The EU Commission announced its ProtectEU strategy this week. It is a "vision and workplan" for what amounts to mandatory encryption backdoors, dressed in the euphemistic language of "lawful and effective access to data for law enforcement" and "technological solutions for accessing encrypted data."
Read that twice. Not "access to lawfully-obtained data." Access to encrypted data. The distinction is not semantic.
I have read seven years of EU policy documents. This is the clearest I have seen Brussels say what it means without saying what it means. The strategy promises that "cybersecurity and fundamental rights will be protected" as a future backdoor is implemented. That is not a promise. That is a pretense.
A backdoor, by definition, is available to all actors who find it. Once the architecture exists—once the vulnerability is designed in—hostile states, criminal groups, and non-state actors will have the same access law enforcement claims to want. The EU knows this. It has been told this by cryptographers, tech companies, and privacy researchers for two decades. It does not care.
What the EU is actually pursuing is not "access to encrypted data." That is impossible. What it is pursuing is the elimination of truly encrypted data. It wants to replace end-to-end encryption with systems where the encryption key is held by a third party—a law enforcement agency, or a government database, or a centralized key management system. That system would then be "secure" in the way a bank vault is secure: protected by access controls, audit logs, rules about who can ask for what.
Except bank vaults get robbed. Databases get compromised. And those rules get changed at 3 AM when the political climate shifts.
The ProtectEU strategy also calls for giving EUROPOL "more powers" around cross-border investigations and making it "a truly operational police agency," with expanded intelligence-sharing between member states through the Single Intelligence Analysis Capacity. This is not law enforcement reform. This is police centralization, sold as security.
I notice the timing. Europe's birthrate has been below replacement for decades. The workforce is shrinking. Public services—the SNS in Portugal, the NHS in the UK, schools everywhere—are collapsing under demographic weight. Trust in institutions is already thin. And Brussels' response is not to fix healthcare or pensions or housing. It is to build more surveillance infrastructure.
The pretense is always the same: terrorism, crime, hostile actors. These are real. But the solution being built—a continent-wide backdoor to encrypted communications, more centralized police powers, intelligence agencies with fewer oversight—is not a solution to those problems. It is a solution to a different problem: the problem of a government that cannot deliver on basics and needs to see what people are saying to know if they are about to revolt.
The discomfort here is not theoretical. It is architectural. Once the backdoor exists, it stays. Once EUROPOL has the power, it stays. These are not tools that go away when the threat passes. They become permanent infrastructure, and they will be used against dissent, protest, and inconvenient speech as readily as against actual crime.
Brussels has stopped pretending it can build a "secure backdoor." Now it is just saying it will build a backdoor and assuring everyone it will be used nicely. That is worse.