Encryption laws: Which governments place the heaviest restrictions on encryption?

Is the government breaking your privacy laws?

From private conversations through the likes of WhatsApp to confidential browsing histories through VPNs, encryption plays an integral role in our freedom of expression and privacy.

Yet, with ongoing government attempts to create “backdoors” into encryption services/products, many countries face severe restrictions when it comes to using apps and tools that utilize cryptography.

To find out where the heaviest restrictions are, our team of researchers has analyzed over 200 countries’ legislation to see:

• Which countries require manufacturers/sellers to get a license before producing or selling cryptography products/services
• Which countries have import and/or export restrictions on cryptography products/services
• Which countries don’t have a personal use exemption on travel with encrypted laptops
• Which countries place obligations on providers to hand over encryption keys for law enforcement purposes (factoring in whether a warrant is required for this)
• Which countries place obligations on end users to hand over encryption keys for law enforcement purposes (factoring in whether a warrant is required for this)
•  

• The vast majority of countries have some kind of restriction on encryption technologies, whether it’s import/export laws or law enforcement access to encrypted data. Severer restrictions are noted in places one might expect them, i.e. Russia and China, but heavy restrictions are also in place across many other countries, too. And with more and more legislation and investigative powers being introduced, restrictions are only set to increase in the coming months and years.For example, while Brazil ranks as one of the “freer” countries due to its current legislation, this is in spite of attempts to impose further restrictions. Recent court orders have tried to block WhatsApp, and Facebook also faced a legal battle with the country due its lack of cooperation in a criminal investigation (which even resulted in the Vice President of Facebook being arrested).In short, many countries may grant citizens the right to freedom of speech and privacy, but thwart this when it comes to encryption, citing national security and serious crimes as the reason.

Which countries require encryption providers to decrypt data for law enforcement purposes?

One of the biggest concerns when it comes to encryption is the access granted to law enforcement agencies, whether it be by decryption key or a requirement for providers to decrypt the data for them.

As the below map shows, a large number of countries have at least some potential access to providers’ encryption keys.

A handful of countries, including China and Russia, have unprecedented access to decrypted data. In Russia, for example, the Sistema Operativno-Rozysknykh Meropriyatii (SORM — the System for Operational-Investigative Activities) gives the Russian federal security service, the FSB, access to electronic messages and the keys to decrypt these without judicial authorization.

Many European, Asian, and African countries, as well as the United States, have laws that enable law enforcement to request providers hand over encryption keys and/or decrypt data.

In the United Kingdom, a number of laws grant law enforcement the right to request encryption technologies be removed on various communications. Section 49 of the Regulation of Investigatory Powers Act 2000 states that when protected information is in the possession of law enforcement, they can, with written permission from a judge, impose a disclosure requirement for data to be produced in intelligible form. Law enforcement must have reasonable grounds that someone possesses the key to the protected information, that disclosure is necessary for national security, detecting/preventing a crime, or that it is in the interest of the UK’s economic well-being, that disclosure is proportionate to what’s sought to be achieved, and that disclosure isn’t possible without imposing the order.

In the United States, Section 103(a) the Communications Assistance for Law Enforcement Act of 1994 suggests that communications providers must ensure intercept capabilities when issued with court orders or other such lawful authorization. However, “A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.”

Most laws carry the same power as that of the United States, placing requirements on providers to decrypt any data that they have encrypted themselves but not data that is encrypted by other providers or the users themselves.

A number of other countries impose ambiguous laws that provide the potential for law enforcement to request the disclosure of encrypted information – or laws have been interpreted in such a way. For instance, in the European Union, the Council Resolution of 17 January 1995 on the Lawful Interception of Telecommunications offers some guidance on the laws that should have been implemented in EU countries.

The resolution states that “If network operators/service providers initiate encoding, compression or encryption of telecommunications traffic, law enforcement agencies require the network operators/service providers to provide intercepted communications en clair.” En clair means “in plain language” and can therefore be interpreted to mean decrypted.

Which countries require encryption users to decrypt data for law enforcement purposes?

It’s a similar picture when we look at law enforcement powers to request decryption keys or decrypted data from users of encrypted services/products.

The laws tend to cover communications or access to computers, requiring those in possession of a key to hand it over to law enforcement upon request or to aid them in the decryption process.

Again, some countries don’t have specific laws but do have ambiguous laws in place. In other cases, countries may rely more heavily upon service providers to hand over the data, i.e. in the United States where no law explicitly provides law enforcement the power to request users hand over decrypted data/keys.

Ultimately, getting “backdoor” access to encryption providers’ data is the easiest way to access encrypted data, which is why a worrying number of countries are trying to implement such measures. This includes:

• India’s ongoing battle with WhatsApp
• Brazil’s recent court orders to try and block WhatsApp and current Fake News bill which is attempting to break end-to-end encryption
• United States’ bill for backdoor access to encrypted data (submitted to Congress in June 2020).

Which countries require licenses for producing or manufacturing encryption services/products?

A large number of African, Middle Eastern, and Asian countries have sweeping licensing requirements. This means the majority of sellers or manufacturers of cryptography products must obtain a license before distributing. France also has such a requirement with any person who wishes to provide cryptography services having to declare so to the Prime Minister.