Several governments have now made it clear that they are at war with encryption technologies, or intend to be. National security and terrorism are the two great wildcards that those in power use to justify certain actions, and in Russia's case, its new anti-terrorism law gives authorities very broad powers, including the ability to collect encryption keys through local internet providers.
A religious fanatic picks up a firearm and kills several people in a restaurant, but somehow encryption technologies end up taking part of the blame. You don't have to look far to see and hear politicians' opinions on the matter. The UK is still seeking to ban "point-to-point". Donald Trump wanted to talk to Bill Gates and propose his idea of "closing" parts of the internet. The Brazilian government has on more than one occasion ordered WhatsApp to cease operations until it hands over access to the content of certain messages. And finally we come to Russia's new anti-terrorism law, which grants the state the ability to collect not only metadata (for 36 months), but also the content of messages (for six months), including encryption keys to facilitate the entire process.
According to the Russian Federal Security Service, the process for internet providers to hand over all relevant information has been formalized, probably in response to the two-week deadline that President Vladimir Putin gave the service after his order to "obtain" encryption keys. Part of the announcement was "lost in translation", and for a moment it seemed Russia had technology capable of breaking all encryption methods in use, but that is not the case. The text of the new anti-terrorism law, which tends to be quite ambiguous, cites three services as examples: WhatsApp, Viber and Telegram. No one knows for sure whether those three systems are already "compromised", and their spokespersons refused to comment.
The problems with the anti-terrorism law are not limited to its ambiguity, or the excessive power it grants. It also affects infrastructure. At least three local providers indicated that it is economically impossible to build and maintain the platforms needed to store such a volume of information. On the other hand, it's also unclear exactly what type of traffic the law targets. Are we talking about SSL keys, or must electronic payment systems be intercepted? What will happen with VPNs? Meanwhile, those responsible for projects like Tor recommend using services based on that network, such as Ricochet. There are no servers, no metadata.
