The Electronic Frontier Foundation (EFF) has launched a new initiative called 'Encrypt It Already,' aimed at compelling large technology and communications companies to fulfill their promises regarding data privacy and implement end-to-end encryption (E2EE) features for user data and communications.

As privacy concerns continue to rise, particularly with the increasing use of artificial intelligence (AI), the campaign emphasizes three main objectives: releasing promised features, activating existing E2EE features by default, and introducing data protection capabilities already available in the industry. Examples include the anticipated launch of E2EE for direct messages on Bluesky, default E2EE for Ring cameras, and E2EE for Android backup data from Google.

E2EE is heralded by the EFF as the most effective method for safeguarding personal conversations and data. Users of various social media and communication platforms, including Facebook, Bluesky, Telegram, and Signal, expect their interactions to remain confidential. Concerns mount when service providers have access to this data and potentially share it with third parties, including law enforcement, without users' consent. E2EE effectively prevents third parties from accessing the content of communications.

Addressing Unfulfilled Promises

While the initiative aims to encourage companies to adopt better privacy and security measures, it does not seek to blame any organization. The goal of 'Encrypt It Already' is to empower users to take control of their privacy and data. Thorin Klosowski, a security and privacy activist at EFF, noted that E2EE often gets deprioritized in favor of more appealing features.

For instance, when Bluesky introduced direct messaging in 2024, it suggested that implementing E2EE would take time due to usability, security, and privacy considerations. However, as of January 2025, no progress had been reported. Similarly, Apple introduced the Rich Communication Services (RCS) messaging protocol in 2024 to enhance security between iOS and Android devices, but full E2EE encryption remains unimplemented, requiring collaboration between Apple and Google.

In 2023, Meta activated E2EE by default for one-on-one conversations on Facebook Messenger. However, the rollout for group messaging and other services, such as Instagram Direct Messages, remains optional and still in testing.

Calls for Default E2EE Implementation

A significant aspect of the 'Encrypt It Already' initiative is the push for companies to implement E2EE features by default. While offering E2EE is crucial, it is more secure when users do not have to actively seek it out. Companies tend to prefer opt-out settings for usability, which minimizes user action but places the burden of security on individuals to understand and manage their privacy settings.

Klosowski emphasizes that most users do not alter default settings, and the initiative serves as a reminder that these features exist and should be utilized. EFF is focusing on major companies that either claim to offer E2EE but do not default to it or have expressed intentions to do so without taking action. The implementation of E2EE is expected to require time, but the initiative aims to initiate dialogue on the matter.

AI and Heightened Privacy Concerns

The urgency of these demands is amplified by the security and privacy challenges associated with the rapid advancement of AI technology. Namrata Maheshwari, senior policy counsel and encryption policy lead at Access Now, stresses the need for encrypted communications to guard against AI surveillance, as AI agents can access sensitive data with minimal human oversight.

The 'Encrypt It Already' campaign articulates specific demands that reflect the expectations of civil society and privacy advocates, insisting that technology companies must meet their commitments.

Balancing Privacy and Law Enforcement Needs

Discussions surrounding E2EE for communication and data storage are multifaceted. Users rightfully deserve privacy, but concerns arise when individuals are implicated in serious crimes, such as the distribution of child sexual abuse material. Law enforcement may seek access to communications for legitimate reasons, but the potential for misuse is significant.

Companies that adopt E2EE for data and communications cannot access user information, regardless of the circumstances. The EFF has urged Ring to enable E2EE for its cameras by default, highlighting the cumbersome process required to activate it manually. By making E2EE the default, users gain greater control over who can access their footage.

The foundation also encourages Google to adopt advanced data protection features that empower users, a capability already available through Apple, demonstrating its feasibility.

As privacy concerns continue to escalate, especially with AI's increasing role, the push for E2EE has never been more critical. Klosowski notes that many companies targeted by EFF are likely to adopt these features within the coming year, and he expresses hope for future celebrations of these advancements.

Source: Dark Reading News