Skip to content

Encryption faces an existential threat in Europe

    That’s a lot of lawyers.

    She [Big Tech] are literally throwing hundreds of millions of dollars at this problem. And as much as Ms. Vestager is committed to fighting this, she faces an uphill battle against vast sources of entrenched power. So it will be a tough fight. But what makes me very optimistic is that for the first time I see the committee reaching out to small companies like Proton to really understand what the problem is and get to the root of it.

    It’s a shift. Instead of just listening to what Big Tech’s consultants and lawyers spout, they’re taking the time to talk to small businesses and for the first time – maybe ever – I feel like we have a voice in Brussels.

    When did that shift take place? After the DMA was passed?

    Just within the last year. I think it really shows a change of mindset in Brussels that hasn’t happened in the US so far. In the US, the antitrust battle is much tougher.

    What about other European regulations? I know there is a lot of concern about the legislation drafted by EU Commissioner for Home Affairs, Ylva Johansson, which proposes to force encrypted platforms to automatically search for child sexual abuse material. Is that something you think might affect you?

    Of course it can affect us. There is also the Online Safety Bill here in the UK. It seems like it comes back from the dead.

    But if these things continue, there is a risk of coding being demonized at a time when there are breakthroughs in these other areas.

    The problem with these laws is that they are written too broadly; they try to deal with too many unrelated issues. Let me give you an example from the online safety debate in the UK. Part of the focus is on moderating content on social media. But there is a difference between social media posts versus private messages. Those two things need to be disconnected. So no one is saying that there are no problems and that we shouldn’t try to solve them. But I think we need to clearly define what we’re trying to solve and how the remedy aligns with the actual problem. Otherwise you will come up with legislation that has many unforeseen consequences.

    That could be the case in the UK’s online safety law, which tries to address many different things. But the EU’s chat control proposal makes a strong case that encrypted messages create a space for concern about child abuse. How do you approach that debate? Because it’s so emotional.

    Typically, the purpose of legislation is to intervene when markets fail to create the right incentive structures to force an outcome that is good for society, right? And when you look at, say, the debate over child sexual abuse control, is there any company in the world that is incentivized not to address this issue? I would say no. It’s a huge problem from a PR standpoint, from a business standpoint. So Big Tech and small tech companies like Proton are already deploying all possible means to combat this problem. So since that is already the case, legislation may not be necessary because the incentives to address the problem are already there.