Why encryption matters: 10 myth-busting facts

This is a text automatically translated from Italian. If you appreciate our work and if you like reading it in your language, consider a donation to allow us to continue doing it and improving it.

This is our free translation (with the help of Mate Translate) Of this article appeared on AccessNow originally written by Namrata Maheshwari And Raman Jit Singh Chima And released under CC BY 4.0.

Around the world, cyber attacks threaten national security and democracy. This is why encryption is important: It's the foundation for online trust and one of the best tools we have for keeping our private communications and digital infrastructure secure. Yet, in the face of these attacks – including the hack revealed by the Pegasus Project – government authorities have persisted in supporting a “backdoor” into cryptography that it would destabilize Internet and it would make everyone less safe. In the meantime, Apple announced a plan to get around the End-to-end encryption, a choice that would limit people's control over their devices and jeopardize our privacy and security.

Our latest report (by AccessNow, Ed.), Policy brief: 10 facts to counter encryption myths, is a refutation of the most common arguments we are seeing in recent years to weaken or bypass encryption. The report explains why encryption is important, not only to protect privacy, free expression and other human rights, but also as a bulwark of the economy, preserving democracy and ensuring national security. We debunk cryptography's most dangerous myths, the ones that form the basis for deeply flawed laws and policies. We shouldn't have to suffer any more attacks, data breaches, or political scandals to understand why encryption matters and should be protected, not undermined. A proposed “security” policy that undermines encryption is a policy of insecurity – and it's time to stop pretending otherwise.

Why encryption matters: 10 myth-busting facts

Done #1: Strong encryption is essential for Internet security

Myth: backdoors for targeted or exceptional access by law enforcement will not compromise Internet security

• Cryptography is a mathematical process that cannot be applied selectively. Any call for a backdoor that only works for the government is essentially at war with mathematics;

• a backdoor to encrypted content is a security flaw that makes the entire system and underlying data vulnerable. Even if it is created only for government access, it will inevitably be exploited by myriad other malicious actors.

Done #2: Giving law enforcement exceptional access threatens human rights and democracy

Myth: law enforcement backdoors will have no impact on our rights or democracy

• Encryption is fundamental to democratic governance and the protection of the right to privacy and the right to freedom of expression in the digital age. Weakening encryption through exceptional access mechanisms jeopardizes these fundamental human rights and democracy as a whole;

• it is particularly necessary for some individuals and groups, including journalists, lawyers, doctors and vulnerable communities whose work and lives depend on the availability of communication channels free from the possibility of surveillance.

Done #3: Strong encryption strengthens privacy And the security

Myth: to achieve security, we must sacrifice privacy

• The framing of the encryption policy debate as “privacy versus security” is inaccurate and based on a false binary. The two are mutually reinforcing principles;

• a more appropriate framing of the debate would be “security versus security,” since encryption not only protects privacy, it protects security. This reformulation would help ensure that a policy of “security” does not become a policy of “insecurity,” creating more dangers than it seeks to prevent.

Done #4: Law enforcement has entered the golden age of surveillance, without breaking encryption

Myth: Law enforcement is facing a “darkness” problem that makes it necessary to break encryption

• The “dark” metaphor is imprecise. It implies that technological changes have diminished surveillance capabilities, when they have greatly expanded. Encryption is not, and is not likely to become, as pervasive as governments suggest;

• a more accurate metaphor for current times is “a golden age of surveillance,” as there is much more data available on individuals today than ever before. Many previously unrecorded details, such as location and contact details, can be compiled to create “digital dossiers” that paint an intimate portrait of our daily lives. Just think about what the FBI managed to do with this suspect.

Done #5: Backdoors to encrypted systems will not prevent criminals and terrorists from using strong encryption

Myth: Weakening encryption is an effective measure to counter terrorism and criminal activity

• The effect of limitations on encryption backdoors is that the general public is deprived of a platform where data and fundamental rights are protected. Criminals will simply move to encrypted platforms available in foreign jurisdictions or on the black market, or may even create their own;

• Increasing surveillance capabilities often leads to invasive surveillance without sufficient evidence of its effectiveness. A study in the United States suggests that the link between increased surveillance capabilities and terrorism prevention is tenuous. Regardless of effectiveness in combating terrorism, it is not necessary or proportionate to jeopardize the privacy and security of all users of a platform in the hope of identifying the fraction engaging in criminal conduct.

Done #6: Strong encryption helps keep children safe online

Myth: encryption makes the Internet dangerous for children

• Like other criminals, perpetrators of crimes against children will turn to alternative encrypted platforms offered in foreign jurisdictions, or create their own platforms, to hide their activities. This means that criminal activity will persist – it will simply move out of the reach of law enforcement, precluding lawful access even to metadata that may be instrumental in investigations;

• children need encrypted platforms where the identity of the people they interact with can be authenticated and where their personal information is not at risk of exposure to third parties. With more children online due to the global pandemic, governments and companies should encourage the use of strong encryption to protect children, not deliberately introduce security vulnerabilities into the technology they use.

Done #7: the obligation of "traceability" jeopardizes privacy and chills freedom of expression

Myth: traceability must be implemented to prevent the spread of misinformation

• Traceability undermines anonymity and the right to privacy and has a chilling effect on free speech. It is therefore incompatible with both human rights and democracy;

• traceability has limited usefulness in practice and will not serve as an effective tool to combat disinformation.

Done #8: Strong encryption is critical to cybersecurity and protects national security

Myth: Exceptional access to encrypted content is necessary to protect national security

• Strong encryption is critical to a resilient cybersecurity infrastructure that safeguards national security. Weakening encryption endangers national security;

• the increase in cybersecurity incidents and targeted breaches is an argument for, not against, strong encryption. Without it, we would see more unauthorized access and exposure of classified information, a boon for cybercriminals or state-sponsored adversaries. We would also see more successful attacks on essential infrastructure such as healthcare systems, elections, and public transportation, as encrypted systems help keep their operations secure.

Done #9: Strong encryption maintains trust in the digital ecosystem and supports economic growth

Myth: deliberately undermining cryptography will have no effect on the economy

• Encryption is a cornerstone of the modern digital economy, maintaining the confidentiality of customer data and the authenticity of financial transactions. Trust in encrypted systems stimulates investment, innovation and economic growth;

• it can prevent or mitigate the impact of cybersecurity incidents that would otherwise do more damage and cost more money. It reduces the risk of data breaches and controls the costs of such breaches, helping business interests and supporting the economy as a whole.

Done #10: Law enforcement and intelligence agencies do not have to break encryption to investigate crime

Myth: the authorities have no alternative but to break the encryption

• Intelligence and law enforcement already benefit greatly from the vast increase in data on individuals available in the digital age. There is no evidence to show that undermining encryption is a necessary, proportionate, or effective means of achieving government objectives in modern rights-respecting democracies;

• in most cases, authorities still rely primarily on traditional evidence such as witnesses, informants, physical evidence, and corporate documents from banks and cellular companies. Weakening encryption and weakening security for everyone in an attempt to obtain all possible evidence in specific cases is not in line with human rights and freedoms and will, in practice, never replace good investigative work.

Join communities