Encryption Is Getting Squeezed From All Sides
Encryption Is Getting Squeezed From All Sides
Save this storySave this storyWelcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.
欢迎阅读《Kernel Panic》，这是一份由 Lily Hay Newman 和 Matt Burgess 撰写的每周通讯，带您深入了解隐私与数字安全的新世界。如需每周在收件箱中接收此通讯，请在此处注册。
Oh, Canada. The Great White North is the latest country to contemplate legislation that could essentially mandate backdoors and increase data retention in encrypted services. The proposed changes have prompted the Canadian anti-censorship company Psiphon VPN—which keeps millions of Iranians online during repressive internet shutdowns—to say it will leave the country if the bill passes. And Psiphon is not the only one.
噢，加拿大。“大白北”国家是最新一个考虑立法的国家，该立法实质上可能强制要求设置后门，并增加加密服务中的数据留存。这些拟议的变更促使加拿大反审查公司 Psiphon VPN 表示，如果法案通过，它将撤离该国。Psiphon 并非唯一一家持此态度的公司，该公司在压制性的互联网封锁期间，帮助数百万伊朗人保持在线。
Encrypted messaging app Signal has said it would exit the Canadian market because the legislation would require unacceptable changes to its open source projects. Apple and Meta have criticized the bill, and DuckDuckGo and NordVPN say they would consider pulling their services, too. But as countries around the world contemplate similar legislation, even larger questions begin to emerge about which states or regions could differentiate themselves as being safe havens for privacy services if global hostility to encryption continues to rise.
加密通讯应用 Signal 表示将退出加拿大市场，因为该立法将要求其开源项目进行不可接受的更改。苹果和 Meta 批评了该法案，DuckDuckGo 和 NordVPN 也表示会考虑撤出其服务。然而，随着世界各国都在考虑类似的立法，一个更大的问题开始浮现：如果全球对加密技术的敌意持续上升，哪些国家或地区能够脱颖而出，成为隐私服务的避风港？
It’s been maddening and disturbing to see more and more democratic countries around the world propose changes to their surveillance and data collection laws, with the aim of giving cops and intelligence agencies greater powers to access people’s information. Governments already have broad digital surveillance powers and investigative tactics to solve crimes that involve encrypted data, but legislative proposals almost inevitably include provisions to expand this access even more—mandating additional logging and what amounts to backdoors or intentional flaws in encrypted products, which cryptographers and security engineers have consistently said cannot be built safely. Truly everyone who understands the issue has said it as much for decades. Yet policymakers return again and again to the idea, somehow expecting a different conclusion or a new breakthrough that will make it all possible.
看到世界上越来越多的民主国家提议修改其监视和数据收集法律，旨在赋予警察和情报机构更大的权力来获取个人信息，这令人感到愤怒和不安。政府已经拥有广泛的数字监视权和调查手段来侦破涉及加密数据的犯罪，但立法提案几乎不可避免地包含进一步扩大这种访问权限的条款——强制要求进行额外的日志记录，以及在加密产品中设置实质上的后门或故意留下的缺陷，而密码学家和安全工程师一直表示这些做法无法安全地实现。事实上，所有了解这一问题的人几十年来一直都在这么说。然而，决策者们却一次又一次地回到这个想法上，似乎期待着不同的结论或某种能使这一切成为可能的新突破。
“There have always been some officials within certain agencies that tend to view technology as a crime scene in and of itself, and it becomes a myopic point of fixation where access is desired,” says Kate Robertson, a senior research associate at the University of Toronto’s Citizen Lab. “But that type of siloed thinking forgets that technology needs to be the secure operating platform for hospitals, for banks, for national security agencies, for police services themselves to protect victims who report private information to them.”
多伦多大学公民实验室（Citizen Lab）的高级研究助理凯特·罗伯逊（Kate Robertson）表示：“在某些机构中，总有一些官员倾向于将技术本身视为犯罪现场，这成为了一种短视的执念，一心只想获得访问权限。但这种孤立的思维方式忘记了，技术必须成为医院、银行、国家安全机构以及警察部门自身保护那些向其报告私人信息的受害者时所依赖的安全操作平台。”
In recent years, the UK and Australia have introduced sweeping surveillance reforms that can compel companies to break their encryption. Other encryption-threatening proposals have also emerged in the EU, France, India, Ireland, Spain, Sweden, Switzerland, and others. While not all measures have passed into law or been enacted, the hostility is clear.
近年来，英国和澳大利亚引入了广泛的监视改革，可以强制公司破坏其加密措施。欧盟、法国、印度、爱尔兰、西班牙、瑞典、瑞士等地也出现了其他威胁加密技术的提案。虽然并非所有措施都已通过立法或付诸实施，但这种敌意显而易见。
First proposed in 2025, and partially revised due to blistering criticism from tech companies and civil society, Canada’s C-22 bill can broadly place requirements on tech companies, including those outside of Canada, to introduce “technical capabilities” that allow data to be accessed for law enforcement purposes. Like many such bills, C-22 says that companies will not have to introduce a “systemic vulnerability” into their systems. But opponents have pointed out that any capability to access end-to-end encrypted data amounts to a backdoor that could be discovered and abused by anyone. And this risk is only heightened even more by the ease with which anyone can now use AI tools for reverse engineering and system mapping.
加拿大 C-22 法案于 2025 年首次提出，由于科技公司和民间社会的猛烈批评而进行了部分修订。该法案可以广泛地对科技公司（包括加拿大境外的公司）提出要求，引入允许执法部门访问数据的“技术能力”。像许多此类法案一样，C-22 声称公司不必在系统中引入“系统性漏洞”。但反对者指出，任何访问端到端加密数据的能力都等同于后门，可能会被任何人发现并滥用。而现在任何人都能轻易使用人工智能工具进行逆向工程和系统映射，这进一步加剧了这种风险。
“Companies could be asked to introduce vulnerabilities, build backdoors, bypass, weaken or otherwise defeat encryption,” members of the US House Judiciary and Foreign Affairs committee said in a May letter to Canadian officials.
美国众议院司法委员会和外交事务委员会的成员在五月份致加拿大官员的一封信中表示：“公司可能会被要求引入漏洞、建立后门、绕过、削弱或以其他方式破坏加密。”
In addition to potential impacts on encryption, C-22 also includes provisions that could require companies to retain metadata about user activity, something that many privacy focused services (including VPN services from Psiphon and DuckDuckGo) intentionally avoid. As a result, these companies say, they would be forced to change their business models to collect data they do not need or want to collect about their users. And researchers say that such product changes would diminish user trust while increasing the potential for widespread surveillance.
除了对加密技术的潜在影响外，C-22 还包含可能要求公司保留用户活动元数据的条款，这是许多注重隐私的服务（包括 Psiphon 和 DuckDuckGo 的 VPN 服务）刻意避免的事情。这些公司表示，结果就是他们将被迫改变商业模式，去收集那些他们不需要也不想收集的用户数据。研究人员表示，这种产品变更将削弱用户信任，同时增加大规模监视的可能性。
“If you are asking and requiring for this infrastructural change—that they retain metadata by default—it is creating a surveillance capability within a tool that didn’t have it,” says Afsaneh Rigot, the founder of the De|Center, a research organization that aims to reduce the risk of technological harms. “There are contexts like Iran and other contexts globally, who all of this has a trickle effect on. It’s not going to stay in Canada because these types of laws always get copy pasted around the world.”
旨在减少技术危害风险的研究组织 De|Center 的创始人阿夫萨内·里戈特（Afsaneh Rigot）表示：“如果你要求进行这种基础设施层面的变更——即默认保留元数据——这实际上是在一个原本不具备监视功能的工具中创造了监视能力。像伊朗以及全球其他地区的情况，都会受到这种连锁反应的影响。这不会仅仅停留在加拿大，因为这类法律总是会在世界各地被‘复制粘贴’。”
As more countries contemplate such laws, developers focused on privacy and anti-censorship tools are increasingly casting around for safe jurisdictions to operate in. But this still doesn’t solve the problem of reaching users in all countries around the world and for now, there are no sure bets.
随着越来越多的国家考虑此类法律，专注于隐私和反审查工具的开发者们正越来越多地寻找安全的司法管辖区进行运营。但这仍然无法解决触达全球所有国家用户的问题，目前来看，还没有万无一失的方案。
“Changing your headquarters isn’t much of a plan B when the law follows your users, as C-22 would,” says Joseph Lorenzo-Hall, security portfolio lead at the Internet Society. “The strongest protection is holding as little user data as possible, but ‘we don’t have it’ is no defense if governments can force you to start collecting it. A safe haven needs more than favorable winds in strong encryption. It needs laws that let companies keep their privacy promises and defend them against foreign threats to confidentiality and integrity.”
互联网协会（Internet Society）安全项目负责人约瑟夫·洛伦佐-霍尔（Joseph Lorenzo-Hall）表示：“当法律像 C-22 那样追随你的用户时，更换总部并不是什么好的 B 计划。最强大的保护是尽可能少地持有用户数据，但如果政府能强迫你开始收集数据，‘我们没有数据’就不是一种辩护。一个避风港需要的不仅仅是强加密带来的顺风，它还需要法律来允许公司信守隐私承诺，并保护它们免受外部对机密性和完整性的威胁。”
Spotted something we should include next week? Let us know at [email protected]. And stay safe out there.
发现了我们下周应该包含的内容吗？请通过 [email protected] 告诉我们。祝大家平安。