Skip to main contentSkip to navigationSkip to navigation
Teenager talking on Skype on Apple laptop computer, England, Britain, UK
'Occam’s razor strongly suggests that Skype has never been as private as we’ve been encouraged to believe.' Photograph: Alex Segre / Alamy/Alamy
'Occam’s razor strongly suggests that Skype has never been as private as we’ve been encouraged to believe.' Photograph: Alex Segre / Alamy/Alamy

Don't believe the Skype: it may not be as private as you might think

This article is more than 11 years old
Skype has always refused to reveal its encryption methods and could now be giving police access to users' conversations

When Skype became popular just under a decade ago, I repeatedly asked the company a question that I considered crucial. The online calling and messaging service encrypted users' communications, and it was based outside the United States. But the encryption methods were kept secret, so outside researchers couldn't verify their quality – a technique that experts in the field sometimes deride as "security through obscurity" – and I wanted to know whether Skype had a software backdoor that it or anyone else could use to listen into users' calls. I was repeatedly given a non-denial denial – that is, an assurance that the information was being encrypted but no guarantee beyond that. So I assumed that Skype shouldn't be considered a foolproof way to have an absolutely private conversation.

That assumption grew firmer when eBay bought Skype in 2005, putting Skype under American legal jurisdiction at a time when the Bush administration was routinely and illegally spying on citizens' communications and Congress was a partner in destroying civil liberties. Moreover, eBay had a reputation for giving law enforcement just about anything it requested under just about any pretext.

Washington's attitudes are, if anything, more police-statish than before. The Republicans don't believe in any restraints on police, while Democrats who hated the Bush policies are supine now that the Obama administration has, if anything, expanded on the worst of the prior administration's practices. And Skype now is part of Microsoft. So I am yawning at a spate of reports, most recently in the Washington Post, that Microsoft is giving law enforcement what torture fans might call "enhanced access" to Skype users' conversations. The company's statement on the matter says no recent changes have been made; but Skype also says this: "Skype takes appropriate organisational and technical measures to protect your information within our control with due observance of the applicable obligations and exceptions under the relevant law."

To be clear, I don't know one way or the other whether Skype has been secretly helping police and security officials listen in on conversations. I do know that the company, as in its statement above, persists in giving non-answers to the question. Some police in some jurisdictions have complained loudly over the years that they have been thwarted by Skype. But Occam's razor strongly suggests that Skype has never been as private as we've been encouraged to believe. To reach that conclusion, I combine the company's history of obscuring how the encryption works with its more recent ownership by government-friendly corporations.

Does this mean you shouldn't use Skype? Of course not. It works fine for most purposes. I've used it a lot over the years with family and for some interviews. But if I was working on a project I needed to keep absolute secret from ruthless competitors, I wouldn't trust it. As a journalist, I'd never use it to communicate with sources to whom I'd promised protection from exposure. And if I was an anti-government activist in places like Syria, I'd be extremely reluctant to trust that the murderous regime couldn't listen in.

This is the reality, sadly, for just about all communications tools that are the property of large companies. I trust some companies more than others. But in the end, I can't be assured that they will stand for their users when governments come calling, or that they can't be compromised in other ways.

Even if you decide that you trust Skype, there's another issue to consider: Microsoft announced recently that it planned to insert adverts into your conversations. That alone would give many folks a reason to find an alternative, as the Free Software Foundation has been urging for years; the foundation tracks progress of some of the alternatives on its website.

I've been testing an application called Jitsi, which is recommended by one of the developers of Tor, a secure web-browsing tool. I'm going to try some others as well. Projects like Jitsi are vital for several reasons. The main one is that they're being created by volunteers in an open-source model, where the code is available for inspection and testing by the best experts. Another advantage is that a community, not a company, is in control.

The most secure software programme is useless if someone can plant spyware on your computer, of course. Remember that security is a process, and an arms race. We all need to understand the risks, and handle our communications accordingly. I take it for granted that Skype is risky, and am acting on that assumption.

Comments (…)

Sign in or create your Guardian account to join the discussion

Most viewed

Most viewed