As tech companies make stronger encryption services, the UK government is announcing more plans to break them. An amendment to the Investigatory Powers Act announced in this week’s King’s Speech could force companies to get permission from the government before making security changes.
Open Rights Group says this “is likely to mean further attacks on end-to-end encryption”, following the passing of the Online Safety Bill earlier this month. Both bills cite terrorism and child sexual abuse as cases for which the invasion of privacy is warranted to prevent crimes.
However, both campaigners and companies have voiced concerns. Tech companies are in fact boosting the encryption they offer, with Meta and X rolling out encrypted messaging on their platforms, and the Signal messenger app announcing upgrades to its encryption. Signal has already said it may leave the UK if forced to weaken its end-to-end encryption. Apple has voiced similar concerns over iMessage and FaceTime.
The Online Safety Bill has already drawn criticism from Apple, Meta and others for potentially forcing them to undermine their encryption services. Companies could be fined either £18 million or 10 per cent of their annual turnover for not complying with the guidelines which Ofcom released yesterday.
Experts suggest that access to end-to-end encryption would require a technology called client-side scanning, but campaigners argue this is the equivalent of a “back door” into people’s phones that can be abused by government, law enforcement, and hackers.
Apple began developing its own version of client-side scanning, but quietly shelved the project in December 2022 over concerns about “a slippery slope of unintended consequences.”