The Clash of Apple and Civil Liberties: Criticism of the UK Online Safety Bill

Government Apple, Civil Liberty Groups Condemn UK Online Safety Bill

Fears mount that UK Online Safety Bill may include a requirement for an encrypted message scanning capability.

Fears are growing that the UK government’s proposed Online Safety Bill may include a requirement for an encrypted message scanning capability. This has prompted condemnation from civil liberty groups and technology giant Apple. The bill is part of the ongoing “crypto wars” that involve governments seeking to introduce backdoors into end-to-end encryption (E2EE) to prevent criminals from evading surveillance. Both the EU’s Child Sexual Abuse Regulation and the UK’s Online Safety Bill are at the heart of this battle.

Civil liberty concerns

The introduction of an encrypted message scanning capability is the primary concern for civil liberty groups. In an open letter signed by 80 technologists and civil rights organizations, the Online Rights Group warned that such software would have to be pre-installed on users’ phones without their permission or full awareness. This would pose severe privacy and security implications, as the underlying databases could be corrupted by hostile actors, making individual phones vulnerable to attack.

Apple‘s opposition

Apple has voiced its opposition to the Online Safety Bill, stating that end-to-end encryption is a critical capability that protects the privacy of journalists, activists, and citizens. The tech giant believes that the bill poses a serious threat to this protection and could put UK citizens at greater risk. Apple urges the government to amend the bill to protect strong end-to-end encryption for the benefit of all.

Understanding end-to-end encryption

To better understand the technology at the center of these concerns, SecurityWeek spoke to Matthew Hodgson, co-founder of Matrix.org and CEO/CTO at Element. Matrix is an open protocol for decentralized, secure communications, and Element is a UK-based E2EE company that uses Matrix as its backbone. Hodgson explains that Matrix allows for end-to-end communication for various types of data, including chats, file transfer, voice/video calling, and more.

Matrix/Element’s approach to communication security is similar to that of Signal, one of the primary suppliers of E2EE. However, unlike Signal, which is centralized, Element is decentralized, with users running their own Matrix servers. This allows for greater control and ownership of communication data, without dependence on external systems. Currently, Matrix/Element has numerous government users, including entities in France, Germany, and the US DOD.

Quantum decryption and security measures

Matrix/Element is also mindful of future threats, such as quantum decryption. The company is actively working on implementing new encryption measures to ensure the security of its users. Additionally, Matrix/Element is exploring messaging layer security (MLS) with the IETF, which will offer further encryption capabilities for group communication.

The uncertain impact of the Online Safety Bill

While Matthew Hodgson expresses his firm opposition to the Online Safety Bill, he remains uncertain about its potential impact on his E2EE company. It is unclear how the bill’s final wording will differentiate between corporate and personal communication, especially in an era of remote working. If the bill becomes law, the detection of non-exempted E2EE communication could criminalize law-abiding citizens. This poses challenges for companies like Element, as they may have to remove their app from app stores to ensure compliance with the proposed legislation.

Editorial: The balance between security and privacy

The debate surrounding the UK Online Safety Bill is a reflection of the ongoing tension between government surveillance and personal privacy. While law enforcement agencies argue that backdoors are necessary to combat criminals ‘going dark,’ civil liberty groups and technology companies argue that weakening encryption puts everyone’s security and privacy at risk. The question remains: can governments strike a balance between protecting national security and preserving individual privacy?

Advice for consumers and policymakers

The use of encryption technology is vital to protect against surveillance, identity theft, fraud, and data breaches. It provides a layer of security for journalists, activists, and everyday citizens. Policymakers should carefully consider the potential consequences of introducing backdoors or scanning capabilities into encrypted communication systems. While the intention may be to enhance national security, the risks to individual privacy and digital security should not be underestimated.

Consumers, on the other hand, should be aware of the potential changes in legislation and how it could impact their access to secure communication applications. It is important to stay informed about the ongoing debate and express concerns to policymakers when necessary. Additionally, individuals should continue to prioritize their own digital security by using strong passwords, keeping software up to date, and adopting additional security measures such as multi-factor authentication.