EU to Pursue Backdoors in Encrypted Apps for Law Enforcement Access

News Analysis

The European Commission’s plans, announced in April, would require encrypted messaging platforms like Signal, Telegram, and WhatsApp to create a digital backdoor for law enforcement, allowing them to access secure communications.

These proposals raise significant concerns about government surveillance, with some analysts warning that such measures could inadvertently aid criminals by creating vulnerabilities to sensitive personal data.

The Commission emphasized the need for “lawful access to data,” which entails allowing backdoor access to encrypted applications and other end-to-end encryption tools.

Andy Jenkinson, a fellow at the Cyber Theory Institute, remarked that introducing backdoor encryption without enhancing government server security “is not only careless; it invites catastrophe.”

Related Stories

“The ethical, legal, and security ramifications of such actions will have lasting impacts well beyond their intended audience,” he conveyed to The Epoch Times.

Jenkinson, who authored “Stuxnet to Sunburst: 20 Years of Digital Exploitation and Cyber Warfare,” identified two primary concerns: first, that cybercriminals might find ways to exploit the backdoor to gain access to encrypted applications; and second, they could capture data transmitted to various government-operated servers worldwide, which he noted are often insecure.

The French government has recently attempted to introduce backdoors for encryption.

“Once implemented, a backdoor can be exploited by various parties—from foreign agents to hackers. Consequently, the private messages of all law-abiding citizens could be compromised,” Durov remarked. “For this reason, as I’ve previously stated, Telegram would prefer to exit a market rather than compromise encryption with backdoors and violate fundamental human rights. Unlike some competitors, we do not exchange privacy for market share.”

“However, the debate is ongoing, and until we receive affirming statements from lawmakers and law enforcement officials globally, we must continue advocating this point: backdoors are detrimental not just for individuals, but also for governments and businesses.”

After the dismantling of Phantom Secure, the FBI created its own encrypted app, AN0M, and sold it to unsuspecting criminals.

“Deploying a fishing net like this in the Netherlands or Germany would be unlawful,” Reisinger stated. “They need justification against a particular individual, based on reasonable suspicion that they are committing sufficiently serious offenses to warrant such invasive investigative actions, which is akin to hacking into someone’s phone.”

Reisinger explained that all EU member states have diverse laws; while law enforcement can obtain a warrant to intercept or seize the data of individuals within their jurisdiction, they cannot do so for those outside it.

“To target Dutch citizens, a Dutch judge must authorize it according to domestic laws, safeguarding individuals’ rights,” he clarified.

For U.S. citizens, such extensive data collection for evidence may infringe upon the Fourth Amendment, prohibiting “unreasonable searches and seizures” absent probable cause, as well as the Fifth Amendment ensuring “due process.”

The European Convention on Human Rights seeks to protect individuals; Article Six guarantees a fair trial while Article Eight upholds, “Everyone has the right to respect for their private and family life, their home, and their correspondence.”

In 2024, Reisinger filed multiple appeals concerning EncroChat and Sky ECC to the European Court of Justice in Luxembourg, which pertains to EU nations, and the European Court of Human Rights (ECHR) in Strasbourg, which includes the UK and other non-EU countries.

Reisinger noted that they contend French authorities “violated privacy rights by collecting all personal communications and associated data without justification” when accessing EncroChat and Sky ECC.

“More importantly, if law enforcement intends to use this kind of data as the primary or sole incriminating evidence in criminal cases, the right to a fair trial necessitates that claims regarding potential illegality or unreliability of evidence be verified by a judge,” Reisinger added.

He mentioned that ECHR decisions typically take four to five years, implying a resolution might not arrive until 2028 or 2029.

The Commission affirmed, “These measures safeguard strong encryption and in no way prohibit, limit, or weaken encryption (‘no backdoors’).”

The report stated that as digitalization continues to expand, providing an increasing array of new tools for criminals, establishing a data access framework that responds to the needs of law enforcement while upholding our values is imperative.

The ProtectEU document also noted that the Commission plans to introduce a roadmap in the first half of 2025 outlining “the legal and practical measures it intends to undertake to enable lawful and effective data access.”

It was indicated that the Commission would produce a “technology roadmap on encryption,” aimed at discovering and evaluating solutions that would permit law enforcement to access encrypted data “lawfully while ensuring cybersecurity and fundamental rights.”

Jenkinson remarked that governments often neglect to secure their own critical infrastructure.

“Prior to mandating the compromise of civilian privacy, the European Commission and its allies must address their systemic vulnerabilities,” Jenkinson stated. “The European Commission’s recent drive to implement backdoors in encrypted messaging reflects a perilous trend paralleled by U.S. authorities—one that has already led to systemic failures and a global increase in cybercrime.”