Jurisdiction & Cyber-Law on ARPOKRAT

Data Act vs CLOUD Act: who really controls your data in the cloud?

Fri, 19 Jun 2026 00:00:00 +0000

For years, the world operated on a simple assumption: data has a physical place of residence. If it was stored on a server in Dublin, it fell under Irish and European law. That assumption collapsed in 2018, when the United States enacted the CLOUD Act — a law that grants American authorities access to data controlled by US companies, regardless of where that data is physically stored in the world. Several years later, Brussels responded with its own protective framework: the Data Act, now fully applicable, which attempts to limit the extraterritorial access of third-country authorities to data held within the European Union.

Here is what these two texts actually provide, where they collide, and why the only truly robust protection against this conflict remains technical impossibility of access.

The American CLOUD Act: access based on control, not location

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), enacted in March 2018, amended US law by adding 18 U.S. Code § 2713. This provision requires any provider of electronic communication services or remote computing services to preserve, back up, or disclose the contents of a communication or any record pertaining to it, whenever that data is in the provider’s possession, custody, or control, regardless of whether the data is located inside or outside the United States.

It is precisely this final clause that changes everything. The criterion is no longer the physical location of the server, but the control exercised by the parent company over its subsidiaries. A US company operating data centres in Europe therefore remains subject to American legal demands, even for data stored entirely on European soil.

The European Data Act: a legal barrier to extraterritorial access

Regulation (EU) 2023/2854, known as the Data Act, entered into force on 11 January 2024 and has been fully applicable since 12 September 2025, with certain provisions phased in through 2026 and 2027. Its Article 32 directly addresses the question of international governmental access to data.

The text establishes a clear rule: any decision or judgment of a court or administrative authority of a third country requiring a data processing service provider to transfer or give access to non-personal data held in the European Union is recognised and enforceable only if it is based on an international agreement, such as a mutual legal assistance treaty (MLAT), in force between the requesting country and the Union, or between that country and the relevant Member State.

In the absence of such an agreement, Article 32 provides a second avenue, but one that is strictly circumscribed: the foreign decision may only be enforced if the legal system of the third country requires that the request be reasoned, proportionate, and sufficiently specific — for example, by establishing a clear link to specific individuals or offences — and if the recipient’s reasoned objection can be submitted to the review of a competent court in that third country.

A direct legal collision

The problem is immediate: the CLOUD Act requires disclosure based on the control exercised by the parent company, without a proportionality requirement comparable to that demanded by European law. The Data Act, conversely, conditions recognition of such a request on the existence of an international agreement or specific procedural safeguards. A US company operating in Europe, ordered by an American authority to hand over data hosted within the Union, thus finds itself caught between two contradictory legal obligations: comply with the American mandate and violate Union law, or respect the Data Act and face the consequences of refusal in the United States.

This tension is not theoretical. It has already been documented by the Court of Justice of the European Union (CJEU) in two landmark rulings, Schrems I (2015) and Schrems II (2020). In the Schrems II judgment, the CJEU held that American surveillance conducted under Section 702 of FISA (Foreign Intelligence Surveillance Act) and Executive Order 12333 does not respect the minimum safeguards required by Union law under the principle of proportionality, and therefore cannot be regarded as limited to what is strictly necessary. The Court also noted the absence of an effective judicial remedy for Union data subjects, in violation of Article 47 of the Charter of Fundamental Rights. This ruling invalidated the Privacy Shield framework, which had until then governed data transfers between the EU and the United States.

The structural risk: Harvest Now, Decrypt Later

Beyond the jurisdictional conflict, a more insidious threat looms over data hosted in infrastructures subject to US law: the so-called Harvest Now, Decrypt Later (HNDL) strategy. The principle involves an intelligence service or hostile state actor intercepting and storing encrypted data today, in anticipation of sufficient quantum computing capabilities to decrypt it in the future.

This strategy transforms any prolonged dependence on American cloud infrastructure into a deferred security liability: what is confidential today may become readable in ten or fifteen years, without any further action required on the part of the attacker — only time and patience.

Why only technical impossibility constitutes a genuine guarantee

Legal analysis converges on a finding shared by many compliance experts: however solid the Data Act’s legal framework may be, it remains a text that geopolitical power dynamics and diplomatic pressures can circumvent, delay, or reinterpret. The only protection that depends on no future negotiation is technical impossibility of enforcement.

A zero knowledge architecture, in which the service provider never holds possession or custody of the decryption keys, renders a legal demand materially inoperable. One cannot be compelled to hand over what one never possesses.

This is the logic that underpins ecosystems such as Arpokrat:

Jurisdictional neutralisation: the infrastructure is hosted in Switzerland, under the Swiss Federal Act on Data Protection (FADP/LPD), outside the direct scope of the CLOUD Act’s extraterritoriality
No custody: the zero knowledge architecture deprives the service provider of any ability to hand over keys or content it never holds
Reduced identity footprint: by eliminating the requirement to register with a phone number or email address — identifiers that FISA Section 702-based surveillance can easily track — the user ceases to be an identifiable subscriber and becomes an anonymous cryptographic key

The chain of custody does not stop at message encryption

A point often underestimated in compliance analyses: encrypting the content of a communication is not enough if the underlying operating system — whether Android or iOS — continues to capture metadata or kernel-level telemetry destined for servers under US jurisdiction. Protecting confidentiality requires a complete closure of the chain of custody, from content all the way down to the hardware infrastructure itself.

This is why digital sovereignty also requires reflection on the operating system in use, not just on messaging applications. De-Googled systems, in which modules such as Bluetooth or GNSS geolocation can be disabled directly at the kernel level, eliminate physical attack vectors that no application-layer encryption can compensate for.

Post-quantum cryptography: an already-engaged horizon

In the face of the threat posed by the HNDL strategy, adopting post-quantum cryptography (PQC) standards becomes a necessity for anyone wishing to guarantee the confidentiality of sensitive data over the long term — whether that involves trade secrets, professional correspondence, or health data. Encryption considered robust today under classical standards does not guarantee that it will withstand the quantum computing capabilities expected within the next fifteen years.

The conflict between the Data Act and the CLOUD Act illustrates a broader reality: digital sovereignty can no longer be built on legislation alone, however solid that legislation may be. It requires closing the chain of custody at every level — from the encryption protocol to the hosting jurisdiction, and including the operating system itself. It is this layered approach, rather than trust placed in a single regulatory framework, that defines genuine digital sovereignty by design today.

Monero and Zcash Banned in Europe from 2027: What AMLR Changes

Thu, 18 Jun 2026 00:00:00 +0000

Monero and Zcash banned in Europe: it is now settled. From July 2027, the European Union will close institutional access to privacy-enhanced cryptocurrencies through a new anti-money laundering regulation called AMLR. Here is what the text concretely provides for, the role of the new European authority AMLA tasked with enforcing it, and what this truly means for anyone holding privacy coins.

AMLR and AMLA: Two Different Texts, Not to Be Confused

Before going into detail, a clarification is in order — these two acronyms refer to two distinct things, often confused in the specialist press:

AMLR (Anti-Money Laundering Regulation) is the law itself: Regulation (EU) 2024/1624, which defines the rules — anonymous accounts prohibited, verification thresholds, treatment of privacy coins. It is the “what.”
AMLA (Anti-Money Laundering Authority) is the new European supervisory authority, created by a separate regulation adopted on the same day, Regulation (EU) 2024/1620. Its role is to directly supervise the application of the AMLR, particularly with respect to the largest crypto-asset service providers (CASPs) operating across multiple Member States. It is the “who enforces it.”

In short: AMLR sets the rules, AMLA ensures they are followed. Both texts form a single European legislative package against money laundering and the financing of terrorism.

What the AMLR Regulation Actually Says

Regulation (EU) 2024/1624 was adopted by the European Parliament and the Council on 31 May 2024, then published in the Official Journal of the European Union on 19 June 2024. Its Chapter VIII (Articles 79–80), entitled “Measures to mitigate risks associated with anonymous instruments”, and more specifically its Article 79 (“Anonymous accounts, bearer shares and bearer warrants”), establishes that credit institutions, financial institutions, and crypto-asset service providers (CASPs) are now prohibited from maintaining anonymous accounts or offering products that enable the anonymisation of transactions.

The text explicitly targets two distinct but related categories:

Anonymous accounts — whether banking, payment, or crypto. The rule aligns the crypto sector with restrictions that already existed for anonymous bank accounts, bearer securities accounts, and anonymous safe-deposit boxes.
“Anonymity-enhancing coins” — the generic term used by the regulation to refer to assets that use advanced cryptographic techniques making transaction flows untraceable. Important clarification: the legal text does not name any token by name. It is the widely shared interpretation of compliance firms and the industry — notably the AML Handbook published by the European Crypto Initiative (EUCI) — that identifies Monero (XMR), Zcash (ZEC), and Dash (DASH) as falling within this category. This is a reading consistent with the regulation’s definition, but it is a sectoral interpretation, not a nominative list written into the law.

The regulation is part of a broader framework, alongside MiCA (Markets in Crypto-Assets), already in force since 2024–2025 and which has already led many platforms (Kraken as early as October 2024, followed by dozens of others) to delist Monero from their European markets in anticipation.

The Key Date: July 2027

The AMLR has a firm application date. The majority of specialist sources, including French-language ones, converge on 10 July 2027 as the deadline for full application. From that date, crypto-asset exchanges and custodial services will no longer be able to deal with either anonymous accounts or privacy coins.

Before that deadline, the regulation already imposes enhanced obligations:

Mandatory identity verification for any occasional crypto transaction exceeding 1,000 euros — a threshold significantly lower than the current practices of many platforms
Enhanced controls on self-hosted wallets (self-custody): when a user transfers funds between a regulated platform and a personal wallet, the CASP will be required to collect information on the origin and destination of the funds, and at minimum verify the identity of the holder of the external wallet
Elimination of anonymous cash payments above 3,000 euros, following the same logic of extending identity controls to all anonymous financial instruments

Why Brussels Is Banning Monero and Zcash on Regulated Platforms

In its AML Handbook, the EUCI summarises the logic underpinning the text: the anonymity of crypto-assets presents significant risks of misuse for criminal purposes, by preventing transaction traceability and complicating the detection of suspicious activity.

This is precisely the same reasoning that has already led Japan, South Korea, and more recently the Philippines to exclude privacy coins from their regulated platforms — a progressive alignment of developed jurisdictions with FATF (Financial Action Task Force) standards. By formalising this prohibition in a regulation directly applicable across all 27 Member States, the European Union gives this trend a legal weight and a pull effect (the “Brussels Effect”) considerably greater than that of isolated national decisions.

What Is NOT Prohibited — The Nuance That Matters

Several legal analyses converge on a central point: the AMLR does not criminalise individual ownership of privacy coins, nor peer-to-peer transfers outside regulated platforms. Self-hosted wallets are not prohibited as such — they are subject to enhanced controls only when they interact with a platform subject to regulation.

What the AMLR closes off are the institutional on-ramps: the purchase, sale, deposit, and withdrawal of privacy coins through a regulated CASP within the European Union. Private ownership and decentralised exchanges remain, at this stage, outside the direct scope of the prohibition — a pattern identical to that already observed in the Philippines.

What This Concretely Means for XMR and ZEC Holders

If you currently hold privacy coins on a regulated exchange within the European Union:

By July 2027, these platforms will have had to remove support for these assets or ceased accepting new deposits related to them
Transfers to personal wallets from those same platforms will be subject to enhanced identity verification, even before the final deadline
Any crypto transaction above 1,000 euros, privacy coin or not, will require full identification

Critics of the text, even within the crypto industry itself, point to a structural risk: by closing off regulated circuits without technically prohibiting the assets themselves, the regulation mechanically pushes privacy coin holders toward less transparent markets and unregulated platforms — the exact opposite of the traceability objective Brussels has declared.

Getting Organised Before the 2027 Deadline

With a horizon set at 2027, the transition is not immediate — but it is already underway. Platforms are already adjusting their offerings in anticipation of compliance, and the window to exchange or consolidate privacy coin positions without depending on infrastructure subject to this jurisdiction narrows every month.

Arpokrat Swap allows you to exchange Monero, Zcash, and all privacy-enhanced cryptocurrencies with no sign-up, no collection of identity data, and no dependency on a regulated CASP subject to the AMLR. The platform is accessible on the clearnet as well as via our .onion address, ensuring that your ability to exchange these assets does not depend on any jurisdiction that might close its on-ramps overnight.

The AMLR confirms a trajectory that is now beyond doubt: regulated crypto markets and financial privacy are becoming, jurisdiction by jurisdiction, structurally incompatible. The question is no longer whether this trend will extend across all developed economies, but how much time will remain, after 2027, to exchange private assets outside circuits that will no longer have the right to touch them.

The Philippines Bans Monero and Zcash on Regulated Platforms: The Signal of a Global Trend

Wed, 17 Jun 2026 00:00:00 +0000

The central bank of the Philippines has just dealt a severe blow to privacy-enhanced cryptocurrencies. Under the guise of compliance with international anti-money laundering standards, the decision illustrates a regulatory dynamic that extends well beyond this single country — and should alert anyone who holds or uses assets like Monero or Zcash.

What the Memorandum Says

The Bangko Sentral ng Pilipinas (BSP), the country’s central bank, has approved Memorandum M-2026-023, signed by Deputy Governor Lyn Javier. The text orders all licensed virtual asset service providers (VASPs) to stop listing and supporting “anonymity-enhancing virtual assets.” The memorandum does not name any token specifically, but the targeted category unambiguously covers Monero, Zcash, and Dash — cryptocurrencies designed to make transaction tracing difficult or impossible.

The measure took effect immediately, with no transition period. Beyond simply delisting these assets from platforms, VASPs must now evaluate each listed token against six compliance pillars: issuer credibility, market maturity, use case, transparency and security, liquidity and reserves, and legal compliance. They must also define internal thresholds that automatically trigger a delisting when an asset no longer satisfies these criteria.

What This Concretely Changes

The memorandum does not criminalize the private holding of Monero or Zcash, nor peer-to-peer transfers conducted outside regulated platforms. What disappears is institutional access: regulated on- and off-ramps (buying, selling, depositing, withdrawing on a licensed platform) will no longer be able to handle these assets.

In practical terms, if you held privacy coins on a Philippine platform subject to a BSP license — including Coins.ph/Betur, Maya Philippines, PDAX, GoTyme Bank, or UnionBank — you must transfer them to a personal wallet or convert them before the platform is forced to delist them.

With over 16 million cryptocurrency users in the country, the impact will be felt on a large scale in the domestic market, even if the effect on the global price of XMR or ZEC should remain limited — the Philippines representing only a marginal fraction of the global liquidity of these assets.

FATF Alignment, the Universal Justification

The BSP justifies its decision through explicit alignment with the standards of the FATF (Financial Action Task Force), the international body that sets the rules for combating money laundering and terrorist financing. Staying on good terms with the FATF is not optional for most central banks — a poor rating can affect an entire country’s access to international financial circuits.

This is exactly the same justification that has already led the European Union, Japan, and South Korea to progressively exclude privacy coins from their regulated platforms over recent years. The Philippine decision is therefore not an isolated case: it is the confirmation of a de facto standard that is becoming widespread — if a jurisdiction wants to operate an internationally recognized crypto market, privacy-enhanced assets no longer have a place in it.

A Tension That Nobody Truly Resolves

It is telling that even actors who support the decision acknowledge the legitimacy of the use case it seeks to restrict. The crypto head at GCash, one of the country’s largest fintechs, explicitly acknowledged that Monero and Zcash “exist for legitimate reasons” and that privacy constitutes “a founding value of crypto: the ability to transact without surveillance.” He nonetheless supported the measure, arguing that the Philippines — a country heavily dependent on remittance flows — could not position itself as a trusted financial infrastructure while allowing the free circulation of anonymizing assets.

This tension is not resolved; it is simply decided in favor of the regulatory perspective: remittance volumes and international credibility weigh heavier than the legitimate privacy argument, every time the trade-off arises.

The Logical Next Step: Migration Toward Self-Custody

The pattern repeating itself from one jurisdiction to another is now clearly readable. The pattern is almost always identical: financial privacy remains legal at the individual level, but gradually becomes impossible to exercise through institutional channels. Self-custody is not yet targeted — but each new jurisdiction that follows this model further reduces the space in which these assets can circulate without regulatory lock-in.

We detailed in depth the technical workings of these blockchains and the reasons why they have become a prime target for regulators in our comprehensive guide on anonymous blockchains — ring signatures, zk-SNARKs, and the real limitations of these technologies.

Exchanging Outside the Closing Circuits

As regulated platforms withdraw from the privacy coin market one after another, the role of non-custodial, data-collection-free infrastructure becomes central for anyone wishing to continue using these assets without depending on a VASP subject to a jurisdiction that could change its policy overnight.

Arpokrat Swap allows you to exchange Monero, Zcash, and all privacy-enhanced cryptocurrencies without registration, without IP log collection, and without cookies — whether you access the platform via clearnet or through our .onion address. No jurisdiction can remove what we never collect.

This Philippine decision is probably not the last of its kind this year. The question is no longer whether other countries will follow the same path — recent history suggests they will — but how much time remains before institutional access to privacy coins becomes the exception rather than the norm.

The End of Privacy? Backdoors, the Online Safety Act, and the Response of Sovereign Ecosystems

Wed, 10 Jun 2026 00:00:00 +0000

London has become the epicenter of a global battle for the future of digital privacy. With the adoption of the Online Safety Act 2023 (OSA) and recent proposals to revise the Investigatory Powers Act (IPA) — dubbed the “Snoopers’ Charter” by its critics —, the British government is claiming the right to impose surveillance obligations at the very heart of private communications. The breaking point is the power granted to the regulator OFCOM to require platforms to deploy “accredited technology” to detect child sexual exploitation and abuse (CSEA) material or terrorism, including within end-to-end encrypted communications .

For major digital platforms, Westminster’s message is unambiguous: either they facilitate state access to their infrastructures, or they face fines of up to 10% of their global revenue. The response was immediate: services like Signal and WhatsApp publicly threatened to withdraw from the UK market, refusing to compromise the security of their users to satisfy a single jurisdiction. The technical argument is hard to dispute: there is no master key reserved solely for legitimate actors. An open door for law enforcement is, by design, an open door for cybercriminals and foreign intelligence services.

The business model of major platforms: a structural obstacle to Zero-Knowledge

The resistance of major platforms to adopting Zero-Knowledge encryption is not explained by technical inability, but by a fundamental economic incompatibility. Companies like Alphabet and Meta rely on monetization models based on the systematic collection of behavioral data. This model is, incidentally, implicitly recognized by the European Union’s Digital Markets Act (DMA), which classifies these “gatekeepers” as entities whose dominant position is precisely fueled by the accumulation of data on an unparalleled scale. For these actors, adopting a Zero-Knowledge architecture would mean depriving their advertising systems of the continuous identification of users that constitutes its fuel. It is therefore not a technical choice, but a trade-off between user privacy and the viability of their business model.

The strategic risk: the “Harvest Now, Decrypt Later” threat

Beyond the debate on privacy, the weakening of encryption raises a national security issue of a completely different scope. The strategy known as Harvest Now, Decrypt Later (HNDL) involves state adversaries intercepting and storing massive volumes of encrypted communications today, in anticipation of future quantum decryption capabilities. By weakening current encryption standards, the British legislative framework objectively facilitates this type of operations against government, diplomatic, or industrial communications.

It is precisely in this context of a trust deficit that ecosystems like Arpokrat’s acquire operational relevance. By operating under the regime of the Swiss Federal Act on Data Protection (FADP), with an architecture that collects no civil identifiers, Arpokrat offers a technical break from infrastructures subject to British jurisdiction — guaranteeing that the system remains deaf to the injunctions foreseen by the OSA.

The conflict of norms: OSA and IPA against European law

The legal analysis of the new British state prerogatives reveals a direct collision with the foundations of European law regarding data protection and the confidentiality of communications.

OSA against the prohibition of generalized surveillance

Article 121 of the OSA introduces the possibility for OFCOM to issue notices forcing platforms to implement client-side scanning. This measure directly contravenes the principle, derived from European law and included in the jurisprudence of the CJEU, prohibiting general surveillance obligations. By imposing a “vulnerability by design”, it also places companies in a double bind situation: by weakening their security to comply with a state mandate, they fail in their obligation to guarantee a level of security appropriate to the processing, as enshrined in Article 32 of the GDPR.

The ePrivacy Directive and the confidentiality of communications

The scanning of private messages is in direct contradiction with Article 5, paragraph 1, of Directive 2002/58/EC (ePrivacy), which obliges Member States to guarantee the confidentiality of electronic communications and prohibits any form of interception or surveillance without the explicit consent of the users concerned.

Technical Capability Notices and blocking security updates

Under the IPA 2016 regime, the British government now intends to use Technical Capability Notices (TCN) to block security updates before they are deployed. This mechanism creates an unsolvable conflict with the obligation, set by Article 32 of the GDPR, to ensure the continuous security of processing systems — an obligation that precisely requires the ability to apply patches without delay or external interference.

Compliance risks for companies operating in Europe

The revisions to the IPA aim to force companies to notify the British government of any technical modification affecting security, prior to its implementation, thereby granting it a veto right over product development. This interference creates considerable legal insecurity for suppliers operating in the European market: British adequacy to European law — already fragile — could be called into question if the UK no longer guarantees protection substantially equivalent to that of the GDPR. Data transfers to the UK under this new framework would therefore likely expose companies to sanctions under the GDPR.

Defense through technical impossibility: the Zero-Knowledge principle as a legal shield

International jurisprudence, consolidated by the Schrems I and Schrems II rulings of the CJEU, has established a defining principle: the only robust safeguard against disproportionate surveillance is the technical impossibility of accessing it. Zero-Knowledge architectures apply this principle in three layers of protection:

Absence of custody: since the platform does not hold the decryption keys, any injunction to scan messages is technically inoperative;
Sovereignty of the operating system: the control of ArpokratOS eliminates telemetry that feeds intelligence collection at the device level;
Swiss jurisdictional anchoring: by hosting its infrastructure in Switzerland, Arpokrat operates under a legal regime requiring individualized and reasoned mutual legal assistance requests, neutralizing the automated execution of mass scans foreseen by the OSA.

Conclusion

The provisions of the OSA and the revisions of the IPA are not only a threat to the privacy of individuals: they represent a breach of legal certainty for all European data passing through infrastructures subject to British jurisdiction. By legitimizing the weakening of encryption in the name of public safety, London paradoxically exposes its allies and trading partners to risks of industrial and state espionage that Zero-Knowledge architectures are precisely designed to prevent.

The integrity of professional and institutional communications now requires a structural response: the migration towards decentralized ecosystems guaranteeing digital sovereignty, from the code level up to the jurisdictional anchoring.

The Shouting Silence: What is a Warrant Canary and Why Its Disappearance Should Worry You

Mon, 01 Jun 2026 00:00:00 +0000

Deep in the coal mines of the 19th century, miners carried caged canaries with them. These small birds, extremely sensitive to toxic gases like carbon monoxide, succumbed long before the miners perceived the danger. They served as a silent, but highly effective early warning system.

In our modern digital world, this bird has come back to life in the form of the “Warrant Canary”.

What is a Warrant Canary?

It is a public statement, published and updated regularly by a service provider (messaging app, VPN, host), stating that, up to that exact date, it has not received any secret legal request forcing it to compromise its users’ data — such as an American National Security Letter (NSL) or an order issued by a FISA court.

The subtlety — and the gravity — of the canary lies in what happens when it disappears.

If a service that displayed the statement “We have received no secret orders” every month suddenly stops updating it, the informed user deduces the obvious: the canary is dead.

The company has been targeted by a surveillance measure accompanied by a gag order, legally forbidding it from revealing the existence of this request. Unable to say that they have been compromised, they simply stop saying that they haven’t been.

The Era of Invisible Surveillance and Bypassing Silence

At a time when extraterritorial legislations like the CLOUD Act and FISA (Foreign Intelligence Surveillance Act) allow the U.S. government to access data hosted by companies without ever informing the targets, the Warrant Canary constitutes one of the few mechanisms to bypass this forced silence.

With the CLOUD Act, the geographical barrier no longer exists: if data is under the “control” of an American company, the United States government claims the right to access it, even if these servers are physically located in Europe. The canary then becomes the last warning signal before a user’s digital sovereignty is silently sacrificed.

This is why major actors in the Privacy sphere have adopted this tool as a standard of transparency:

Proton : The Swiss messaging and email service publishes a transparency report including a strict Warrant Canary.
Riseup : The secure communication collective for activists maintains one of the most famous and monitored canaries on the web.
Arpokrat : Our own ecosystem maintains a public Warrant Canary, cryptographically updated, to guarantee absolute transparency to our community.

Legal Analysis: The Right Not to Lie

The very existence of the Warrant Canary rests on one of the most fascinating pillars of constitutional law: the doctrine of compelled speech and its collision with judicial secrecy.

The legal basis rests on a simple principle: if the State has the power to impose silence on you (via a gag order), it does not have the constitutional power to force you to lie.

Under the First Amendment of the United States Constitution (and analogous principles in Europe), the government cannot force a company to produce a factually false statement. Thus, when a company removes its canary, it does not violate the silence order — since it does not explicitly announce having received a warrant. It simply exercises its fundamental right to stop making a statement that is no longer true.

The Conflict with European Law

The relevance of the canary is today reinforced by Article 32 of the Data Act (EU Regulation 2023/2854). This provision requires providers to implement technical and legal measures to prevent data access by authorities of third countries when this contradicts European law. The death of a canary immediately signals this conflict of laws: the provider is likely being forced to bypass European guarantees to satisfy a foreign mandate.

The Arpokrat Approach: Sovereignty by Design

In the Arpokrat ecosystem, operating under the jurisdiction of the Swiss FADP (Federal Act on Data Protection - RS 235.1), the canary takes on an even more powerful dimension. It is part of a holistic approach to digital sovereignty: Zero-Knowledge.

The architecture is designed in such a way that the company creates a technical and mathematical impossibility to obey a mandate. The State or an intelligence agency can issue all the orders it wants, the answer will remain the same: there are no private keys, no identities (Zero-ID), and no centralized metadata to hand over.

In this context, the canary is no longer just a warning of compromise; it is the continuous public proof that the infrastructure has remained technically inviolable and faithful to its principles.

Conclusion

Ultimately, the Warrant Canary is the piece of legal agility that complements the cryptographic agility necessary to face the horizon of modern threats (such as post-quantum computing). In an infrastructure where data is sovereign by design, the canary is not just a simple bird in a mine: it is the silent guardian of your digital fortress.

Utiq: The new telecom 'Super-Cookie' threatening your privacy

Mon, 01 Jun 2026 00:00:00 +0000

The scheduled end of third-party cookies on web browsers has triggered a true arms race in the targeted advertising industry. While Google is trying to impose its own standards (like the Privacy Sandbox), another unexpected player has decided to grab a piece of the pie: your Internet Service Provider (ISP).

Thus was born Utiq (formerly known as project TrustPid), a joint venture founded by European telecommunications giants. Sold to the general public as a “transparent and respectful” solution, Utiq is actually what cybersecurity experts fear most: a “supercookie” operating at the network level.

What is Utiq and how does it work?

Traditionally, advertising tracking (cookies) is managed by your web browser (Chrome , Firefox , Safari ). You could block it using extensions (like uBlock Origin ) or a privacy-oriented browser (like Brave ).

Utiq shifts the problem one step back: to the level of your network connection.

Here is how the trap springs:

Network interception: When you browse the internet via your mobile connection (4G/5G) or your fiber box, Utiq uses your IP address and your telecom subscription data to identify you.
Consent (the false choice): Upon arriving at a partner site, a pop-up window asks you to accept Utiq. Due to the fatigue associated with cookie banners (Consent Fatigue), millions of users click “Accept” without reading.
The “Network Signal”: Once consent is given, Utiq directly contacts your telecom operator. The latter generates a unique, pseudonymized identification token (the network signal) which it transmits to advertisers.

You are now trackable from site to site, not by a file stored on your computer, but by the very infrastructure that provides you with the internet.

Why Utiq is a privacy nightmare (OPSEC)

The initiative raises serious problems for digital sovereignty and the confidentiality of your data:

Tracking at the source: Unlike classic cookies, you cannot simply “clear your history” or “empty your cache” to get rid of Utiq. The identification token is generated by your ISP.
The centralization of profiles: Telecom operators already know your name, physical address, banking details, and location in real-time. By linking your web browsing history via Utiq to this, they create behavioral profiling of daunting precision.
The flaw of pseudonymization: Utiq defends itself by not sharing your name in plain text, claiming to use “encrypted” tokens. However, in the cybersecurity world, it is proven that pseudonymization is reversible. Cross-referencing these tokens with other databases allows individuals to be easily re-identified.

Which operators use Utiq?

Utiq was founded by an alliance of the four largest European operators. If you are a customer of one of them (or one of their low-cost subsidiaries), your connection is potentially already “compatible” with this tracking.

Here are the founders and links to their respective privacy policies:

Orange (France, Spain, Poland, etc.)
Vodafone (Germany, Spain, UK, etc.)
Telefónica / O2 / Movistar (Spain, Germany, etc.)
Deutsche Telekom (Germany, Central Europe)

The OPSEC tip: Although Utiq offers a centralized consent management portal (consenthub.utiq.com ) to revoke access, the best defense remains technological.

The Zero-Trust approach to counter Utiq

The philosophy of digital sovereignty, driven by ecosystems like Arpokrat, relies on a simple principle: never trust the network infrastructure.

To technically neutralize systems like Utiq, the solution is to hide your traffic from your own internet service provider:

Using a sovereign VPN: By encrypting your traffic as soon as it leaves your device, your ISP only sees an unreadable stream of data directed towards a VPN server. It can no longer inject or read Utiq tokens.
The Tor network (Orbot ): Onion routing prevents any end-to-end identification.
DNS Encryption (DoH/DoT): Prevents your operator from knowing which websites you request to visit.

In summary, Utiq is proof that internet service providers are no longer content with being mere “pipes”; they want to become data brokers. More than ever, encrypting your traffic is no longer a security option, but an absolute necessity to preserve your digital silence.

The Illusion of Sovereignty: The Olvid Case and the CLOUD Act Trap

Thu, 21 May 2026 00:00:00 +0000

The announcement sounded like a true “cry of independence” in the corridors of Paris: the Prime Minister ordered the government to abandon WhatsApp and Signal in favor of Olvid, a messaging app presented as “native.” The stated goal was clear: protect state secrets from the long reach of foreign intelligence agencies.

However, a bitter irony quickly emerged: Olvid’s core — its server infrastructure — beats within Amazon Web Services (AWS), an American giant.

For the general public, this seems like a simple technical hosting issue. But for architects of sovereign cybersecurity and those tracking data geopolitics, it is a primary political vulnerability.

Extraterritoriality and Conflict of Sovereignties

By relying on Amazon’s infrastructure, Olvid automatically enters the orbit of the US CLOUD Act .

The legal analysis of this case reveals a scenario of jurisdictional insecurity that simply adopting a national “app” does not resolve. The tipping point lies in the concept of “control” versus “localization.”

The CLOUD Act radically changed the legal paradigm by stipulating that the physical location of the server does not matter. The service provider’s (here, AWS) obligation to cooperate stems solely from its jurisdictional tie to the US. Thus, Washington can demand data from companies under its jurisdiction, even when that data is physically stored on European soil.

Legally, this creates a frontal conflict with the General Data Protection Regulation (GDPR). The Court of Justice of the European Union (through the famous Schrems I and II rulings ) has already established that US surveillance laws do not offer a level of protection equivalent to Europe’s, as they are not limited to what is “strictly necessary.”

Digital sovereignty is not an attribute of software, but a property of the integrity of the chain of custody.

The Spectre of FISA and the False Promise of Encryption

Worse still, this dependence on American infrastructure places this data under the shadow of the Foreign Intelligence Surveillance Act (FISA) , which authorizes electronic surveillance for “foreign intelligence” purposes targeting individuals located outside the US.

Faced with these threats, Olvid asserts that its end-to-end encryption constitutes a sufficient shield. From a privacy engineering perspective, this defense is dangerously partial.

The recent rejection of backdoors by the French National Assembly shows legislative resistance to vulnerability by design. Yet, even if the content of a message is encrypted, AWS’s centralized infrastructure exposes metadata. Knowing who is talking to whom, when, how often, and from where is often much more valuable to foreign intelligence than the message content itself.

Encryption protects the text, but the centralized server betrays the network of contacts.

The Real Danger Is Yet to Come

As long as European infrastructure relies on entities subject to extraterritorial statutes, the legal security of our communications will remain purely temporary and illusory.

National security in the 21st century requires much more than good legislative intentions or superficial software shields: it demands total infrastructure and hardware independence . Because while intercepting this metadata and encrypted packets seems harmless today, it actually feeds the most devastating threat of the next decade: the strategy of “Harvest now, decrypt later”.

A state secret intercepted today is nothing but a mathematical time bomb.

(Read the rest of our analysis in Part 2: The Time Bomb and the Zero-Knowledge Imperative )