Policymakers often face a dangerous dilemma: preserve privacy and security for everyone, or break encryption so law enforcement can catch criminals. This is a false choice.
Encryption is a fundamental technology that protects the confidentiality and integrity of data, communications, devices, and services. It is essential to a secure, trustworthy Internet.
Law enforcement agencies do not need to jeopardize the digital safety of billions of users to investigate crimes effectively.
We are living in the golden age of digital evidence. Agencies have access to more data today—location history, metadata, and transaction logs—than ever before. And breaking encryption—through backdoors, client-side scanning, or mandated access—introduces systemic vulnerabilities that criminals and hostile states will exploit, making the Internet less safe for everyone.
The Solution: Effective Tools (Support These)
Law enforcement agencies already have access to a broad and diverse investigative toolkit that does not require weakening encryption or undermining the technical foundations of the Internet.
Instead of demanding “magic keys” into encrypted data, governments and law enforcement should focus on these investigative methods:
- User reporting: Law enforcement can often get important evidence directly from witnesses, victims, or cooperating individuals involved in criminal activity. Easy-to-use mechanisms for user-reported crime and for recovering digital evidence from devices can facilitate this process.
- Undercover operations for covert and serious crimes, such as those against children: Traditional policing adapted for the digital age—such as infiltrating groups and using decoy accounts—remains the gold standard for catching predators.
- Voluntary cooperation: Fast, reliable channels for platforms to share non-content data (login history, account activity) solve more crimes than mandated technical weaknesses.
- Metadata analysis: Encryption protects content, not behavior. Investigators can build timelines, map criminal networks, and identify suspects using non-content data—who, when, where—without decrypting messages. (This measure does not imply a call for blanket collection and retention of any such information about every user.)
- Digital forensics on seized devices: Accessing data physically stored on a suspect’s seized device is a targeted alternative to mass surveillance. It accesses evidence at the endpoint, leaving the secure “pipe” intact for the rest of the world.
The Red Zone: Dangerous Proposals (Reject These)
Some investigative techniques pose far greater risks to cybersecurity, human rights, and public trust than others. The risks that these intrusive measures pose vastly outweigh their speculative investigative benefits.
Governments and law enforcement should avoid relying on these methods of obtaining encrypted data:
- Mandated backdoors: Backdoors intentionally insert weaknesses into software so that authorized parties, such as law enforcement, can access information. In reality, there is no such thing as a backdoor that only the “good guys” can use.
- Client-side scanning: This method uses systems to scan content on a person’s device before it reaches a recipient, essentially turning user devices into surveillance tools.
- Lawful access by design: This is a marketing term for systemic vulnerabilities. No system can provide exceptional access without weakening security.
Weakening encryption for anyone weakens it for everyone. When vulnerabilities exist, criminals, hostile states, and other malicious actors can exploit them.
These approaches create systemic risks, fail the tests of necessity and proportionality, and threaten the open, globally connected, secure, and trustworthy Internet. These harms are intrinsic and unavoidable.
Recommendations
Policies should strengthen, not weaken, encryption. Encryption is essential for maintaining the confidentiality, integrity, and authenticity of data and communications. It underpins a secure and trustworthy Internet and protects individuals, businesses, governments, and critical infrastructure.
Investigative measures must also be targeted, lawful, and limited to what is strictly necessary and proportionate to the seriousness of the crime. Measures that undermine the security of all users in order to investigate a limited number of cases fail this test and should not be pursued.
Policy and operational approaches should support a secure, trustworthy, and resilient Internet that protects data confidentiality, integrity, and availability. Maintaining strong cybersecurity across the digital ecosystem is essential for public safety, economic stability, and trust in digital services.
The Bottom Line
Protecting strong encryption is not an obstacle to public safety, child protection, or crime prevention. It is a prerequisite for all three, and a necessary component of a secure and trustworthy Internet.
Policymakers must stop looking towards security-eroding workarounds and instead start investing in the human and forensic capabilities that solve crime.
Want to learn more? Read our full report.
Image © Sasun Bughdaryan on Unsplash