In Response to the Lawful Access to Encrypted Data Act

Among IT and cybersecurity professionals, it has long been understood that strong encryption practices are essential to mitigating risks posed by cyber criminals and protecting privacy rights against businesses and government entities. These same professionals also feel strongly about the need for more informed policymakers who can support legislation that maintains best practices. Professionals have often criticized policymakers of being far removed from technical understanding, resulting in ill-informed policy. The Lawful Access to Encrypted Data Act is no exception.  

If passed, this bill would require technology companies to assist law enforcement with search warrants that seek encrypted data—exposing potential risks and contradicting global data policy regulation trends. Much like the EARN IT Act introduced back in January, I feel that there are concerning undertones of anti-speech and anti-security themes within the Lawful Access to Encrypted Data Act. 

These discussions should aim to build awareness, educate people what these bills aim to accomplish, and present risks that may be exposed such as misuse of personal data or unnecessary exposure to data theft. Legislation around cybersecurity and data privacy should advance security, while ensuring privacy is maintained. Both the EARN IT Act and the Lawful Access to Encrypted Data Act detract from progressing, advancing, and adapting legislation to improve security posture, while upholding privacy. For example, creation of backdoors across various provider’s devices and information services incentives decryption, or in other terms the vulnerability would exist in all devices, all versions of operating systems, upgrades, and so on. Not just when a warrant or wire tap is executed. This can create a vulnerability exposing millions of users within the U.S. and abroad. Take, for example, WhatsApp, a messaging app that includes nearly 1.5 billion users across 180 countries. 

There is a balance that needs to be maintained between national security posture and upholding privacy—a balance that I feel the Lawful Access to Encrypted Data Act is missing. 

One way to encourage this balance is for lawmakers to seek out forums or discussion with a mixed group of IT and security professionals, civil rights advocates, intelligence groups and foreign entities to consult around best practices. The current patchwork of U.S. “cybersecurity” legislation reflects legacy statutes, protections and understanding. To progress legislation, more collaborative discussion between various groups and professionals is required. Given the current environment around COVID-19 forcing many organizations to work remotely, this factor alone would warrant discussion around stronger encryption and security practices.

Beyond privacy rights considerations, many industries rely on encryption for secure transactions and to maintain the trust of its users. Trusted encryption services are used across healthcare, online banking, e-commerce, along with research and development. The Lawful Access to Encrypted Data Act effectively reduces the incentive for organizations to use strong encryption. The approach to discourage strong encryption within organizations would introduce a technically flawed backdoor that could be exploitable by business, government and other bad actors. Further, the risk exposure is also passed along to global consumers that use U.S. services and products. 

From this vantage point, proposed U.S. legislation would be in direct contradiction to global data privacy legislation, such as General Data Protection Regulation in the European Union or Personal Information Protection and Electronic Documents Act in Canada. What happens when global data privacy regulations move in a different direction than those in the U.S.?

Steps are absolutely being taken to strengthen data privacy protections, among U.S. states and in other countries. Take for example GDPR, which regularly and repeatedly emphasizes encryption and pseudonymization as standard security measures and safeguards. Should the U.S. move in the opposite direction with encryption protections, which would be the case if the Lawful Access to Encrypted Data Act is passed, we could see very contradicting legislation that could impact the U.S. economy.  For example, some countries with strict data privacy regulations may not conduct business in the U.S. due to increased cybersecurity risk to their citizens—perhaps discouraging EU citizens from doing business with U.S. companies. 

Legislation like California Consumer Privacy Act and GDPR, positive examples of policy related to cybersecurity and privacy, are forcing businesses to consider data privacy and security while adapting business processes, updating policies and introducing technologies. The Lawful Access to Encrypted Data Act of 2020, along with the EARN IT Act of 2020, poses potential risks that could be exposed and contradicts global data policy regulation trends. 

There must be a balance that allows access for national security and investigative purposes, but avoids absolute positioning that still considers cybersecurity best practices and upholding data privacy. One of the ways I can think to combat this is increased awareness, and voting for legislators who will support best practices. Federal legislation in the U.S. is lagging behind many other countries—and U.S. businesses and citizens should take note of what this means for them. 

Bob Swanson is a compliance research consultant at Swimlane.