Encryption protects cybersecurity, safeguards vulnerable groups like journalists and victims of domestic violence, and allows people to communicate securely with family, colleagues, and sensitive third-parties. However, encryption is often seen as a safeguard that is only relevant to people with specific privacy concerns, and that people who have “nothing to hide” don’t need or benefit from strong encryption. This could not be further from the truth. Encryption is crucial to the way that everyone interacts with technology and lives their lives online.

Law enforcement has continually claimed that encryption hampers investigations and protects criminal actors, referring to the spread of encryption as “going dark.” They have pushed for the implementation of mechanisms, commonly described as “backdoors,” that would guarantee them access to encrypted data. Technologists, academics, members of civil society, and allies within government have continually explained that strong encryption is crucial to privacy, security, free expression, and economic growth. Discussing the importance of encryption as a matter of consumer privacy for all people is an important component of the conversation regarding next steps for regulators, Congress, and companies.

Encryption has been under attack many times before, but in the past year we have seen new and serious threats to the ability of companies to provide strong encryption to consumers, and for everyone to have access to the security they need for their communications and stored data. Various U.S. government officials have pushed companies to weaken the encrypted technology they provide to users, or to not implement crucial security updates including the implementation of universal end-to-end encrypted messaging. These dangerous and misguided proposals are not based on a factual understanding of encryption.¹ Additionally, discussing encryption as an issue of “security vs. privacy” fundamentally misrepresents the way encryption protects everyone. Two of the most recent proposals to undermine encryption, the Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act and the Lawful Access to Encrypted Data Act, both introduced in Congress in 2020, will be discussed later in this paper.

This report builds on an event held by New America’s Open Technology Institute on February 4, 2020 that examined the role of encryption in protecting consumer privacy. The panel began with a fireside chat with Federal Trade Commissioner Rohit Chopra and Alexandra S. Levine, reporter and host of Morning Tech at Politico. Levine moderated the following panel discussion, which included Asad Ramzanali, legislative director for Rep. Anna G. Eshoo (D-Calif.); Katie McInnis, then-policy counsel at Consumer Reports; Keun Kim, senior managing counsel, Digital Payments & Labs, Products and Innovation, at Mastercard; and Hannah Quay-de la Vallee, senior technologist at the Center for Democracy & Technology. The discussion covered the history of encryption’s role in the privacy debate, an analysis of its role in consumer protection, and background on how policies surrounding encryption are playing out in both the government and private sector.

This event was designed to move debates about encryption away from hot-button issues, which often distract from discussions about the ways encryption protects everyone and is already embedded in the technologies we use every day. The paper likewise does not focus on those issues, and instead seeks to center the debate around the fundamental issue of consumer privacy. Participants in the “Privacy’s Best Friend” panel helped set the stage for discussions about next steps for policy regarding encryption and consumer privacy, and identified some of the recurring themes in our decades-long debates about whether to regulate encryption.

Editorial disclosure: This report discusses policies by Apple, Facebook, and Google, all of which are funders of work at New America but did not contribute funds directly to the research or writing of this report. New America is guided by the principles of full transparency, independence, and accessibility in all its activities and partnerships. New America does not engage in research or educational activities directed or influenced in any way by financial supporters. View our full list of donors at www.newamerica.org/our-funding.

Federal Trade Commissioner Chopra began the event by reminding participants that we had “gone through this same debate 20 years ago… that [the Justice Department] is probably recycling some older arguments, and that it may not fully be taking into account how unencrypted communications may actually be a risk to the public.” These discussions are indeed not new—debates about encryption, individual privacy, and the role of government have circulated in U.S. policy for decades. This section will briefly review this historical context as a primer for understanding the panel’s discussion.

Until the mid-1970s and the development of public key cryptography, the government had a domestic monopoly on the use of electronic ciphers, but in 1976 researchers Whitfield Diffie and Martin Hellman discovered and published a paper that demonstrated how ordinary users could use a pair of related private and public keys to encrypt and decrypt plaintext conversations.² Unlike previous methods of encryption, this technology allowed two or more parties to communicate privately and securely without ever having met before.³ Although these advances in cryptographic technology made encryption available to non-government users, it took societal factors—including the increasing use of personal computers by large companies, the demand for secure email technology for individual use, and increased use of portable and mobile devices—to bring the importance of encryption from academic conversations into the mainstream.

By the early 1990s the proliferation of encryption as part of modern communications provoked the first congressional attempt to force the inclusion of backdoors by electronic communications service providers and equipment manufacturers. A 1991 anti-terrorism bill included language requiring that companies “shall ensure that communications systems permit the government to obtain the plaintext contents of voice, data, and other communications when appropriately authorized by law.”⁴ Although this proposal was withdrawn, it was the precursor to multiple government efforts to find a way for law enforcement to reliably gain access to encrypted communications. The most notable early attempt at this was the failed introduction of the “Clipper Chip,” a then state-of-the-art microchip that could be inserted into consumer hardware telephones.⁵ One of the significant vulnerabilities of the Clipper Chip included its reliance on “key escrow,” where third parties held keys to the chip’s encrypted information.⁶ Ultimately the proposal failed when prominent computer scientist Matt Blaze discovered that the chip was easy to exploit, would not provide the security proponents argued it could, and instead would actually undermine the security of any device it was installed in.⁷

The Clipper Chip debate, and others occurring during that era, are often described as the “Crypto Wars.” This took place on the domestic front, but there was a simultaneous debate going on at the international level over U.S. export controls and encryption technology. Because they had historically been used by military and intelligence agencies almost exclusively, existing export control regimes classified cryptographic tools as “munitions” and restricted their export. These controls were based on the strength of the encryption and applied not only to hardware but also to encryption software and source code. The intelligence community was concerned that U.S. companies were selling international customers strong encryption technology, which many officials feared could reduce their ability to gather information on foreign targets. However, restrictions on the quality of encryption produced by big companies would all but ensure that surveillance targets would simply use other services, leaving everyone without secure options. This aspect of the debate continues even now, with Chopra noting during his opening remarks at the event that if the government restricted encryption “criminals and crooks are going to use encrypted communication, and the rest of us could be left vulnerable.” Ultimately, after much pushback from advocates, companies, and allies in Congress, these controls were liberalized at the end of the 1990s, which effectively ended the first Crypto Wars period with a blow against backdoors and a major win for consumer privacy.

Although those 1990s debates focused primarily on encrypted technology that was theoretically available to consumers, the reality is that encryption then played a dramatically smaller role in the lives of ordinary people than it does now. The use of email was increasing, but internet-connected devices, smartphones, online financial transactions, and a complete reliance on virtual communication via email or messaging tools were not even on the horizon. A few decades later, many millions of people rely on the security and privacy provided by strong encryption every single day. This rise of a second era of encryption debate was likely inevitable.

The encryption of data “in transit” protects information that is moving over a network from one place to another. End-to-end encryption, the most secure method of protecting this data, ensures that messages encrypted by the original sender can only be decrypted by the recipient—not by other actors who may intercept it or even by the company providing the messaging service.⁸ Encryption of data “at rest” protects information that is stored somewhere, like on a laptop, smartphone, external hard drive, or in the cloud, and is not moving from one place to another. Both modes of encryption are crucial to protecting consumer privacy, and both have been targeted for government interference.

In 2014, both Apple and Google announced that they would begin encrypting their smartphones by default, ensuring that users would have their data protected at rest without having to take any further steps to activate the feature.⁹ This was in the wake of the Edward Snowden revelations and increasing concern by customers that large tech companies were sharing customer data with the National Security Agency. These changes meant that not only was all the important data on a phone—photos, messages, contacts, reminders, call history—inaccessible to third parties, it was inaccessible to the companies who made the phones. Companies would no longer be able to provide information stored on devices to law enforcement upon request. This was a huge victory for consumer privacy and security, but it sparked instant backlash from the U.S. government, with the FBI accusing Apple of “[marketing] something expressly to allow people to place themselves beyond the law.”¹⁰

Given the increasing amount of personal data stored on smartphones (including health and financial data), privacy and security experts agree that further security for these devices is crucial to protecting privacy. The argument by some government officials that people who want to use secure devices are somehow nefarious, and that the reason consumers may be interested in an encrypted phone is because they want to evade law enforcement, does not reflect the reality of current threats to consumer privacy. If a mobile device stores emails, contact information, photos, location data, audio recordings, and apps that collect sensitive data, theft or loss of that device could have serious consequences for the owner. By contrast, if a device owner could trust that such information would remain private should their phone be lost, stolen, or seized by a government third party, they may prefer to purchase devices with those security features.

Law enforcement opposition to increasing implementation of strong encryption has also targeted end-to-end encrypted messaging services, similarly casting those as tools used by criminal actors rather than ordinary consumers who wish to protect their private communications. Proponents of law enforcement access to encrypted information have argued that it is possible to build a system that only allows “good guys” access to private communications—an assertion technical experts have repeatedly debunked. During the panel, Hannah Quay-de la Vallee, senior technologist at the Center for Democracy & Technology, highlighted one of the key problems with proposals for encryption backdoors—that it is possible to create mechanisms for only the “good guys” to access encrypted data—saying, “[the] fundamental aspect of this is not technically feasible… There's not actually a way to get 95 percent crypto, or 98 percent crypto. It's a little bit of an all-or-nothing situation.”

Specific events have regularly brought encryption into the public eye, including the terrorist attack in San Bernardino, California in 2016, following which the FBI demanded that Apple break the encryption on the shooter’s iPhone.¹¹ More recently, U.S. government officials have cited the role of encrypted communications in limiting Facebook’s ability to report all tips about the online sexual exploitation of children in support of their demands for encryption backdoors.¹² However, to this point no U.S. government attempts to legislate backdoors or restrict access to encryption have been successful. The role of government policy in both promoting and undermining encryption, and where these consumer privacy discussions stand now, will be discussed later in this paper.

Encryption is often discussed as an issue of law enforcement, cybersecurity, or free expression for specific groups of users. However, it is also crucial to the privacy and security of everyone who browses the internet, communicates online, or uses websites for convenient activities like banking, shopping, or filing taxes. Unfortunately, many companies do not employ best practices for securing data, such as encrypting databases, which has resulted in many cases of people’s personal, health, and financial information being hacked. For example, the Equifax data breach of 2017 exposed the personal information of 147 million people from a database that was not encrypted.¹³ Cybersecurity incidents like this show that consumers need stronger data privacy protections for their personal information. People are “weary and angry,” said Katie McInnis, policy counsel at Consumer Reports, “at their data being out there,” and of the privacy and security consequences that they might face.

A 2019 survey by the Pew Research Center points to deep public concern about a lack of control over the increasing amount of personal data available to third parties. Eighty-one percent of respondents felt they have very little to no control over the data that companies collect on them, such as their demonstrated interests, past purchases, or other characteristics.¹⁴ These types of personal information could potentially be used to identify individuals’ financial information and make them more susceptible to fraud or online threats. Consumers are also learning that any kind of data, even anonymized data or metadata, can reveal a lot about their personal activities. Research consistently indicates that anonymized or de-identified data can be reidentified to the individual.¹⁵

Given increasing user concern over the collection of personal information and the threat of someone accessing that data, companies need to adopt strong cybersecurity safeguards to protect consumer data. This should include encrypting user data, as well as minimizing access to user-created data. As described earlier, consumers have theoretically had access to various forms of encryption for decades; however, it often required a certain level of technical expertise to implement, and was often the responsibility of an individual user to set up. Privacy should not be limited to only those with technical knowledge; rather, companies should broadly protect consumers to the fullest extent. During the event, McInnis pointed out that even if consumers are not well educated on privacy or are going to be reckless in their use of a product, they should be protected, “just like when you drive, a car should have seatbelts and airbags just in case you ram into a wall.”

Encryption by default improves data protection and privacy by removing the obstacle of manual user implementation. As noted above, Apple and Google’s decision to encrypt their mobile devices by default (previously the setting was optional) was a huge shift in the protection of user data at rest.¹⁶ As Quay-de la Vallee explained, when an iPhone screen is locked the device is encrypted. Once the phone has been unlocked, any iMessage communication is protected by end-to-end encryption, or encryption in transit, so that nobody along the way is able to read it.

Encryption, therefore, can promote trust between companies and consumers, as it builds in protection not incumbent upon consumer knowledge of privacy practices. Products should be designed with the best interests of the end user in mind. As McInnis remarked, “Just the way your toaster shouldn't set your house on fire, the services you use shouldn't expose your data to the public either.”

Current debates on expanding the use of encryption in consumer products may overlook the ways in which it is already embedded and relied on in certain industries. Many private companies, like those in the banking, digital communications, and cloud storage sectors, actually compete on the strength of their consumer privacy protections—including strong encryption. These industries hold sensitive information—like social security numbers and credit card numbers—that may easily be hacked and exposed when companies do not encrypt digital files and transactions. A study published earlier this year by Cisco found that the majority of international cybersecurity professionals across industries see significant or very significant benefits in operational efficiency, data security, and customer loyalty and trust due to increased annual spending on privacy.¹⁷

Investing in better privacy practices also shields companies against the high costs of data and privacy breaches. When customers lose trust in companies from their personal data being exposed, it can lead to a loss of business amounting to $1.42 million per organization on average, or 36 percent of the total cost of a data breach, according to a study released by IBM in 2019.¹⁸ Encrypting data at rest is a key safeguard against data breaches. One study found that 96 percent of data breaches in 2016 involved data that was not protected with encryption.¹⁹ According to the 2019 report from IBM, the average time to contain a data breach in 2019 was 279 days, 73 more days than the span of a breach in 2018.²⁰ The longer a data breach, the higher the costs. Breaches lasting fewer than 200 days were on average $1.22 million less costly than breaches with a life cycle of more than 200 days, which could cost $4.56 million on average.²¹

Encrypting data in transit while consumers engage with businesses online is also a key privacy best practice used by cloud storage companies. Cloud storage can introduce great security risks for individuals and organizations, since personal and sensitive information is being stored with a third party—encryption can provide a necessary layer of security. Many cloud storage companies use encryption to protect information, with 81.8 percent of cloud service providers encrypting data in transit between the user and cloud service.²² OneDrive, for example, encrypts data in transit, though it does not encrypt data stored in the cloud. On the other hand, iCloud encrypts both data in transit and data at rest.²³

One example of how companies have improved privacy measures is in the payments industry, with encryption playing a central role in ensuring personal financial data is transmitted safely. During the panel, Keun Kim, senior managing counsel, Digital Payments & Labs, Products and Innovation, at Mastercard, gave the example of companies like his employing magnetic card stripes and CVV numbers for card payments, then evolving to electronic chips embedded in each card. Chips, unlike magnetic stripes, are encrypted, which makes it much harder to read the information stored in the card while also limiting the data stored on any single key at the same time.²⁴ An encrypted credit card with an electronic chip is much harder for criminals to read and replicate the information, since information stole from magnetic stripes can simply be placed on a new strip and used to make fraudulent purchases. Encryption is therefore critical in ensuring that personal data is secure during a transaction.

Messaging and digital communications is another area where encryption is becoming the standard, as McInnis offered during the panel. Popular messaging services, like Signal, Telegram, and WhatsApp, use encryption to protect messages. In March of 2019, Facebook announced that it was adopting end-to-end encryption across all its platforms.²⁵ The reasons for the change included in Mark Zuckerberg’s announcement reflected not only his and his company’s recognition of a change in public opinion, saying that people want to connect privately, and that the industry as a whole is moving towards encryption.²⁶

It is likely that companies will continue to innovate around privacy as more of our everyday lives move online. Encryption promises to be a key part of this innovation.

There are a variety of government actors that play key roles in debates around encryption and consumer privacy. As noted earlier, Congress has periodically taken up efforts to enact encryption legislation since the 1990s. Most of these initiatives have involved attempts to restrict or undermine the use of strong encryption. For example, in response to events like the terrorist attacks in San Bernardino, California in 2016, and at a Naval air station in Pensacola, Florida in 2019, law enforcement has asserted that encrypted mobile devices are a significant barrier to their investigations. Opponents have also characterized encrypted messaging as a tool used by criminals and drug cartels to coordinate violent activities.²⁷ Based on these assertions, various members of Congress have introduced bills seeking to restrict encryption, with the two most recent being the Law Enforcement Access to Encrypted Data Act of 2020, and the EARN IT Act of 2020, both introduced by Sen. Lindsey Graham (R-S.C.).

The Law Enforcement Access to Encrypted Data Act attempts to force companies to proactively design vulnerabilities in their products, so that they are always able to provide user information to law enforcement. The bill applies to both stored data and data in motion, and is more comprehensive than previous legislative attempts to restrict encryption for a few reasons. First, the bill seeks to amend a sweeping range of law enforcement and surveillance authorities. Second, it would apply to a much broader scope of targets, including nearly every device that includes at least one gigabyte of storage capacity, which would include cell phones and laptops, but probably also Internet of Things devices, gaming consoles, and maybe even voting machines.²⁸ It also targets all encrypted messaging services. Further, the bill would provide two mechanisms to undermine encryption—companies with over 1 million U.S. users would be required to proactively design backdoors, and companies with fewer than 1 million U.S. users could be issued an assistance capability directive by the Attorney General, which would require them to build a backdoor on request. By definition, if companies must retain the ability to decrypt information for law enforcement, it is not technically possible for them to implement fully end-to-end encryption, so this bill would effectively result in a ban on the use of strong encryption by companies.

The EARN IT Act of 2020 is unlike previous legislative attacks on encryption.²⁹ It is focused specifically on one type of criminal activity that law enforcement argues is facilitated by strong encryption—the exchange of “child sexual abuse material” or CSAM online. The problem of CSAM is extremely important to address, however the EARN IT Act is not actually well-designed to do so. There are myriad other ways to empower law enforcement to combat CSAM, including redirecting funding to support the addition of badly needed staff and helping them more effectively use current lawful investigative tools. The EARN IT Act does not directly require companies to design backdoors in their products; instead the bill uses Section 230 of the Communications Decency Act to threaten the intermediary liability protections for tech platforms or other providers that publish third-party content. Although the Senate Judiciary Committee approved a revised version that does incorporate an amendment aimed at protecting encryption, the bill still poses a real threat to strong encryption. The latest version increases companies’ Section 230 liability so greatly that companies might avoid offering encryption services altogether rather than face litigation based on state CSAM laws with varying standards.³⁰

It is worth noting that none of the directly anti-encryption laws have yet passed, and that the United States currently has no laws limiting the use of encryption or restricting the ability of companies to implement it, unlike other countries including Australia and the United Kingdom. Although this is an ongoing debate around the world, supporters of strong encryption in the United States have, so far, managed to prevent any dangerous legislation from passing.

Some members of Congress have also sought to enact legislation that would protect and promote strong encryption. Pro-encryption proposals have ranged from the Security and Freedom Through Encryption (SAFE) Act of 1996, which garnered sponsorship from the majority of the members of the House of Representatives and aimed “to affirm the rights of United States persons to use and sell encryption and to relax export controls on encryption,” to the Ensuring National Constitutional Rights for Your Private Telecommunications (ENCRYPT) Act of 2019, which would preempt states from imposing decryption requirements on a manufacturer, developer, seller, or provider of covered products or services.

Encryption also plays a role in discussions about comprehensive consumer privacy legislation. During the event, Asad Ramzanali, legislative director for Rep. Eshoo, described the importance of including encryption in the Online Privacy Act, a bill proposed by Reps. Anna Eshoo and Zoe Lofgren (D-Calif.) as part of “a broader discussion about the role of technology companies, and technology and society, and how policy should and should not be reacting to some of the harms that we see.” Ramanzanali specifically addressed the relationship between policy on encryption and the current “techlash,” as well as heightened scrutiny and mistrust of the technology industry in general. As he explained, “Tech can do a lot of good. But when people stop to trust it, it becomes problematic, And so that's where encryption, to us, also plays an important role.”

A crucial component of many companies’ moves to default encryption at rest and end-to-end encrypted messaging is that these protocols also prevent companies themselves from accessing user data. Quay-de la Vallee framed the privacy dynamic as “if you want to live in this world, you're going to cede control to entities that you don't necessarily trust… the whole concept of end-to-end encryption is essentially that I don't have to trust that WhatsApp isn't going to look at my messages. I don't have to trust that they're going to do the right thing and not go snooping. I just know that they can't.” Legislation to protect and promote strong encryption would help safeguard private data, from both companies and other actors, while allowing users to benefit from technology that is crucial to the way we live and work.

As long as debates surrounding the importance of encryption are centered on issues of law enforcement access and the need for exceptional access to information to facilitate criminal investigations, an important part of the discussion is missing. A common reaction to advocates’ arguments about the need for strong encryption is that if someone “has nothing to hide,” they should not care if law enforcement has access to their data. As much as proponents try, attempts to reorient the discussion from “privacy vs. security” to “security vs. security” often fail to capture the attention of the general public and convince them of encryption’s importance for privacy and free expression, rather than as a supposed barrier to catching criminals and terrorists.

Reframing encryption as a consumer privacy issue, and illustrating all the ways it is important in everyday life has the potential to bring together advocates from different fields, as well as to change the minds of everyday people. Encryption is crucial to the way we communicate remotely, make secure purchases, use online tools to access financial information or file taxes, and access remote medical care. The same technology that allows journalists to communicate securely also allows people to buy groceries using a mobile app without fearing that their sensitive financial information will be stolen. The same technology that allows users to chat securely with friends on messaging platforms also prevents tech companies from gathering data from those conversations to use in ways that participants may not be comfortable with. Further including protection for and promotion of strong encryption in comprehensive consumer privacy legislation, both at the state and federal levels, would both provide important recognition of how intertwined it is with other issues of data protection, and would incorporate another much-needed tool as a safeguard to protect privacy.