrypt E2E communications is a disproportionate interference with the right to privacy. *when no adequate safeguards against abuse are in place Unfortunately it is not as straightforward as that it's incompatible altogether. Per this ruling, it's only incompatible when there are no good safeguards (they use the word "adequate" in one place and "suitable" in another, neither is very specific about what it means)

Quanttek 3y ago
Yes, that is very true. The Court generally does not oppose surveillance measures in general, as long as adequate safeguards are in place. However, I read the relevant paragraphs (paras 76-79) to be quite a strong rejection of any statutory obligation that would effectively require the installation of a backdoor undermining E2EE. The criticism of a lack of adequate safeguards and the risk of abuse is more focused on other aspects of the law. That also becomes clear in the key paragraph 80: "The Court concludes from the foregoing that the contested legislation providing for the retention of all Internet communications of all users, the security services’ direct access to the data stored _without adequate safeguards against abuse_ and the _requirement to decrypt encrypted communications_, as applied to end-to-end encrypted communications, cannot be regarded as necessary in a democratic society" The Court does not qualify the requirement to decrypt E2EE communications with the same safeguards requirements. That of course does not exclude the possibility of the Court finding that a more narrowly-construed law is not in violation. But the Court clearly signals its skepticism towards any "requirement that providers of such services weaken the encryption mechanism for all users" (para 79).
- bondarchuk 3y ago
  Yes, this was a problem all along with arguments against surveillance (/encryption weakening) based on "it can be abused by bad actors" - it implies that one would be ok with surveillance if it could not be abused by bad actors. While it's tempting to use such arguments (it looks like they had effect in this case at least) it remains necessary to emphasize the true reasons one takes a stand against surveillance e.g. authoritarian overreach or a fundamental right to privacy.
  - Karellen 3y ago
    Do you think that phone taps and mail-opening warrants, issued by judges, based on evidence submitted to the court that such warrants are appropriately targetted and based on existing evidence and reasonable suspicion, are intrinsically "authoritarian overreach"?

iamthirsty 3y ago

> the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. The UK wants to leave the ECHR[0], so they might be able to get around it — unfortunately. — [0]: https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-leaving-echr https://www.chathamhouse.org/2023/03/uk-must-not-sleepwalk-l...

stranded22 3y ago
The UK DOES NOT WANT TO LEAVE THE ECHR. Select people in the government want to, not the whole of UK.
- noir_lord 3y ago
  To tack onto this I don't think most people in the UK understand what the ECHR does and why leaving the EU didn't alter our obligations under the ECHR. The media carries a lot of responsibility for that but not all of it - nearly every person in the UK carries a little box with access to a huge chunk of the sum total of all human knowledge, they just choose to not to use it. If that sounds elitist or arrogant it's because I've about reached my limit with ignorant people refusing to understand the world is messy and complex.
  - robertlagrant 3y ago
    It doesn't sound elitist or arrogant - quite the opposite. It just assumes that people know what's true and what's not up front, and know when the media is telling them the truth. Their little box doesn't only tell them true things.
- tailspin2019 3y ago
  Good clarification. Personally I just hope we can remove those “select people” from office before they can actually carry out their plan.
  - ein0p 3y ago

M2Ys4U 3y ago

>While a ruling on a specific case (and law), the Court seems quite skeptical towards any "requirement that providers of such services weaken the encryption mechanism for all users". If I were the UK government, I would be quite worried that the UK Online Safety Bill will be overturned by domestic courts (or the European Court) on the basis of this ruling. It's worth noting that UK courts can't overturn Acts of Parliament. The best they can do is issue a declaration of incompatibility, which enables ministers to use secondary legislation to correct any defect rather than having to go through the process of passing another act (if they have the political will to do so...). Having said that, a lot of how the Online Safety Act tries to get things done is through secondary legislation and statutory codes and guidelines; these all can be quashed by the courts (unless the Act constrains the way the other instruments are made in such a way that it'd be illegal not to make an infringing instrument) so it'll be interesting to see how that plays out.

seanw444 3y ago
> It's worth noting that UK courts can't overturn Acts of Parliament. Interesting. I didn't know this, and as an American, it seems quite odd. Decisions by the parliament are treated as immutable there? Here, if a bill passed by Congress is deemed unconstitutional, it can be struck down by the Supreme Court.
- arethuza 3y ago
  They aren't immutable, but they can only be changed by Parliament: "the courts cannot overrule its legislation and no Parliament can pass laws that future Parliaments cannot change. Parliamentary sovereignty is the most important part of the UK constitution" https://www.parliament.uk/about/how/role/sovereignty/ https://www.parliament.uk/about/how/role/sovereignty/
- denton-scratch 3y ago
  The only constitution that the UK has consists of Acts of Parliament. So I don't know why it should seem odd; the US courts can't strike clauses of the US Constitution, and the UK courts can't strike Acts. Amusingly, the UK government is currently trying to pass an Act to the effect that black is equivalent to white, i.e. that Rwanda is a safe country to which asylum seekers can be sent. This is analogous to the State of Indiana trying to legislate that the value of Pi shall be 3.2. You can't legislate a fact.

martingxx 3y ago

The UK government almost seem to be deliberately passing multiple pieces of legislation that they know will be overturned due to ECHR, because they believe such rulings would strengthen their argument for withdrawing from the convention.

TheRealPomax 3y ago

Perhaps a dumb question, but why would the EU courts be able to overturn laws in the UK now that the UK is not part of the EU anymore?

AAAAaccountAAAA 3y ago
ECHR is not an EU court, but a separate entity, having for long had many non-EU member states.
shortsunblack 3y ago
ECtHR is not an EU court. UK is part of Council of Europe, which also includes Russia. Being member of Council of Europe entails mandatory treaty law of ECHR.

sandworm101 3y ago

>> information necessary to decrypt electronic messages if they were encrypted That reminds me of Lavabit, which I once used as my primary email. In response to demands for decryption information, Lavabit handed over their private keys. On paper. Typed out. Possibly with a typo somewhere on page 6, or 12. https://thenextweb.com/news/you-wont-believe-what-email-provider-lavabit-did-to-avoid-giving-the-us-government-its-data https://thenextweb.com/news/you-wont-believe-what-email-prov...