Europe's Views on Encryption Could Spell Problems for US Tech Companies, Say Experts
As dominant providers in Europe, American technology companies fighting for strong encryption face significant pressure from France, Germany, the U.K. and others, where actions are being implemented to undermine encryption, a New America Open Technology Institute event Thursday was told.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
In the UK, OTI Director Kevin Bankston said there's a measure in the broad surveillance law called the Investigatory Powers Act that could potentially weaken encryption. After the U.K. election, in early June, officials could issue secret "technical capability notices" to companies demanding they maintain or develop capabilities to help with surveillance, he said. "There’s grave concern this vaguely drafted authority could be used ... to require back doors or rolling back of the encryption feature.”
France views U.S. tech companies as "imperialistic" in imposing their policy judgments, a view shared by some other European countries, said Bankston. The country recently passed a "fairly aggressive" version of a law with increasing penalties for companies that don't comply with government requests. France, he said, does have an existing "surveillance assistance authority" but it's unclear how far it reaches and likely wouldn't require redesign of an encrypted system.
Germany's interior minister has been "really aggressive" in undermining encryption, but Bankston said the broader German government is largely pro-encryption, amid a backdrop including NSA leaker Edward Snowden revealing the U.S. spied on Chancellor Angela Merkel. The government "doubled down" on hacking as a way to address data it needs, which is "arguably good in some ways," said Bankston. "Targeted hacking of bad guys’ devices is better than forced introduction of vulnerability into all our devices. But at the same time [it] raises a broad range of other privacy and human rights and accountability concerns.”
Not all European countries seek to weaken encryption. Access Now U.S. Policy Manager Amie Stepanovich said the Netherlands is the strongest supporter, issuing a "solid, good statement" that encryption shouldn't be undermined. Earlier this year, she said Italy proposed a draft bill on government hacking as an alternative to encryption. She said there's still a "gaping hole globally" for a leader to support strong encryption.
Bijan Madhani, public policy and regulatory counsel for the Computer & Communications Industry Association, said the industry's perspective is the same on both sides of the Atlantic. Effectiveness of U.S. companies in Europe is "diluted" because the EU allows its member states to act independently, so tech has to fight at several levels there.
The EU seemed to be at a turning point almost a year ago when Europol said encryption shouldn't be eroded, said Stepanovich. She had hoped policymakers could then debate government hacking, data localization and data retention issues, but instead the EU sent out questionnaires to member states about their perspectives on and experiences with encryption. Access Now learned most member states saw encryption as a hindrance to law enforcement investigations, she said.
Ashley Deeks, associate professor at the University of Virginia School of Law, likened the encryption debate to a "Rashomon problem" -- where things look very different depending on one's point of view -- with perspectives including human rights, law enforcement, intelligence, commercial and export control perspectives: “The form in which encryption questions percolate up is going to help dictate the outcome."