united-kingdom social-media encryption
Does the Regulation of Investigatory Powers Act 2000 give the police the right to access end-to-end encrypted messages?
<p>End to end encryption is a security measure in which the sender of a message encrypts the message in a way that only the intended recipient is able to decrypt it.  This was first popularised by the software <a href="https://en.wikipedia.org/wiki/Pretty_Good_Privacy" rel="nofollow noreferrer">Pretty Good Privacy</a>, the format of which is now defined in the <a href="https://www.openpgp.org/" rel="nofollow noreferrer">OpenPGP standard</a>, has in recent years been implemented in messaging systems such as whatsapp.</p>
<p>Suggestions to implement this technology more widely are meeting some resistance.  An example of the oposition is <a href="https://www.bbc.co.uk/news/technology-60055270" rel="nofollow noreferrer">discussed by the BBC</a>:</p>
<blockquote>
<p>The UK government and a coalition of charities are urging the British public to put pressure on Facebook not to introduce end-to-end encryption (E2EE) on its Messenger service.</p>
<p>The system is beloved by privacy-minded people as the data is safe from everyone. Even the messaging company is unable to decipher the data you send.</p>
<p>But authorities dislike it as they have no way of reading the messages, looking at the pictures or listening to the calls, even if they suspect criminal activity.</p>
</blockquote>
<p>However <a href="https://www.legislation.gov.uk/ukpga/2000/23/section/49" rel="nofollow noreferrer">Section 49 of the Regulation of Investigatory Powers Act 2000</a> appears to be focused on exactly this problem, and is designed to provide exactly this right, and defined the procedure that must be followed in such cases.</p>
<p>Is this a correct reading of the act?  Was it designed to allow the police to access end to end encrypted communication?  Does in allow police access to whatsapp messages if they follow the defined procedure?  Would it allow access to facebook messenger communications if such encryption was implemented in this software?</p>

<blockquote>
<p>Is this a correct reading of the act? Was it designed to allow the police to access end to end encrypted communication?</p>
</blockquote>
<p>That is rather narrow and misfocused interpretation.</p>
<p>S 49 talks about &quot;protected information&quot; which is defined in <a href="https://www.legislation.gov.uk/ukpga/2000/23/section/56" rel="nofollow noreferrer">s 56(1)</a>:</p>
<blockquote>
<p>“protected information” means any electronic data which, without the key to the data—</p>
<p>(a) cannot, or cannot readily, be accessed, or</p>
<p>(b) cannot, or cannot readily, be put into an intelligible form;</p>
</blockquote>
<p>Information transmitted in end-to-end encrypted messages indeed falls under that definition. But so do any encrypted files, hard drives, USB sticks, discs etc.</p>
<p>But, applying s 49 to end-to-end encrypted messages is actually much more difficult than to the other examples. This is because:</p>
<ol>
<li>The encrypted messages need to come into the <em>possession</em> of a designated official as described in s 49(1). This can <em>only</em> be done by sniffing/capturing the encrypted traffic by a man in the middle. (On the end devices this information will <em>already</em> be decrypted, so, technically, it will no longer fall under the definition.)</li>
<li>A properly implemented end-to-end encryption will not necessitate any person to know the key. Rather, just the device itself knows it, and only temporary. It will often be rotated/renewed. So, there will be just no person to give a disclosure notice under s 49 to.</li>
</ol>
<p>Conversely, encrypted hard drives etc. fall under s 49 perfectly. There will always be someone knowing (where to get) the key, and that key will not expire. This will also apply to the end devices that have received (and, so, decrypted) end-to-end encrypted messages — where the devices themselves are now protected by some key known to the owner.</p>
