‘Flip-the-Switch Risk’ Is a Threat to All Internet Users
By: Dean Patrick
Tags: Technology, Internet, Encryption, Privacy

Encryption makes the internet work. It consists of a few elegant math equations that scramble data before being sent over the internet where prying eyes could otherwise intercept it, read it, and manipulate it. Without encryption our use of the internet would be limited to unimportant communication; anything valuable or interesting could and would be tampered with.

Encryption is the reason everything from financial transactions to state secrets get whipped around the internet nearly instantaneously— unlocking untold amounts of innovation, wealth, and prosperity as a result.

But not all encryption is created equal. Some forms of encryption expose the communications of internet users to private companies and others those companies choose to share your data with.

A lot of technology companies claim to have products that are “end-to-end encrypted”. This is often misleading. For example, as recently as March Zoom claimed in their security white paper that hosts could “enable an end-to-end encrypted meeting” with the click of a button. After backlash, Zoom quietly changed the language in their white paper to avoid using the term “end-to-end encrypted”.

The backlash was due to a critical distinction that Zoom failed to acknowledge between standard web encryption sometimes called “client-to-server” (C2S) encryption and true “end-to-end” (E2E) encryption.

The difference between C2S and E2E encryption can’t be over overstated. Simply put, it is the difference between communicating privately, and having everything you do monitored.

The difference between C2S and E2E encryption can’t be overstated. Simply put, it is the difference between communicating privately, and having everything you do monitored.

As the above graphics illustrate, C2S gives the company access to unencrypted data since the data is held on servers that sit behind the point where encryption occurs. Encryption was meant to secure communication between the sender and the recipient. But C2S encryption has an achilles heel. A vulnerability giving the company that runs the service, application or device that you use access to your communications.

E2E encryption covers the achilles heel of C2S and preserves totally private two-party communication. This is what E2E means. One “end” is the sender and the other “end” is the recipient; there is no pesky server in between allowing a third party to listen in.

This Problem is Not Limited to Your Laptop

Most homes today have some sort of internet-connected device in them. Whether it’s your refrigerator pinging the manufacturer to let them know the temperature gauge isn’t working right, or it’s an Alexa device telling dad jokes on demand by pinging Amazon, your home is almost certainly connected to the internet.

This new reality means the decision of a company to use C2S or E2E encryption has implications for the safety of the devices in your home, pocket, and on your wrist. Given this, the security and privacy practices of private companies increasingly affect your physical safety. In other words, encryption is getting physical.

C2S Encryption Exposes Users to Flip-the-Switch Risk

I refer to the dangers of C2S encryption as flip-the-switch risk. What is flip-the-switch risk? Let’s say you buy a product from a company you absolutely love and trust unconditionally.

A company that comes to mind that fits this description for a lot of people is Apple. Apple makes incredible products. Imagine Apple rolls out a new iPhone where all the phone’s data is encrypted on Apple servers using a form of C2S (disclaimer: this is not how Apple encrypts iPhone data today).

You trust Apple. And this iPhone is so jam packed with upgrades like ear-ID, a camera that can zoom in far enough to see cells, and a processor that can calculate Pi’s final digit. You buy this iPhone. You buy it because you assume no one at the company will use your new phone’s data to blackmail you or to steal your credit card information to go on a spending spree. Or at least, you feel the low risk of something like this happening is worth the incredible new features.

But the Apple of today may not be the Apple of tomorrow. Let’s say a wealthy, secretive group of investors buy up a majority stake in Apple. They then oust the board of directors, install a new CEO who then decides to sell your data to the highest bidder. This phenomenon is known as flipping-the-switch. The fact you trust the people at the reigns of a company that holds your sensitive data today, does not protect you from those people ultimately leaving, and having the switch flipped on you.

While it’s unlikely Apple will be subject to a hostile takeover that leads to selling user data en-masse, this example illustrates a larger risk that users of companies who use C2S encryption expose themselves to.

Flip-the-switch risk manifests in lots of smaller, real ways. For example, Fitbit was acquired by Google in late 2019. If you were one of the 28 million Fitbit users at the time of acquisition your sensitive health data was suddenly handed over to a new company who you may or may not trust. Amazon’s acquisition of PillPack in 2018 is another example of a tech behemoth acquiring their way to sensitive user data.

Flip-the-switch risk also applies to insiders. In fact, this is the most common way sensitive user data gets exposed. An engineer who is also a spurned divorcee spies on their ex. Or a network administrator who is also a crazed super fan stalks a celebrity. Amazon fired several Ring employees in January for spying on customer footage without consent. All of these are examples of flip-the-switch risk. Your data gets exposed the moment the wrong person gets access to it. C2S encryption opens a pandora’s box of exactly this kind of exposure.

As a user, you can never trust that the people with the keys to your data now won’t hand them over to someone else in the future. This is the essence of flip-the-switch risk. Demanding E2E encryption is one of the ways you can insulate yourself from flip-the-switch risk, removing the possibility of anyone else ever gaining access to your data.