Spain seeks to ban encryption, leaked document reveals

The great majority of EU countries support the proposal of scanning encrypted messages, a leaked document has revealed.

Spain's vision appeared to be the most extreme, with the nation's leaders apparently seeing the access to citizens' data as “imperative” to allow authorities catching criminals in the virtual world.

End-to-end encryption (E2E) – the core upon which security software like VPN services and secure messaging apps are built – is under attack everywhere, in fact. In the EU, the so-called Chat Control seeks to force providers to create an enter-point for law enforcement bodies to scan encrypted communications. Cryptographers and privacy advocates keep strongly opposing such provisions.

Chat Control: 15 out of 20 EU countries in favor

“Breaking end-to-end encryption for everyone would not only be disproportionate, it would be ineffective in achieving the goal to protect children,” Iverna McGowan, the secretary general of the European branch of the Centre for Democracy and Technology said to WIRED after reviewing the leaked document.

Many experts have been arguing, in fact, that weakening encryption will de-facto make the online world more dangerous by giving a backdoor to exploit to criminals and limiting the right to privacy for all.

McGowan specifically referred to the different responses the EU leaders gave to a series of questions on the matter. The results—dated April 12, 2023—count a concerning 15 out of the 20 nations interviewed in favor of breaking encryption in at least some forms.

Spain wasn't just the strongest fan of the bill, but it also argued how EU-based providers should be ideally prevented from implementing E2E in the first place. Of a similar stance was Poland, suggesting that parents should have the power to decrypt children's chats. Among other supporters for the Chat Control proposal are Cyprus, Hungary, Croatia, Slovenia and Romania.

Unsurprisingly, the news was angrily received by users who voice their discontent online. Below is a Reddit conversation as an example of the many comments of dissent currently circulating on social media.

Comment from r/privacy

On more moderate views, we found Ireland and Denmark. While supporting the scanning of encrypted messages in the lookout out of child sexual abuse content, these also call for the law to include some wording to ensure E2E isn't weakened. Similarly, Netherlands proposed some “on-device solutions” instead to detect the harmful material before being encrypted and sent to other users.

That's something that experts keep describing as technically impossible, though. “Politicians still seem to believe they can have a ‘magical key' to access encrypted communication—completely ignoring the technical background,” Tutanota's co-founder Arne Möhle told TechRadar, deeming Chat Control the worst legislative initiatives in the EU to date.

“As cryptography experts we have to explain this again and again: If the EU undermines encryption to prosecute criminals, it will destroy security online for all 450 million EU citizens.”

Despite being just a minority, a handful of EU nations have expressed their concerns on the unattained consequences of undermining encryption's safety.

According to Italy, such a law “would represent a generalized control on all the encrypted correspondence sent through the web.” Italian experts also pointed out its potential inefficiency due to the struggle of handling such a large amount of content likely to produce many false positives, too.

Also Estonia said not to support the creation of “backdoors to end- to-end encryption solutions.” Finland and Germany have also rejected the possibility of disrupting encryption in any ways, urging EU lawmakers to revise the bill accordingly before passing on the next stage.

Another leak coming from the internal EU legal advice has previously showed lawyers raising significant doubts around the lawfulness of the proposed Chat Control, the Guardian reported.

A global fight against encryption

As mentioned before, the European Union isn't the only one ready to sacrifice encrypted communications in the name of a safer internet.

In the UK, the Online Safety Bill is currently making its way through parliament. Many have been voicing their discontent so far, with the most popular encrypted messaging apps like WhatsApp and Signal threatening to quit the UK if the bill becomes law.

The EARN IT Act is trying to regulate something similar in the US, a nation already infamous for failing to effectively protect people's privacy online. “The idea of subjecting millions of people to false accusations of child abuse is horrific,” commented digital rights advocacy at the Electronic Frontier Foundation (EFF), while pledging for people to oppose the bill.

The tensions between online safety and users' privacy are even more stretched in the largest worldwide democracy. Earlier this month, India blocked 14 encrypted apps as they were allegedly used by terrorists across the country.

Head of Policy and Compliance at Element—one of the banned service—Denise Almeida told TechRadar: “The fact that this sort of ban is even possible in one of the largest democracies in the world is particularly concerning and sets a very dangerous precedent.”