Hard Choices for UK Gov – Block or Don’t Block WhatsApp and Signal

Two of the internet’s most popular secure messaging platforms, WhatsApp and Signal, have now both said that they would rather be blocked by the UK’s controversial new Online Safety Bill (OSB) than undermine the security (end-to-end encryption) of their platforms by allowing private messages to be filtered and moderated.

The confusing and ugly mess of legislation that is the OSB, which began life as an otherwise noble and desirable policy to help tackle “harmful” internet content (i.e. via fines, website blocks by broadband ISPs and other sanctions), has in recent years become somewhat of a Frankenstein’s monster.

Despite the very public talk of protecting children and the political focus on major social media platforms (e.g. Facebook, Twitter etc.), the OSB itself actually goes much further than that. The bill now risks placing a massive administrative and legal burden on even smaller sites / content providers, which could have a chilling effect on freedom of expression as content providers move to limit their liability. Some of its technical measures may even be outright unworkable.

One example of this is the endless debate over end-to-end encryption (E2EE), which is a method that any software developer can add to help keep everything from financial transactions, to website visits and messaging services secure. But unlike regular encryption, which can be broken by hackers and hostile states if the decryption keys are uncovered, E2EE goes further by ensuring those keys are kept hidden, even from the provider.

However, the UK Government has long been concerned that such technology can also be used to conceal conversations between criminals and terrorists or to spread child abuse, which makes it harder for the police and spies to catch them. Finding a balance on this front is difficult because E2EE is, at its most basic, something that any coder could add.

The OSB threatens to break this by handing Ofcom the power to require that encrypted-messaging and other such services adopt “accredited technology” for content moderation, such as to identify and remove child-abuse material. The problem for E2EE based services is that this approach is incompatible with how the technology works.

Signal and WhatsApp Rebel

The President of encrypted messaging app Signal, Meredith Whittaker, has now confirmed (here) that they would stop providing services in the United Kingdom, such as if required by the bill to weaken the privacy of its encrypted messaging system.

Meredith Whittaker said:

“Let me be blunt: encryption is either broken for everyone, or it works for everyone. There is no way to create a safe backdoor.

As a whole, the Online Safety Bill is a grab bag. Sensible proposals are positioned next to dangerous “spy clauses” and vague “duty of care” provisions that make providers responsible for policing the content of every message sent by every user. A report from the Internet Society makes the stakes clear: “the only way for service providers that offer end-to-end encryption to comply with this duty of care would be to remove or weaken the encryption that they offer.”

Experts from the UK-based Open Rights Group have also criticized the Bill’s potential to offer future configurations of the UK government “considerable leeway” to “introduce draconian and authoritarian-style censorship,” expanding the scope of government control over expression. Some supporters negligently assure the public that such mass government inspection of messages is compatible with strong end-to-end encryption. We know that it is not.”

The Head of WhatsApp, Will Cathcart, has similarly told the BBC that they “won’t lower the security of WhatsApp … We have never done that – and we have accepted being blocked in other parts of the world … We’ve never seen a liberal democracy do that. When a liberal democracy says, ‘Is it OK to scan everyone’s private communication for illegal content?’ that emboldens countries around the world that have very different definitions of illegal content to propose the same thing.”

One possible way to get around this issue might be to adopt client-side scanning on the device itself (mobile, laptop etc.) that could check messages BEFORE they are sent, but that would still undermine the privacy of E2EE services. At the end of the day, you can’t allow one state or group to have special access to such platforms and then expect that not to be abused by others (e.g. hackers or less democratic countries).

Speaking personally, I also use secure message platforms, such as when communicating with important sources for some of the articles we write. Suffice to say, I would not want either the messaging provider’s staff or government to have any access to those conversations.

The difficulty for WhatsApp and Signal – as well as other E2EE using platforms – is that, if they continue to operate in the UK after the OSB has passed (assuming it passes in its current form, and it does have cross-party support), then the company could face massive fines worth up to 4% of its turnover. In the case of WhatsApp, that’s Meta’s annual turnover!

On the flip side, a huge amount of ordinary people in the UK use such services to communicate with friends, family and work colleagues across the world. At this point, though, it’s hard to know who the public would blame more if that facility were stopped, the government or the messaging providers. But one thing is certain, those who desire secure communications will simply switch to platforms that are beyond the reach of UK law.