Comment by jeffparsons | Hacker News Reader

Comment by jeffparsons | Hacker News Reader

Parent Full thread

Serious question for whoever actually understands this: what is the legal status of true, peer-to-peer, attack-resistant encrypted messaging in the "western" world? I'm particularly interested in the USA, the UK, Australia, New Zealand, and whatever European countries you care to throw into the mix.

I've occasionally tinkered with building software (but never released said software) that uses encrypted peer-to-peer connections as the _sole_ way of communicating, because it seemed like the most natural way to build said software _and_ the most interesting technically. (And I have zero interest in hosting servers for FOSS side projects.) If I were to actually release one of these projects and it were to become popular, should I expect to be shut down by law enforcement on the grounds that it's already unambiguously illegal? Or would I likely receive a "Technical Assistance Notice" at some point, effectively requiring me to sneak a back door into the software? Or is it actually fine?

I seem to recall all sorts of stories about law enforcement and "TLA agencies" pressuring vendors of secure messaging software to make the software unavailable or to add back doors, including at least one who chose to shut down their business rather than lying to their users about the security of the product. But somehow in all this I failed to glean whether or not it's actually meant to be legal, even on paper.

I know of no law here in Germany that would make it illegal, heck, Germany allows me to sign my PGP Key with my National ID. There has been some conservative resistance over the years but it's still legal and in practice for the normal user simply not an issue. Unless you are using things like Anom or other messengers that are like exlusively used by criminals and even it's not illegal in itself you might at worst get caught up in a sting operation when they take down the central servers.

Fun fact most Tor exit nodes are in Germany. Hosting those is more risky.

I heard tutanota collaborates with German law enforcement for decryption.

Heard from where? How would they do that? Tutanota doesn’t have the key, the end user does. I keep hearing weird things about Turanota that sound like the types of rumors intelligences agencies who really don’t want people to use the service would start.

Encryption for end users is de facto legal almost everywhere except for UK. For vendors it's illegal almost everywhere maybe except for USA, but that's just how the law works in USA: you receive a subpoena, then it's up to your luck.

It's not illegal for vendors, they just have to colaborare with law enforcement when a subpoena is received, and this collaboration can entail attacking their own users as long as a technical capability to do so exists.

If you think about it, it's more or less the only way this could work in any democratic society.

Not illegal in Finland at least.

Oh and proton mail brags that Swiss allows it too.

Mullvad is Swedish and they run no logs VPN so not illegal there

Curious as to whether Mullvad will respond the same way Signal did to Sweden's assault on E2EE.

https://www.theregister.com/2025/02/26/signal_will_withdraw_...

> Encryption for end users is de facto legal almost everywhere except for UK.

Encryption is legal in the UK.

But if the government turns up asking for your decryption keys, "you can't have them" is not an option unless you wish to enjoy the luxurious surrounds of a prison cell until you change your mind.

Which, to be fair, is basically the case worldwide, as per the famous XKCD cartoon[1].

[1] https://xkcd.com/538/

That’s a huge simplification.

If you don’t have they keys, you can’t hand them over, for one thing.

Also, the wrench treatment is extremely unlikely in most democracies. Now, deplatforming such as seizure of DNS names and such, is another matter and varies, often orthogonally to the risk of wrench treatment.

> the wrench treatment is extremely unlikely in most democracies

If you prefer ... substitute "wrench treatment" for the democratic wording: "jail time and the associated criminal prosecution process"

Where has this happened? For using encryption? Or what are we talking about here?

> what are we talking about here?

We're talking about "if the government turns up asking for your decryption keys, ...".

> Where has this happened?

Pretty much everywhere. Even in the US you can only avoid it if you're careful; if you admit to knowing the keys then you can't. Either way you're dealing with the "criminal prosecution process" as GP pointed out.

There's deniable encryption to counter the wrench attack

> There's deniable encryption to counter the wrench attack

The trouble with deniable encryption is its viable use-case is very narrow.

It is, for example, not viable to use deniable encryption when exchanging messages with others.

If the authorities, through whatever means, get the a copy of an encrypted message you sent, and they have done sufficient metadata homework to link it back to you, find your address and come knock on your door, then you are going to seriously struggle with a deniable encryption defence.

I would look into wassenar if I were you, an artifact of the cold war, encryption can be treated like a munition. Nothing stricter than that from what I’ve seen. Yet.

end-to-end encrypted messagess, when the end-points (Android, iOS, Windows, etc) are basically spyware?

On top of that it runs through servers running who knows what, closed source stuff. So who knows if they're somehow decrypting everything on there before forwarding re-encrypted stuff?

fair point, when someone's using google push notification service and gboard, that's both ends of the pipe, for the most part

In the Five-eyes jurisdiction, it is legally allowed to use strong end-to-end encryption. Any potential laws that are contrary to that would come up against some serious 4th amendment issues. The idea of cryptography as a munitions was largely set aside in the name of capitalism.

Tor was funded by the U.S. Department of State. Signal and WhatsApp are end to end encrypted.

Sign up for EFF's mailing list and donate money to them. Check out their Secure Messaging Scorecard: https://www.eff.org/pages/secure-messaging-scorecard

We, as a society, are under constant attacks on our ability to maintain our privacy. As we've seen in large political and technological shifts, it only becomes more important to maintain your privacy. Deep fakes used in scamming relatives is one good example.

Please do release your software and ideas that make information more secure.

Reply on news.ycombinator.com