Privacy / P1
Reading encrypted messages
The state wants to read the person's end-to-end encrypted messages, although they are suspected of no serious crime.
What we score
What can the state lawfully do to get at them?
Default assumptions: Unless a vignette says otherwise, the person is a 30-year-old citizen of sound mind with no criminal record, acting alone, on their own behalf and not for profit, in an ordinary residential area. Where subnational units (states, provinces, cantons, Länder) make their own law, each unit is scored and the result is weighted by population. 'The state' includes police, prosecutors, courts, regulators, tax authorities and anyone acting on their orders, including platforms obeying takedown orders.
Score anchors
Both the law score and the practice score use these anchors. Half points are used when a country sits between two of them.
| Score | What it means for this vignette |
|---|---|
| 10 | Nothing without a judicial warrant based on individual suspicion; no compelled decryption; no backdoor mandates. |
| 8 | Judicial warrant needed; device hacking allowed under warrant; no compelled decryption. |
| 6 | Warrant needed, but refusing to hand over a password is a crime. |
| 4 | Administrative (non-judicial) warrants or bulk interception reach ordinary people. |
| 3 | Providers can be ordered to build in access (backdoor or client-side scanning). |
| 2 | Using unapproved encryption is a crime. |
| 0 | Pervasive surveillance with no legal limits. |
Evidence used: Interception and surveillance statutes; key-disclosure laws; technical-capability notices; bulk-collection programmes.
How each country scores
| Country | Law | Practice | Process | Score | Why |
|---|---|---|---|---|---|
| Germany | 7 | 8 | 0 | 7.6 | Police can read encrypted messages only by court-ordered source-TKÜ or device hacking (§ 100a and § 100b StPO, ordered by a judge under § 100e). Both require suspicion of a listed serious crime, so this person is not reachable that way. There is no key-disclosure law or backdoor mandate. Intelligence services can intercept with approval of the G10 Commission, a parliamentary body rather than a court. |
| Czechia | 7 | 7 | 0 | 7.0 | Interception of content requires a judicial order and an offence carrying at least 8 years, or a listed offence (Criminal Procedure Code § 88). Traffic-data access requires a judge's order for offences carrying 3 or more years (§ 88a). Intelligence services need consent from a High Court judge. There is no key-disclosure offence or backdoor mandate. Providers must retain metadata on all users for 6 months (Electronic Communications Act § 97), which is a general retention duty. |
| New Zealand | 6 | 6 | 0 | 6.0 | Police need a warrant or warrantless power to search a device, and can then require a person to provide access information such as passwords (Search and Surveillance Act s130). Refusing carries up to 3 months' imprisonment (s178), though the privilege against self-incrimination is preserved for information that is itself incriminating. Intelligence warrants targeting New Zealanders need approval from the Minister and a Commissioner of Intelligence Warrants, and there is no backdoor mandate for end-to-end encrypted apps. |
| Mexico | 6 | 5 | 0 | 5.4 | Constitution art. 16: only a federal judge can authorise interception of private communications, never in fiscal, civil or administrative matters. There is no key-disclosure law and no encryption backdoor mandate. However, the 2025 Ley del Sistema Nacional de Investigación e Inteligencia gives security agencies access to telecom, biometric and financial databases without a judicial order in all cases. The army's illegal use of Pegasus against journalists and activists remains in litigation (R3D, 2026). |
| Netherlands | 4 | 6 | 0 | 5.2 | In criminal cases, hacking devices requires authorisation from an investigating judge, and suspects cannot be compelled to reveal passcodes. The Hoge Raad (ECLI:NL:HR:2021:202) does allow forced fingerprint unlocking. Under the intelligence act (Wiv 2017), the AIVD and MIVD can hack and run bulk 'investigation-directed' cable interception with ministerial approval plus the TIB review committee, not a court, which can reach people suspected of no crime. No encryption backdoor or client-side scanning mandate is in force; the EU CSA regulation is still in trilogue. |
| Denmark | 4 | 6 | 0 | 5.2 | Police interception of communications, and covert reading of a device (dataaflæsning, e.g. hacking), need a court order and an offence carrying 6 years or more (retsplejeloven §§ 781, 791 b), so a person suspected of no serious crime cannot be targeted. However, providers must keep general, undifferentiated records of every user's internet access for 1 year (§ 786 f). The Defence Intelligence Service may collect information on people in Denmark during foreign-directed bulk collection without a warrant (FE Act § 3(2)). There is no key-disclosure offence. |
| Ireland | 4 | 6 | 0 | 5.2 | Interception is authorised by the Minister for Justice, not a judge, under the Interception of Postal Packets and Telecommunications Messages (Regulation) Act 1993, for serious crime or state security, with only after-the-fact review by a designated judge. Search warrants under laws such as Criminal Justice (Theft and Fraud Offences) Act 2001 s48 let gardaí demand device passwords, and refusal is an offence under s49 (up to 6 months). There is no backdoor mandate yet, but the government plans a Communications (Interception and Lawful Access) Bill covering encrypted services and state spyware. A person suspected of no serious crime is in practice not targeted. |
| United States | 5 | 5 | 0 | 5.0 | Domestic interception needs a judicial warrant (Fourth Amendment, Title III), and no backdoor mandate exists for end-to-end encryption. FISA Section 702 bulk collection, and the FBI's warrantless queries of Americans' communications in it, continue. The statute lapsed on 12 June 2026, but FISC certifications keep collection running until 17 March 2027. Courts split on compelled decryption: Massachusetts (Commonwealth v. Jones) and others allow orders to give up a passcode under the foregone-conclusion doctrine, enforced by contempt jail. Device hacking under warrant is allowed under Rule 41. |
| Switzerland | 4 | 5 | 0 | 4.6 | Targeted interception requires a strong suspicion of a catalogue offence and court approval (Criminal Procedure Code Arts. 269-272). Government trojans are limited to the most serious offences (Art. 269ter), and the accused cannot be compelled to self-incriminate (Art. 113), so a person suspected of no serious crime cannot be targeted. However, the intelligence service runs cable intelligence on cross-border traffic, authorised by the Federal Administrative Court (Intelligence Service Act Arts. 39-41), which sweeps in ordinary people's traffic. Providers must keep metadata for 6 months and remove encryption they applied themselves (Surveillance Act Art. 26). The 2025 draft VÜPF revision extending duties to messaging apps is not in force. |
| Singapore | 4 | 4 | 0 | 4.0 | Under CPC s39, police investigating any arrestable offence may access and search a computer or phone without a warrant. Under s40, on the Public Prosecutor's order rather than a judge's, police may require a suspect to hand over passwords or decryption keys. Refusal is punished with up to S$10,000 and/or 3 years, or up to 10 years where the data relates to serious offences. There is no general ban on encryption and no backdoor mandate for messaging apps. |
| United Kingdom | 3 | 3 | 0 | 3.0 | Investigatory Powers Act 2016 s253 lets the Home Secretary serve secret technical capability notices requiring providers to keep the ability to remove encryption. Apple withdrew Advanced Data Protection for new UK users in February 2025 after one such notice, and challenges by Apple and Privacy International are still pending at the IPT (hearing listed for December 2026). The IPA also allows bulk interception and bulk equipment interference, and RIPA s49 disclosure notices make refusing to hand over a key a crime (up to 2 years, 5 in national-security cases). |