This article describes the tension at the nonprofit that builds the messaging app Signal – the tension between providing totally private messaging, and the inevitability that such a service will be used by terrorists and criminals to organise.
Privacy was, is and will be political. Governments have always wanted access to information, from intercepting postal mail to eavesdropping on telephone conversations to the USA National Security Agency’s PRISM programme that collected data from nearly every major USA tech company: Microsoft, Google, Facebook, Apple.
Until recently, end to end encryption, like the kind Signal (and Telegram) makes possible, has not been available to people like you and me. With such encryption, not even Signal itself can access the contents of our conversations [1]. This means even if USA or other government spies were to break into Signal’s systems, or obtain its covert cooperation, they wouldn’t be able to see what messages you and I typed to each other.
That means for you and me, the very act of using Signal and other such services is political. Likewise for Signal, providing such a service is a political act.
It is always going to be at the receiving end of governmental efforts, USA and outside, to provide encryption backdoors for their security agencies [2][3].
If you were such a government, you’d use informal private pressure, you’d build a public legal case and you’d discredit the company and private messaging in general by pointing out the danger to national security. This is also the playbook governments the world over have used to deal with cryptocurrency.
I think the only way that the Signal organisation and others like it will be left un-harassed is by reframing the question.
Today it is “What is Signal doing to tackle terrorist activity taking place on your service?”
The much more politically fraught – but correct – question is “Why is the onus of identifying, reporting and shutting down terrorist/criminal activity primarily on Signal?”
Like it or not, Signal is a political organisation. It needs to begin acting like one.
[1] And we don’t need to take Signal’s word for it – the app and server code is available publicly.
[2] Never mind that that kind of backdoor would require explicitly moving to a fundamentally different, less secure encryption algorithm.
[3] PS: And you and I, as Signal users, are going to be suspect.