[ad_1]
It’s no secret at the moment that India wants to trace the origin of messages on apps like WhatsApp and Signal. In its new social media policing rule, the government said that while it didn’t want to categorically break the encryption, it wanted to know who generated a particular post first.
A report released yesterday by the Economic Times suggested that some officials are proposing that WhatsApp assign and store an alphanumeric hash to every message so that it can be traced back to the sender if it causes illegal activity.
An official involved in the traceability discussion said the government was “willing to work with WhatsApp to find a solution that allows message traceability without breaking the encryption.”
However, this approach poses some problems. In an end-to-end encrypted system, every message is different for the system because it cannot read your messages. So if you send “Hi” twice, it doesn’t recognize it as the same message.
Prasanth Sugathan, legal director of Software Freedom Law Center (SFLC.in), a New Delhi-based organization that focuses on digital law, said the authors could tweak the post slightly or just copy it to cause the hash to change. :
The government assumes that every message transmitted is delivered as is. The hash is specific to the message. Edit a letter in a message and its hash will change. This means that if a malicious party wants to send a viral message, they would do so simply by changing the hash of a message each time or after multiple transfers. Thus, change the first sender each time such a message has been transmitted. There is a good chance that this will lead to a very complicated implementation.
In 2018, WhatsApp faced a lot of backlash from India after forwarded messages containing false information caused more than 30 lynchings in the country. However, the company has taken several steps to limit transfers, so it would be naive to assume that every message travels in a chain.
Now, if a government identifies a problematic message, and needs to find out who sent it first, it’s hard to do without reading the chat content and breaking the existing encryption.
Matthew Hodgson, CEO of Element, a secure messaging app based on the Matrix protocol, said hash messages could reduce user privacy and compromise encryption of messaging applications:
This could be used by a malicious party to blackmail an innocent party into proving that they sent a given message (e.g. to persecute a whistleblower who tips a reporter, or to quote a private message out of place. its context to embarrass the sender). Worse yet, Facebook or other data brokers could use it to collect much richer metadata about which users forward which messages – further profiling users and violating their privacy.
The government may suggest a key escrow, a method of allowing authorized third-party entities to access content without breaking the encryption. But as the Clipper Chip case in the United States in the 1990s suggests, key receivers have many gaping holes in terms of unauthorized use and security.
Then there is the legal question of whether the sender of a message is the culprit.
In an interview with Medianama last year, Anyesh Roy, head of Delhi Police’s Cyber Crime Cell Unit, said WhatsApp provides law enforcement metadata to catch criminals – but not the creator. In a recent Forbes article, lawyers noted that India’s rules for determining whether the perpetrator is the perpetrator of the crime are obscure and that courts will need to review them on a case-by-case basis.
In another scenario, if someone shares illegal content, the police would only have information about the person arrested and who sent the content to them. But since the hashes are different for different messages, it can be difficult to catch everyone who is distributing the file.
India’s suggestion to hash the messages looks like a half-hearted attempt to resolve the distribution of false information at this time. He has more questions – technically and legally – than answers at the moment. It’s probably time to get back to the drawing board.
[ad_2]