STJ clears fine against company unable to intercept end-to-end encrypted messages
15/02/2021
It was recognized, at the time, that “no one can be forced to do the impossible”
The Third Panel of the STJ considered illegal a fine imposed against a company that failed to comply with a judicial order aimed at the interception of messages exchanged in applications by users, suspected of criminal activities. It was recognized, at the time, that “no one can be forced to do the impossible” in view of the existence of end-to-end encryption and the technical impossibility presented by the applicant company.
The specific case refers to an appeal filed by a company seeking the suspension of a fine imposed for failure to comply with the order of breach of confidentiality and telematic interception of accounts in a message application, determined during a criminal investigation. The court of origin understood that the said company had not proved the technical impossibility.
In the appeal, among the arguments presented by the company, the lack of elements demonstrating the technical capacity to intercept dialogues protected by end-to-end encryption is emphasized, as this is applied in the company’s communication services, preventing the fulfillment of orders interception lawsuits.
It also supported the pending judgment in the STF of ADI 5527 and ADPF 403, which discusses, from a constitutional perspective, issues related to end-to-end cryptography. In particular, the suspension, by court order, throughout the national territory, of the operation of the instant messaging application, justified by the non-availability to the judicial authority of the content of private messages exchanged by users of the application submitted to criminal investigation.
Minister Ribeiro Dantas, author of the vote that prevailed in the trial, adopted the understanding of Ministers Rosa Weber and Edson Fachin, rapporteurs of the aforementioned actions in the STF, according to which “the legal system does not authorize – to the detriment of the protection generated by cutting-edge cryptography the edge in favor of freedom of expression and the right to privacy – whether the technology developers are fined for breaching a court order incompatible with encryption ”.
In the vote, a distinction was also made regarding the precedent of the Third Section, in which the possibility of imposing a fine was defined to compel a foreign company operating in Brazil to provide user data required by court in criminal investigations. This is because in this specific case there was the existence of end-to-end encryption and the claim of technical impossibility.
Wilson Sales Belchior