Human rights and encryption
Encryption in media and communication
Encryption in media and communication
-------------------------------------

In the context of media and communication, two types of encryption in media and communication can be distinguished:
1. It could be used as a result of the choice of a service provider or deployed by Internet users. [Client\-side encryption](/wiki/Client-side_encryption "Client-side encryption") tools and technologies are relevant for [marginalized](/wiki/Social_exclusion "Social exclusion") communities, [journalists](/wiki/Journalist "Journalist") and other online media actors practicing journalism as a way of protecting their rights.
2. It could prevent unauthorized [third party access](/wiki/Third-party_access "Third-party access"), but the service provider implementing it would *still have access* to the relevant user data. End\-to\-end encryption is an encryption technique that refers to encryption that also prevents service providers themselves from having access to the user's communications. The [implementation](/wiki/Implementation "Implementation") of these forms of encryption has sparked the most debate since the start of the 21st century.

### Service providers deployed techniques to prevent unauthorized third\-party access.

Among the most widely deployed cryptographic techniques is the securitization of [communications channel](/wiki/Communication_channel "Communication channel") between internet users and specific service providers from [man\-in\-the\-middle](/wiki/Man-in-the-middle_attack "Man-in-the-middle attack") attacks, access by unauthorized third parties. Given the breadth of nuances involved, these cryptographic techniques must be run jointly by both the service *user* and the service *provider* in order to work properly. They require service providers, including online news publisher(s) or [social network](/wiki/Social_networking_service "Social networking service")(s), to actively implement them into service design. Users cannot deploy these techniques [unilaterally](/wiki/Unilateralism "Unilateralism"); their deployment is contingent on active participation by the service provider. The [TLS protocol](/wiki/Transport_Layer_Security "Transport Layer Security"), which becomes visible to the normal internet user through the [HTTPS](/wiki/HTTPS "HTTPS") header, is widely used for securing online commerce, [e\-government](/wiki/E-government "E-government") services and health applications as well as devices that make up networked infrastructures, e.g., routers, cameras. However, although the standard has been around since 1990, the wider spread and evolution of the technology has been slow. As with other cryptographic methods and protocols, the practical challenges related to proper, secure and (wider) deployment are significant and have to be considered. Many service providers still do not implement TLS or do not implement it well.

In the context of [wireless](/wiki/Wireless "Wireless") communications, the use of cryptographic techniques that protect communications from third parties are also important. Different standards have been developed to protect wireless communications: [2G](/wiki/2G "2G"), [3G](/wiki/3G "3G") and [4G](/wiki/4G "4G") standards for communication between mobile phones, base stations and base stations controllers; standards to protect communications between mobile devices and wireless routers ('[WLAN](/wiki/Wireless_LAN "Wireless LAN")'); and standards for local computer networks. One common weakness in these designs is that the transmission points of the wireless communication can access all communications e.g., the [telecommunications provider](/wiki/Telecommunications_service_provider "Telecommunications service provider"). This vulnerability is exacerbated when wireless protocols only [authenticate](/wiki/Authentication "Authentication") user devices, but not the [wireless access point](/wiki/Wireless_access_point "Wireless access point").

Whether the data is stored on a device, or on a local server as in the [cloud](/wiki/Cloud_computing "Cloud computing"), there is also a distinction between 'at rest'. Given the vulnerability of [cellphones](/wiki/Cellphones "Cellphones") to theft for instance, particular attention may be given to limiting service provided access. This does not exclude the situation that the service provider discloses this information to third parties like other commercial entities or governments. The user needs to trust the service provider to act in their interests. The possibility that a service provider is legally compelled to hand over user information or to interfere with particular communications with particular users, remains.

### Privacy\-enhancing Technologies

There are services that specifically [market](/wiki/Marketing "Marketing") themselves with claims not to have access to the content of their users' communication. Service Providers can also take measures that restrict their ability to access information and communication, further increasing the protection of users against access to their information and communications. The integrity of these [Privacy Enhancing Technologies](/wiki/Privacy-enhancing_technologies "Privacy-enhancing technologies") (PETs), depends on delicate design decisions as well as the willingness of the service provider to be transparent and [accountable](/wiki/Accountability "Accountability"). For many of these services, the service provider may offer some additional features (besides the ability to communicate), for example, contact list management—meaning that they can observe who is communicating with whom—but take technical measures so that they cannot read the contents of the messages. This has potentially negative implications for users; for instance, since the service provider has to take action to connect users who want to communicate using the service, it will also have the power to prevent users from communicating in the first place.

Following the discovery of [vulnerabilities](/wiki/Vulnerability "Vulnerability"), there is a growing [awareness](/wiki/Awareness "Awareness") that there needs to be more investment in the [auditing](/wiki/Audit "Audit") of widely used [code](/wiki/Code "Code") coming out of the free and open software community. The pervasiveness of [business models](/wiki/Business_model "Business model") that depend on the collection and processing of user data can be an obstacle for adopting cryptographic mechanisms for protecting information at rest. As [Bruce Schneier](/wiki/Bruce_Schneier "Bruce Schneier") stated:

*"Surveillance is the business model of the Internet. This has evolved into a shockingly extensive, robust, and profitable surveillance architecture. You are being tracked pretty much everywhere you go on the Internet, by many companies and [data brokers](/wiki/Data_brokers "Data brokers"): ten different companies on one site, a dozen on another."* Cryptographic methods play a key role in [online identity management](/wiki/Online_identity_management "Online identity management").

[Digital credential](/wiki/Digital_credential "Digital credential") systems can be used to allow anonymous yet authenticated and accountable transactions between users and service providers and to build privacy preserving identity management systems.

### End\-user and community\-driven encryption and collaborative services

The Internet allows [end\-users](/wiki/End_user "End user") to develop applications and uses of the network without having to coordinate with the relevant [internet service providers](/wiki/Internet_service_provider "Internet service provider"). Many of the available encryption tools are not developed or offered by traditional service providers or organizations but by experts in the [free and open\-source software](/wiki/Free_and_open-source_software "Free and open-source software") (FOSS) and Internet engineering communities. A major focus of these initiatives is to produce [Privacy Enhancing Technologies](/wiki/Privacy-enhancing_technologies "Privacy-enhancing technologies") (PETs) that can be unilaterally or collaboratively deployed by interested users who are ready, willing, and able to look after their own privacy interests when interacting with service providers. These PETs include standalone encryption applications as well as [browser add\-ons](/wiki/Browser_add-on "Browser add-on") that help maintain the confidentiality of web\-based communications or permit anonymous access to online services and search engines. Technologies such as [keystroke loggers](/wiki/Keystroke_logging "Keystroke logging") can intercept content as it is entered before encryption is applied, thereby falling short of offering protection. Hacking into information systems and devices to access data at or after the moment of [decryption](/wiki/Decryption "Decryption") may have the same effect.

[Multi\-party computation](/wiki/Multi-party_computation "Multi-party computation") (MPC) techniques are an example of collaborative solutions that allow parties, e.g., [NGOs](/wiki/Non-governmental_organization "Non-governmental organization") with sensitive data, to do [data analytics](/wiki/Data_analysis "Data analysis") without revealing their [datasets](/wiki/Data_set "Data set") to each other. All of these designs leverage encryption to provide privacy and security assurances in the absence of a trustworthy centralized authority.

There are many developments in the implementations of [cryptocurrencies](/wiki/Cryptocurrency "Cryptocurrency") using [blockchain](/wiki/Blockchain "Blockchain") protocols. These systems can have many benefits and these [protocols](/wiki/Cryptographic_protocol "Cryptographic protocol") can also be useful for novel forms of contracts and electronic attestation, useful aids when legal infrastructure are not readily available. As to the protection of privacy related to payments, it is a common misconception that the cryptographic techniques that are used in [Bitcoin](/wiki/Bitcoin "Bitcoin") ensure anonymous payments. The only protection offered by Bitcoin is [pseudonymity](/wiki/Pseudonymity "Pseudonymity").

### The cryptographic protection of metadata

The availability of [metadata](/wiki/Metadata "Metadata") (the *non [personally identifiable information](/wiki/Personally_Identifiable_Information "Personally Identifiable Information")* generated by a user's communications/behaviors) can pose a particular threat to users. This is information that is not protected by law, \& that can be observed by service providers through the provisioning of services; including but not limited to: the time, frequency, duration, involved parties \& so on. Metadata can also be used to track people geographically and can interfere with their ability to communicate anonymously. As noted by the [Berkman Center](/wiki/Berkman_Klein_Center_for_Internet_%26_Society "Berkman Klein Center for Internet & Society") report, metadata is generally not encrypted in ways that make it inaccessible for governments, and accordingly *"provides an enormous amount of surveillance data that was unavailable before \[internet communication technologies] became widespread."* To minimize exposure of meaningful metadata, encryption tools may need to be used in combination with technologies that provide communication anonymity.

#### The Onion Router

[The Onion Router](/wiki/The_Onion_Router "The Onion Router"), most commonly known as [Tor](/wiki/Tor_%28anonymity_network%29 "Tor (anonymity network)"), offers the ability to access websites and online services anonymously. Tor requires a community of volunteers to run intermediary proxies which channel a user's communication with a website so that third parties cannot observe who the user is communicating with. Through the use of encryption, each proxy is only aware of part of the communication path meaning that none of the proxies can by itself infer both the user and the website he/she is visiting. Besides protecting anonymity, Tor is also useful when the user's ISP blocks access to content. This is similar as the protection that can be offered by a [VPN](/wiki/Virtual_private_network "Virtual private network") (Virtual Private Network). Service providers, such as websites, can block connections that come from the Tor network. Because certain malicious traffic may reach service providers as Tor traffic and because Tor traffic may also interfere with the business models, service providers may have an [incentive](/wiki/Incentive "Incentive") to do so. This interference can prevent users from using the most effective means to protect their anonymity online. The Tor browser allows users to [obfuscate](/wiki/Obfuscation "Obfuscation") the origin and [end\-points](/wiki/Endpoint_security "Endpoint security") of their communications when they communicate on the internet.

#### Obfuscation

Obfuscation, the automated generation of "fake" signals that are indistinguishable from users' actual online activities, providing users with a noisy "cover" under which their real information and communication behaviour remains unobservable. Obfuscation has received more attention as a method to protect users online recently. [TrackMeNot](/wiki/TrackMeNot "TrackMeNot") is an obfuscation tool for search engine users: the plugin sends fake search queries to the [search engine](/wiki/Web_search_engine "Web search engine"), affecting the ability of the search engine provider to build an accurate profile of the user. Although TrackMeNot and other search obfuscation tools have been found to be vulnerable to certain attacks that allow search engines to distinguish between user\-generated and computer\-generated queries, further advances in obfuscation are likely to play a positive role in protecting users when disclosure of information is inevitable, as in the case of search or [location\-based services](/wiki/Location-based_service "Location-based service").


What is The Onion Router (Tor) and what are its benefits?