Shining A Light on the Encryptoin Debate: A Canadian Field Guide

106 Pages·2017·1.57 MB·English

SHINING A LIGHT
ON THE ENCRYPTION
DEBATE: A CANADIAN
FIELD GUIDE
JOINT RESEARCH PUBLICATION, MAY 2018
BY THE CITIZEN LAB AND THE CANADIAN
INTERNET POLICY & PUBLIC INTEREST CLINIC
LEX GILL

TAMIR ISRAEL
CHRISTOPHER PARSONS
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
This page has intentionally been lef blank.
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
COPYRIGHT
© 2018 Citizen Lab and the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic, “Shining a Light on the
Encryption Debate: A Canadian Field Guide,” by Lex Gill, Tamir Israel, and Christopher Parsons
Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike Licence)
Electronic version first published by Citizen Lab and the Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic in
2018. This work can be accessed through https://citizenlab.ca and https://cippic.ca.
Citizen Lab and the Canadian Internet Policy & Public Interest Clinic (CIPPIC) are collaborative research partners. Together, the
two groups engage in research that investigates the intersection of digital technologies, law, and human rights. This report is a
joint research publication.
Document Version: 1.1 (23 May 2018 — minor revisions)
The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix,
transform, and build on it, as long as you:
• give appropriate credit;
• indicate whether you made changes; and
• use and link to the same CC BY-SA 4.0 licence.
However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and
product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or
trademark rights require the rightsholder’s prior written agreement.
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
CITIZEN LAB, MUNK SCHOOL OF GLOBAL AFFAIRS
The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs, University of Toronto, focusing on
research, development, and high-level strategic policy and legal engagement at the intersection of information and
communication technologies, human rights, and global security.
Citizen Lab uses a “mixed methods” approach to research combining practices from political science, law, computer science, and
area studies. Its research includes investigating digital espionage against civil society, documenting Internet filtering and other
technologies and practices that impact freedom of expression online, analyzing privacy, security, and information controls of
popular applications, and examining transparency and accountability mechanisms relevant to the relationship between
corporations and state agencies regarding personal data and other surveillance activities.
CANADIAN INTERNET POLICY & PUBLIC INTEREST CLINIC
The Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic (CIPPIC) is a legal clinic based at the Centre for Law,
Technology & Society (CLTS) at the University of Ottawa, Faculty of Law. Its core mandate is to ensure that the public interest is
accounted for in decision-making on issues that arise at the intersection of law and technology. It has the additional mandate of
providing legal assistance to under-represented organizations and individuals on law and technology issues, as well as a teaching
mandate focused on providing law students practical training in a law and technology setting.
CIPPIC adopts a multi-lateral approach to advancing its mandate, which involves placing objective and comprehensive research
and argumentation before key political, regulatory and legal decision makers. It seeks to ensure a holistic approach to its analysis,
which integrates the socio-political, technical and legal dimensions of a particular policy problem. This regularly includes
providing expert testimony before parliamentary committees, participating in quasi-judicial regulatory proceedings, strategic
intervention at all levels of court and involvement in domestic and international Internet governance fora.
ABOUT THE AUTHORS
Lex Gill is a Citizen Lab Research Fellow. She has also served as the National Security Program Advocate to the Canadian Civil
Liberties Association, as a CIPPIC Google Policy Fellow and as a researcher to the Berkman Klein Center for Internet & Society at
Harvard University. She holds a B.C.L./LL.B. from McGill University’s Faculty of Law.
Tamir Israel is Staff Lawyer at the Samuelson-Glushko Canadian Internet Policy & Public Interest Clinic at the University of
Ottawa, Faculty of Law. He leads CIPPIC’s privacy, net neutrality, electronic surveillance and telecommunications regulation
activities and conducts research and advocacy on a range of other digital rights-related topics.
Christopher Parsons is currently a Research Associate at the Citizen Lab, in the Munk School of Global Affairs with the University
of Toronto as well as the Managing Director of the Telecom Transparency Project at the Citizen Lab. He received his Bachelor’s
and Master’s degrees from the University of Guelph, and his Ph.D from the University of Victoria.
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
ACKNOWLEDGEMENTS
The authors would like to extend their deepest gratitude to a number of individuals who have provided support and feedback in
the production of this report, including (in alphabetical order) Bram Abramson, Nate Cardozo, Masashi Crete-Nishihata, Ron
Deibert, Mickael E.B., Andrew Hilts, Jeffrey Knockel, Adam Molnar, Christopher Prince, Tina Salameh, Amie Stepanovich, and Mari
Jing Zhou. Any errors remain the fault of the authors alone.
We are also grateful to the many individuals and organizations who gave us the opportunity to share early versions of this work,
including Lisa Austin at the Faculty of Law (University of Toronto); Vanessa Rhinesmith and David Eaves at digital HKS (Harvard
Kennedy School); Ian Goldberg and Erinn Atwater at the Cryptography, Security, and Privacy (CrySP) Research Group (University
of Waterloo); Florian Martin-Bariteau at the Centre for Law, Technology and Society (University of Ottawa); and the Citizen Lab
Summer Institute (Munk School of Global Affairs, University of Toronto).
Finally, the authors would like to offer our sincere thanks to the John D. and Catherine T. MacArthur Foundation and the Ford
Foundation, whose generous funding made this report possible.
CORRECTIONS AND QUESTIONS
Please send all questions and corrections to the authors directly, at:
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
TABLE OF ACRONYMS
AANDC Aboriginal Affairs and Northern Development Canada
ACLU American Civil Liberties Union (US)
AES Advanced Encryption Standard
BCCLA British Columbia Civil Liberties Association
CACP Canadian Association of Chiefs of Police
CALEA Communications Assistance for Law Enforcement Act (US)
CBSA Canada Border Services Agency
CCTV Closed-Circuit Television
CIA Central Intelligence Agency (US)
CIPPIC Canadian Internet Policy and Public Interest Clinic
CoE Council of Europe
CSE(C) Communications Security Establishment (Canada)
CSIS Canadian Security Intelligence Service
DES Data Encryption Standard
ECL Export Control List
EFF Electronic Frontier Foundation (US)
ENISA European Network and Information Security Agency (EU)
FBI Federal Bureau of Investigation (US)
FELEG Five Eyes Law Enforcement Group
FFU Free File Upload
FINRA Financial Industry Regulatory Authority (US)
FISC Foreign Intelligence Surveillance Court (US)
FOI Freedom of Information
G8 Group of Eight
G20 Group of Twenty
GCHQ Government Communications Headquarters (UK)
GPG GNU Privacy Guard
GSM Global System for Mobile Communications
GSN General Sofware Note (Wassenaar Arrangement)
HTTP Hypertext Transfer Protocol
HTTPS Hypertext Transfer Protocol (Secure)
IACP International Association of Chiefs of Police
ICCPR International Covenant on Civil and Political Rights
IMSI International Mobile Subscriber Identifier
IP Internet Protocol
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
IPA Investigatory Powers Act (UK)
ISP Internet Service Provider
ISO International Organization for Standardization
LEAF Law Enforcement Access Field (Clipper Chip)
MI5 Military Intelligence, Section 5 (UK)
NATO North Atlantic Treaty Organization 
NIST National Institute of Standards and Technology (US)
NSA National Security Agency (US)
OECD Organisation for Economic Co-operation and Development
OSINT Open Source Intelligence
OTR Off-the-Record
PGP Pretty Good Privacy
RCMP Royal Canadian Mounted Police
RIM Research in Motion
RSA Rivest–Shamir–Adleman (Cryptosystem or Company)
SGES Solicitor General’s Enforcement Standards
SIM Subscriber Identity Module
SSL Secure Sockets Layer
TSL Transport Layer Security
TSP Telecommunications Service Provider
UDHR Universal Declaration of Human Rights
UN United Nations
UNESCO United Nations Educational, Scientific and Cultural Organisation
URL Uniform Resource Locator
VPN Virtual Private Network
W3C World Wide Web Consortium
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
TABLE OF CONTENTS
Executive Summary and Introduction i
Part 1: Cryptography 101: What is Encryption? 1
A. Basic Terms & Concepts 1
B. Encryption at Rest 4
C. Encryption in Transit 5
D. Intermediary Access & End-to-End Encryption 5
E. Symmetric & Asymmetric Encryption 6
F. Forward Secrecy 7
G. Encryption & Metadata 8
Part 2: Why Encryption Matters 11
A. Encryption Enables Fundamental Rights & Freedoms 11
B. Encryption is a Cornerstone of Electronic Commerce 16
C. Encryption Safeguards Public Safety & National Security 17
Part 3: Going Dark? Four Decades of Debate 21
A. An Era of Strict Encryption Control (Pre-1990s) 21
i. Strict Control and Closed Door Controversies 21
ii. Export Controls and the Intelligence-Military Mindset 22
B. Crypto Wars 1: The Road to Liberalization (1990-2000) 23
i. The Clipper Chip and the Push for Key Escrow 23
ii. An International Move Toward Commercial Liberalization and Public Control 24
iii. The Canadian Context and the Cryptography Policy 27
C. Global Shifs in the Encryption Debate (2000-2010) 28
i. Ubiquitous Access to New Kinds of Data 28
ii. Global Markets and Global Problems 31
D. Going Dark: The Current Debate (2011-2018) 32
i. Renewed Demands for Undefined Solutions 33
ii. The Canadian National Security Consultation 36
Part 4: Evaluating Responses to the Encryption Problem 39
A. Efforts to Limit Public Access and Use of Encryption Tools 41
i. Criminalization and Encryption Bans 42
ii. Censorship of Encryption Tools 42
iii. Limits on Key Length, Choice of Algorithms, or Use of End-to-End Encryption 43
iv. Export Controls 45
v. Covert Efforts to Undermine Encryption 48
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
B. Measures Generally Targeting Intermediaries 50
i. Exceptional Access: A Backdoor By Any Other Name? 51
ii. Voluntary Private Sector Collaboration 57
iii. Mandatory Decryption Requirements for TSPs 58
iv. Other Forms of Mandatory Participation by Third Parties 62
a) Production Orders 62
b) Assistance Orders 63
C. Measures Targeting Specific Individuals & Devices 65
i. Compelled Decryption and/or Key Disclosure 65
ii. Search Incident to Arrest 70
iii. Border Searches and Questioning 72
iv. Drawing Prejudicial Inferences from the Use of Encryption 77
v. Other forms of Mandatory Disclosure by Targeted Individuals 78
a) Conditions on Bail and Sentencing 78
b) Civil Orders for the Preservation of Evidence 78
D. Conclusion 79
Part 5: Encryption is Not an Insurmountable Barrier 80
A. Reframing Encryption as Investigative Friction 81
B. The State is Not Running Out of Data 84
Concluding Reflections 90
SHINING A LIGHT ON THE ENCRYPTION DEBATE: A CANADIAN FIELD GUIDE
FIGURES
Figure 1 Sample Ciphertext Page 1
Figure 2 Encryption Key Derived From Password Page 3
Figure 3 Proceedings & Convictions Using Part VI-Derived Evidence Page 29
Figure 4 Part VI Authorizations Obtained Page 30
Figure 5 Little Bobby on End Point Security Page 82
Figure 6 Clearance & Charge Rates per Police-Reported Incident, 1998-2016 Page 89
INFORMATION BOXES
Box 1 Understanding the Strength of a Cryptographic System Page 3
Box 2 Web Browsing Without Encryption Page 7
Box 3 Factors for Courts and Policymakers to Consider in Evaluating Policy Responses Page 40
to Encryption
Box 4 Flawed Incentives and Penalties for Silence Page 66
Box 5 Using Fingerprinting Powers to Unlock Cell Phones, A Canadian Case Study Page 70
Box 6 Requests for Passwords to Social Media and Other Non-Device Passwords at Page 76
Borders?
Box 7 Law Enforcement and Intelligence: Different Capabilities and Different Page 80
Objectives