The state would like to replace WhatsApp or Telegram with its own communication application

When two Czech officials communicate via WhatsApp or Signal today, their messages travel through the infrastructure of foreign companies, and although these and other applications offer end-to-end encryption, for example, the state practically has no control over the data. This is precisely what the Czech Republic wants to change in the future. Deputy Minister of Interior and Government Commissioner for Digitalization and Strategic Security Lukáš Klučka revealed to Lupa.cz that the state is considering operating its own alternative to communicators like WhatsApp, Signal, or Telegram. This information emerges at a time when governments worldwide are addressing to whom they are entrusting their potentially sensitive communication.

What we know about the project so far

The goal of the state communicator is to provide secure data communication for the state and its key entities, i.e., security forces, ministries, and other organizations, writes Lupa. The application should meet high security standards and ensure, among other things, that data will not leave the country. According to Klučka, the deployment of post-quantum cryptography (PQC), which is encryption resistant to future quantum computers, is also being considered.

The plans are part of the revised concept of the BIVOJ project. This project aims to carry out a major revision and unification of state networks, which should simultaneously increase security and optimize costs. The communication application is just one of the sub-projects falling under BIVOJ. Part of the activities will also be taken over by NÚKIB – according to Klučka, it should build a secure DNS, for example.

Signal leads today, NÚKIB also praises Threema

According to Lupa, state officials often opt for Signal today. Lupa recalled that NÚKIB, in its 2022 analysis of communication applications, also highly rated the Swiss Threema. Both applications feature end-to-end encryption for all forms of communication but differ in their emphasis on privacy.

The greatest asset of Threema is anonymity: it does not require a phone number or email for registration; the user only receives a randomly generated ID. The Swiss jurisdiction and the fact that it is a paid application also score points – thus, the operator has more transparent funding sources. The trade-off is a smaller user base and fewer features, which, however, is not an issue for widespread deployment within a single organization. NÚKIB had not registered any security incidents at the time of the analysis’s publication.

Signal, on the other hand, is the most popular encrypted communicator and offers more convenience – group video calls, automatic message deletion, or open-source code that anyone can audit. Its weakness from a privacy perspective is the linking of the account to a phone number, meaning it cannot be used completely anonymously. It is operated by the non-profit Signal Foundation, based in the USA.

Poland recently introduced its own communicator

The Czech Republic is not alone in considering its own solution and can find inspiration right next door. The Polish Ministry of Digital Affairs, together with the research institute NASK-PIB, launched testing of the mSzyfr communicator this April – the first communicator fully under Polish jurisdiction. It is intended for public administration bodies and entities of the national cybersecurity system; its servers are located on Polish territory and are managed by people with security clearance.

End-to-end encryption covers not only text and voice messages but also audio and video calls, transferred files, and metadata, with the system also capable of handling classified information up to the “restricted” level. According to Lupa, the fact that Signal became the target of social engineering campaigns aimed at officials also contributed to the Polish decision. Similar national tools are currently operated in Europe only by France, Germany, and Estonia.

Should the state develop its own communication application, or rather widely deploy a proven solution like Threema?

Sources: Lupa.cz, NÚKIB, gov.pl (1, 2)