U.S. Sanctions against Autistici/Inventati are the next wake-up call for digital sovereignty
Autistici/Inventati Sanctions: Privacy technology does not become extremist because extremists use the tool.
While it is the obligation of every democratic country to protect its citizens from terrorist threats, the question is:
Where does responsibility for crimes end and where does responsibility for providing infrastructure begin?
Autistici/Inventati provides digital infrastructure such as secure email, web hosting, and email lists. According to the U.S., this infrastructure has been used by terrorists and, thus, it has put A/I on the same level as the terrorists themselves, sanctioning the service.
No judge involved
This happened without a court order or judicial oversight.
While one can agree or disagree with the service that Autistici/Inventati provides, it is shocking to see that the service is sanctioned without being convicted by court for committing a crime.
Privacy technology does not become extremist because extremists use the tool.
Encrypted email can be used by normal citizens, by journalists protecting a source, by political activists documenting human rights abuses – or by criminals. This does not make encrypted email illegal.
A provider should not be held hostage for its users.
Legal processes exist
Sanctions without a court ruling, like in this case, are especially dangerous. This gives the U.S. government too much power to act according to their own agenda – no matter the motivation – without any judicial oversight. The service provider Autistici/Inventati has no option of pledging their case in court, and all users of their service are affected, independently of whether they are involved in criminal activity or not.
Instead of sanctioning the entire service, the U.S. authorities should have used court orders against suspected criminal users of A/I.
Via court orders, the authorities can force any service provider to work with the authorities and make sure that their services are not abused by criminals – which is what we at Tuta do, as you can see in our transparency report. After all, it must be possible to offer a private and secure service to everybody, to enable people and businesses to protect their communication from mass surveillance, while still working with the authorities so criminals cannot abuse the system.
European digital infrastructure at risk
This case, similar to when an order by U.S. President Trump forced Microsoft to shut down the email account of the Chief Prosecutor of the International Criminal Court (ICC), highlights once again why Europe needs digital sovereignty.
The European Union has fundamental rights such as the right to privacy protected in its constitution. Europe must not assume that any U.S. security measure fits to its own legal system. Now that the U.S. has created a precedent where a digital service provider has been sanctioned for offering its services to criminals, European politicians must ask a simple question:
Would we accept the same measure if it were applied by another government (e.g. Russia or China), or against another service provider based in the European Union?
If the answer is no, we must make it clear now that we do not agree with this process – even though the measure comes from an ally.
Privacy must not become a sign for guilt
This case has even more significance: In politics, not just in the U.S., but also in the EU, there is a tendency that privacy-first technology is looked upon as suspicious, for the sole reason of it making surveillance harder.
This is a path we must not go down.
Encryption exists for everybody’s protection. Encryption makes sure that our private communication can not be spied upon, not by governments, but also not by corporations, or criminals.
Privacy is a human right, and we must not take that away from everyone.
