Opinion The British government is preparing to launch a full-scale policy assault against Facebook as the company gears up to [1]introduce end-to-end encryption across all of its services.

Yet the backlash has already begun, showing that officials face a tooth-and-nail fight against their attempt to derail the rollout of end-to-end encryption on the anti-social networking site and others in the Facebook estate.

Prominent in details briefed to the news media this week (including The Register ) were [2]accusations that Facebook harbours paedophiles, terrorists, and mobsters and that British police forces would effectively be blinded to the scale of criminality on the social networking platform, save for cases where crimes are reported.

[3]

It's a difficult and nuanced topic made no simpler or easier by the fact that government officials seem hellbent on painting it in black and white.

[4]

[5]

Government and law enforcement officials who briefed the press on condition of anonymity earlier this week* sought to paint a picture of the [6]internet going dark if Facebook's plans for end-to-end encryption (E2EE) went forward, in terms familiar to anyone who remembers how Western nation states defended themselves from public upset after former NSA sysadmin Edward Snowden's 2013 revelations of illegal mass surveillance. The US National Centre for Missing and Exploited Children (NCMEC) generates around 20 million reports of child sexual abuse material (CSAM) every year, of which 70 per cent would be "lost" if E2E encryption were put in place, claimed British officials.

The government's long-signalled push to deter Facebook from implementing E2EE comes, inevitably, at a significant cost to taxpayers: London ad agency M&C Saatchi has been [7]hired at an undisclosed cost by the Home Office to tell the public that Facebook (and WhatsApp) harbours criminals. The ad campaign will run online, in newspapers and on radio stations with the aim of turning public opinion against E2EE – and, presumably, driving home the message that encryption itself is something inherently bad.

[8]

Other announcements due this week, from notoriously anti-encryption Home Secretary Priti Patel and intergovernmental meetings, will explicitly condemn Facebook's contemplated rollout of E2EE.

Weighing it up

Unsurprisingly, given Facebook's 42 million UK users (in 2017, according to the London School of Economics, [9]PDF ) there are indeed some criminals, and certainly criminal abusers using the site. Around 100,000 individuals are [10]reportedly on the Sex Offenders' Register at any one time, while government officials suggested to the press that potential child sex abuse offenders on Facebook are greatly in excess of that number.

Officials suggested that the greatest threat to child safety from Facebook is that abusers can discover a safe space that normalises the sharing of CSAM and helps encourage depraved newcomers onto the platform.

Looking at the drive from a prevention-is-better-than-cure perspective, implementing E2EE would disrupt the ability of Facebook itself to monitor chat conversations for concerning content; inherent in proper implementations of E2EE is the notion that the service provider cannot read the contents of messages. It would also disrupt the platform operators' ability to scan for hashes of known child sexual abuse material (CSAM), for example by comparing hashes of new image uploads to watchlists maintained by the Internet Watch Foundation or the US' National Centre for Missing and Exploited Children (NCMEC.)

These are not trivial concerns. If the current state of affairs helps catch and divert abusers, and those who may be sliding down the slippery slope towards creating and sharing CSAM, perhaps maintaining it has some merits that deserve an informed public discussion.

Mass hacking?

One consequence of E2EE on major social media platforms (and not just Facebook) may be an increased demand by government for weaponisable exploits against personal devices: that primarily means Android, iOS and Windows. It would also mean police forces having to make direct attempts to break into phones and computers in search of evidence, instead of having it brought to them on request by social media companies.

There are two ways of looking at that. One is to say that police and government ought to accept a new reality where they are constrained to operate within specific one-off warrants authorising hacking into a specified device. The last quarter of a century, where legislation controlling police searches of digital devices and cloud storage failed to keep pace with technology, is a blip against a long legal and historical tradition that kept police on a short leash when it came to searches and seizures.

[11]

On the other hand, officials talking to the press raised the spectre of vulnerability disclosure by governments drying up as frustrated law enforcement agencies hoarded vulns for their own use, out of public sight or legal control.

Yet, looking beyond the issue of paedophiles that British government officials want the public conversation to focus on, implementing end-to-end encryption (E2EE) also makes it far more difficult to implement [12]population-scale mass surveillance of the type exposed by NSA whistleblower Edward Snowden in 2013 .

Not only that, but in an era where hostile foreign countries [13]actively hack large stores of personal data for their own purposes , placing encryption barriers in their way is no bad thing. So far, we don't know the implications of countries such as China and Russia sharing and dissecting Westerners' personal details, but doubtless it's nothing positive.

Officials were grave when The Register asked what their Plan B was if Facebook shrugs off the publicity blitz and implements E2EE anyway. One said we'll still hear the stories of children targeted by abusers, but not "in sufficient time that we can intervene." Rather than being proactive, we're told, police forces would end up being reactive, responding to reports instead of proactively patrolling what they see as the digital streets of the modern era.

Yet that focus may mean that crucial nuance and balance in this debate gets missed. While taxpayer-funded messaging bombards us with "think of the children" over the next few months, think instead of what else E2EE encryption brings – both its upsides and its downsides.

A poorly informed decision hastily reached on the basis of one-sided information is no decision worth making. ®

Bootnote

*Of those who spoke to journalists this week, about half have previously gone public and declared their opposition to end-to-end encryption.

Government officials routinely brief friendly news outlets under condition of anonymity, ruthlessly exploiting British political journalism's convention that official mouthpieces are never named and are usually referred to, obliquely, as "Whitehall sources". A true source – a whistleblower, or someone who tips off the media about wrongdoing – usually becomes a "person familiar with the matter" or isn't referred to in reporting at all.

Get our [14]Tech Resources



[1] https://about.fb.com/news/2021/04/messenger-policy-workshop-future-of-private-messaging/

[2] https://www.theregister.com/2021/04/19/uk_anti_encryption/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTjeOjgWqjzWbQ3A6houwQAAAAs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTjeOjgWqjzWbQ3A6houwQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTjeOjgWqjzWbQ3A6houwQAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2014/06/05/how_the_interenet_was_broken/

[7] https://www.thetimes.co.uk/article/priti-patel-backs-ads-accusing-facebook-of-blindfolding-police-in-child-sex-abuse-inquiries-bbxqbpg63

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTjeOjgWqjzWbQ3A6houwQAAAAs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://info.lse.ac.uk/staff/divisions/communications-division/digital-communications-team/assets/documents/guides/A-Guide-To-Social-Media-Platforms-and-Demographics.pdf

[10] https://www.telegraph.co.uk/news/2021/05/14/number-sex-offenders-national-register-almost-doubles-five-years/

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTjeOjgWqjzWbQ3A6houwQAAAAs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[12] https://www.theregister.com/2013/07/12/forget_snowden_what_have_we_learned_about_the_nsa_in_the_last_month/

[13] https://www.theregister.com/2015/06/26/china_the_primary_suspect_in_the_opm_data_breach_clapper/

[14] https://whitepapers.theregister.com/