Encryption Faces an Existential Threat in Europe

The CEO of Proton says new competition laws have finally given him a voice in Brussels, even as he fights the EU’s anti-encryption campaign.

ANDY YEN IS positioning himself to be Europe’s answer to Google cofounder Larry Page. Like Google, Yen’s company Proton offers services including email, calendar, drive storage, and VPN, just with a privacy twist. All its products are encrypted. But unlike Google, nine-year-old Proton has had to try and grow its business in the shadow of the tech giants. That has been a huge disadvantage, says Yen, because companies like Google and Apple can exploit their dominance to nudge users to use their apps as well as their phones. 

If a person buys a Google Android or Apple iPhone, they are offered a default email service, search engine, and calendar app. “The defaults just so happen to be the services that [these companies] themselves provide,” complained Yen in 2021. He was well aware that people favor convenience. “What we know from studies is that 95 percent of people will not change the defaults.”

But 2022 was the year the European Union finally took action. In March, the bloc’s lawmakers agreed on new rules designed to release the grip Big Tech has on European consumers and to help homegrown internet companies compete with American giants for customers. The Digital Markets Act will obligate companies that run phone operating systems to offer “choice screens” so users have more control over which services they use. Technically, the DMA went into force in November, although it may not take full effect until March 2024. Proton is headquartered in Geneva, Switzerland, which is not an EU member. But Yen thinks this law will help European companies, like Proton, finally have a voice in Brussels.

Europe’s momentum in rewriting the rules of the internet, however, is not all good for Proton, which has grown to 70 million accounts. The company is warily watching a wave of proposals in the UK and the EU that privacy advocates warn will threaten encryption, such as the UK’s Online Safety Bill and the EU’s proposals to combat child sexual abuse material. Yen spoke in October at WIRED’s business conference, WIRED Smarter. At the event, we talked about how he is thinking about the breakthroughs and concerns that are emerging out of Europe’s increasing focus on technology legislation. This interview has been edited for clarity and length.

WIRED: You’ve been a big advocate for Europe’s Digital Markets Act. Now that the new rules have passed, are you concerned about enforcement? 

Andy Yen: I had a call earlier this year with Margrethe Vestager, who is the head of competition at the European Commission. And I can tell you, the political will to enforce this is there. You can see the fire inside her. She wanted to get it done. 

But is political will the same as having the resources to force big tech companies to comply? 

That's exactly the problem. The combined market cap of these big tech companies a couple months ago was $7 trillion, which is bigger than most European countries’ GDP. 

That’s a lot of lawyers.

They [Big Tech] are throwing literally hundreds of millions of euros at this problem. And as much as Ms. Vestager is committed to fighting this, she is facing an uphill battle against enormous resources of entrenched powers. So it will be a tough fight. But what is making me very optimistic is that, for the first time, I'm seeing the commission reach out to small companies like Proton to really understand what the issue is and get to the heart of it. 

It's a shift. Instead of just listening to whatever Big Tech’s consultants and lawyers are spewing out, they're taking time to talk to small companies and, for the first time—maybe ever—I feel like we have a voice in Brussels. 

When did that shift happen? After the DMA was passed? 

Just within the past year. I think it really shows a shift in the mindset in Brussels that has, so far, not yet happened in the US. In the US, the antitrust fight is much tougher. 

What about other European regulation? I know there's a lot of concern about the legislation drafted by EU Home Affairs commissioner Ylva Johansson which proposes forcing encrypted platforms to carry out automated searches for child sexual abuse material. Is that something you think could affect you?

Source