Jump to:

'The stakes could not be higher' — VPN providers oppose EU plans to weaken encryption

News
By published

The so-called 'Chat Control' bill is receiving significant backlash

Row of European Union flags flying in front of a modern building. The flags are dark blue with a circle of yellow stars
(Image credit: Jacek Kadaj / Getty Images)
Jump to:

A collection of VPN providers has issued a stark warning over the dangers of weakening European encryption laws.

The VPN Trust Initiative (VTI), which includes some of the best VPN providers, has issued a statement and paper opposing the so-called "chat control" law being proposed by European Union (EU) member states.

"Weakening encryption doesn't make us safer"

In a detailed paper discussing the bill, the VTI says "all VTI members are unequivocally opposed to online criminal activity, and support effective measures to reduce online harms."

It keeps on saying, however, that there needs to be a "balance between crime-fighting and user safety," adding that "weakening encryption harms the very security it seeks to protect."

What is encryption?

Encryption encodes data. It turns it into a random string of unintelligible characters, and prevents it from being read by snoopers and hackers. Encrypted communication between a sender and receiver is private.

The VTI argued that everyone's encryption security and privacy shouldn't be sacrificed in order to catch a small minority. It urged "policymakers to avoid measures that erode encryption and put user safety at risk."

"With the EU’s Member States set to vote on Chat Control, the stakes could not be higher," said Emilija Beržanskaitė, Co-Chair of the VTI. "Weakening encryption doesn’t make us safer, it makes every citizen, every business, and every government more vulnerable."

To add to the controversy, it has been suggested that accounts from EU politicians, government, and military officials will be exempt from the laws, with "professional secrecy rules" cited.

Cartoon of laptop with padlock on keyboard. White CCTV cameras are surrounding it, with a salmon pink background

(Image credit: J Studios / Getty Images)

The VTI's criticisms

Security Risks

The VTI says the law would give authorities the power to scan private communications, including those that utilise end-to-end encryption.

A form of "targeted" access is being proposed, where only certain information (shared URLs, pictures, and videos) is scanned before getting encrypted. However, the VTI doesn't see this as a solution, arguing that you either provide full encryption for everyone or no one.

It says "there is no way to create a selective weakness" that selected individuals can exploit. Inevitably, any weakness could also be exploited by hackers.

The VTI also argues that weakening encryption directly contradicts the EU's roadmap to post-quantum cryptography. Post-quantum encryption is the new industry standard, and a handful of VPNs have already adopted it. The VTI says you "cannot have opposing initiatives."

The following recommendations were proposed by the VTI:

  • Reject any legislation that weakens encryption, mandates encryption backdoors, or imposes technical requirements
  • Preserve strong encryption standards without exception for companies dealing with user data
  • Strengthen targeted and proportionate investigative capabilities that do not require weakening encryption

Privacy Risks

Encryption can be a lifeline for journalists, activists, and those living under internet censorship. It protects individuals and enables safe and secure access to communication. The VTI calls encryption "a non-negotiable safeguard for the rights to privacy and freedom of expression."

The group warns that, if encryption is weakened, personal data is at risk. Hackers can steal or misuse data. The VTI says encryption protects everyone, "not just those with something to hide."

The VTI called on privacy to be preserved by "design and default."

Practical Realities

The VTI believes encryption "is not the root cause of online crime." It argues the "real drivers" are not being addressed and "breaking encryption only exposes vast majorities of law-abiding users."

Once encryption is broken, the VTI says there's "no way back" and small exceptions are in danger of becoming "broader mandates" – which will erode original safeguards.

Concerns are also raised about a "global domino effect" and the potential of other regimes using this legislation "to justify intrusive surveillance."

The VTI recommends:

  • Law enforcement are provided more resources
  • Public-private collaboration is fostered to achieve online safety that doesn't compromise security

What happens next?

The bill didn't get full member support at last week's meeting. It has been reported that Germany's lack of support for the legislation was a key factor in this outcome. However, Denmark is pushing ahead with the bill.

The Danish Minister of Justice, Peter Hummelgaard, has been quoted as saying, "We need to break with the completely erroneous perception that it is everyone's civil liberty to communicate via encrypted messaging services."

The next meeting is due to take place on October 14, and we could see some changes in the position of member states between now and then.

Following this meeting, the legislation would have to pass through the EU Parliament for the final trilogue negotiations with the European Council and Commission before becoming law.

The failure to achieve full support has been seen as a victory by privacy advocates. But many are expecting further attempts to weaken encryption and this will continue to be opposed.

Follow Tom's Guide on Google News, or add us as a preferred source, to get our up-to-date news, analysis, and reviews in your feeds. Make sure to click the Follow button!

Disclaimer

We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

George Phillips
George Phillips
Staff Writer

George is a Staff Writer at Tom's Guide, covering VPN, privacy, and cybersecurity news. He is especially interested in digital rights and censorship, and its interplay with politics. Outside of work, George is passionate about music, Star Wars, and Karate.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Back To Top