Why not ban cars, Amber Rudd? It’d be more effective than banning encryption

Op-ed: Another terrorist attack, another government attempt at backdooring WhatsApp.

Credit: Lauren Hurley - WPA Pool/Getty Images

This story was originally published on March 27, 2017, after the Westminster attack.

Following Saturday night's London Bridge and Borough Market attacks, home secretary Amber Rudd and PM Theresa May were quick to reuse the "Internet provides a safe space for terrorists" rhetoric. Here's our op-ed response to government regulation of the Internet and backdooring end-to-end encryption.

The ink has only just dried on the UK's Investigatory Powers Act—the most powerful digital surveillance law in the western world—but home secretary Amber Rudd still isn't satisfied. Now she's declared that strong encryption is "completely unacceptable" and should be outlawed, and that the authorities must have access to messages sent through encrypted platforms such as WhatsApp.

The perpetrator behind last week's attack on Westminster used WhatsApp just three minutes before the assault begun. We don't know who he was messaging, or the content of any messages he might've sent, because WhatsApp uses end-to-end encryption. MI5 reportedly asked Facebook (which owns WhatsApp) to decrypt any messages, but the company refused. (If the encryption is truly end-to-end, Facebook wouldn't be able to help, anyway.)

According to Rudd, David Cameron in 2015, and countless other politicos over the last decade, encrypted messaging platforms give terrorists a safe space to hide and plan their attacks.

Rudd, in an interview on Sunday with BBC One's Andrew Marr, pointed out that spies used to simply "steam-open envelopes or just listen in on phones," but they can't do that with encrypted messaging apps like WhatsApp, Telegram, or Signal. "You can’t have a situation where warranted information is needed, perhaps to stop attacks like the one last week, and it can’t be accessed," continued Rudd.

"... We do want them [tech firms] to recognise that they have a responsibility to engage with government, to engage with law enforcement agencies when there is a terrorist situation," said Rudd. "We would do it all through the carefully thought through legally covered arrangements, but they cannot get away with saying we are different situation. They are not."

There are two problems with Rudd's argument. First, having backdoor access to every messaging platform wouldn't necessarily help MI5, the CIA, or any other intelligence agency. The 2015 terrorist attacks on Paris were seemingly planned and executed with not-encrypted SMS messages sent via prepaid burner phones. Even more damning, though, is that a number of the attackers were already known to the French and Belgian authorities, but they didn't have enough resources to track their movements and behaviour. At the time, the French authorities reportedly had around 500-600 staff available to physically follow people, versus a national security watch list of about 11,000.

The second issue is that granting backdoor access to the UK government would make it much easier for other groups to snoop on those same messages. Backdoors are inherently insecure: if WhatsApp grants access to our security agencies then it is virtually guaranteed that hackers—either working for themselves or perhaps another country—will also gain access. Whoever finds that backdoor would have access to credit card details, passport scans, medical data, or whatever else you've recently sent to your friends and loved ones. Imagine the potential for blackmail or fraud or identity theft—just so the government can access yet more data that it doesn't have the resources to handle.

Even if by some miracle the UK government succeeds in gaining access to WhatsApp, what's to stop terrorists from moving to another service that doesn't yet have a governmental backdoor, or from taking some code from Github and making their own encrypted messaging tool? To paraphrase that massively overused adage, if we outlaw encryption, only outlaws will have encryption.

Why, then, is the home secretary once again calling for access to encrypted messages? Is there someone whispering in her ear? Or is it purely down to a lack of technical expertise?

It would be more effective—and easier to police—to just ban cars from driving on roads, or at least make people pass a full background check before renting a car. Or perhaps Rudd could go even bigger: legislate a telecommunications kill switch that completely disables the country's phones and Internet access. Never mind the legitimate uses of cars or the Internet—or, you know, that the UK's emergency services are in the process of moving over to EE's cellular network. Let's just throw everything out with the bath water.

What we really need is to rethink mass surveillance, and we need a moratorium on passing new surveillance laws after major atrocities to prevent political knee-jerks that will have major repercussions down the line. Surveillance doesn't work if it just produces an ever-increasing list of potential suspects while eroding the privacy and freedoms of everyone else. Short of developing a pre-crime system a la Minority Report, we need a more targeted, intelligent approach that makes the most of our finite number of spies.

Now read our guide on how to improve your privacy and security online...