Police Aim for Real-Time Access to Data Streams from WhatsApp & Co in Germany

The issue of encryption has been a contentious topic among policymakers and law enforcement agencies for years. In the heart of this debate lies the balance between privacy and security. The European Union’s High-Level Expert Group (HLEG) on data access for effective law enforcement has been working tirelessly behind closed doors to crack what they term the “encryption problem.” Recently, an information freedom request by EU Parliament member Patrick Breyer has shed light on the group’s efforts. This article delves into the measures being proposed, with a focus on Germany, and their potential implications.

Understanding the Encryption Problem

What is Encryption?

Encryption is a method of converting information or data into a code to prevent unauthorized access. End-to-end encryption (E2E) ensures that only the communicating users can read the messages, a feature that services like WhatsApp, Signal, and Threema offer.

The Challenge for Law Enforcement

For law enforcement agencies, encryption poses a significant challenge. The inability to access encrypted communications can hinder criminal investigations, a phenomenon they refer to as “Going Dark.”

EU’s High-Level Expert Group (HLEG)

Formation and Objective

The HLEG was formed to address the challenges encryption poses to law enforcement. The group’s primary focus is to find a way to access meta- and communication data from end-to-end encrypted services in real-time without compromising the encryption itself.

Recent Developments

An information freedom request by Patrick Breyer has revealed some of the presentations and discussions within the HLEG. These documents highlight the group’s approach and the specific measures being considered.

Proposals by the National Technical Support Unit (NTSU)

Real-Time Data Access

The Belgian Federal Police’s National Technical Support Unit (NTSU) has put forth significant demands for real-time data access managed by Over The Top (OTT) platforms like WhatsApp. They propose a “Yahoo approach,” which involves direct contact with big tech companies to facilitate data access.

Standardized Requests

The NTSU advocates for a procedure that does not require backdoors in encrypted products. Instead, law enforcement would submit standardized requests to the data-processing entity of the OTT service provider, who would then provide the necessary data in real-time, securely, and in a comprehensible format.

Technical Neutrality and Discretion

This method is described as “invisible, discreet, and secret for the target” of investigations, ensuring technological neutrality. The NTSU emphasizes that even with E2E encryption, service providers or their designated third parties must comply with data requests.

ETSI’s Trusted Authenticated Party Concept

ETSI’s Role

The European Telecommunications Standards Institute (ETSI) is contemplating a solution involving a “trusted authenticated party” that would manage access keys. This approach, however, has been criticized by IT security experts as a potential security weakness.

Lawful Access by Design

ETSI also shows interest in standardizing “Lawful Access by Design,” where products are designed to facilitate lawful access to data without compromising user security.

EU Commission’s Recommendations

Enhanced Cooperation

The EU Commission suggests strengthening the cooperation between commercial companies and law enforcement agencies, encouraging the voluntary sharing of technical product documentation and source codes.

Legislation Against Criminal Use of Encryption

The Commission recommends laws to combat the use of encryption devices for criminal activities, mandating technology providers to enable access to data stored on user devices upon judicial request.

Implications for Privacy and Security

Privacy Concerns

The proposals raise significant privacy concerns. The idea of real-time data access and trusted authenticated parties could undermine the privacy protections that encryption is meant to provide.

Security Risks

Introducing any form of access, whether through backdoors or trusted parties, could create vulnerabilities that malicious actors might exploit. The balance between ensuring security and enabling lawful access remains a delicate one.

Alternative Approaches

State-Sponsored Hacking

The NTSU dismisses state-sponsored hacking methods, such as state trojans, as uncertain, costly, and often ineffective. These methods also hinder collaboration on vulnerabilities, which is crucial for maintaining overall cybersecurity.

Future Communications

For past communications, these measures wouldn’t apply, focusing only on future data from the point of order. This distinction aims to prevent a technological arms race between encryption and decryption efforts.

Focus on Germany

German Law Enforcement’s Stance

Germany, like many EU countries, faces the challenge of balancing privacy with security. German law enforcement agencies are keen to gain similar real-time access to encrypted data to combat crime effectively.

Public Reaction in Germany

The German public, with a strong emphasis on data privacy, has expressed concerns over potential privacy violations. The debate continues to grow as both sides weigh the benefits and risks of such measures.

FAQs

What is end-to-end encryption?

End-to-end encryption (E2E) is a method where only the communicating users can read the messages, ensuring data privacy.

Why is law enforcement concerned about encryption?

Encryption can prevent law enforcement from accessing communications during criminal investigations, posing challenges to public safety.

What is the “Going Dark” phenomenon?

“Going Dark” refers to the inability of law enforcement to access encrypted communications, hindering their ability to investigate crimes.

What is the role of the National Technical Support Unit (NTSU)?

The NTSU proposes solutions for law enforcement to access real-time data from encrypted services without compromising encryption.

What is ETSI’s “trusted authenticated party” concept?

ETSI suggests a trusted third party to manage access keys, which has been criticized for potential security risks.

What are the EU Commission’s recommendations regarding encryption?

The EU Commission recommends enhanced cooperation between companies and law enforcement, legislation against criminal use of encryption, and voluntary sharing of technical documentation.

Conclusion

The efforts to address the encryption problem are complex and multifaceted. While law enforcement agencies seek to access encrypted data for effective investigations, the need to protect privacy and ensure security cannot be overlooked. As the debate continues, finding a balance that safeguards both public safety and individual privacy remains paramount, especially in privacy-conscious countries like Germany.