As one commenter put it, "Here we go again".

There's something up with the so-called "Intelligence Community" that convinces them that there is a technical solution to the social and political problem that exercises them the most these days.

And, what is that problem?

It's that people talk to each other, and often¹ want to do so in private.

In a Statement of Principles on Access to Evidence and Encryption, the 5-eyes partnership – the U.S.A., the U.K., Australia, New Zealand and Canada, working together to share all the "signals" (a.k.a. internet) data they capture – have again stated that internet service providers must "assist authorities to lawfully access data, including the content of communications" if the law requires it.

This is all fine, but given the history of the requirement, and the ways it has been stated over the years, it's clear that this is code for their belief that the service providers must only provide encrypted communications that law enforcement and other security types can spy on². It has been pointed out countless times by people far more informed than I that what they seek just can't be provided safely.

I am firmly of the belief that this requirement is effectively impossible, and attempts to put it in place will ultimately harm innocent people.

Here's a little experiment…

Social Gibiris is an instance of the microblogging system called GNU Social. I operate that instance. Social Gibiris is a node in a federated group of similar systems that might be as large as thousands – or maybe tens of thousands – of nodes.

These federated nodes use internationally-agreed information-sharing protocols so that a post on one node is made available to users on another if they wish it. Not all of these nodes, or computers, run GNU Social. Other alternatives that speak the same information-sharing protocols include Pleroma, Mastodon, postActiv and many other software packages. However, they can all shares messages with each other, and no one organisation or entity is in control of this environment.

As the information-sharing protocol is freely available, anyone can write a new system that can be plugged into the federation of nodes, and – if that person chooses to do so – the code for that new system can be shared with anyone else for them to create their own node.

At present, GNU Social, which Social Gibiris uses, doesn't support end-to-end encryption of messages. Therefore, the 5-eyes group of nations doesn't have to worry about trying to crack those messages – they're there for all to see.

But, I have posted an encrypted message on my own instance. Only one person can read the decrypted message, and I'm not saying who that is. That person doesn't even know that the message is there. It's not important.

That message is now available on other micro-blogging nodes that mine is federated with. By my act of posting it on my instance, Highland Arrow has it, so has social.heckin.tech, it's on gnusocial.net and – while it's still in existence – it's on Quitter.no³. Heck, it's even accessible on twitter! The one person who can decrypt that message can do so by retrieving it from anywhere it has been federated to (except twitter, which doesn't support messages longer than 280 characters, and mine is longer than that).

What is important is that I posted an encrypted message to my micro-blogging system that doesn't support encryption, and the 5-eyes countries can't do anything about it.

Or… can they?

If the answer to any of the following questions is No, then it's unlikely that they can.

1. Can the 5-eyes countries break the encryption method I used to encrypt that message (PGP)?
2. Can they break the other encryption methods that are currently considered "strong"?
3. Can the 5-eyes countries criminalise the use of that encryption method, or any other encryption method that they can't break?
4. Can they force all the other countries in the world to follow along with such a criminalisation?
5. Can the 5-eyes countries really force all the large, global internet platforms to use weakened encryption for the messaging services they offer their users?
6. If they were successful in forcing all the large, global internet platforms to use weakened encryption, can they force all the world's internet users to use only those platforms?
7. Can they prevent users of these large, global internet platforms from first encrypting their messages themselves using strong encryption (i.e. just like I did with my encrypted message on Social Gibiris)?
8. Can the 5-eyes countries stop small software development communities from developing alternatives (e.g. GNU Social, postActiv, etc.) to the weakened systems operated by the large global platforms?
9. Can the 5-eyes countries stop small software development communities from developing alternative encryption methods in the event that the currently-strong methods become weak (e.g. by some new methods being developed to defeat them)?
10. Can the 5-eyes countries genuinely prevent all forms of secret communication, known now, or yet to be invented, from being used by all 7.5+ billion people in the world?

To that last question, I have two non-Yes/No follow up questions: How much would that cost? Do we really think it would be worth it?

One of the regular arguments against letting governments "legally" spy on encrypted messages is that once that has been facilitated for governments we like, it will also be facilitated for governments we don't like (and also for other bad actors like, for example, organised crime gangs that want to see our banking transactions). The reasoning here is that just like a car, or a screw-driver, or a shoe, an encryption method knows nothing about the intention of its user, and once it's weak, it's weak for all users; good, bad or indifferent.

However, that's not my point these days, even though I've made it in the past, and even though I believe it to be compelling. My point these days is that all this effort WILL NOT RESULT IN WHAT THE 5-EYES COUNTRIES PRETEND THEY WANT.

And I think that's more compelling.

But, what do I know? If you can refer me to a good analysis that suggests I'm wrong, please do so. I can be contacted at @eibhear@social.gibiris.org, @eibhear@twitter.com or at my e-mail address, which can be seen at the bottom of this web page. I would genuinely love to hear what there is out there that might prove me wrong.

---