Edinburgh Napier University

  Prime Minister David Cameron has stated that the UK government will look at “switching off” some forms of encryption in order to make society safer from terror attacks. This might make a grand statement but it is impossible to implement and extremely technologically naïve. Encryption is a core part of the internet; it’s use is increasing every day – Google’s services, including search and email, use encrypted streams, as do Facebook and Twitter and many other widely used sites. Encryption makes it almost impossible for eavesdroppers to read the contents of the traffic. It is the foundation upon which all e-commerce is based. It’s just impossible to ban. There is no way to define a law which constrains the use of encryption. Would it be only when used in certain applications (such as email), or by disallowing certain methods (such as the encryption program PGP)? Would using a Caesar code, a cipher nearly 2,000 years old, be illegal? Such a move would make the UK – or any country that followed suit – unsafe in which to do business. Free countries wouldn’t consider switching off encryption due to the insecurity it introduces for both consumers and businesses. Much online content accessed in the UK is actually stored and processed outside the country. Someone who suspects that they may be monitored can set up a secure connection to a remote site in the cloud – Amazon’s for example – and store and process information there. How would this fall under any new law? And where would the ban end? Would it include character encoding, such as the Base-64 encoding that allows for email attachments, or the encoding that provides non-Roman character sets for other languages? Encryption is also the basis for cryptographic signing, a digital signature used by all manner of organisations to verify that digital content – software, audio-visual media, financial products – is what it claims to be. It is the basis of trust on the internet. We have a right to some privacy. Few people would not object to their letters being examined or their phones being tapped – and the rights enjoyed in the days of traditional communications should be no different when applied to their modern digital equivalents. We also have a right to protect ourselves. With major losses of data occurring regularly, whether from attacks or due to error, we need to protect ourselves and our data. Encryption of data when stored or communicated is one way of doing so. The tools used by the security services to hack systems and break encryption are largely the same used by criminal hackers – reducing encryption levels will increase our vulnerability to both.