Sign in Subscribe
By Audrey Hingle —

It was the best of intentions, it was the worst of implementations

It was the best of intentions, it was the worst of implementations
Photo by Geranimo / Unsplash

This week in our main story, Heather Burns explores the unfolding drama of two distinct Technical Capability Notices (TCNs) from the UK government.

But first...

Can the Feds get my data? | ¿Puede el gobierno federal acceder a mis datos?

Since Trump began his second term, organizations, activists, and individuals involved in digital rights, data privacy, and technology advocacy have all been scrambling to secure every aspect of their digital work. But what exactly is at risk? What kind of requests for data should you anticipate receiving? Does moving servers to another country make any difference? How should you prepare?

A new webinar from May First, the Electronic Frontier Foundation and the Progressive Technology Project will de-mystify the hype, cut through the fear and tell real stories from the past and present. They will be sharing actual subpoenas and search warrants served on May First, discuss what they did in response and what made their lives harder and easier. In addition, you will hear from the Electronic Frontier Foundation about how these legal instruments (and others) work and what steps you can take now to defend yourselves.

When: Wednesday, April 30th, 9:30 AM PT/10:30 AM Mexico City/11:30 am Chicago/ 12:30 pm New York.

Register

Support the Internet Exchange

If you find our emails useful, consider becoming a paid subscriber! You'll get access to our members-only Signal community where we share ideas, discuss upcoming topics, and exchange links. Paid subscribers can also leave comments on posts and enjoy a warm, fuzzy feeling.

Not ready for a long-term commitment? You can always leave us a tip.

Become A Paid Subscriber

Internet Governance

Digital Rights

Technology for Society

Privacy and Security

Upcoming Events

Careers and Opportunities

What did we miss? Please send us a reply or write to editor@exchangepoint.tech.

💡
Want to see some of our week's links in advance? Follow us on Mastodon, Bluesky or LinkedIn.

A Tale of Two TCNs

By Heather Burns

You are probably aware of the international backlash caused by the UK Home Office’s secret issuance of a Technical Capability Notice (TCN) to Apple. The notice was issued under Section 253 of the Investigatory Powers Act (IPA), a surveillance law that allows the UK government to compel companies to make their systems accessible to law enforcement authorities, which in this case sought to weaken core security features on Apple devices. You might also be aware that UK government agencies do not have a good track record of handling the data they acquire, as demonstrated by the recent ruling from the Investigatory Powers Tribunal, which confirmed that UK agencies like MI5 have unlawfully mishandled personal data. What you may not be aware of is that there is a second, separate TCN regime quietly in the works in the UK, one which poses equally worrisome threats to encryption.

Ofcom, the UK’s telecommunications and online safety regulator, recently held a public consultation on its own Technology Notices regime, introduced under Section 121 of the Online Safety Act (OSA). This provision, which attracted significant controversy in 2023 as the then-Bill wheezed towards the finish line after five years of contentious debate, could have compelled service providers to break end-to-end encryption (e2ee) in order to detect terrorist or child sexual exploitation and abuse (CSEA) content, “where necessary or proportionate”.

After heavy criticism from technologists, civil society and industry, the outcome of that debate was Ofcom’s caveat that “user to user services should only apply measures where it is technically feasible for them to do”, effectively an admission that these clauses were based in magical thinking rather than real-world technical feasibility.

The OSA TCN regime would require service providers to implement client-side scanning to detect CSAM or terrorist content, using hash-matching technology that compares user-generated content against known illegal material before it is encrypted or shared, but only on publicly communicated (e.g. unencrypted) content. Sections 4.29-4.32 of Ofcom’s draft guidance (unfortunately, Ofcom only communicates through massive, unwieldy PDFs) outlines its rationale for what counts as public vs. private communication content vis-à-vis the European Convention on Human Rights (ECHR) Article 8: the right to respect for private and family life, home, and correspondence. Despite Brexit, the UK remains a signatory to the ECHR and is still bound by European Court of Human Rights (ECtHR) rulings.

Clearly, Ofcom have been forced to do their homework. Their separate rationale on public versus private communications, issued as part of a different consultation and which I highly recommend reading in full, is the only legally feasible response to the ECtHR’s ruling in Podchasov v Russia, which reaffirmed strong protections for private encrypted communications and rejected bulk surveillance. Index on Censorship recently issued a strongly worded legal opinion reminding Ofcom of that fact. 

Ofcom’s consultation covered two key areas: one, what the minimum standards of accuracy should be for the technologies they plan to accredit, which technologists should study closely; and two, draft guidance on how Ofcom intends to issue technology notices. While the consultation has closed, all submitted responses have been posted to the same page.

Safeguards and oversight

How will the OSA TCN regime compare to the IPA regime? There is one clear improvement: notices will be announced publicly (reducing the need for whistleblowers to leak to The Washington Post). If and when Ofcom issues a TCN to a service provider, meaning a request to introduce scanning technology, it would appear on this page, updated annually. At this stage there is nothing to report, though the page is worth bookmarking.

For now, Ofcom can only note that “this part of the regime is not active and the Secretary of State cannot approve or publish any minimum standards of accuracy until they have received advice from Ofcom. Therefore, we have not yet been in a position to assess whether or not there is any technology which meets, or is in the process of development to meet, any such minimum standards of accuracy.”

So far, that transparency seems to be the only positive change. 

By contrast, the IPA regime, for all its flaws, includes several layers of oversight, including the Investigatory Powers Commissioner (currently the extremely capable Sir Brian Leveson), the IPCO, and judicial authorisation. The Ofcom TCN regime has none of those safeguards or judicial routes of appeal. Its implementation is at the discretion of Ofcom’s Chief Executive, currently Dame Melanie Dawes, whose governance of the Online Safety regime is led by public relations partnerships with the media. It is never a good sign when any regulatory regime is more driven by narrative storymaking and clickbait than by the rule of law and judicial safeguards.

As for external oversight, the IPA requires TCNs to be reviewed by a semi-secret government committee called the Technical Advisory Board. Incredibly, it took media inquiries in the aftermath of the Apple TCN for members of the TAB to learn that the Home Office had forgotten to renew their contracts. In contrast, Ofcom has opted to precede a TCN with a “report, from a skilled person, appointed by us.” Who is a “skilled person”?  Ofcom defines it as someone who appears to Ofcom to “have the skills necessary to prepare a report about matters relevant to those purposes.” To paraphrase Theresa May, “skilled person means skilled person.”

Similar to the IPA TCN regime, Ofcom intends to issue “warning notices” to providers before issuing the notice. At that time, the provider will be allowed to “make representations” to Ofcom.

Ofcom’s technology notices must be necessary, proportionate, and must also consider:

  1. the extent to which the use of the specified technology would or might result in interference with users’ right to freedom of expression within the law; and
  2. the level of risk of the use of the specified technology resulting in a breach of any statutory provision or rule of law concerning privacy that is relevant to the use or operation of the service (including, but not limited to, any such provision or rule concerning the processing of personal data).
  3. In the case of a notice relating to a user-to-user service (or to the user-to-user part of a combined service), the extent to which the use of the specified technology would or might:
    1. have an adverse impact on the availability of journalistic content on the service, or 
    2. result in a breach of the confidentiality of journalistic sources; and
    3. whether the use of any less intrusive measures than the specified technology would be likely to achieve a significant reduction in the amount of relevant content.
Ofcom’s chart for Process for exercising Technology Notice functions, taken from page 6 here)

Chekov’s gun

Given what we know about the IPA TCN regime, we must ask whether the intention of the Ofcom TCN is to use it as a pincer movement against encryption. There is, after all, precedent for two separate sets of domestic surveillance rules to be used in tandem in ways that violate Article 8 of the European Convention on Human Rights, as was established in Ekimdzhiev v Bulgaria. 

Ofcom’s OSA TCN regime does not explicitly mandate the breaking of end-to-end encryption. However, the Apple IPA TCN raises serious concerns that the government may intend to use that regime to accomplish the job for Ofcom, Article 8 be damned, aligning with Scott and Ó Floinn’s observation that the UK government’s ongoing strategies around encryption “may be intended to have the effect of weakening or undermining encryption in a less direct fashion”.

In its December 2024 consultation on the OSA TCN regime, Ofcom noted that “if law enforcement wants specific information about a specific individual, to intercept communications, or to obtain communications data, then they would still need to do so using powers under and in accordance with the Regulation of Investigatory Powers Act 2000 and Investigatory Powers Act 2016, as appropriate.”

One might wonder, “Why would Ofcom place the IPA on the table, if the intention is not to use it?” This is an admission that Ofcom knows that its TCN regime could facilitate a form of bulk surveillance through compromised encryption, one that the security services might find highly useful.

This conclusion seems further supported by the fact that Ofcom’s draft guidance on TCNs addresses all six of the tests set out in the Weber and Saravia v Germany Article 8 ruling: 

  1. the nature of the offences (CSAM and terrorism)
  2. a definition of the categories of people liable to have their communications intercepted (all users of the impacted service)
  3. a limit on the duration of interception (36 months)
  4. the procedure to be followed for examining, using and storing the data obtained (under consultation)
  5. the precautions to be taken when communicating the data to other parties (under consultation)
  6. and the circumstances in which intercepted data may or must be erased or destroyed (under consultation).

Ofcom also seems to have studied the ECtHR Big Brother v UK ruling which, despite addressing bulk national security surveillance as opposed to CSS hash matching, found its deficiencies:

  • that “bulk interception was not authorized by a body independent of the executive, but by the secretary of state
  • that categories of search terms defining the kinds of communications to be examined were not included in the warrant application
  • and that the use of specific identifiers, so called “subject selectors linked to an individual”, had not been authorized. Ofcom’s TCN consultation has addressed two out of three of these points.

Further clues appear in Ofcom’s joint statement with the Information Commissioner’s Office (ICO), which confirms that OSA compliance will involve extensive data collection, processing, and retention. This level of activity amounts to a bulk regime in itself. Index on Censorship commissioned a very pointed legal opinion on this matter during the Act’s traumatic birth, and the ECJ’s La Quadatre du Net ruling hints at the trouble ahead here.

In summary, Ofcom has taken pains to make its TCN regime reflect multiple ECtHR rulings on Article 8. Why would they do that if the intention is not to use the regime in ways which trigger Article 8 issues at scale, either independently or in tandem with the IPA? 

We now await Ofcom’s official response to its own consultation, and to see what the Apple IPA debacle has taught regulators about the public’s tolerance for compromised encryption disguised as safety regulation.

💡
Please forward and share!

Subscribe to Internet Exchange

Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe