In some ways, the biggest news of the week was not the Panama papers but the announcement that WhatsApp was rolling out end-to-end encryption for all its 1bn users. “From now on,” it said, “when you and your contacts use the latest version of the app, every call you make, and every message, photo, video, file and voice message you send, is end-to-end encrypted by default, including group chats.”
This is a big deal because it lifts encryption out of the for-geeks-only category and into the mainstream. Most people who use WhatsApp wouldn’t know a hash function if it bit them on the leg. Although strong encryption has been available to the public ever since Phil Zimmermann wrote and released PGP (Pretty Good Privacy) in 1991, it never realised its potential because the technicalities of setting it up for personal use defeated most lay users.
So the most significant thing about WhatsApp’s innovation is the way it renders invisible all the geekery necessary to set up and maintain end-to-end encryption. Inspection of the detail of what two smartphones have to be able to do in order to communicate securely leaves one gobsmacked. To be able to make this happen on such a colossal scale is a breathtaking technical achievement.
What it means is that a billion people and counting will, from now on, be able to send and receive communications that are secure in transit. In an online world characterised by chronic lack of security, this is unquestionably a good thing because sending unencrypted messages across the open internet is like sending your most intimate secrets via holiday postcards. Not only could the state or its agents read your mail but so too could the postman and the person who sorted your mail.
For a long time, the transparency of most internet communications proved a boon to state agencies and criminals alike. They snooped and phished and spammed to their hearts’ content. But the arrival of mainstream encryption makes life much more difficult – for both parties. For their part, law enforcement and intelligence agencies are caught in a bind. On the one hand – because they see at first hand the horrendous consequences of our current unencrypted online world – they realise that there is an overwhelming public interest in making our personal communications private. On the other hand, since bad guys (and not just Islamic State) use encryption, the authorities are understandably alarmed at the prospect that the world will “go dark” on them.
Finding a rational way through this thicket would not be easy at the best of times. But what makes it almost impossible at the moment is that while everyone involved makes sanctimonious noises – about civil liberties, legality and that elusive property, “proportionality” – in practice they’re all playing hardball. The director of the FBI has been screaming blue murder about encryption for as long as I can remember.
The way his agency approached the problem of unlocking the iPhone of the San Bernardino gunman also demonstrates how the FBI is not above playing politics with these issues. We see the same phenomenon over here: after every terrorist atrocity, there are unattributed “briefings” to obliging journalists on how things might have been better if surveillance powers had been more “robust”, ie intrusive.
The thing that really infuriates state authorities about the encryption systems that firms such as Apple and WhatsApp (now owned by Facebook) have created is that they do not involve the companies holding any decryption keys.
So when the cops come armed with a warrant, corporate executives are, regretfully, “unable to help”. This represents both shrewd corporate strategy and political astuteness: it means that they can give the same reply to the Chinese or Russian governments as they do to the American or British authorities.
The WhatsApp decision is significant but it’s not the end of the story because we’re into an arms race that will never end. For one thing, the online world isn’t really going to “go dark”, as the Harvard Berkman Center made clear in February in an excellent report.
For another, while your WhatsApp messages may be secure when they’re in transit, it won’t do you any good if your phone has already been covertly compromised.
Which is why it’s interesting that the only major new power sought by the security services in the investigatory powers bill now going through parliament comes under the heading of “equipment interference”. The spooks have clearly been listening to Willie John McBride, the Irish rugby forward who famously believed in “getting your retaliation in first”.