The European Court of Human Rights (ECtHR) ruled that laws requiring poor encryption and extensive general retention of user data they violate the European Convention on Human Rights and are therefore illegal. The decision could derail current or future regulations that governments develop around these issues, always sensitive, where the battle of states, intelligence services and their security forces against “bad guys” must be balanced, but with guarantees that the rights of other citizens are respected.

The ECtHR’s decision comes in response to a lawsuit filed by Russian citizen Anton Valeryevich Podchasov in 2019, when Russia was still a member of the Council of Europe. Although Putin removed his country from this body, when the conviction came for his illegal invasion of Ukraine, the court continued to deal with the case until the end. It is clear that the ruling will not apply in Russia, but will apply in the rest of Europe.

Podchasov challenged a state rule that allowed Russia’s Federal Security Service (FSB) to provide Telegram messaging service with technical information that could be used to decipher user communications. Or what is the same, it reveals backdoor to break end-to-end encryption who uses Telegram and other services. The case, albeit with a different motivation, may sound similar to the “San Bernardino iPhone” case when the FBI tried to order Apple to take similar action.

Decision of the European Court of Human Rights It’s pretty clear: “The contested legislation, which provides for the retention of all Internet communications of all users, the direct access of security services to stored data without adequate safeguards against misuse, and the requirement to decrypt encrypted communications, as applied to end-to-end encrypted communications, cannot be considered necessary in a democratic society.”.

Weakening encryption systems is nonsense

We have talked about this on other occasions. The idea of ​​making encryption systems less secure with the useful “security” argument it’s really nonsense. It’s not just that a democratic system can’t allow “crime” to be a pretext for curtailing fundamental rights, it’s that global cyber security depends on encryption systems, including the entire Internet and services as sensitive as e-commerce or online banking . It would not be unusual for cybercriminals to exploit this potential backdoor. This has happened on multiple occasions.

That is where the ECtHR is going when it says this “Russian law requiring Telegram to decrypt end-to-end encrypted communications risks providers of these services weakening the encryption mechanism for all users”. And as such, the Court finds that this requirement “is disproportionate to the legitimate goals of law enforcement.”

The ECtHR decision will have no effect in Russia, but will be decisive for other regulations which are being developed, such as the UK Government’s Chat Control and Online Safety Act. Patrick Breyer, MEP for the Pirate Party, praised the decision for showing that chat control is incompatible with EU law:

“With this historic and landmark decision, the ‘client-side scanning’ monitoring of all smartphones proposed by the European Commission in its chat monitoring bill is clearly illegal”

The MP points out the obvious: weakening encryption systems would destroy everyone’s protection instead of investigating suspects. “EU governments will now have no choice but to change their stance on this proposed destruction of secure encryption, as well as indiscriminate surveillance of the private communications of the entire population.”.