Imagine a statute criminalizing the placement of curtains in home windows. After all, people regularly commit terrible crimes in the privacy of their own homes — perpetrating domestic violence, cooking up deadly drugs, storing illegal contraband, harboring fugitives, running kitchen-table scams, etc.
If at-home conduct were made visible to the police and the public, the reasoning goes, fewer acts of force and fraud would be committed. Lawmakers then discover that the Curtain Ban Act is insufficient to thwart criminals (and who objects to thwarting criminals?).
Next comes legislation to remove the locks from doors that impede law enforcement, and then more legislation to ban doors. These fail too, and lawmakers enact a mandate requiring all home walls to be built of glass. Radical transparency prevails. Privacy is lost. All in the service of safety and law and order.
THE KREMLIN FEARS VPNS MORE THAN UKRAINIAN DRONES
Nobody proposes this. The people would not tolerate it. But this instinctive care for privacy may be becoming an anachronism of the physical world. In the digital realm, lawmakers have increasingly proposed intrusive legislation to root out misconduct or conduct they simply disapprove of. The latest target: virtual private networks, or VPNs, tools that protect online privacy, anonymity, and data security. These efforts treat such technologies as dispensable the moment public safety arguments are trained against them, with little concern for what gets lost in the process.
VPNs hide the user’s IP address and location (among other information) and safeguard data from malicious actors. But VPNs also enable users to skirt jurisdiction-specific digital mandates, irking the authors of those mandates. Two state legislatures recently considered VPN bans. “In Michigan, six Republican representatives proposed a bill that would not only restrict access to VPNs…,” The Verge reports. “Wisconsin lawmakers packaged a VPN ban in the state’s age verification bill, but they have since removed the provision after facing widespread backlash.”
Regulatory ire against the VPN is a trans-Atlantic phenomenon. In 2023, the United Kingdom enacted the Online Safety Act, an age verification regime implemented last year, purportedly to protect children. Without delay, users sensible of the dangers to privacy that attend age verification flooded to app stores to download VPNs, seeking to avoid compliance. Ofcom, the British internet regulator, reports that VPN usage initially doubled following the OSA’s enforcement (usage rates fell in the ensuing months but remained elevated).
Perhaps discomfited, Ofcom contracted a third party, whose name it would not disclose, to observe Britons’ VPN usage. Moreover, Children’s Commissioner Dame Rachel de Souza declared: “We need age verification on VPNs — it’s absolutely a loophole that needs closing.” Across the English Channel, Anne Le Henanff, the French minister delegate for artificial intelligence and digital affairs, advocated action against VPNs, saying, “VPNs are the next topic on my list.”
As regulators continue down the list of proposals to mitigate the difficulties of the internet, each one is more meddlesome, more damaging to privacy, and more invasive of the individual’s domain, a domain once safe from the arbitrary interference of the state. Without a distinct limiting principle, the slope becomes slippery all the way down. Controversies about VPNs recall the yearslong effort on Capitol Hill to fracture encryption technologies, without which users cannot be sure of the security of their data and communications. The individual cannot have online privacy if every technology that ensures it can be disabled or broken into at the whim of legislators, bureaucrats, and law enforcement.
THE KIDS ACT TREATS EVERYONE LIKE A KID
For the purposes of privacy, the digital world differs from the physical one in this critical aspect: Digital intrusions into the lives of Americans are far less obvious and unconstrained by the usual constraints of physical proximity. Men on computers in the basements of government buildings can snoop and surveil undetected by anyone, observing the behavior and hoovering up the most intimate information of users without bursting through doors or rifling through personal records. Big Brother no longer needs conspicuously placed telescreens to watch and listen in on the citizenry. And the same goes for cybercriminals and the agents of hostile foreign powers.
As the economist Thomas Sowell noted, there are no solutions, only trade-offs. It is indisputable that the government ought to enforce its laws and that criminals must be caught and prosecuted. However, those ends must not be pursued to the exclusion of all others. As technologies that increase the surveillance powers of governments (domestic and foreign) and criminal enterprises wax, privacy-preserving technologies must not be stymied, and the law must strengthen, not endanger, privacy. The digital world must not be transformed into a house with walls of glass.
David B. McGarry is the research director of the Taxpayers Protection Alliance.