Edward Snowden’s leaks from NSA and Five Eyes surveillance programs three years ago reverberate today in European Union demands for total privacy in daily communications. If they become privacy regulations which US companies doing business with Europeans must obey, compliance could violate US law. Keeping up with privacy developments on both sides of the Atlantic is challenging, but it’s the only way to make good decisions on encrypting company communications and records.
The European Data Protection Supervisor is the EU’s privacy czar for now. He issued a preliminary opinion last month on ePrivacy Directive regulations. There may not be a final opinion because the Directive will be replaced in May 2018 by the General Data Protection Regulation (GDPR). Since the privacy czar is a lame duck and the Directive will be gone before you know it, some see the preliminary opinion as lobbying out in the open for new GDPR regulations.
The privacy czar is not a lone EU voice. His encryption recommendations are supported by the Article 29 Working Party (WP29) made up of data protection representatives of every EU member state. The recommendations are rigid:
• End-to-end encryption
• No back-doors
• Encryption and communication service providers, and “all other organizations” prohibited from allowing or facilitating back-doors.
• Decryption, reverse engineering, and communication monitoring prohibited by law
End-to-end encryption allows only the communicating parties to read messages. Every other player in the communication process must be prevented from getting the keys to unlock the conversation. Encryption must be designed to be tamper-proof and surveillance-proof.
Here, courts have ordered Apple about a dozen times to unlock cryptographic protection of iPhones. The most famous case this year involved a San Bernardino terrorist’s phone. Total privacy advocates cheered when the court rebuked the government for a “far-reaching” request. But the ruling lost its purpose and the case ended a short time later when the FBI said it unlocked the phone with third party help.
The most successful US legislative proposal of the moment ignores the subject. The Email Privacy Act proposed in 2015 was approved by a House vote of 419 to 0. If it becomes law it will close a legal loophole allowing authorities to get data more than 180 days old without a court order.
The bill eliminates any question whether electronic communication devices are “effects” protected by the Fourth Amendment’s “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.” It requires search warrants to obtain online communications or data stored in the cloud.
But while the bill is silent on encryption, US search warrants deal with it head-on. The Justice Department’s warrant form says “For any computer hard drive or other electronic media…(b) … encryption keys.” Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ssmanual2009.pdf .
The EU privacy czar and WP29 would prevent any and all searches and surveillance of encrypted communications. US law grounded on the Fourth Amendment’s protection allows search warrants based on “probable cause.” This is qualified privacy protection, not absolute.
When the US encourages and rewards encryption such as with the HIPAA Security Rule on personal health information in place more than a decade, it also recognizes the encrypted information can be required by court order and warrants.
As the US and EU head toward a showdown, encryption is looking like the new killer app. WhatsApp launched end-to-end encryption for about a billion users in April. Viber did the same for 700 million users. Facebook knows firsthand how serious the EU is about privacy and is now beta testing “Secret Conversations.”
If you are shopping for encryption solutions, you need to know if the vendor is offering virtually warrant-proof encryption or if they have back doors or decryption software. Whatever you decide in light of the conflict between US law and EU proposals, please remember that even warrant proof encryption is no safer than the security of your company’s devices and your employee’s alertness.
Devices can be hacked and the cryptographic keys stolen. And everyday spear phishing can give wrongdoers the ability to read decrypted messages.
This communication, a service of Bose McKinney & Evans LLP, exists for informational purposes only and none of its contents should be construed or used as legal advice on any specific facts or circumstances. Your receipt or transmission of information does not create an attorney-client relationship and cannot substitute for obtaining legal counsel from an attorney admitted to practice law in your state.
Bose McKinney & Evans LLP is headquartered at 111 Monument Circle, Suite 2700, Indianapolis, Indiana 46204, with an office located at 200 East Main Street, Suite 536, Fort Wayne, Indiana 46802 and one in located at 2000 M Street, N.W., Suite 520, Washington, DC 20036. © Bose McKinney & Evans LLP 2016. All Rights Reserved