Meta’s WhatsApp is threatening to leave the UK if the government passes the Online Safety Bill, saying it will essentially eliminate its encryption methods. Alongside its rival company Signal and five other apps, the company said that, by passing the bill, users will no longer be protected by end-to-end encryption, which ensures no one but the recipient has access to sent messages.
The “Online Safety Bill” was originally proposed to criminalise content encouraging self-harm posted to social media platforms like Facebook, Instagram, TikTok, and YouTube, but was amended to more broadly focus on illegal content related to adult and child safety. Although government officials said the bill would not ban end-to-end encryption, the messaging apps said in an open letter, “The bill provides no explicit protection for encryption.”
It continues, “If implemented as written, could empower OFCOM [the Office of Communications] to try to force the proactive scanning of private messages on end-to-end encrypted communication services, nullifying the purpose of end-to-end encryption as a result and compromising the privacy of all users.”
OFCOM is a government-approved agency tasked with regulating broadcast, telecommunications, and postal services in the UK, but could abuse its power to inspect individual conversations if the bill goes through, according to WhatsApp and Signal.
“In short, the bill poses an unprecedented threat to the privacy, safety, and security of every UK citizen and the people with whom they communicate around the world while emboldening hostile governments who may seek to draft copycat laws.”
Signal said in a Twitter post that it will “not back down on providing private, safe communications,” as the open letter urges the UK government to reconsider the way the bill is currently laid out. Both companies have stood by their arguments, stating they will discontinue the apps in the UK rather than risk weakening their current encryption standards.
WhatsApp and Signal did not immediately respond to Gizmodo’s request for comment.
The companies operate globally, and WhatsApp is ranked as the number one most-used encryption app, garnering more than two billion monthly active users last year, according to Statista. Given its global popularity, WhatsApp says its concerns are valid, explaining in the letter that it is not possible to adhere to its end-to-end encryption services when the UK government is increasing surveillance on the apps.
“We aren’t the only ones who share concerns about the UK Bill,” WhatsApp and Signal wrote in the letter. “The United Nations has warned that the UK Government’s efforts to impose backdoor requirements constitute ‘a paradigm shift that raises a host of serious problems with potentially dire consequences.’”
The Online Safety Bill, in addition to targeting pornographic deepfakes, criminalizing the encouragement of self-harm, and forcing social media sites to more strongly enforce their terms of service, aims to address what legislators deem a major concern of child abuse and child sexual abuse material going unregulated in the UK. The bill explicitly states that it will monitor any messages that go against its guidelines. These include paying a child for sexual services, inciting the creation of child sexual abuse material, or arranging or securing child sexual abuse material.
Rich Collard, the associate head of child safety and online policy at the NSPCC, a British child protection charity, told The Guardian that the group will scrutinize the bill to “make it a legal requirement for platforms to identify and disrupt child sexual abuse taking place on their sites and services.”
He continued, “Experts have demonstrated that it is possible to tackle child abuse material and grooming in end-to-end encrypted environments. Regulation should incentivise tech companies to find a balanced settlement and distance themselves from tired false arguments that claim children’s fundamental right to safety online can only be achieved at the expense of adult privacy.”
At the same time, prior iterations of the bill had promised to impose a “duty of care” on tech companies to protect adult users from “legal but harmful” content, amounting to what critics called a “censor’s charter” prior to the provisions being removed late last year.