{"id":25152,"date":"2023-09-08T04:53:15","date_gmt":"2023-09-08T11:53:15","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=25152"},"modified":"2025-04-16T01:07:33","modified_gmt":"2025-04-16T08:07:33","slug":"uk-government-retreats-from-plans-to-break-end-to-end-encryption","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/uk-government-retreats-from-plans-to-break-end-to-end-encryption\/","title":{"rendered":"UK Government Halts Plans to Break End-to-End Encryption, but Privacy Risks Remain"},"content":{"rendered":"\n

A new law is about to be passed in the UK that will have a serious negative knock-on effect around the world. It\u2019s part of a wider move by governments to force internet companies to break end-to-end encryption and undermine global privacy. We first reported on the UK\u2019s Online Safety Bill<\/a> two years ago. Since then, it\u2019s been winding its way through the parliamentary process<\/a>. It has grown into an unwieldy rag-bag of ideas that aims to tackle the vague concept of \u201charmful content.\u201d As the Open Rights Group explains<\/a>:<\/p>\n\n\n\n

\n

Under new age verification rules in the UK\u2019s massive Online Safety Bill, all internet platforms with UK users will have to stop minors from accessing \u2018harmful\u2019 content, as defined by the UK Parliament.<\/p>\n\n\n\n

This will affect adult websites, but also user-to-user services \u2013 basically any site, platform, or app that allows user-generated content that could be accessed by young people.<\/p>\n\n\n\n

To prevent minors from accessing \u2018harmful\u2019 content, sites will have to verify the age of visitors, either by asking for government-issued documents or using biometric data, such as face scans, to estimate their age.<\/p>\n<\/blockquote>\n\n\n\n

While the bill\u2019s intentions may be good, online age verification systems are a danger to privacy. CNIL, the French data protection body, found in a study last year that the main types of age verification systems \u201care circumventable and intrusive,\u201d and called for the implementation of more privacy-friendly models. Wikipedia has said that it will not age verify its users, and will withdraw from the UK<\/a> if necessary.<\/p>\n\n\n\n

The worst element of the proposed Online Safety Act is a requirement for online platforms to use \u201caccredited technology\u201d to scan messages for Child Sexual Abuse Material (CSAM). Fighting CSAM is a noble and necessary cause, but the UK government\u2019s approach will require mass surveillance of everyone using messaging services \u2013 a terrible move for privacy. It will also require basic end-to-end encryption to be broken in some way.<\/p>\n\n\n\n

The UK government has insisted that message scanning can take place without harming end-to-end encryption, but has never said how that is possible. In effect, it has been left to the online companies to come up with a solution to the problem. The fact the UK government would like to be able to reconcile privacy with the ability to scan encrypted messages doesn\u2019t mean it\u2019s possible. An open letter<\/a> from 70 organizations, cybersecurity experts, and elected officials explained that message scanning \u201ccreates serious security and privacy risks for all society while the assistance it can provide for law enforcement is at best problematic.\u201d In June of this year, the UK Home Secretary \u2013 that is, the Interior Minister \u2013 wrote an article<\/a> in which she claimed:<\/p>\n\n\n\n

\n

The Safety Tech Challenge Fund is a UK Government-funded challenge programme that supported the development of proof-of-concept tools capable of detecting child sexual abuse material within end-to-end encrypted environments.<\/p>\n\n\n\n

Through this, the Government, tech experts and wider industry partners have demonstrated that it would be technically feasible to detect child sexual abuse in environments which utilise encryption while still strongly maintaining user privacy.<\/p>\n<\/blockquote>\n\n\n\n

The Safety Tech Challenge Fund<\/a> details how its five projects aim to scan messages without breaking end-to-end encryption. In its press release, it claims that they include:<\/p>\n\n\n\n