Back in the late 1990s, government rows and corruption controversies were often born from suspicious dealings over a pint in dingy pubs near Westminster. Roll forward a quarter of a century and today's sleaze rows centre on Boris "Two Phones" Johnson and his now-ousted advisor, the self-confessed geek Dominic Cummings. The problem is those phones: what is on them, and what has technology been used to hide?
Five years later, the same architecture is failing from the other direction. Prime Minister Andy Burnham has been caught exchanging messages with someone impersonating Susie Wiles, Donald Trump's White House chief of staff. He worked out that it was not her, and reported it. The problem is not that he was fooled; the problem is that the impersonator should never have been able to reach him in the first place. The messaging channel could not tell him who he was talking to. Nor could his phone, his software, or the network the messages travelled over. Hiding a real conversation on Signal, and being reachable by a spoofed White House staffer, are at the architecture level the same problem: there is no identity layer in the device in a public official's pocket.
Chat and messaging apps like WhatsApp and Signal allow messages to be sent and received using end-to-end encryption. That keeps them safe from interception. It does not tell either end who they are actually talking to. Anyone with the right number can reach a prime minister, a president, or an ambassador using the same channel their family and their friends do — an unaccountable lobbyist, a foreign state, a convincingly fake chief of staff. Historically we had tighter controls: calls were witnessed and recorded, letters were read, meetings in person were done with a civil servant present or quickly reported on. Corruption is probably everywhere and always has been, but is new technology making it worse?
We cannot really know for sure, and the only complete solution would be to ban people in public office from using those tools. But those tools are useful, indeed critical, to the pace of modern government. What can be done instead?
Our research examines architectures that hold both properties at the same time: the same end-to-end encryption a citizen expects for personal privacy, and a means by which the messages of public office holders can be attributed with certainty to the parties who sent them, and made accountable to the institutions those office holders serve. In that architecture, only verified accounts can send or receive. There is no way for an unverified sender to reach a prime minister at all: the message would be rejected before it arrived. And in special cases — a politician, a VIP — a copy of their official-capacity messages is written to an encrypted store to which only specific auditors, authorised by parliament, can gain access. That access can be narrow: the messages with a particular hand-dryer mogul, but not the messages between the prime minister and his kids.
Hansard might rightly argue that, in time, a prime minister's messages should be public, just as Churchill's letters are. In an architecture designed for this from the start, communications on matters of state by a serving prime minister could become part of the public record once again, as they should be. That is an important part of our democracy.
