Fundamentals

Encryption, Privacy, and Freedom: What It Protects and Where Its Limits Lie

By Daniel Sardá · Published on October 05, 2026

6 min read1,238 words

Encryption protects the confidentiality of messages and files, but it does not guarantee anonymity or complete security. Understanding its limits makes for a more rigorous debate about privacy, freedom, and government access.

When we send a personal conversation, share a work file, or coordinate an association, we reasonably expect its contents not to be open to anyone who happens to come across them. Encryption helps meet that expectation: it transforms readable information into data that can be understood only with the appropriate key.

It does not make the people communicating invisible, nor does it solve every security problem. Its role is more specific and, for that reason, valuable: it reduces the chance that unauthorized third parties can read certain data. Understanding that role makes it possible to explain why encryption matters for privacy and freedom without treating it as a magic solution.

What encryption does

In technical terms, encryption transforms plaintext into ciphertext using an algorithm and a key, as defined by the NIST. In ordinary terms, it is like putting information in a box whose contents cannot be understood without the right means of opening it.

Encryption can protect stored data—for example, a file on a device—or data travelling across a network. In both cases, its central purpose is confidentiality. Someone who intercepts the information should encounter an unintelligible form rather than the original contents.

One especially important form is end-to-end encryption. Under this arrangement, content is protected between the sender and intended recipient. Intermediaries may carry the data, but they do not need to receive the message in readable form. This differs from transport encryption, which protects a connection in transit even though an intermediary service may decrypt the content at some stage.

Key idea: Encryption protects data from unauthorized reading; by itself, it does not guarantee anonymity, invulnerability, or complete privacy.

What encryption does not necessarily hide

A conversation can be encrypted while still revealing information about the communication. It helps to distinguish five issues that are often conflated:

• Content and metadata: Content is what is said or sent; metadata may indicate who communicated, when, for how long, the size of a file, or the route used. What is exposed varies by system.
• Encryption and anonymity: Encryption protects information; anonymization seeks to disconnect an activity from an identity. An encrypted message may still be tied to known participants.
• Transport and end-to-end encryption: Both reduce interception risks, but only the latter aims to keep content inaccessible to intermediaries.
• Channel and device: A well-protected channel does not safeguard content if a phone or computer is compromised, unlocked, or copies data to a less secure place.
• Technical protection and legal immunity: Encrypting data does not place it beyond the law or prevent every investigation by other means.

These distinctions avoid two opposing errors. One is to believe that encryption eliminates every trace or risk. The other is to treat it as a tool reserved for people seeking to hide unlawful conduct. In fact, it protects ordinary activities: professional consultations, financial information, business projects, family conversations, and the work of civil-society organizations.

Why confidentiality supports freedom

Privacy does not mean living without ties or accountability. Among other things, it means retaining a space in which to speak, read, deliberate, and associate without indiscriminate exposure. That space is part of individual privacy and helps make freedom of expression meaningful.

The connection is practical. A person may refrain from seeking information, voicing an unpopular opinion, or exercising freedom of association if they assume every conversation will be observed and archived. Journalists, lawyers, doctors, businesses, and associations have different reasons to protect communications, but they share one need: the ability to decide who may access them.

The UN Special Rapporteur's 2015 report on encryption and anonymity describes them as tools that facilitate the exercise of opinion and expression. That does not mean every encrypted communication is virtuous. It means confidentiality creates conditions for exercising legitimate freedoms, just as a locked door protects many lawful activities even though it can also be used for other purposes.

Key idea: Privacy is not the same as impunity. It is a condition that lets people choose when, how, and before whom to disclose personal information or share ideas.

From a liberal perspective, the point is not to assign absolute value to secrecy. It is to recognize that autonomy loses substance when individuals and organizations must act under constant exposure. Protecting communications disperses power: it makes it harder for governments, companies, criminals, or the merely curious to gain unrestricted access to other people's lives.

The dilemma of exceptional access

The hardest argument arises when a legitimate investigation needs to obtain encrypted information. A serious crime may leave evidence on a device or in a conversation. If no one but the endpoints holds the keys, authorities may lose a relevant source of evidence. Denying that cost would be unconvincing.

This concern gives rise to the proposal for exceptional access: a technical capability allowing an authorized party to recover plaintext. But a court order and a backdoor are not the same thing. An order answers a legal question—when may the state require access? A backdoor answers a technical one—how can a capability that does not exist in ordinary operation be built and safeguarded?

An exceptional-access architecture must manage additional keys, permissions, or recovery mechanisms. That expands the surface that can fail, be abused, or become a target for third parties. The National Academies report on the encryption debate recognizes both sides of the problem: strong encryption can impede investigations, while facilitating access to plaintext imposes some security cost. The scale of that cost depends on design and operation; it is not enough to promise that only the “good guys” will gain access.

Warning: Legal authority can define who ought to access data, but it cannot ensure that a technical vulnerability will always remain available only to authorized users.

The alternative is not to choose between public safety and the total absence of investigation. With appropriate safeguards, authorities may rely on unencrypted information, available metadata, copies, testimony, device analysis, or other techniques. Each path has its own limits and risks. The institutional question is whether a particular measure is lawful, necessary, and proportionate, and whether it has oversight, auditing, and remedies for abuse.

Trust, rules, and limits on power

Encryption alone does not determine how much power the state should have, what obligations digital services should bear, or how a crime should be investigated. It does change the starting point: confidentiality need not depend solely on an intermediary's promise, and certain forms of indiscriminate access become more difficult.

For that reason, a sound policy should avoid two absolutes. Not all surveillance is illegitimate: a targeted investigation grounded in law and subject to review belongs to a different category from mass collection. Yet not every legitimate aim justifies weakening a general protection. The rule of law—and the broader case for limits on political power—requires examining necessity, proportionality, the security of the design, and whether its use can genuinely be supervised.

Encryption's value lies in protecting an everyday boundary: who may read our words and files. That boundary will never be perfect, but it lets us talk, work, and associate more freely. Preserving it does not require ignoring crime or turning privacy into an absolute shield. It requires something more prudent: general rules, investigations with safeguards, and a high burden of justification before introducing weaknesses that would affect everyone.