Privacy-focused technology firms are raising alarms over proposed French legislation that could undermine encryption and impose restrictions on VPN services, posing significant threats to user privacy and cybersecurity.
Encryption Backdoors in ‘Narcotrafic’ Law
A proposed amendment to France’s “Narcotrafic” law aims to compel providers of encrypted communication services to implement backdoors, allowing law enforcement to access decrypted messages of suspected criminals within 72 hours of a request. Non-compliance could result in substantial fines: €1.5 million for individuals and up to 2% of annual global turnover for companies. The amendment has passed the French Senate and is advancing to the National Assembly.
Privacy-focused email provider Tuta (formerly Tutanota) has urged the National Assembly to reject this amendment, emphasizing that mandating backdoors would create vulnerabilities exploitable by malicious actors, thereby compromising the security and privacy of all users, not just criminals. Tuta Mail’s CEO, Matthias Pfau, stated, “A backdoor for the good guys only is a dangerous illusion.”
VPN Providers Face Blocking Demands
In a related development, rightsholders Canal+ and the French Football League (LFP) have initiated legal actions to compel VPN providers to block access to pirate sites and services. The VPN Trust Initiative (VTI), whose members include AWS, Google, Cloudflare, Namecheap, OVH, IPVanish VPN, Ivacy VPN, NordVPN, PureVPN, and ExpressVPN, has expressed strong opposition to this measure. VTI argues that focusing on content-neutral tools like VPNs, rather than addressing the sources of illegal content, fails to combat piracy and creates collateral damage to cybersecurity and privacy, putting users at risk.
VTI warns that such measures could set a dangerous precedent for government overreach into encrypted services, potentially leading some VPN providers to consider exiting the French market to maintain their commitment to privacy and security standards.
Global Implications for Privacy and Security
These legislative efforts in France are part of a broader global trend where governments attempt to control encrypted services under the guise of content regulation. Similar measures have been observed in countries like China, Russia, Myanmar, and Iran, often leading to increased censorship and weakened cybersecurity.
Privacy advocates argue that undermining encryption and imposing restrictions on VPNs not only threaten individual privacy but also compromise the overall security of digital communications. They stress the importance of preserving robust encryption and unrestricted access to privacy tools to protect against cyber threats and uphold fundamental rights.