Thank you.
Hi, my name is Marcel Colya. I'm the policy and advocacy director for Europe at Access Now.
And we are going to be talking today about how is the European Commission planning to break
cryptography this time, which is a bit provocative title I understand, but also I think it kind of reflects the reality unfortunately.
Access Now is a civil society organization, our mission is to defend and extend the digital rights of people and communities at risk and I work in the Brussels office.
So the crypto wars and attacks on encryption is something that's been here for decades.
I'll be speaking only about the recent events that I think we can date back to June 2023.
When the European Commission sets up a high level group on access to data for effective law enforcement.
Next in italic is is quote is a quote and there will be a lot of quotes on these slides.
So the group is tasked to explore and it challenges that law enforcement and the union face in their daily work.
In connection to access to data and explore and contribute to finding potential solutions to overcome them with the aim of ensuring the availability of law enforcement tools to fight crime and enhanced public security in the digital age.
Now this is followed up in May 2024 where the high level group adopts a set of recommendations that include establishing a research group to access the technical feasibility of built in lawful access obligations including for accessing encrypted data for digital devices.
So now you already recognize that things are getting very serious and dangerous.
In June 2024 the council of the European Union which is a body where the ministers from the individual member states meet.
They hold an exchange of views on these recommendations and one of the priorities that the home affairs ministers identified
is establishing legally and technically sound solutions for accessing encrypted electronic communication in individual cases and subject to a judicial order for the purpose of preventing investigating and prosecuting serious and organized crime and terrorism.
What happens around the same time is the European elections.
The parliament is elected for five years, so 24 to 29 and subsequently a couple months later from the first of December.
The Hyundai Line Commission to start.
Now with the political landscape shift as you can see you know on the colors here on the seats of the in the European parliament.
The colors are political groups and the color that I believe is like blue I'm color blind sorry for that is the European people's party and what I believe is yellow is renew Europe.
So if you look at 2020 then you see that renew Europe which are which is the you know social liberals and neoliberals basically the liberal political group.
They are kind of in the center who is in the center is very often in negotiations the kingmaker they decide where the needle moves because they are by definition in the center.
Now as you see from 2024 this has shifted so that the European people's party is more in the center.
So they are in a better position to basically find compromises left or right from them because these are the political groups that are closest to them.
Well the issue of course is that if on the right side from you where you can find alternative majorities there are only zero skeptics the far right and the far far right.
The secularization narrative strengthens the political appetite for lawful access to encrypted data even though.
I would argue it removes security by definition and the secularization narrative is something that is very very live in the current political landscape.
So now the European Commission starts a European internal security strategy called protects EU that is published by the European Union on the first of April 2025 unfortunately not as a joke.
And that replaces the European security union strategy which led to the check control proposal among others so it's not a completely new thing it's more of a evolution from the previous strategy that also let's do some bad things and this strategy sets out the objectives and actions for the next years to ensure a safer and more secure Europe.
Commission will present a technology roadmap on encryption to identify and access technologies solutions to be able to enable lawful access to encrypted data by law enforcement authorities in 2022 and this political narrative totally contrast with the technical reality and that the objective cannot be achieved without actually weakening encryption and therefore security.
Road map for effective. What is it 10 minutes? Road map for effective and local access to data for law enforcement. So this was published by the Commission in back in June.
It was published in 2005 as an important deliverable under the protects EU strategy it outlines six areas with key actions defined because we don't have too much time.
I will not go through all of these so maybe if you want to read this later the picture we will focus on the fact that the commission wants to in that strategy.
Road map wants to ensure that so called evidence can be read to quote this which means they need to decrypt encrypted data in their understanding.
So they want to deliver a technology roadmap on encryption in Q2 this year and also a second very important action outline is support the rich and development of new decryption capabilities to equip Europe all with next generation decryption capabilities from 2030.
So when he speak about encryption and how words like the commission like to access encrypted data well that's technically speaking we are about to see in Q2 2022 with this roadmap.
However at this moment it is already clear that client sites scanning is something that the commission has been exploring already for quite some time including in the debates around chat control.
And I see this as a change of strategy that instead of attacking encryption directly the narrative is that they will work around the encryption and therefore the narrative which is very false is we are not weakening encryption.
So client sites scanning is a technique that content is scanned before it is encrypted which means on the client and then for instance checking hashes of content against the database of prohibited material.
Then this of course expands the attack surface there are rates and of course hash collisions is something that complicates everything so this is an example from a research paper bugs in our pockets this picture shows two pairs of hash collisions that that actually exists.
So basically according to that software this would be seen as the same picture.
What is the potential impacts we can in encryption is detrimental to fundamental rights enshrines in the charter of fundamental rights of the European Union specifically protection of person data and the freedom of expression and information.
There is no technical lawful access to an encrypted communication without breaking privacy and security period client sites scanning therefore breaks privacy and security.
And my favorite parallel on what client sites scanning is is like imagine that that encryption is a seed belt in a car that is protecting the passengers and encryption is protecting the data now client sites scanning means we are not directly weakening the seed belt.
But we just make you sit in front of the seed belt which means when there is a crash the seed belt is perfectly fine unfortunately this may have a very disastrous impact on you and with encryption and data I see it as the very same.
The risk of this proportion surveillance and lack of judicial oversight companies can avoid Europe or implement weaker security which would lead to innovations low down which I find interesting enough given the commission's agenda where Europe's competition.
And of course as already outlined in the road map research funding shift so instead of strengthening security.
Okay I will water the plans I promise when I come home so instead of instead of funding strengthening security.
Well funding which shift to to to to to research on access to encrypted data and of course potential major for free and open source software because how do you implement client sites scanning in an open source project.
So actually you do but then by definition anyone who finds a bug in that software can fix it and for kids and I would say this client sites scanning is not only a bug it's a security vulnerability that needs to be fixed assup and then how do you deal with that and more and more complications like this of course in the eyes of the politicians and lawmakers can actually damage free and open source software.
So let's frame the debates correctly first strong encryption is essential for security and protect national security.
Second given law enforcement exceptional access threatens human rights and democracy third strong encryption strengthens privacy and security.
And bagdors to encrypted systems will not stop criminals and terrorists from using strong encryption.
If you are for if everybody all providers are forced to implement client sites scanning for instance or system with any sort of bagdors into encrypted communication channels then this does not mean that criminals and terrorists will use the same platforms.
So basically that would mean the whole society would be under surveillance just with the exception of those were the law enforcement wants to target.
So what can be done definitely supports civil society organizations, politicians and networks like for instance access now where I work a bunch of others that I have listed here for the interest of time I'm not going to read all of those.
Like all of them or most of them have you know newsletters they are active on social networks follow them of course.
You can also donate most of those also receive individual donation donations if you go on an access now dot org there's a button to do it so very easy.
These basically advocate for digital rights and defend the strong encryption and or advocate against these efforts to undermine encryption of course you can also talk to policy makers yourself.
These organizations very often provide hints how to speak who to speak to and so on.
You can also participate in public consultations if you want to spend a couple of evenings trying to figure out what the commission tried to ask in a specific feedback request.
And of course raise public awareness you know speak about the this with your friends with your colleagues in the community.
And so on credits for the picture I by the way really really recommend this research paper bugs in our pockets.
It's it's very well accessible and that's it. I am afraid there is no time for questions.
The part of the panel has kindly donated to that question too. Okay, so first of all, can we thank myself.
Thank you.
Five minutes.
I'll let you pick them.
Okay, so do you have a question for myself.
We have a question.
Go ahead.
I'm going to do the first one as well.
I can get that.
Obviously, breaking or doing client science can only works in centralized systems that can control the client.
Now if you have mastered on or the Fediver's federated communication.
Is this discussed at all that we centralize or regulate only centralized systems.
So, unfortunately this would apply to everyone targeting the European markets, right?
This is how usually European regulation works.
And I think it was also indicated in the previous talk.
You know, that it's not only the applications themselves that can be targeted.
It's also app stores for instance.
You know, that you can have an obligation potentially that it would say those clients that do not comply with these obligations.
They cannot be on the app store.
So, there's a myriad of very bad proposals that can come up as part of this.
And, you know, it does not mean that decentralized or federated systems would not fall into the scope.
But what definitely applies is that there it's very difficult to have it on the control for niche communities.
Or for criminals or terrorists that I have outlined.
Because if you basically fix all the systems in the eyes of the politicians that the society uses,
it doesn't mean that there will not be a terrorist organization who will fork the one existing system.
And that they would actually escape these obligations.
So, I would say that effectively cannot work.
It's a really, really bad proposal to go in the direction.
And there was another question done here, I think.
Yes.
Thank you.
Bake quickly.
So, from what can we do perspective?
How much time do we have?
And what would you say are the most effective ways among the ones you have listed to help?
What was it?
How much time do we have?
What's the most effective way?
Right.
So, I wouldn't, I take it from the end.
I wouldn't say that there's one silver bullet, you know, most effective approach.
I think it's a combination.
And it's a puzzle that's basically you have to build.
So, there are several elements you have to, basically, strategically, strategically use all of them.
On the first part of the question, how much time we have?
Well, in Q2, which means very soon in a couple of months,
the commission will come up with the technology roadmap.
And then things can spin very quickly.
At this moment, there is no legislative proposal when it comes to this on the table.
Of course, there is the chat control, but that's, you know, separate from this very initiative.
But this could potentially lead to a proposal of a very broad,
obligation to provide access to law enforcement if they need evidence for criminal investigation,
which I would say chat control is nothing compared to this, you know.
And that, we will see after the technology roadmap is here in Q2 2020 this year.
Q2 this year.
Thank you.
We have time for one more question.
And it's the back of course.
Thank you.
So, yeah, this makes a lot of sense.
But from the point of view of law enforcement,
how can we help them not implement this?
Good question.
Because I tried to hint with the framing,
because I think it's a bad idea to, like advocacy efforts to go against this
and dismiss basically the goal.
Because the objective is to protect the society.
But I think we need to be hinting at the facts and framing the debate correctly,
because encryption is a key element in ensuring security of citizens.
So, basically going into this direction, you're undermining the main objective
that this is, you know, trying to achieve.
That's one thing.
Second thing where I think we can actually, like, go against the arguments is that the main argument
is law enforcement operates in dark because everything is encrypted.
Well, this is, of course, not true.
I believe that we actually live in a golden age of surveillance.
Everyone is under surveillance.
So, saying we cannot actually catch criminals because we don't have access to an encrypted communication
is just false.
I mean law enforcement needs to focus also on other angles.
And third, law enforcement is not necessarily an answer to everything.
Maybe prevention, maybe setting up a society that does not encourage so much,
you know, into criminal activities, you know, living environments for people
that would not feel incentivized or that, you know, would not be let down if they have mental health issues.
And so, like, there's a myriad of other elements that you need to also take into scope
and not just look into, we need to access encrypted data.
Thank you very much indeed.
Thanks.