Encryption Vital For Right to Privacy, European Court Rules

A European court has sided with a Russian petitioner who challenged a Kremlin rule that requires telecom firms to backdoor their servers for law enforcement data collection. The court found that end-to-end encryption is essential to preserving the right to privacy in digital communication systems.

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

The decision Tuesday by the Europe Court of Human Rights stems from a 2018 complaint from Russian national Anton Podchasov against the Kremlin, challenging a 2017 order by the Russian Federal Security Service. The Russian Information Technologies and Protection of Information Act requires Telegram to disclose the data of its users.

Under the law, companies listed as “internet communication organizers” will have to store communication data of all Russian users within the country for six months. Companies also should provide the FSB information needed to decrypt data and as well as identify the end-to-end protected messaging of users.

The FSB demanded that Telegram share details including IP addresses, as well as data needed to decode the end-to-end protected messages of six app users. Telegram does not use end-to-end encryption as the default setting but uses a custom-built, server-client encryption scheme. Although the app allows users to apply end-to-end encryption by activating the “secret chat” feature.

Since the six app users did not enable the secret chat feature, Telegram refused to comply with the FSB order, arguing it was technically impossible as it would require the company to create a backdoor that would ultimately weaken the encryption mechanism for all its users.

Podchasov initially petitioned the Russian court, arguing that the provision requiring submission of encryption keys under the Russian law will decrypt communications of all users, violating the “right to respect for their private life and for the privacy of their communications.”

The Russian district court dismissed the case on the grounds of lack of violation of fundamental rights. The Moscow City Court and the Supreme Court of the Russian Federation also dismissed the case – forcing the petitioner to approach the European court.

At the European court, the petitioners argued the Russian regulation violated Article 8 of the Human Rights Convention – the right to private life and correspondence.

During the case hearing, the European court heard from the European Information Society Institute, which said as end-to-end encryption is designed to ensure that only intended recipients have access to data, and the request by the FSB would mean the privacy of all Telegram users will be compromised “for the sake of a small number of suspects.”

Since telecom companies relied on encryption to shield their users from hacking, identity and personal data theft, as well as state surveillance, the EISI argued weakening of encryption would have a “chilling effect” on free speech.

Rights group Privacy International, which also testified before the court, said making companies backdoor their applications would force telecom operators to introduce “radical changes” to their software that will “weaken the encryption,” making the application an easy target of hacking.

The rights group also argued that compliance with the Russian measure also would mean companies would be violating privacy and confidentiality requirements under European and other national privacy laws.

The European court further cited the United Nations High Commissioner for Human Rights decision on the right to privacy, in which the UN agency stated that “encryption is a key enabler of privacy and is essential for safeguarding rights.” The court also referenced the 2017 Council of Europe Parliamentary Assembly Resolution adopted in the wake of revelations from former U.S. National Security Agency contractor Edward Snowden on the U.S. government mass surveillance program.

Expressing concerns about government tactics such as backdooring software components and exploiting vulnerabilities, the council recognized the need for “effective, targeted surveillance.”

The European court also said breaking encryption could cause “collateral damage” to internet security, citing a 2016 statement by the Europol and European Union Agency for Cybersecurity. The European agencies called for alternate models of intelligence collection through undercover operations, infiltration into criminal groups and accessing communication devices through live forensics on seized devices.

The European court ruled the decision of the Russian government to intercept the telecommunications interfered with Article 8 of the complaint and that “protection of personal data is of fundamental importance.”

The court also found that Russian domestic law is “inadequate” as it does not have effective safeguards such as information on how long the collected data would be retained and details on who can access the collected data.

“The court concludes that in the present case, Russia’s statutory obligation to decrypt end-to-end encrypted it not proportionate to the legitimate aims pursued,” the European Court of Human Rights said. “Confidentiality of communication is an essential element of the right to respect for private life and correspondence,” the court said.

The latest decision is less likely to prompt Russia to change its law, Stefan Soesanto, senior researcher at ETH Zurich Center for Security Studies said. “The Russian government is not interested in shutting Telegram, we saw this from the country banning the app and later reversing it.”

After Telegram was added as an internet communication organizer, the company refused to comply with Russian law, forcing it to relocate its office to Dubai. The Russian federal communication office Roskomnadzor banned the app in 2018. Later, the Russian government lifted the ban after Telegram agreed to cooperate with investigations of extreme nature.

Soesanto added Telegram is likely to continue operating in Russia, with the FSB using different tactics such as hacking for communication interception.

Since there is collective interest from several governments to weaken encryption, Soesanto added the latest European court decision is also less likely to dissuade the governments from pursuing legislative proposals that could impact encryption.

European law enforcement agencies have argued that end-to-end encryption prevents them from collecting bulk data promptly needed to prevent terrorism and sex crimes.

Among nations pursuing proposals that could affect encryption is the European Commission-backed bill to prevent online child abuse material or the CSAM proposal that will require telecom companies to carry out client-side scanning to identify CSAM content (see: EU’s Proposed CSAM Bill Poses Hacking Risks ).

The U.K. government recently passed a similar proposal called the Online Safety Act obliging online intermediaries such as search engines and instant messaging apps to carry out client-side scanning in a bid to secure children from online harm. After privacy groups and telecom companies raised concerns about its harmful effect on encryption, the U.K. amended the law mandating that tech companies find an alternate solution that will not impact encryption for content scanning (see: UK Government Seeks to Dispel Encryption Concerns ).

The UK government is also racing to finalize a bill seeking to make data collection by British intelligence agencies easier by amending the scope of data that can be lawfully intercepted (see: UK Lawmakers Push Ahead With Revised Snoopers’ Charter).

Ioannis Kouvakas, legal officer at Privacy International, said the latest decision from European Court of Human Rights will send “a clear message to other governments currently toying with similar ideas.”

Telegram did not respond a request for comment from Information Security Media Group.