URnetwork
•••

Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS
News / AnalysisGermanyRussiaIsraelUnited KingdomMyanmarChinaThailandDenmarkSwedenFranceAustraliaIndia

Encryption Is Unbreakable. The Infrastructure That Delivers It Isn't.

This week, Microsoft locked out the developers of WireGuard and VeraCrypt — with no warning, no notification, and no human to contact. ICE confirmed it reads encrypted messages with zero-click spyware. The EU's scanning law expired but companies keep scanning anyway. Seven countries are demanding encryption backdoors while their own militaries mandate Signal. And the lesson is the same everywhere: privacy has a permission problem that no amount of math can solve.

URnetwork editorialSan Francisco — April 10, 2026

The week encryption won and lost simultaneously

On April 3, the European Parliament let the legal basis for voluntary message scanning expire. The vote — 311 to 228 — was the most significant privacy win in Europe in years. The EFF reported that companies like Google and Meta lost their authority to scan billions of private messages. But then they kept scanning anyway, issuing a joint statement pledging to "continue to take voluntary action" — now likely in violation of the ePrivacy Directive. In 2024, Germany's federal police found that 48.3% of flagged messages were false positives — family photos and medical images misidentified as illegal content. Five hundred scientists from 34 countries had already declared client-side scanning "technically infeasible" and a de facto backdoor. The European Court of Human Rights ruled in Podchasov v. Russia that encryption backdoors violate Article 8 of the Convention. None of this stopped the scanning.

On April 7, NPR reported that ICE had confirmed, in a letter to Congress, that it actively uses Paragon Solutions' Graphite spyware to read Signal and WhatsApp messages on American soil. The technical mechanism: Graphite adds the target to a group chat, sends a crafted PDF, and triggers CVE-2025-27363 — a FreeType library vulnerability — for code execution and spyware installation. No click required. The $2 million contract was signed under the Biden administration, paused, then reactivated by Trump. Paragon was founded by Ehud Schneorson, former commander of Israel's Unit 8200, and Ehud Barak, former Israeli Prime Minister, and was acquired for $900 million by AE Industrial Partners and folded into a Virginia-based company called REDLattice. Rep. Summer Lee responded: "The people most at risk, including immigrants, Black and brown communities, journalists, organizers, and anyone speaking out against government abuse, deserve more than secrecy and deflection."

On April 8, TechCrunch reported that Jason Donenfeld — creator of WireGuard, the most widely deployed modern VPN protocol — could not ship software updates because Microsoft had terminated his developer account. The same week, Mounir Idrassi (VeraCrypt), the Windscribe VPN team, and MemTest86 discovered their accounts were locked too.

Donenfeld wrote on Hacker News: "Microsoft never sent me any notification at all about this. I've looked in every inbox in every spam folder in every mail log, and zero, nothing, zilch."

Idrassi tried to get help: "I tried to contact Microsoft through various channels, but only received automated replies and bots." It took Tim Sweeney, the CEO of Epic Games, personally escalating the issue to Microsoft's President of Windows and Devices to get anyone to respond. Microsoft VP Scott Hanselman dismissed the incident: "Not everything is a conspiracy, sometimes it's literally paperwork."

It's not a conspiracy. It's worse. The paperwork is the point.

The permission stack

Every privacy tool you use sits on top of a stack of permissions that you did not grant, cannot control, and may not know exist.

Layer 1: Driver signing

WireGuard and VeraCrypt cannot run on Windows — which holds 72% of the desktop OS market — without a driver signed by Microsoft's Hardware Program. Microsoft's new mandatory account-verification policy, announced October 2025, requires developers to upload government-issued ID where the name matches the Partner Center Primary Contact. Accounts that didn't comply by April 1, 2026 were automatically suspended.

This requirement is fundamentally incompatible with pseudonymous open-source development. The termination message Idrassi received was final: "There are no appeals available, we have closed your application."

VeraCrypt's bootloader is signed with a certificate that expires June 27, 2026. After that date, UEFI Secure Boot will refuse to load it. An estimated 5 to 10 million encrypted devices globally will face boot failures — not because the encryption was broken, but because Microsoft's certificate expired and the developer's account was locked.

Layer 2: App stores

In early 2026, Apple and Google removed at least twelve VPN services from Indian app stores at government request — including Cloudflare's 1.1.1.1, Hide.me, and PrivadoVPN. Across all of Indian-administered Kashmir, VPNs are now banned in every district, with over 800 people accused of VPN violations and 150 formally booked in a single three-day period. Police confiscate and search phones.

In the UK, Apple withdrew its own Advanced Data Protection feature for iCloud in February 2025 rather than comply with a government backdoor order. Fourteen months later, as of April 2026, ADP has not been restored for UK users. Ten major iCloud categories — including backups, photos, files, and notes — remain without end-to-end encryption. Apple holds the keys. The Home Office issued a second, narrower order — same backdoor demand, limited to UK residents. But as security researchers note: a backdoor cannot be geographically limited. The mechanism, once built, is a universal vulnerability.

Layer 3: ISP routing

On February 12, Russia blocked WhatsApp entirely — affecting 100 million users. The block used a two-layer approach: removing WhatsApp domains from Russia's National Domain Name System, backed by TSPU deep-packet-inspection boxes on every ISP. Signal has been blocked since August 2024. Discord since October 2024. Viber since December 2024. Instagram and Facebook since 2022. YouTube was blocked alongside WhatsApp in February.

The replacement is Max, a state-backed messenger built by VK, mandated for preinstallation on all devices sold in Russia since September 2025. Max has no end-to-end encryption — it uses FSB-approved encryption that gives authorities access to all messages. Cybersecurity researcher Baptiste Robert discovered a hidden module called HOST_REACHABILITY that actively detects VPN use and reports it to VK's servers. Robert concluded: "Any data that passes through this application can be considered to be in the hands of the Russian state."

Approximately 50% of Russians now use VPNs. The AP reports a "spring of growing discontent" — even Kremlin supporters are angry. Business leader Alexander Shokhin told Putin directly that the shutdowns "made life difficult for both businesses and citizens."

Layer 4: Government acquiescence

Myanmar's Cybersecurity Law criminalizes unauthorized VPN use with one to six months' imprisonment and fines up to $4,760. In Mandalay, Yangon, and cities across nine regions, military patrols and Pyu Saw Htee militia stop people on the street to inspect smartphones for banned apps.

The enforcement is powered by Chinese deep-packet-inspection hardware. A 600-gigabyte data leak from Geedge Networks — a company led by Fang Binxing, the "Father of China's Great Firewall" — exposed source code and contracts revealing a turnkey "Great Firewall in a Box" product deployed across 26 data centers in 13 Myanmar ISPs, monitoring 81 million TCP connections simultaneously and blocking 281 VPNs and 55 apps including Signal, Tor, and WhatsApp.

In three months, the Mandalay Region Police Force arrested 1,657 people using the PSMS (Person Scrutinization and Monitoring System). At checkpoints, soldiers demand 1 to 3 million kyats ($460–$1,380) from anyone found with VPN software. Two young women were detained for two days in Yangon; their parents paid $230 each for their release.

A woman named Pan Pan, who fled to Thailand after two friends were arrested at checkpoints, told a journalist: "Because of all this surveillance, our daily lives feel like we could be arrested anytime on the street. Freedom of movement is gone. It's like living inside a slaughterhouse."

Myanmar's internet freedom score: 9 out of 100. Tied with China for the worst in the world.

Layer 5: Endpoint compromise

ICE's Graphite spyware, now confirmed active on American soil, reads encrypted messages by compromising the device itself. But Graphite is not the only tool. DHS operates a 1.2-billion-image facial recognition database through an app called Mobile Fortify, built by NEC Corporation, that has been used over 100,000 times since June 2025 — including against teenagers near a high school in Aurora, Illinois, where an agent asked "Can you do facial?" while pointing a phone at a minor's face. Biometric data is retained for 15 years. No Privacy Impact Assessment was ever completed.

ICE's total surveillance budget: $28.7 billion — ten times its cumulative surveillance spending over the prior 13 years.

At every layer of this stack, the math of encryption is irrelevant. The question is not whether your messages can be decrypted. The question is whether you will be allowed to encrypt them.

The encryption paradox of April 2026

The paradox sharpens when you hold the wins and the losses side by side.

The wins are real. The EU killed Chat Control's legal basis. Signal deployed the Sparse Post-Quantum Ratchet — the first consumer-scale hybrid post-quantum encrypted messaging protocol, combining a classical Double Ratchet with ML-KEM-768 (a NIST-standardized post-quantum key encapsulation mechanism) into what Signal calls the "Triple Ratchet." Bruce Schneier wrote: "This update can be seen as doubling the security of the ratchet part of Signal." The protocol was formally verified by Cryspen using ProVerif and F*. "Harvest now, decrypt later" attacks — where adversaries warehouse encrypted traffic until quantum computers can break it — are now structurally harder against Signal's 70–100 million monthly active users.

Denmark reversed its encryption ban proposal after Justice Minister Peter Hummelgaard — who had declared that "we must break with the totally erroneous perception that it is everyone's civil liberty to communicate on encrypted messaging services" — was discovered to be one of 70 out of 179 Danish MPs who personally use encrypted messaging. Sweden's own Brigadier General Mattias Hanson directed all non-classified military communications to use Signal — while the Swedish government's encryption backdoor bill seeks to force Signal to store and hand over messages. The Armed Forces' formal consultation response: access requirements in end-to-end encrypted communications "cannot be fulfilled without introducing vulnerabilities and backdoors that third parties could exploit." 237 organizations from over 50 countries wrote to the Swedish Riksdag in opposition. The bill has been postponed.

And the FBI and CISA issued a joint warning that Russian hackers are actively compromising Signal and WhatsApp accounts of government officials — an implicit admission that encrypted messaging protects national security. The FBI's reversal goes deeper: after China's Salt Typhoon campaign hacked 200+ telecom companies across 80+ countries — exploiting the very lawful-intercept infrastructure that governments mandated telecoms build — the FBI now tells Americans to use Signal. Salt Typhoon accessed the FBI's own DCS-3000 ("Red Hook") wiretap management system through a seven-year-old unpatched Cisco vulnerability, obtaining a near-complete list of who the FBI was wiretapping. The agency that spent decades fighting strong encryption now recommends it — because its own wiretap system was turned against it.

The losses are structural. At least seven jurisdictions are simultaneously pursuing encryption weakening: the UK, Sweden, France, Denmark, Australia, India, and the EU collectively. Signal has threatened to leave five of them. The EU's Chat Control 2.0 trilogue continues — the next session is April 16, six days from now, with a target deal by July. The European Digital Rights initiative called the CSAR regulation "the most criticised draft EU law of all time."

Meanwhile, the Anthropic–Pentagon standoff revealed what happens when an AI company refuses to enable surveillance. Anthropic declined to allow its Claude models for mass domestic surveillance and autonomous weapons. The Pentagon designated it a "supply chain risk" — a label previously reserved for Huawei and ZTE. Federal Judge Rita Lin called the designation "Orwellian" and granted a preliminary injunction, writing: "Nothing in the governing statute supports the Orwellian notion that an American company may be branded a potential adversary and saboteur of the U.S. for expressing disagreement with the government." The D.C. Circuit reversed on April 8, citing "active military conflict with Iran." OpenAI stepped in with its own $200 million deal; the EFF called the contract language "weasel words." ChatGPT uninstalls spiked 295% in a single day.

The encryption math has never been stronger. The infrastructure that delivers it has never been more fragile.

What permissionless privacy has to mean

The lesson of this week is not that encryption is failing. AES-256 is not the bottleneck. Signal's new post-quantum ratchet is not the bottleneck.

The bottleneck is that the entire delivery pipeline — the driver signing, the app store listing, the ISP routing, the government acquiescence, the physical safety of the device — is controlled by entities whose permission can be revoked.

A privacy infrastructure that survives the permission stack has to satisfy four properties:

  1. Distribution without gatekeepers. The software must be available through channels no single entity controls. Open source is necessary but not sufficient — the Microsoft lockout proved that. You also need reproducible builds anyone can verify, and distribution channels (F-Droid, direct APK, sideloading) that do not depend on Apple or Google's continued cooperation.
  1. Transport indistinguishable from ordinary traffic. If DPI hardware — whether Chinese-manufactured Geedge Tiangou gateways or Russia's TSPU boxes — can fingerprint your protocol, it can block your protocol. Standard VPN protocols are now routinely detected: OpenVPN, WireGuard, and IKEv2 are all blocked in Russia. Only protocols that look like normal web traffic — VLESS+Reality, AmneziaWG 2.0, WebRTC — survive.
  1. No central operator to compel. If there is a company that runs the servers, that company can be ordered to log, to block, to hand over data, or to shut down. The network must be operated by its participants — not by a vendor that participants trust.
  1. No identity to revoke. If using the network requires an account or subscription, that identity is a handle that can be suspended, subpoenaed, or used to deny service.

URnetwork against the permission stack

URnetwork was designed to remove every permission gate in the stack.

Distribution without gatekeepers. The client is fully open source. It is listed on F-Droid (version 2026.1.7) with builds independently reproduced from source by F-Droid maintainers and verified bit-for-bit against URnetwork's published artifacts. It is available through Obtainium for direct GitHub releases, and through major app stores as a convenience, not a dependency. When Microsoft locks out a developer account, URnetwork's distribution does not stop. When India removes a VPN from the App Store, the APK is still downloadable. When a government demands a backdoor, there is no binary to backdoor that someone else hasn't already verified.

Transport indistinguishable from ordinary traffic. The protocol ships three transports — QUIC/TLS, TCP/TLS, and WebRTC/dTLS — all spoken by ordinary web browsers. The transport layer (URTRANSPORT1) automatically selects and upgrades between them based on availability and performance. The accessibility layer supports N-TLS encryption (N>=2) with SNI spoofing — nested TLS layers where each outer encryption uses a self-signed certificate for any hostname to an intermediary IP, making connections look like standard HTTPS traffic. A government or ISP that wanted to fingerprint and block them would have to block the open web.

No central operator to compel. Every hop is a real consumer device — a phone, a laptop, a $145 URnode (2GB DDR RAM, dual gigabit Ethernet, 2x2 MIMO Wi-Fi). Providers earn through a performance auction that routes traffic through the fastest, most reliable paths. The multi-client manager maintains a window of 2–6 providers simultaneously, with blackhole detection (5-second timeout for clients that acknowledge traffic but don't return it), ping health checks (30-second timeout), and continuous window resizing. When a path drops, the next-best path is already being tested. There is no central server list. There is no operator to serve a Technical Capability Notice.

No identity to revoke. The free tier provides 50 GiB per month with no subscription profile, no account ledger to subpoena, and no identity to age-verify. Providers earn weekly payouts in USDC. If Myanmar's military inspects your phone and finds URnetwork, it looks like a normal app making normal web connections. There is no VPN icon in the status bar.

The honest caveat

Permissionless does not mean invulnerable. If ICE deploys Graphite on your phone, it reads your messages regardless of what app sent them. If Iran deploys military-grade GPS jammers — which it did in January 2026, cutting Starlink performance by 80% — no overlay network can manufacture connectivity from nothing. During full infrastructure-level shutdowns, all software-based circumvention tools fail: VPNs, Tor, Psiphon, Shadowsocks, everything.

But most real-world censorship is not total infrastructure shutdown. It is a developer account locked because of a paperwork policy. It is an app listing removed at a regulator's request. It is a protocol throttled by DPI hardware. It is a bureaucrat rewriting a backdoor order after the first one was struck down. It is a checkpoint soldier demanding $1,380 from a student whose phone has a VPN icon.

Those are permission problems. And they have a permissionless answer.

What you can do

Every person outside a restricted zone who opens URnetwork and enables provider mode adds residential capacity to a network that someone inside a restricted zone may need tomorrow. Every URnode shipped is a whole-home endpoint that runs against a network no gatekeeper controls. Every developer who reads the protocol and verifies the build is one more person who can confirm the binary matches the source.

The encryption math works. It has always worked. The problem was never the math. The problem is that someone, somewhere, has to give you permission to use it — and this week proved, again, that permission can be revoked at any layer of the stack, by any entity with leverage, for any reason or for no reason at all.

The fix is an infrastructure that does not need permission. That infrastructure exists. You can run it.

References (45 sources)

References

Microsoft Developer Account Lockouts (April 8-9, 2026)

ICE Spyware / Paragon Graphite

EU Chat Control

Encryption Backdoor Demands

Russia

India / Kashmir

Myanmar

Salt Typhoon

DHS Surveillance Apparatus

Anthropic-Pentagon

Signal Post-Quantum Ratchet

Circumvention Tools

URnetwork

Further Discussion

Open Source Security Has a Single Point of Failure — And It's Microsoft

WireGuard protects millions of VPN connections. VeraCrypt encrypts an estimated 5 to 10 million hard drives. Both were unable to ship security updates this week because one company — Microsoft — locked their developer accounts. No notification was sent. No human was available to help. The developer of VeraCrypt tried "various channels" and received only "automated replies and bots." It took Tim Sweeney, the CEO of Epic Games, personally calling Microsoft's President of Windows to get a response. Meanwhile, Microsoft now requires government-issued ID from all developers in the Windows Hardware Program — a policy fundamentally incompatible with pseudonymous open-source development. VeraCrypt's bootloader certificate expires June 27, 2026. After that date, millions of encrypted devices face boot failure. Open source software is supposed to be resilient because anyone can read and build the code. But on Windows — 72% of the world's desktops — none of that matters if Microsoft won't sign your driver. We don't have decentralized security tools. We have security tools that exist at the pleasure of the platform.

The Permission Layer Is the Only Thing Protecting Us From Chaos

Removing all gatekeepers from security infrastructure sounds liberating until you think about what gatekeepers actually prevent. Microsoft's driver-signing requirement exists because unsigned drivers are the number-one vector for rootkits and kernel-level malware. Apple's App Store review catches thousands of malicious apps per week. In June 2025, the Supreme Court upheld Texas's age-verification law 6-3 — and for good reason: the age verification company Persona, which performs 269 surveillance checks per transaction, had its source code exposed on a government server; the identity verification company IDMerit leaked 3 billion records; and Discord's verification vendor leaked 70,000 ID photos. These breaches happened WITH gatekeepers. Imagine what happens without them. Celebrating the removal of all gatekeepers is celebrating a world where your grandmother installs a trojan that calls itself VeraCrypt, where a fake "Signal" app — like the one WhatsApp warned about in April 2026 — infects 200 devices before anyone notices. The real answer isn't permissionless infrastructure — it's accountable gatekeeping: transparency about criteria, due process before lockout, appeal rights for developers, and multiple independent signing authorities. Tearing down the gates doesn't free the good guys. It frees everyone.

Comics

#1Open Source Security Has a Single Point of Failure — And It's Microsoft
#2The Permission Layer Is the Only Thing Protecting Us From Chaos