ChatControl in Disguise
In August 2026, the European Commission officially released a cryptography roadmap, demanding that law enforcement agencies acquire the ability to crack encrypted chats by 2030. Their core justification is a staggering figure: European police currently cannot access crucial evidence in approximately 85% of their cases.
This ProtectEU strategy, which sounds like a measure for counter-terrorism and security, is actually the rebirth of the 2022 ChatControl bill. Back then, the EU attempted to force client-side scanning of encrypted messages under the pretext of combating child sexual abuse material (CSAM), but it was ultimately shelved due to a lack of a qualified majority in the Council.
Now, the core provision has been replaced with “lawful and effective access to data,” cloaked in the guise of preventing cyberattacks. This proves that a terrifying legislative strategy is working: just rename and resubmit every 18 months, and it will eventually pass.
Math Doesn’t Support “Good Guys Only”
Faced with police demands, the cryptography community has delivered a very cold response. About 40 civil rights organizations and over 40 experts co-signed an open letter requesting to participate in the development of the technical roadmap, but they have yet to receive a response.
The statement by Matthias Pfau, CEO of Tuta Mail, revealed the core contradiction: “There is no technological silver bullet; access for only the good guys is impossible.” Under the mathematical principles of end-to-end encryption, only ciphertext is stored on the server. Any method that allows a third party to read plaintext on demand is fundamentally a backdoor.
In the objective world, there is no cryptographic technology that can automatically distinguish whether “this is a court-authorized request” or “this is a hacker attack.” Once a master key exists, it can be stolen by hackers, abused, or even coerced by foreign governments.
Figure: Report on the ProtectEU encryption roadmap. Source: OpSec Insider
The Resistance of Physical Isolation
Faced with the EU’s tough stance, privacy tech companies have chosen the most direct counterattack. Mainstream encrypted service providers such as Signal, Proton, and Tuta have collectively stated: they would rather exit the EU market than implement exceptional access mechanisms in their products.
In 2026, GrapheneOS, a privacy-focused project, completely withdrew from its local data center due to France’s data access demands. This is the first privacy project to proactively move out of an EU country due to compliance pressure. This shows that the battle between tech companies and regulatory bodies has escalated from verbal protests to physical isolation.
It is worth noting that the EU’s expert group officially listed VPN services as a “key challenge” facing law enforcement for the first time. This characterization, equating privacy tools with criminal tools, has left the entire open-source and privacy community feeling extremely uneasy.
Figure: Diagram of end-to-end encryption principles. Source: Wikimedia Commons
The Patience of Power
Both sides of the argument face their own practical dilemmas. Law enforcement agencies, dealing with an 85% data black hole, certainly bear immense counter-terrorism pressure; while security experts are defending the baseline of trust in modern internet communication.
On the path to breaking encryption, the US has already made concessions on storing data and decrypting metadata, and the UK’s IPA act is heading down a similar path. The European Commission has shown great patience in this game: the parliament cannot actively legislate, while the Commission only needs to succeed once.
ProtectEU repackages a previously rejected proposal with a counter-terrorism shell, proving that regulatory agencies can use time to wear down the energy of opponents. An encryption backdoor can never mathematically be made “only for the good guys.” Once this master key is forcibly forged, its holders will no longer just be anti-terrorism police, but any organization capable of stealing it.
References:
- ReclaimTheNet Report
- OpSec Insider Report
- HN Discussion (HN)
