Why it’s not okay to compromise privacy for security
The WhatsApp hack involving NSO has highlighted the urgent need for a digital surveillance framework in India. While law enforcement agencies demand access to encrypted messages, the incident demonstrates the risks of creating backdoors in communication platforms. Preserving civil liberties and maintaining robust security should be prioritized over short-term safety measures.
This article was first published in The Mint. You can read the original at this link.
Last week, when information about the WhatsApp hack broke, news channels were falling over themselves to try and make sense of what it really meant. I found myself on TV (ironically patched into the live broadcast through a WhatsApp video call) being vigorously cajoled by my fellow panellist to draw conclusions far bigger than the available facts seemed to warrant. The big question that everyone seemed to want an answer to was who exactly it was who had engaged NSO, the Israeli company at the centre of the controversy, to target the couple of dozen Indian lawyers, activists and journalists at whom the attack was aimed. Since NSO claims to only license its services to national governments, the unstated inference was that the Indian government was snooping on its own citizens.
We may never find out who engaged NSO to target Indian civil society, but what the incident has done is bring into sharp focus the urgent need of a framework for digital surveillance in India—one that states what can be done to maintain law and order and what cannot in the interests of protecting the civil liberties of innocent citizens.
As it happens, the battleground on which this very issue has been fought over the past few months is WhatsApp itself. Messages on WhatsApp are encrypted from end-to-end, allowing users to communicate with each other over the platform without the fear that their conversations will be eavesdropped upon. As reassuring as this is for users, it has turned out to be a nightmare for law enforcement agencies that are displeased with the fact that such encryption prevents them from identifying the source of illegal content exchanged on WhatsApp’s network. For some time now, demands have been raised requesting WhatsApp to tweak its platform architecture to allow messages to be traced to their source if and when required. WhatsApp, for its part, has been resisting these requests, claiming that the creation of a backdoor, even if only for the limited purpose of lawful interception of communication, will be all that unlawful elements need to take advantage of the platform for nefarious purposes.
From the available evidence, it seems that NSO’s spyware was unable to crack open WhatsApp’s end-to-end encryption. However, what this incident really demonstrates is the extent to which global communication platforms are under the attack of sophisticated hackers who are focused on finding ways to either access the information carried over the network, or use these platforms as vectors through which they can infect the devices of targeted individuals with spyware. End-to-end encryption only protects messages whilst in transit. If hackers can somehow install spyware on a phone, it will allow them to exploit the vulnerabilities of the device and read messages as well as everything else on the phone—contacts, photographs, and every other item of personal information stored on it.
We need to recognize this incident for what it is—a clear warning of the technical capabilities of the adversaries we are up against. In today’s world, rather than weakening security even an iota, we need to ensure that our communication infrastructure is as robust as possible. I have no doubt that had WhatsApp capitulated to the demands of law enforcement and created a backdoor for agencies to access the relevant information, it would have been child’s play for an organization as sophisticated as NSO to use that opening to wreak far worse damage than was done this time.
So, what do we do? Should we just allow bad actors to hide behind unbreakable encryption when we know that we can monitor them and possibly prevent them from carrying out the crimes they are plotting?
As it happens, a similar question had been asked and answered by our courts at the very dawn of Indian privacy jurisprudence. The earliest privacy cases decided by the Supreme Court of India revolved around the practice of domiciliary visits by the police to the homes of known criminals. In those days, it was believed that by constantly checking up on offenders at all hours of the day and night, the police would be able to keep society safe from any future crimes they might be contemplating. The Supreme Court disagreed, stating that invading the privacy of people who have not committed a crime, merely on the suspicion that they might do so in the future, was an unacceptable violation of their civil liberties. And if, as a result the police are unable to protect society from the crimes they might go on to commit, that is the price that we as a society have to pay to preserve our democratic principles.
Technology has brought us newer and more effective means of secure communication. We can, if we so choose, dilute this security so that law enforcement can identify criminal activity before it happens. However, if we lower our defences for any reason, we effectively open ourselves up to attack by hackers waiting for an opportunity to gain access to our devices.
The Supreme Court has already told us that we must choose to preserve civil liberties even if doing so means we may not be able to prevent a crime from occurring. I believe we must apply those principles to the trade-offs that modern technology asks of us.
As much as diluting end-to-end encryption could keep us safer in the short term, the long term impact on cybersecurity is too high a cost to pay.
