European Commission Revives Push for Encryption Backdoors in ProtectEU Strategy

The European Commission's new internal security strategy, ProtectEU, puts government access to encrypted communications back on the table. It is presented as a "vision and workplan" spanning several years and stops short of concrete policy proposals.

What the strategy says

The Commission's press release frames the threat picture as growing pressure from hostile states, criminal groups and terrorists "operating increasingly online", alongside surging cybercrime and attacks against critical infrastructure. Against that backdrop the strategy covers six areas, one of them "more effective tools for law enforcement" — which is where online encryption comes under scrutiny.

When describing how the groundwork for mandating encryption backdoors might be laid, the document reaches for euphemisms: it speaks of roadmaps for "lawful and effective access to data for law enforcement" and of seeking "technological solutions for accessing encrypted data". A separate technology roadmap on encryption is meant to help find those solutions.

Who bears the risk

The strategy promises that cybersecurity and fundamental rights will be protected as a future mechanism is implemented. Critics argue no one can make that promise: a backdoor, once it exists, is effectively available to all actors, including the hostile states and non-state groups the strategy is supposed to defend against.

The core issue is that encryption delivers both the privacy of communications law enforcement wants to reach and the technical security of those communications, financial transactions and more. That is the argument tech companies and privacy advocates keep raising whenever such initiatives surface. The EU is not the first government to look for ways to legislate around encryption, but the objections follow the same pattern each time.

Centralisation: SIAC and Europol

Other prominent points in ProtectEU concern centralisation. One is increased intelligence sharing between member states and the bloc's Single Intelligence Analysis Capacity (SIAC), presented as a way to "anticipate" security threats.

Another is giving the EU's law enforcement agency Europol more powers, including around cross-border and large-scale investigations, in the process making it "a truly operational police agency". Member countries are told the purpose is to reinforce support for them.