Encryption creating a barrier for police, documents suggest

OTTAWA—The growing popularity of programs that protect online privacy is creating a barrier for police and security agencies ability to intercept and use data, documents obtained by the Star suggest.
Public Safety officials warned Minister Ralph Goodale in November that encryption — the ability to mask communications so only the intended recipients can makes sense of the message — is hindering their ability to use online communications in investigations.
“Canadians are increasingly using mobile phone networks, the Internet, and other electronic means to communicate and execute transactions with each other,” the documents, heavily censored and stamped “secret,” read.
“This has led to a significant gap between the technologies available for criminal exploitation and our means to enforce Canada’s laws and keep Canadians safe.”
Once a fringe set of complicated tools, encryption technology has become more and more mainstream, particularly after the disclosures of NSA whistleblower Edward Snowden. Journalists use encrypted emails to protect sources, businesses use encryption to protect their customers’ transactions, and governments use encryption to try and protect sensitive information.
Because a number of companies have moved to encryption by default, plenty of Canadians are using encrypted messaging without even knowing it. If you’ve sent a text on your iPhone, you’ve used encryption.
Despite perfectly legal and appropriate uses, however, law enforcement has generally focused the encryption debate on the perceived advantages the technology gives to criminals to plot or cover their tracks.
The Star requested an interview with Goodale to discuss these issues, but the minister was unavailable over the past two weeks. His office noted that the minister recently addressed the encryption debate in a speech at the University of Regina.
“We need a thoughtful discussion about the legal framework that applies to new technologies. On the issue of encryption, for example, is absolute privacy the only ‘public good’ that needs to be safeguarded, or is there a point at which criminal or terrorist investigations should be properly and lawfully assisted?” the minister’s prepared remarks read.
“And if so, where?”
Officials also flagged a number of other issues to Goodale in the documents, including data retention. Canada does not have an overarching law that requires companies to retain data for a certain period, meaning evidence sought by police could already be gone by the time they get around to asking for it.
The fact that many companies keep their data on foreign servers presents jurisdictional challenges. And a recent Supreme Court decision requiring police to obtain a warrant for users’ “basic subscriber information” — things like address, Internet Protocol address, or phone numbers — have led to police complaints about increased paperwork.
“The issues outlined above are multi-faceted and inherently complex,” the documents note.
“While it is possible to consider each issue separately, any solution would need to look to all issues collectively. . . To date, some work has been done to develop and advance solutions to address the issues highlighted above, however certain solutions are much more advanced than others.”
Christopher Parsons, a researcher with Citizen Lab at the University of Toronto, suggested that there’s little the government can do to prevent encryption in an age where every iPhone or WhatsApp message provides a high level of security.
“I think that really where the government has to explain things is, (for one) how could it possibly compel third parties who operate outside of the country and have invested so much on privacy and security, what are they going to do? I guess they can try to block Apple and iMessage, but that’s not going to work,” Parsons said in an interview Friday.
“And, moreover, people are gaining an appreciation slowly what encryption means. So it means that if you’re using (messaging client) WhatsApp, it’s actually pretty secure now to send your credit card information. . . You can send a password securely. These aren’t bad things.”
Parsons also questioned framing the encryption debate around criminals and terrorists, rather than ordinary folks trying to protect their privacy.
“The majority of communications that are conducted using encryption are going to be fully lawful. So that means that there’s an immediate proportionality issue,” Parsons said.
“When we start framing things as we need access to the content to catch the bad guys, it really depends on what we’re trying to do. . . I’m inherently suspicious.”