SAN FRANCISCO – The Apple-FBI fight may just be the opening salvo in a broader war over encryption, as technology companies continue to lock up their users’ messages, photos and other data to shield them from thieves and spies — and, incidentally, criminal investigators.
WhatsApp, the globally popular messaging system owned by Facebook, has already run into trouble on this front in Brazil. WhatsApp encrypts all user messages in “end to end” fashion, meaning that no one but the sender and recipient can read them. Brazilian authorities arrested a Facebook executive earlier this month after the company said it couldn’t unscramble encrypted messages sought by police.
U.S. officials are debating how to enforce a similar wiretap order for WhatsApp communications in a U.S. criminal case, the New York Times reported . WhatsApp started as a way to exchange written messages over the Internet, but it has added services like photo-sharing and voice calling, while gradually building encryption into all those formats.
Spokesmen for WhatsApp and the Justice Department declined comment on the Times report, which said the wiretap order had been sealed to keep details secret. The Brazilian case is still pending, although the Facebook executive was released from jail after a day.
For now, U.S. authorities and the tech industry are watching for the outcome of Apple’s legal battle against the FBI, which wants to force the company to help unlock an encrypted iPhone used by one of the San Bernardino mass shooters. But as more companies explore adding encryption, further confrontations are likely.
“I think we can say, without a doubt, there’s going to be more pressure on app-makers now,” said Nate Cardozo, staff attorney at the Electronic Frontier Foundation.
Cardozo said he’s aware of other recent cases in which U.S. authorities have approached individual companies that use encryption and warned them that criminals or terrorists are using their services. Cardozo declined to name the companies, but said authorities have urged those companies to “try harder” — by redesigning their apps or providing other technical solutions that would let agents read the encrypted messages.
Tech companies say they don’t want to interfere with legitimate criminal investigations or national security matters. Instead, they argue they’re concerned about criminal hacking, privacy invasion and violations of civil rights.
“It’s the government’s job to protect public safety,” said Denelle Dixon-Thayer, chief legal and business officer at Mozilla, which makes the Firefox Web browser. “Our job in the tech sector is to support that goal by providing the best data security.”
While law enforcement authorities have chafed at tech companies’ use of encryption, national security officials have warned against weakening encryption. “We’re foursquare behind strong data security and encryption,” Defense Secretary Ash Carter told a tech audience this month. He drew applause when he added, “I’m not a believer in back doors or a single technical approach to what is a complex problem.”
Tech-industry encryption efforts expanded following 2013 disclosures by former National Security Agency contractor Edward Snowden that showed extensive government collection of Internet users’ data. The resulting controversy helped spur companies like Apple, Google, Facebook and Yahoo to step up their security efforts, although the companies say they already had those plans in the works.
“There was a fundamental shift in relationships after the Snowden revelations,” said Ed McAndrew, a former federal prosecutor now practicing law in Philadelphia, who said he has worked extensively with those companies on cybercrime investigations over the last decade. The companies felt “burned,” he said, “so they decided to improve the privacy of their products.”
WhatsApp, which boasts a billion users around the globe, first added encryption for its Android smartphone app in 2014. It’s been gradually incorporating similar protections into other services, including messages sent on iPhones and even some voice calls. Founder Jan Koum traces his concerns about data-security stem to his parents’ fear of government agents listening to phone calls in their native Ukraine.
While Apple uses similar end-to-end encryption for its iMessage service, some other leading messaging and email services do not. Google uses encryption extensively to foil outsiders who might try to read users’ data, but in many cases the company can access the data itself — and will turn it over to authorities when presented with legal orders.
Some newer messaging services, including Signal and Wickr, use end-to-end encryption. So does Telegram, which recently announced it has 100 million users around the world. The year-old messaging app Wire said this month that it’s adding similar protection for video communications.
More companies may follow suit as a result of the high-profile iPhone dispute, said Mozilla’s Dixon-Thayer. The controversy has raised public awareness of encryption, she said. “We might see even more demand from users.”
BRANDON BAILEY
