THE HAGUE - A new report by the EU Innovation Hub for Internal Security looks into how to uphold citizens’ privacy while enabling criminal investigation and prosecution.

Encryption represents an important means of securing private communications. However, at the same time, it also enables threat actors to manage their malicious activities below the radar of law enforcement. Understanding the needs and challenges of stakeholders in the Justice and Home Affairs (JHA) community is the foundation of adopting the necessary measures to keep Europe safe, while safeguarding fundamental rights.

Cite this publication: EU Innovation Hub (2024), First Report on Encryption by the EU Innovation Hub for Internal Security, Publications Office of the European Union, Luxembourg.

Executive summary

The first report on encryption created by the EU Innovation Hub for Internal Security presents an analysis on the topic of encryption from a legislative, technical and developmental viewpoint. It also touches upon certain specific judicial process and court rulings about overcoming encryption in cases where it represents an obstacle for criminal investigations, especially in relation to evidence admissibility.

In the last few years, the debate between data privacy and lawful interception (LI) has evolved into a more constructive discussion. While police and judicial authorities acting within their power can be prevented from accessing digital
evidence by modern privacy-enhancing technologies like end-to-end encryption (E2EE) and Rich Communication Services (RCS) systems, different international initiatives are calling for a balanced approach, where LI can coexist with encryption without undermining cybersecurity and/or privacy.

At the same time, a framework to access encrypted communications is steadily taking shape in the EU. As technology advances, finding a balance between individual privacy and collective security remains an ongoing challenge. The key to success is to foster dialogue, cooperation and innovation to ensure that fundamental rights (including protection of personal data), as well as the security and integrity of the person, are equally respected.

The newly adopted e-evidence package can be seen as a step in the right direction for enhancing law enforcement access to electronic evidence. However, the package does not specifically address the challenges related to encryption outlined in this report because the regulation does not include obligations for service providers to make data in the clear available.

The admissibility of evidence gathered from encrypted communication channels has been legally questioned in a number of countries. However, several courts have dismissed such challenges, thereby setting precedents in favour of using evidence gathered in this manner (for instance, the French Court of Cassation accepts the use of evidence from the EncroChat
cryptophone service).

Court rulings in Germany, Italy and the Netherlands have also established that evidence gathered through authorised interception by other nations (e.g. France, Canada) is valid and usable in domestic criminal proceedings. In other words, courts in these countries have concluded, in several instances, that data gathered in this manner is obtained lawfully and in a proportional manner. In its ruling of 30 April 2024, the Court of Justice of the European Union clarified conditions under which intercepted data from encrypted communication channels can be requested and transmitted between EU Member States, and used in criminal proceedings as evidence.

Technologies using encryption present many challenges but also opportunities for law enforcement and security practitioners. In this paper, we will look at encryption challenges and opportunities in relation to various technologies, i.e.: quantum computing, cryptocurrencies, biometric data, the Domain Name System (DNS), telecommunication technologies, artificial intelligence (AI) and large language models (LLMs).

For example, cryptocurrencies are widely used for laundering criminal proceeds and there are concerns that tracing funds will become more complicated if zero-knowledge proofs and layer 2 applications are more widely deployed in the blockchain. On the other hand, the use of custodial wallets, where the user does not hold their own private key, create opportunities for cooperation between law enforcement authorities, exchanges and service providers to seize crypto assets that are suspected to be of criminal nature.

In the realm of DNS encryption, two competing approaches have surfaced, DoT/DoQ and DoH/DoHTTP3. In both cases, the content of the DNS messages is encrypted, hindering the lawful access to suspects’ DNS traffic contents. In practice, it means that law enforcement will become more dependant of DNS service providers’ cooperation.

Similarly, the use of encryption in 4G (VoLTE) and 5G (Standalone 5G) telecommunication technologies complicates law enforcement and judicial authorities’ ability to carry out investigations. These standards introduce endto-end encryption (E2EE) for voice calls over the network, which complicates lawful interception of criminal communications in roaming scenarios. For this reason, it is important for the communication service providers to disable privacy-enhancing technologies in home routing scenarios. Looking into the future, it is vital that law enforcement needs are taken into account when designing standards for the next generation telecommunication services (e.g. 6G) and that the architecture introduced has innate features that enable law enforcement to carry out their criminal investigations.

The use of biometric recognition is predicated on being able to safely store and use biometric data, which can be enabled by biometric template protection (BTP) technologies. These technologies enable citizens to, for example, use national ID cards, passports or conduct banking transactions through biometric verification, while recognition comparison operations take place
in the encrypted domain. The security and privacy of current biometric recognition systems still need to be enhanced before they become fully deployable in public services.

Artificial intelligence (AI) and large language models (LLMs) continue to play an important role in cryptography. These technologies can be used for both strengthening encryption algorithms as well as for analysing cryptographic security systems, which in some cases helps break the encryption by scrutinising its mathematical properties.

The same goes for the advancements that are being made in the field of quantum computing, which can be used for breaking cryptographic protocols in the future. This ties in with the well-known concept of ’store now, decrypt later’ that could create opportunities for law enforcement to decrypt stored criminal communications, but also creates risks as malicious actors might also be gathering encrypted data with the same prospect in mind. In addition, quantum computing will likely also support the creation of new digital forensic techniques that help with the retrieval of electronic evidence in investigations.

The main future research areas relevant for policymakers in the areas of law enforcement and justice will most likely be the use of “user-controlled” encryption (and its effect on digital forensics and decryption capabilities), the development of quantum computing, and the use of encrypted data for development of machine learning (ML) algorithms. The EU has different funding
schemes that can be leveraged to develop research projects to address the challenges related to these technologies.

To download the full report, visit: https://www.europol.europa.eu/cms/sites/default/files/documents/EU_Innovation_Hub_First%20Report%20on%20Encryption.pdf