Sign in Subscribe

Democracy Needs Encryption

Encryption protects fundamental rights, and it must be preserved as governments expand their cybersecurity and investigatory powers.

Democracy Needs Encryption
Photo by Joel Muniz / Unsplash

By Mallory Knodel

At IGF 2025, I had the privilege of speaking at the Parliamentary Session “Striking the Balance: Upholding Freedom of Expression in the Fight Against Cybercrime” as a representative of the Global Encryption Coalition. Below is a summary of my remarks, which focused on how encryption protects fundamental rights and why it must be preserved as governments inevitably seek to expand their cybersecurity and investigatory powers. Stay tuned to civil society advocacy positions in anticipation of the upcoming Signing Ceremony of the United Nations Convention on Cybercrime in Hanoi, an event that marks a global shift in how governments approach cybersecurity and human rights for years to come.

The Global Encryption Coalition was founded in 2020, following a pre-meeting at the Berlin IGF in 2019. We launched in response to increasing legislative attacks on end-to-end encryption, especially in a few key jurisdictions, notably the Five Eyes countries. The goal was to bring together private sector voices, civil society, scientists, computer scientists, and cryptographers to align and speak out about the benefits of encryption and the importance of protecting it.

I joined through my role as Chief Technologist at the Center for Democracy and Technology, one of the founding secretariat members. Today, I serve as one of the coalition’s technical specialists. Our membership is primarily civil society organizations, small and medium-sized enterprises (not large tech firms) and academics from around the world.

In addition, I’m active in the Internet Engineering Task Force (IETF) and the Internet Research Task Force (IRTF), where I chair the Human Rights Protocol Considerations research group. Some of these issues overlap with freedom of expression, although the group’s mandate is broader. Still, I’m glad to bring that perspective into this discussion.

On the subject of cybercrime: when I was at CDT, we participated as observer members in the UN’s Ad Hoc Committee [on the UN Cybercrime Treaty]. I followed that process closely, and I carry many thoughts from it—especially from the civil society perspective.

Encryption protects all human rights, not just privacy. As the UN has long recognized, it also supports freedom of expression, opinion, and association. To avoid being overly broad, let me get specific.

In more than 15 years of work in civil society and the nonprofit world, I’ve seen that we can be strident in our advocacy. But that’s because we’re part of a much longer historical struggle, one that predates the digital age. Democracies have always wrestled with striking the balance between investigatory powers and human rights. The difference today is that we now have technical mechanisms that can help enforce those limits. Encryption is perhaps the most powerful example: it lets individuals say, “This conversation is private, and I decide who can access it.” That’s a profoundly democratic capability.

From the civil society perspective, the goal is to restore a better balance of power between people and institutions. Unfortunately, recent years have tipped that balance toward law enforcement and investigatory agencies. There’s a tendency to overcorrect, and we keep learning the hard way that weakening security technologies like encryption creates vulnerabilities; vulnerabilities that can and will be exploited.

One common narrative is that technology moves faster than policy, and laws need to “catch up.” Too often, that narrative is used to argue against the widespread, democratic use of technology, suggesting people are the threat and must be reined in. But we don’t hear the same urgency when governments use technology in unaccountable or extralegal ways.

Mass surveillance, or even targeted surveillance without proper oversight, is a clear example of technology outpacing policy. From a civil society perspective, this imbalance is obvious, yet it is often overlooked in debates about cybercrime.

There’s also the matter of scale. In the pre-digital world, there were natural limits to what could be known about an individual. With the digitization of our lives, those limits are gone. Companies collect, generate, store, and analyze enormous amounts of data. Governments almost inevitably want access too. But this exceeds what our societies were built to handle in terms of boundaries between public and private.

Encryption is the only tool we have that can reintroduce some of those boundaries. And it’s not just a shield from governments, it’s also a shield from companies. Many users, especially human rights defenders and journalists, rely on encryption to protect themselves from corporate surveillance as well.

From that perspective, here are a few jurisdictional recommendations:

  1. Protect cybersecurity research. Civil society, academics, and private-sector researchers must be free to probe and audit systems. Don’t criminalize those efforts, they make us all safer.
  2. Strengthen limits on surveillance. If states are expanding their cybersecurity capabilities through international cooperation, domestic safeguards must be strengthened, not weakened.
  3. Ensure responsible and transparent investigatory powers. Any cooperation between governments and companies should be independently overseen. Government hacking, backdoors, and zero-day exploits pose enormous risks to cybersecurity.
  4. Improve standards in international agreements. Many civil society groups believe the UN Cybercrime Treaty lacks sufficient human rights safeguards. But there’s nothing stopping jurisdictions from exceeding those minimums. Governments can and should do more to protect journalists, activists, and human rights defenders.

I closed with a question:  I think the core dilemma in all of this is whether we’re designing policy and technology to protect people or to protect against them. Are we leaning into democracy, or are we afraid of it?

If we start by putting people at the center of security, privacy, and rights, the tensions begin to soften. That’s the direction we should be aiming for. It will take political will, and maybe the political moment isn’t quite here yet. But we can imagine it, and that vision is worth holding onto.

Help Shape the Future of the Fediverse: Take the Needs Assessment Survey

Are you an admin, moderator, or community organizer in the Fediverse?

The annual Fediverse Needs Assessment survey is open and your input matters. It collects data on safety challenges, moderation gaps, operating costs, revenue, and team size to help shape tools, policy guidance, and advocacy that reflect real community needs. Last year moderators representing more than 4.3 million accounts took part. This year response rates are low and we need your voice. The survey is quick, anonymous, and makes a real impact.

Complete The Survey

Support the Internet Exchange

If you find our emails useful, consider becoming a paid subscriber! You'll get access to our members-only Signal community where we share ideas, discuss upcoming topics, and exchange links. Paid subscribers also get a free sticker, can leave comments on posts, and enjoy a warm, fuzzy feeling.

Not ready for a long-term commitment? You can always leave us a tip.

Become A Paid Subscriber

Open Social Web

Internet Governance

Digital Rights

Technology for Society

Privacy and Security

Upcoming Events

Careers and Funding Opportunities

What did we miss? Please send us a reply or write to editor@exchangepoint.tech.

Fediverse Finds

Posts worth boosting.

From Fiona Scott Morton ‪@proffionasm.bsky.social‬: Exquisite timing by Apple! Perhaps designed to make a fool of the judge and show Apple’s approach to competition law? Was the executive who testified that Apple would never enter search the same one a different court described as “not credible” 14 times?
From @alineblankertz@indieweb.social: @ecosia made a cute out-of-the-box suggestion to steward Chrome and plant more trees. This could have been a fun experiment because Ecosia is different (cannot be acquired or pay out dividends). But then, again, those profits probably should not arise in the first place… …all of this is history with yesterday’s ruling by Judge Mehta, but just a reminder: Yesterday, we still had different options for today, even if today the present seems deterministic.
💡
Want to see some of our week's links in advance? Follow us on Mastodon, Bluesky or LinkedIn, and don't forget to forward and share!

Comments ()