The Encryption Paradox: Fostering Security by Threatening Security

Abstract

The debate on encryption has become more and more heated in the last few years. The resurgence is mainly linked to the recent advent of two factors: on the one hand, endpoint encryption is increasingly becoming the default setting on every device. While, on the other, Internet Service Providers have started to broadly offer end-to-end encryption services. So, if data is now strongly encrypted and protected both in transit and at rest, it is law enforcement and intelligence agencies that pay the price by being unable to access the content of numerous communications. This problem has been named by the US government "going dark" as it compromises investigations and surveillance activities by creating sudden "black holes" of pivotal information. Although the proliferation of encryption can often represent a major hurdle for law enforcement, it is justified on the Internet by its inherent insecurity as a dense network of nodes where packets of information are transmitted uninterruptedly. Indeed, the Internet infrastructure rests the foundation of its success on the possibility of encrypting information so that it cannot be accessed by malicious actors. Hence, encryption "weakened" by the presence of backdoors (required by the government) to access data in cases of national security protection would alter an otherwise ironclad mechanism. And so, it will undermine the security of global cyber trafficking and, consequently, of (digital) human rights such as freedom of expression and information, the protection of personal data, and even the smooth functioning of the online market. This article aims to seek a solution that can reconcile the - seemingly - opposing demands at stake: the national and collective security as opposed to the security of Internet architecture - and the entire ecosystem of rights exercised within it. In conclusion, it will be argued that it is not feasible to reduce the overall level of communication privacy to protect collective security, as a further erosion of communication privacy would result in a substantial violation of individual freedom