A guide for defending encryption

In June 2019, Lizzie O’Shea was named as a Human Rights Hero by Access Now and received the award from the UN High Commissioner for Human Rights, Michelle Bachelet. This is an edited version of her acceptance speech.

Thanks so much to Access Now for this wonderful award. It’s such a great initiative to support activists in the field doing important work – awards usually go to famous people at the top of their fields, and the challenging activist work of mobilising people and community building is rarely acknowledged. I feel honoured, especially alongside so many other wonderful activists.

I also wish to acknowledge that my work on this campaign was not a solo effort – I accept it on behalf of my colleagues at Digital Rights Watch, as well as colleagues in many other civil society organisations in Australia, Blueprint for Free Speech, Electronic Frontiers Australia, the Australian Privacy Foundation, Future Wise, the Human Rights Law Centre and GetUp!

Technological advancement is not just about intelligent design, clever cryptography or brilliant coding; it’s also a function of power. To make technology work for people, we need to take this power back – and demand that the development of technology involve social, political and ethical considerations. Just because technology does certain things now, doesn’t mean it couldn’t do them better. And just because technology gives us the power to do something does not mean that we should. These tensions are not simply technological, they are political.

Protecting encryption is about protecting democracy – it is about shifting power away from states and companies and towards people.

With that framing I wanted to offer some reflections on the campaign to defend encryption in Australia.

Australia is the only Western democracy without a bill of rights and it is an enthusiastic member of the Five Eyes intelligence alliance. Our government thinks we have a special role to play in advancing the cause of the surveillance state. So we were not surprised when Australia was the place that the most powerful intelligence agencies in the world sought to attack encryption.

Australia has been a vanguard for oppressive laws – our parliament has introduced a mandatory data retention regime, a suite of expansive powers for national security agencies and, most troubling of all, sweeping powers that allow government agencies to force companies to break encryption, without a warrant or any meaningful accountability process.

Where we have gone, others will soon follow. So what lessons can we learn from this?

To defeat attacks on encryption, we need to talk about technical topics in accessible ways. Encryption is not just about maths or cryptography, it is about the security of our digital infrastructure. Our healthcare system, our energy grid, our banking system, our public transport services – they all rely on encryption to ensure that the wrong people can’t get access to them. It’s not that encryption is a good source of protection, it’s one the only lines of defence we have against criminal behaviour and state sponsored hacking. When we compromise its strength, we put all of those systems at risk.

By framing the defence of encryption in accessible ways, it undermines the official narrative. Our politicians talked all how breaking encryption was necessary to protect us from terrorism and serious crimes. But law enforcement agencies already have lots of powers at their disposal to do this, and giving them more powers without accountability risks them being misused. Moreover, it ignores the incredible danger pose to the security of our digital infrastructure when we weaken encryption. Even if a tool to break encryption is created for a legitimate purpose, it can be used for any purpose. We can start to show how everyone has a stake in defending encryption, not as an obstacle to fighting criminal behaviour but as a source of protection against it.

We need to explain how encryption is important for journalists and whistle blowers, but also not just for them. The people who need encryption are patients in the healthcare system, users of public transport, anyone who relies on the energy grid, or pays for things online. In Australia, we talked to unions, welfare organisations, health charities and human rights lawyers – as well as technologists, cryptographers and coders. Civil society has a unique role to play by finding diverse allies from across the political spectrum. Industry can help us do this, but they cannot do it without us.

Our job is to challenge the official narrative and change the calculus in the minds of elected decision makers.

In seeking to break encryption, government agencies prioritise their own interests over those of the citizen are supposed to protect. They want to created technical tools they can stockpile as an arsenal of digital weapons to use against their enemies (whoever they may be). But this is like stockpiling weapons while claiming you are preparing for peace. It’s not possible. Activists are the people who will beat these digital swords into networked ploughshares.

We were not successful in Australia, but we did manage, for a brief moment, to break the bipartisan consensus on national security. That may sounds small, but it’s not. For the last twenty years the majority of politicians have waved through reforms that affect national security. Digital Rights Watch collected 15,000 submissions from the public on encryption laws – in a world in which we are told people don’t care about privacy and don’t understand encryption. It’s a huge step forward that cracks have appeared between the surveillance state and our politicians. Our job is to turn those cracks into chasms – to let the light in – so that law makers remember they work for us.

In recent days we have seen raids on several journalists who have been reporting on surveillance agencies seeking greater powers, and leaks about war crimes committed by Australian troops. This is an alarming development that signifies a turn toward authoritarianism.

As keen observers of the surveillance state, digital rights activists are not surprised that agencies would use their powers to protect themselves rather than protect democratic values like freedom of the press. In fact we are ready – to show up with our knowledge, credibility and strategic alliances to shine a light on how we got here and illuminate the path to fixing it.

We may have lost this battle, but the war has only just begun. Rosa Luxemburg wrote about how revolutionary movements are often paved with thunderous defeats. “Where would we be today without those “defeats,”’ she wrote, “from which we draw historical experience, understanding, power and idealism?” She concluded that we cannot do without any of them, because “each one contributes to our strength and understanding.”

It is wonderful to be here to tell you about our historical experience, and in doing so, contributing to our common strength and collective understanding and united idealism, so we can win next time.