Anlasslose Massenüberwachung: Es muss nur ein Wort gestrichen werden, um die britische Chatkontrolle zu entschärfen

Über 80 zivilgesellschaftliche Organisationen, Wissenschaftlerinnen und Internetexperten aus 23 Ländern haben sich in einem offenen Brief an die britische Regierung gewandt, um die Befugnisse im Online Safety Bill zu kritisieren. Dieses Gesetzesvorhaben ist das britische Äquivalent zur EU-Plänen für die Chatkontrolle. Es sieht vor, dass auch verschlüsselte Messaging-Apps wie WhatsApp und Signal die Inhalte ihrer Nutzer:innen nach Darstellungen sexualisierter Gewalt und sogenannter Kinderpornografie scannen müssen.

Im offenen Brief heißt es, dass die Online Safety Bill ein „äußerst beunruhigender Gesetzesvorschlag“ sei:

Wenn er in seiner jetzigen Form verabschiedet wird, könnte das Vereinigte Königreich die erste liberale Demokratie werden, die das routinemäßige Scannen privater Chat-Nachrichten vorschreibt, einschließlich Chats, die durch eine Ende-zu-Ende-Verschlüsselung gesichert sind. Da mehr als 40 Millionen britische Bürger und 2 Milliarden Menschen weltweit auf diese Dienste angewiesen sind, stellt dies ein erhebliches Risiko für die Sicherheit digitaler Kommunikationsdienste nicht nur im Vereinigten Königreich, sondern auch international dar.

Die Unterzeichnenden fordern deswegen, dass Ende-zu-Ende-verschlüsselte Dienste aus dem Anwendungsbereich des Gesetzentwurfs herausgenommen werden und die Privatsphäre der vertraulichen Kommunikation der Menschen gewahrt bleibt.

Laut Monica Horten von der Open Rights Group bedarf es nur der Streichung eines Wortes im geplanten Gesetz. Die Abgeordneten hätten die Möglichkeit das Gesetz zu entschärfen, indem sie einen Änderungsantrag zur Streichung des Wortes „privat“ aus dem Gesetz zur Online-Sicherheit annehmen: „Wir bitten die Abgeordneten eindringlich, diesen Änderungsantrag zu unterstützen und Nein zu sagen zu einer staatlich verordneten Überwachung privater Chats“, so Horten weiter. Der umstrittene Online Safety Bill findet sich in den letzten Metern des Gesetzgebungsprozesses, demnächst ist die dritte Lesung im britischen Oberhaus, das Unterhaus hat schon zugestimmt.

Tech-Industrie geschlossen gegen Gesetzentwurf

In der Vergangenheit haben einzelne Messenger-Anbieter aufgezeigt, wie sie auf das Gesetz reagieren werden. So will Threema es auf einen Rausschmiss ankommen lassen, und WhatsApp hatte einen Rückzug aus Großbritannien ins Spiel gebracht. Im April hatten sich die verschlüsselten Messenger Element, Signal, Threema, Viber, WhatsApp, Wire und Session in einem offenen Brief gemeinsam gegen die Online Safety Bill gestellt.

Nun hat sich auch Apple gegen den Gesetzentwurf ausgesprochen. In einer Erklärung sagte der Konzern laut der BBC: „Die Ende-zu-Ende-Verschlüsselung ist wichtig, um die Privatsphäre von Journalist:innen, Menschenrechtsaktivist:innen und Diplomat:innen zu schützen.“ Weiter heißt es: „Sie hilft auch normalen Bürger:innen, sich vor Überwachung, Identitätsdiebstahl, Betrug und Datenschutzverletzungen zu schützen.“ Der Online Safety Bill stelle eine ernsthafte Bedrohung für diesen Schutz dar. Apple fordert deswegen die Regierung auf, den Gesetzentwurf zu ändern, um eine starke Ende-zu-Ende-Verschlüsselung zum Nutzen aller zu schützen.

Hier der offene Brief im Volltext

• Datum: 26.6.2023

To: Chloe Smith, Secretary of State, Department for Science, Innovation and Technology
cc: Tom Tugendhat, Minister of State for Security, Home Office
Paul Scully, Minister for Tech and the Digital Economy
Lord Parkinson of Whitley Bay

Dear Ms Smith,

We are over 80 national and international civil society organisations, academics and cyberexperts. We represent a wide range of perspectives including digital human rights and technology.

We are writing to you to raise our concerns about the serious threat to the security of private and encrypted messaging posed by the UK’s proposed Online Safety Bill (OSB).

The Online Safety Bill is a deeply troubling legislative proposal. If passed in its present form, the UK could become the first liberal democracy to require the routine scanning of people’s private chat messages, including chats that are secured by end-to-end encryption. As over 40 million UK citizens and 2 billion people worldwide rely on these services, this poses a significant risk to the security of digital communication services not only in the UK, but also internationally.

End-to-end encryption ensures the security of communications for everyone on a network. It is designed so that no-one, including the platform provider, can read or alter the messages. The confidentiality between sender and recipient is completely preserved. That’s why the United Nations, several human rights groups, and anti-human trafficking organisations alike have emphasised that encryption is a vital human rights tool.

In order to comply with the Online Safety Bill, platform providers would have to break that protection either by removing it or by developing work-arounds. Any form of work-around risks compromising the security of the messaging platform, creating back-doors, and other dangerous ways and means for malicious actors and hostile states to corrupt the system. This would put all users in danger.

The UK government has indicated its intention for providers to use a technology that would scan chats on people’s phone and devices – known as client-side scanning. The UK government’s assertion that client-side scanning will not compromise the privacy of messages contradicts the significant evidence of cyber-security experts around the world. This software intercepts chat messages before they are encrypted, and as the user is uploading their images or text, and therefore confidentiality of messages cannot be guaranteed. It would most likely breach human rights law in the UK and internationally.

Serious concerns have also been raised about similar provisions in the EU’s proposed ‘Child Sexual Abuse Regulation’, which an independent expert study warns is in contradiction to human rights rules. French, Irish and Austrian parliamentarians have all also warned of severe threats to human rights and of undermining encryption.

Moreover, the scanning software would have to be pre-installed on people’s phones, without their permission or full awareness of the severe privacy and security implications. The underlying databases can be corrupted by hostile actors, meaning that individual phones would become vulnerable to attack. The breadth of the measures proposed in the Online Safety Bill – which would infringe the rights to privacy to the same extent for the internet’s majority of legitimate law-abiding users as it would for potential criminals – means that the measures cannot be considered either necessary or proportionate.

The inconvenient truth is that it is not possible to scan messages for bad things without infringing on the privacy of lawful messages. It is not possible to create a backdoor that only works for “good people” and that cannot be exploited by “bad people”.

Privacy and free expression rights are vital for all citizens everywhere, in every country, to do their jobs, raise their voices, and hold power to account without arbitrary intrusion, persecution or repression. End-to-end encryption provides vital security that allows them to do that without arbitrary interference. People in conflict zones who rely on secure encrypted communications to be able to speak safely to friends and family as well as for national security. Journalists around the world who rely on the confidential channels of encrypted chat, can communicate to sources and upload their stories in safety.

Children, too, need these rights, as emphasised by UNICEF based on the UN Convention of the Rights of the Child. Child safety and privacy are not mutually exclusive; they are mutually reinforcing. Indeed, children are less safe without encrypted communications, as they equally rely on secure digital experiences free from their data being harvested or conversations intercepted. Online content scanning alone cannot hope to fish out the serious cases of exploitation, which require a whole-of-society approach. The UK government must invest in education, judicial reform, social services, law enforcement and other critical resources to prevent abuse before it can reach the point of online dissemination, thereby prioritising harm prevention over retrospective scanning.

As an international community, we are deeply concerned that the UK will become the weak link in the global system. The security risk will not be confined within UK borders. It is difficult to envisage how such a destructive step for the security of billions of users could be justified.

The UK Prime Minister, Rishi Sunak, has said that the UK will maintain freedom, peace and security around the world. With that in mind, we urge you to ensure that end-to-end encrypted services will be removed from the scope of the Bill and that the privacy of people’s confidential communications will be upheld.

Signed,

Access Now
ARTICLE 19: Global Campaign for Free Expression
Asociația pentru Tehnologie și Internet (ApTI)
Associação Portuguesa para a Promoção da Segurança da Informação (AP2SI)
Association for Progressive Communications (APC)
Big Brother Watch
Centre for Democracy and Technology
Chaos Computer Club (CCC)
Citizen D / Državljan D
Collaboration on International ICT Policy for East and Southern Africa (CIPESA)
Community NeHUBs Africa
cyberstorm.mu
Defend Digital Me
CASM at Demos
Digitalcourage
Digitale Gesellschaft
DNS Africa Media and Communications
Electronic Frontier Finland
Electronic Frontier Foundation (EFF)
Electronic Frontier Norway
Epicenter.works
European Center for Not-for-Profit Law
European Digital Rights (EDRi)
European Sex Workers Rights Association (ESWA)
Fair Vote
Fight for the Future
Foundation for Information Policy Research
Fundación Cibervoluntarios
Global Partners Digital
Granitt
Hermes Center for Transparency and Digital Human Rights
Homo Digitalis
Ikigai Innovation Initiative
Internet Society
Interpeer gUG
ISOC Brazil – Brazilian Chapter of the Internet Society
ISOC Ghana
ISOC India Hyderabad Chapter
ISOC Venezuela
IT-Pol
JCA-Net (Japan)
Kijiji Yeetu
La Quadrature du Net
Liberty
McEvedys Solicitors and Attorneys Ltd
Open Rights Group
OpenMedia
OPTF
Privacy and Access Council of Canada
Privacy International
Ranking Digital Rights
Statewatch
SUPERRR Lab
Tech for Good Asia
UBUNTEAM
Wikimedia Foundation
Wikimedia UK

Professor Paul Bernal
Nicholas Bohm
Dr Duncan Campbell
Alan Cox
Ray Corrigan
Professor Angela Daly
Dr Erin Ferguson
Wendy M. Grossman
Dr Edina Harbinja
Dr Julian Huppert
Steve Karmeinsky
Dr Konstantinos Komaitis
Professor Douwe Korff
Petr Kučera
Mark A. Lane
Christian de Larrinaga
Mark Lizar
Dr Brenda McPhail
Alec Muffett
Riana Pferfferkorn
Simon Phipps
Dr Birgit Schippers
Peter Wells
Professor Alan Woodward