Scoping Law Enforcement's Encrypted Messaging Problem

Contributor: William A. Carter

Mobile messaging applications such as WhatsApp, Facebook Messenger, iMessage, Telegram, Skype, Line, and others are rapidly becoming the dominant mode of communication around the world. Growing demand for instant messaging (IM) means that its share of global message traffic is estimated to grow from 50 percent to 63 percent in the next few years. Instant messaging traffic is expected to grow more than 20 percent annually through 2022, nearly doubling from 2016 to almost 100 trillion messages per year (or almost 274 billion per day).[i] Many of these apps, called over-the-top (OTT) services and applications, have recently moved to adopt end-to-end encryption, making them inaccessible to law enforcement agencies.

Four of the world’s top twelve mobile messaging apps, as measured by monthly active users (MAUs), have enabled unrecoverable end-to-end encryption by default. This means more than 2 billion individuals globally use end-to-end encrypted messaging applications. Many of the largest messaging platforms have adopted end-to-end encryption (E2EE) in the last two years, including WhatsApp, Facebook Messenger (not by default), and Viber. The largest end-to-end encrypted messaging app by number of users is WhatsApp, which implemented E2EE by default in April 2016. Only a quarter of Internet users in the United States use WhatsApp, but for many other countries WhatsApp is a primary mode of communication.[ii] Approximately 38 percent of global Internet users have WhatsApp on their phones. In Latin America and the Middle East about 66 percent of Internet users use WhatsApp.[iii]

Juniper Research estimates that roughly 108 trillion messages were sent 2016.[iv] Almost 90 percent of those messages are instant messages and e-mails, the majority of which are encrypted, often using HTTPS encryption that is accessible to law enforcement through the service provider. Based on the share of messaging platforms that employ end-to-end encryption, we estimate that about 18 percent of total communications traffic uses end-to-end encryption and is inaccessible to law enforcement.

The share of unrecoverable encryption as a share of total communications traffic is likely to grow, as instant messaging becomes increasingly dominant. Meanwhile, growth in e-mail and short message service (SMS) messaging, which are usually accessible to law enforcement agencies, is expected to be flat.

The rapid growth of IM means that its share of global message traffic will increase from 50 percent to 63 percent.[v] These estimates imply that even if the share of instant messages that are end-to- end encrypted remained constant, more than 22 percent of global messaging will be end-to-end encrypted and inaccessible to law enforcement by 2019 as instant messaging becomes an increasingly dominant mode of communication.

Some messaging applications present challenges for law enforcement that are unrelated to encryption. For example, Kik is a messaging platform that is known to be used by child predators, who use it to identify victims and share sexually explicit material. Kik is not end-to-end encrypted, but it does not retain most user data on its servers, making it impossible to service search war-rants.[vi] Telegram, a popular messaging app, supports end-to-end encryption but does not enable it by default. However, law enforcement has struggled to access even unencrypted communications over Telegram, which hosts its data in Switzerland. Telegram is popular with terrorist groups and was used by the jihadi killers of a French priest in August 2016.[vii] Developed by Russian Inter-net entrepreneurs who were forced out of Russia and fled to Germany, Telegram refuses to comply with law enforcement requests for data.[viii]

To learn more about the impact of encryption on law enforcement access to communications and data, you can access our report on the topic here.

_______________________________________________________________________________
[i] Windsor Holden, “A2P Messaging,” Juniper Research, September 19, 2016, https://www.juniperresearch.com/researchstore/content-applications/mobile-online-messaging/sms-rcs-im-markets.
[ii] Statista, “Share of internet users in the United States who use WhatsApp as of August 2017, by gender,” https://www.statista.com/statistics/740654/whatsapp-app-chat-usage-usa/; Simon Kemp, “Digital in 2018: World’s Internet Users Pass the 4 Billion Mark,” We Are Social, January 30, 2018, https://wearesocial.com/uk/blog/2018/01/global-digital-report-2018/  
[iii] Statista, “Usage Penetration of WhatsApp in Selected Global Regions as of 4th Quarter 2015,” https://www.statista.com/statistics/321460/whatsapp-penetration-regions/
[iv] This includes SMS, multimedia message service (MMS), e-mail, IM, and social media posts. See Holden, “A2P Messaging.”
[v] Calculated by CSIS based on Juniper Research data: Lauren Foye, “Mobile & Online Messaging: SMS, RCS & IMMarkets 2015-2019,” Juniper Research, September 6, 2015, https://www.juniperresearch.com/researchstore/telco-service-providers/a2p-messaging/opportunities-competition-forecasts.
[vi] Department of Homeland Security Office of Intelligence and Analysis, “Going Dark—Covert Messaging Applications and Law Enforcement Implications,” September 29, 2015, https://assets.documentcloud.org/documents/2500347/going-dark-covert-messaging-apps.pdf
[vii] “France Terror: Girl, 16, Investigated over Telegram ‘Attack Plan,’” BBC, August 10, 2016, http://www.bbc.com/news/world-europe-37033271; “TIMELINE: Aaron Driver’s History of Radicalization,” CBC, August 11, 2016, http://www.cbc.ca/news/canada/aaron-driver-timeline-1.3717169.
[viii] Electronic Frontier Foundation, “Secure Messaging Scorecard,” https://www.eff.org/secure-messaging-scorecard
Image
James Andrew Lewis
Senior Vice President; Pritzker Chair; and Director, Strategic Technologies Program