Spies Still Butthurt They Can't Get At Encrypted Comms Data

Five Eyes to tech: We have ways of making you comply

The Five Eyes nations have told the tech industry to help spy agencies by creating lawful access solutions to encrypted services – and warned that governments can always legislate if they don't.

The UK, US, Canada, Australia and New Zealand - which have a long-standing intelligence agreement – met in Australia this week.

In an official communiqué on the confab, they claim that their inability to lawfully access encrypted content risks undermining democratic justice systems – and issue a veiled warning to industry.

The group is careful to avoid previous criticisms about their desire for backdoors and so-called magic thinking – saying that they have "no interest or intention to weaken encryption mechanisms" – and emphasise the importance of privacy laws.

But the thrust of a separate framework for their plans, the Statement of Principles on Access to Evidence and Encryption, will do little to persuade anyone that the agencies have changed their opinions.

"Privacy laws must prevent arbitrary or unlawful interference, but privacy is not absolute," the document stated.

Although governments "should recognize that the nature of encryption is such that that there will be situations where access to information is not possible", these situations "should be rare".

The problem the Five Eyes have is that the principles that allow government agencies to search homes or personal effects don't give them the ability to use the content of encrypted data.

The group described this situation as "a pressing international concern that requires urgent, sustained attention and informed discussion on the complexity of the issues and interests at stake".

Ever keen to amp up the threat this poses to society, it added: "Otherwise, court decisions about legitimate access to data are increasingly rendered meaningless, threatening to undermine the systems of justice established in our democratic nations."

The principles set out in the Five Eyes' statement seek to stress that law enforcement's inability to access the content of "lawfully obtained data" is the responsibility of everyone.

"Law enforcement agencies in our countries need technology providers to assist with the execution of lawful orders," the group said.

The agencies also pointed out that tech firms, carriers and service providers are also subject to the laws of the land – and if they don't cooperate willingly, well, they have ways of making them.

"The Governments of the Five Eyes encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services that they create or operate in our countries," it said.

Should governments continue to encounter impediments to lawful access to information necessary to aid the protection of the citizens of our countries, we may pursue technological, enforcement, legislative or other measures to achieve lawful access solutions.

Providers can create customised solutions that are tailored to their individual system architectures, it added, but governments should not favour a particular technology.

The communiqué also makes the common complaint that the "anonymous, instantaneous, and networked nature of the online environment has magnified" the threats of terrorism, child abuse, extremism and disinformation.

Again, tech firms should "take more responsibility for content promulgated and communicated through their platforms and applications", with another separate statement setting out the action industry needs to take.

This includes development of capabilities to prevent uploading of illicit content, to carry out "urgent and immediate" takedowns, and more investment in human and automated detection capabilities.

Major firms should also set industry statements and help smaller firms deploy these capabilities on their own platforms.

Elsewhere, the communiqué re-committed the five nations to cooperate on terrorism, cyber security, and immigration through intelligence sharing and new sources of data importance.

Source: theregister