‘Fighting crime blindfolded’: Europe is coming after encryption

Youth gangs have wreaked havoc in Sweden and Denmark for months, with violence ranging from murders to explosions.

For Peter Hummelgaard, Denmark’s justice minister, it's not just guns and bombs that are causing mayhem. It's also the criminals' smartphones.

“We've seen a new trend of crime-as-a-service, where organized criminals use digital platforms to hire children and young people from Sweden to commit serious crimes in Denmark — murders, attempted murders, explosions,” Hummelgaard told POLITICO in an interview last month.

Technology has made it “far easier for criminals to reach a larger audience and also coordinate actions in real time,” the justice minister said, singling out crimes like spreading child pornography, money laundering, illicit drug smuggling — "or, as we've seen examples in Denmark and Sweden, recruitment of minors into a life of crime."

The smartphones and applications used by criminals to recruit, organize and carry out crime sprees are increasingly the target of European law enforcement and politicians alike. So-called end-to-end encrypted technology — a pillar of privacy-friendly and cybersecure digital communication — is seen as a foe by police and investigative authorities.

The technology is now coming under heavy fire across Europe.

“Without lawful access to encrypted communications, law enforcement is fighting crime blindfolded,” said Jan Op Gen Oorth, a spokesperson for Europol, the European Union's law enforcement agency.

France has put forward an anti-drug trafficking law that critics say would ban encryption. The Nordic countries have taken the fight to tech companies. Spain said it wants to ban encryption. And the U.K. government has now entered a legal battle with Apple over an apparent attempt to secretly spy on encrypted data. 

Denmark will soon take over the rotating presidency of the Council of the EU, giving it an influential role at a time when EU countries are debating the bloc’s child sexual abuse material bill (CSAM). That draft legislation could impose an obligation on all messaging platforms to conduct blanket scans on their content to root out child abuse images — even if they're end-to-end encrypted and thus technically out of reach of the platforms themselves.

“It's no secret that I would like to see an ambitious regulation on child sexual abuse,” Hummelgaard said. 

The EU won't stop there. The European Commission, the bloc's executive branch, this month unveiled a new internal security strategy, setting out plans to look into “lawful and effective” data access for law enforcement and to find technological solutions to access encrypted data.

It also wants to start work on a new data retention law, it said in the strategy, which would define the kinds of data that messaging services, including digital ones like WhatsApp, have to store and keep, and for how long. The EU’s top court struck down the previous data retention legislation in 2014, saying it interfered with people's privacy rights.

The Commission is presenting a united front in their plans to help law enforcement. The internal security strategy was presented jointly by Henna Virkkunen, a powerful executive vice-president who heads the digital department, and Magnus Brunner, the commissioner in charge of home affairs. Both hail from the center-right European People's Party, as does Commission President Ursula von der Leyen.

Police face privacy groups

In taking on encryption, European governments are heading for a massive clash with a powerful political coalition of privacy activists, cybersecurity experts, intelligence services and governments favoring privacy over police access.

Strands of that fight date all the way back to the last century. Cryptography was a powerful asset during the Cold War, when the U.S. and the Soviet Union aimed to restrict access to the technology to keep control of confidential communication. But the technology grew in stature during the age of the internet, underpinning everything from digital banking to sensitive data transfers. In recent years, an increasing number of major tech firms have moved toward using end-to-end encryption as a default setting.

“I have no sympathy for the argument that one needs to undermine encryption in order to catch the bad guys,” said Matthew Hodgson, a co-founder of Matrix, a secure comms protocol that has been used by the U.S. Navy and multiple European governments. 

Doing so would punish regular people hoping to communicate privately while pushing drug dealers, pedophiles and terrorists toward encrypted messaging services operated in countries beyond the reach of European police, Hodgson said. “It really is a naive, fool’s errand."

One app in particular has taken up the fight against the creep of encryption-threatening laws: Signal.

The app is seen as the industry standard on end-to-end encrypted messaging — and recently entered the limelight when a group chat among top U.S. security officials was compromised in what was dubbed "Signal-gate."

Its president, Meredith Whittaker, has repeatedly threatened to pull out of a country rather than abide by any law that forces her to weaken Signal’s security. Whittaker told POLITICO in early March that it is a “fundamental mathematical reality that either encryption works for everyone, or it’s broken for everyone.”

Danish Justice Minister Hummelgaard suggested he would have no problem if Signal ceased operations in Denmark over its refusal to work with law enforcement.

“I’m beginning to question whether or not these are technologies and platforms that we simply cannot live without,” he said.

A fork in the road

With no legal solution in sight, law enforcement authorities are making do with what they have. They've had success infiltrating and compromising open encrypted messaging services used only for criminal purposes, like Encrochat, and getting access to so-called metadata (like location information) that is more in the open than messages.

But they continue to complain of being locked out of the dominant form of communication. Jean-Philippe Lecouffe, the deputy head of Europol, put it simply at a recent conference: “We want legal access.”

That's where mathematics gets in the way.

Those in favor of police access to data argue there are ways for messaging services to get access to criminals’ end-to-end-encrypted messages without weakening the security of regular people’s conversations. Yet tech experts have noted that with end-to-end-encryption, it’s not possible for only the “good guys” to get access. Once such a so-called backdoor has been opened, they say, it cannot remain closed to hackers, criminals and spies. 

Both can't be true, so the debate remains a clash of heads with no compromise available.

With the legislative challenges to encryption, Europe seems headed for a fork in the road, where political momentum could give the police what they want — or the fight could rumble on.

Ella Jakubowska, head of policy at European digital rights group EDRi, which has long fought police surveillance, said the debate seems intractable. "It's like banging our head into a brick wall."