For messaging apps, such as WhatsApp, that use ‘end-to-end encryption’ (E2EE), the requirement to use ‘best endeavours’ to comply is technologically impossible without potentially forcing the proactive scanning of private messages.
This reverses the purposes of E2EE and could compromise the privacy of users. WhatsApp says this is a step they are not willing to take.
Ofcom has the power to take appropriate action against all social networks no matter where they are based if they are accessible to UK users. Given that 98% of WhatsApp users are outside the UK, WhatsApp would prioritise the security of its majority (non-UK) users, rather than lower its current security measures.
A relatively small market such as the UK is not something for which WhatsApp would compromise its billions of non-UK users.
Legislators have called on the Government to take the concerns seriously as there is a risk these networks will leave the UK, due to the significant pressure from Ofcom and the Bill on the networks to scan communications.
The Government’s stance
The Government has confirmed that the Bill will not ban E2EE or weaken encryption, but it warns that strong encryption cannot come at the cost of public safety.
Ofcom will only be able to direct networks to use accredited technology or use best endeavours to develop new technology, where it is effective, proportionate, and necessary to do so.
The government’s approach has been described as ‘intentional ambiguity’ as it says it has no intention to ban E2EE but refuses to confirm that it could not do so under the new powers in the Bill.
Conservative MPs have confirmed that the Bill doesn’t attach encryption, as it would only require networks to share information they have access to, which doesn’t include message content.
However, authorities should be able to access the background data behind users, such as usage of the app, contacts, location and names of user groups.
If users access WhatsApp through a web browser, the network can also collect information about websites visited before and after sending messages.